Policies.md
... ...
@@ -1,12 +1,91 @@
1 1
# Policies
2 2
3
+## Resource Allocations
4
+
5
+dn42 global resources are limited so, by necessity, all requests for resources above the typical allocations must be treated as exceptions. If users genuinely need additional resources they can be provided, but the registry maintainers can only do this by challenging every request to ensure it is justified. It's not fair to throw away resources now and then require much stricter limits in the future because we ran out of space.
6
+
7
+Users applying for additional resources should consider their requests against the following criteria:
8
+
9
+ - Does your allocation provide **additional value** to the rest of the dn42 community?
10
+
11
+Allocations for personal use are harder to justify, why should you get global, community resources if that doesn't provide any value back to the community?
12
+
13
+ - Why is your use case **exceptional**?
14
+
15
+Requests for additional resources cannot be the norm, so they must be exceptional.\
16
+What makes your use special over everybody else in the network?\
17
+Why should you get additional resources when other people will not be able to have them?
18
+
19
+ - Is your request based on **demonstrable need**?
20
+
21
+Additional resources should only be requested where there is clear evidence that existing resources are being fully utilised and are insufficient for the current requirement. Resources will not be granted based on anticipated future demand or the possibility that they may be needed later.
22
+
23
+If you are developing a new service that requires additional resources, you should first deploy and operate the service so that the requirement can be demonstrated and justified.
24
+
25
+### New Users
26
+
27
+Typical and maximum allocations for new users
28
+
29
+| | ASN | IPv6 Allocation | IPv4 Allocation |
30
+|:--|:--|:--|:--|
31
+| Typical | 1 | /48 | /27 |
32
+| Maximum | 1 | /48 | /26 |
33
+
34
+The typical allocation provides enough resources for most new users; it is suitable for doing all the fun things in dn42 and growing your network.
35
+
36
+For IPv4, new users should be aware that allocations smaller than a /27 can become restrictive. Even if your network is currently small, a /27 usually provides a better starting point and gives you room to expand later without requiring a second resource request or fragmenting the IP space.
37
+
38
+For IPv6, there is generally no advantage to request anything other than a /48. Even if your network doesn't support IPv6 yet, some parts of dn42 are IPv6-only, and IPv6 is the preferred protocol for many services. Allocations smaller than a /48 can be very restrictive, while a /48 provides enough address space for even very large networks.
39
+
40
+When registering for the first time, new users will not be allocated more than the maximum amounts shown above.
41
+
42
+These limits are based on the principle of demonstrable need. Additional resources are provided when there is clear evidence that existing resources are being fully used and are no longer sufficient.
43
+
44
+For this reason, please do not register and immediately request more resources. Requests for additional allocations will normally only be considered after you can demonstrate that your current allocations are actively in use and no longer meet your requirements.
45
+
46
+### ASN Allocations
47
+
48
+ASNs are administrative, not geographical boundaries; additional ASNs are not required for additional nodes or to provide geographic services.
49
+
50
+Additional ASNs 'for testing' are also unlikely to be provided.
51
+
52
+Alternative approaches include:
53
+
54
+- Setting up local lab environment using private ASNs in the 42xxxxxxxx range, outside the dn42 424242xxxx range. There's no problem peering locally with your dn42 router as an external peer to testing policies and what it looks like, or even having your own local mini dn42 with multiple peers and transits.
55
+
56
+- You can already view how the rest of the network sees your ASN via looking glasses; it's also instructive to see how other user's policies impact your announcements. Learning what to look for or diagnose problems using a looking glass is a valuable skill in its own right.
57
+
58
+- Talk to your peers! dn42 is a community and most users will be happy to help.
59
+
60
+### IPv4 Allocations
61
+
62
+A typical IPv4 allocation is /27. This provides you with 32 x /32 IPv4 addresses which is often more than enough for most networks. You should typically only require 1 IPv4 address for each peering node or service on dn42.
