IPv6 overlay

An IPv6 overlay gives the hosts on an overlay network IPv6 addresses. The overlay is independent of the underlay, so an IPv6 overlay runs fine over IPv4-only internet connections, and hosts can talk to each other over IPv6 even where their local networks don’t support it.

IPv6 in Managed Nebula

Every new network is IPv6-capable. Defined Networking generates each network’s IPv6 range, so there’s nothing to choose and nothing for it to collide with. A network can also have one IPv4 range, which makes it dual-stack. You can add the IPv4 range when you create the network or later.

A host can have at most one IPv4 and one IPv6 overlay address. On an IPv6-capable network, every host gets an IPv6 address. On a dual-stack network, a host created through the API only gets an IPv4 address if you ask for one.

IPv6 needs version 2 Nebula certificates, which arrived with Nebula 1.10 (see PKI).

Older IPv4-only networks

Networks created before IPv6 support use version 1 certificates and are IPv4-only. They keep working, but their hosts can’t have IPv6 overlay addresses, and they can’t use the managed lighthouse, which requires an IPv6-capable network. In the API, the endpoints for these networks and their hosts are listed under Legacy.

Why use IPv6 on the overlay

An IPv4 overlay range has to avoid every range your hosts’ local networks use, which is the hard part of choosing a CIDR. An IPv6 range is generated for you and is too large to run out of, so that problem goes away. It also lets applications move to IPv6 without waiting for every office, cloud, and ISP connection to support it.

Routes and IPv4 subnets

A route that serves IPv4 subnets needs a router host with an IPv4 overlay address. If you use routes to reach IPv4 devices that can’t run DNClient, use a dual-stack network and give the router host an IPv4 address. See Extend network access beyond overlay hosts.