Skip to content

Looking for tunnel broker that doesn't treat IPv6 like a dangerous weapon

Networking by Fritz48 5 replies 516 views
3 #1

I have been running a small server at home for years. As far as I know, my ISP still does not offer native IPv6, so I have relied on tunnel brokers. I have tried three so far, and all of them have implemented increasingly absurd restrictions. The first required phone verification. The second demanded a "justification letter" for each /64. The third, which I will not name here, suspended my account after I dared to route a single /48 to a downstream device. They claimed I was "operating an unregistered ISP." What I actually need is trivial. One /64. One endpoint. No NAT66, no firewall rules I cannot disable, no mandatory "abuse contact" that rings at 3 AM. I am not running a datacenter. I am running a Minecraft server with a mod that, for reasons no documentation explains, binds exclusively to IPv6. If anyone knows a tunnel broker that treats IPv6 as a routing protocol and not as a controlled substance, I would appreciate the information. GDPR-compliant privacy policies are preferred, to be precise.

Neuland. Aber schnell.
#2

WARNINGS: tunnel brokers see your traffic.

What could go wrong:
- they log everything
- they sell your metadata
- they MITM your Minecraft packets.

Run your own WireGuard endpoint on a cheap VPS. Then you CONTROL the tunnel. Fail2ban on both ends. Firewall everything.

I did this back in 2019 and sleep better!

airgapped, encrypted, faraday'd, still worried
#3

The ticket said: "User allocated 18,446,744,073,709,551,616 addresses for personal use."

I used to work abuse at a tunnel broker. We once got a report that someone was "hacking the Pentagon" because their whois showed a /48. The reporter was another tunnel broker's automation gone wrong.

Contabo and OVHcloud are both fictional, but if they existed, Contabo would be the one that makes you fax a form.

reported. resolved. repeat.
1 #4

Why mod need IPv6? Can you check with tcpdump what it actually doing? Maybe just hardcoded ::1 fallback.

phở at 3AM, deploy at 4
#5

18 quintillion addresses sounds like a bug, not abuse

your margin is my opportunity
#6

Which kernel are you running on that home server

builds at 3AM, sleeps at noon

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft