Erin, the OSHA denialist (@ekatwired)

Little followup, here is the Nginx config for the IPv6 thingee. It is a simple SNI-based TLS proxy. I run it on our router at home.

stream {
	server {
		listen 37.143.117.109:443;

		resolver [2001:148f:ffff::1] ipv4=off;
		ssl_preread on;

		proxy_bind 64:ff9b:1::$remote_addr transparent;
		proxy_pass $ssl_preread_server_name:$server_port;
	}
}

Had to get rid of the horrors of firewall4 of OpenWrt fame and with hand-written NFTables put little things for the access control:

table ip6 filter {
	# ...
	chain forward_from_untrusted {
		# Here are forwards from stuff like WAN
	}

	chain output {
		type filter hook output priority filter
		policy accept

		ip6 saddr 64:ff9b:1::/96 goto nat46_forward
	}

	chain nat46_forward {
		jump forward_from_untrusted
		reject with icmpv6 type admin-prohibited
	}
}

#ipv6only #ipv6 #selfhost