Posted: 2026-05-04
Two prior posts covered a bit about Slow Servers and IPv4.
As discussed previously, I had two models for tunneling IPv4. GIF, which worked great for OpenBSD guests, and WireGuard, which worked well for OpenBSD and Debian. However, Wireguard has notable overhead, especially when considering all of our IPv4 traffic would go through it.
At the moment, it appears that Freya can handle a bit over 300Mbit/sec of traffic forwarding, but perhaps only 80Mbit/sec of Wireguard. This would be a pretty big potential bottleneck, and pointless extra heat if not.
Fortunately, I was able to figure out a more traditional way to offer IPv4 while keeping the infrastructure fully routed. I think that OVH and some other hosts might do something similar to this.
Here's what it looks like:
The only issue left, that I'm working on, is that the publicly routable range, 142.249.45.0/24 is currently on-link, so I have to ARP spoof to make this work. But, it does work once that's done, and changing it to a routed model should be quite possible.
Now there's no tunneling or MTU reduction. While fully IPv6 native would've been cool, this is actually the most efficient option.
I did some benchmarks and it appears that IPv4 and IPv6 performance is nearly identical this way.
Network configuration works on both Debian and OpenBSD. Speaking of, I finally resolved the issue of Debian's network configuration being unstable (through ifupdown, after updates.) I'm now using systemd-networkd. Not a big fan of systemd, but if it's there I should probably use it!
openbsd-guest# cat /etc/hostname.vio0 inet6 2602:f5ef:0:ff01::1 64 inet 142.249.45.100/32 openbsd-guest# cat /etc/mygate 2602:f5ef:0:ff01:: !route add -inet 172.17.99.1/32 -llinfo -link -iface vio0 172.17.99.1 slowservers# cat /etc/resolv.conf lookup file bind nameserver 2602:f5ef::1:0 family inet6 inet4
On a IPv6-only server, family can be ignored, or can be set to just family inet6.
debian-guest# cat /etc/systemd/network/static.network [Match] Name = enp0s2 [Network] Address=2602:f5ef:0:ff01::1/64 Gateway=2602:f5ef:0:ff01:: DNS=2602:f5ef::1:0 Address=142.249.45.100/32 [Route] Destination=172.17.99.1 Scope=link [Route] Gateway=172.17.99.1
(To make this work properly, you have to delete /etc/netplan/*.)
I've been thinking about giving host access (for serial console and such) via IPv4. Most likely, I would use relayd or PF to forward along the SSH port. Thus Loki would be port 2203, Spare 2299. Loki and Spare would listen on port 22 and their respective new ports. There would be a A record in DNS to allow this to "just work." This way, IPv4 addresses aren't wasted on hosts that don't need them. I guess it's not a huge waste, but their only purpose would be to keep tech savy users from having to use an alternative port for SSH, if connecting over IPv4.