63
+
64
+The smallest routable IPv4 prefix size in dn42 is /29.
65
+
66
+Total IPv4 allocations greater than /26 will be challenged and you will be expected to provide robust justification.
67
+
68
+Allocations >= /25 are rare and >= /24 require mailing list consensus; these will require extraordinary justification and are almost never granted apart from the most exceptional (and usually temporary) circumstances.
69
+
70
+If you have a requirement for a large number of IP addresses you should consider using IPv6 first.
71
+
72
+You should also consider using NAT for anything not directly providing dn42 services (for example, where you want to access dn42 from a homelab or laptop, but are not providing services to the rest of the dn42 community).
73
+
74
+### IPv6 Allocations
75
+
76
+The smallest routable IPv6 prefix size in dn42 is /64.
77
+
78
+There are very few reasons for not allocating the standard /48 address block; it provides a huge address space sufficient to run a global network whilst smaller block sizes can often be limiting.
79
+
80
+A typical IPv6 address plan will use /56 subnets per site, with the typical /48 providing for 256 x /56 sites and 256 x /64 networks per site.
81
+
3 82
## Bridging from the Internet
4 83
5
-dn42 is a separate network from Internet and users are actively discouraged from creating publicly accessible services that allow direct access to the dn42 IP space from the Internet; this includes public NAT and VPN services.
84
+dn42 is a separate network from the public Internet. While dual-homed services can be beneficial (for example, looking glasses), users should not provide services that grant direct access to the dn42 address space from the Internet. This includes, public NAT gateways, VPN services, proxies, or other mechanisms that allow non-dn42 users to reach dn42 resources.
6 85
7 86
dn42 is primarily for learning about network technologies. Providing zero effort access to the network runs counter to that core purpose and prevents users gaining experience of learning how to create and configure their own network.
8 87
9
-Preventing direct access also helps keep AI scrapers and other abuses that are common on the Internet, away from the network.
88
+Preventing direct access from the public Internet also helps protect the network from abuse, including AI scrapers, large-scale crawlers, and other unwanted traffic that is commonplace on the Internet. This reduces unnecessary load on network participants and contributes to a safer and more stable environment.
10 89
11 90
## Network / Port scans
12 91
howto/Getting-Started.md
... ...
@@ -135,6 +135,9 @@ From now on, you should use:
135 135
136 136
This applies to AS numbers, network prefixes, routes, DNS records...
137 137
138
+Please also read the [Policies](/Policies) for guidance on acceptable resource requests.
139
+
140
+
138 141
### Register an AS number
139 142
140 143
To register an AS number, create an `as-name` object in `data/aut-num/`.
... ...
@@ -166,7 +169,11 @@ source: DN42
166 169
167 170
#### IPv6
168 171
169
-To register an IPv6 prefix, you create an `inet6num` object. dn42 uses the fd00::/8 ([ULA](https://tools.ietf.org/html/rfc4193)) range. A single /48 allocation is typical and will likely provide more than enough room for all devices you will ever connect. The smallest announceable prefix length is /64.
172
+Even if you do not currently support IPv6, networks in dn42 are encouraged to be IPv6 first and many services are available only using IPv6.
173
+
174
+To register an IPv6 prefix, you create an `inet6num` object. dn42 uses the fd00::/8 ([ULA](https://tools.ietf.org/html/rfc4193)) range.
175
+
176
+A single /48 allocation is typical, it will provide more than enough room for a global network and there are no compelling reasons for choosing a different size. The smallest announceable prefix length is /64 but registering IP blocks smaller than /48 can often be limiting and restrict what you can do.
170 177
171 178
dn42 is interconnected with other networks, like icvpn, which also use the same ULA range so a registration in the dn42 registry can't prevent IPv6 conflicts. A fully random prefix (see [RFC4193](https://tools.ietf.org/html/rfc4193)) is recommended; finding a conflict and needing to renumber your network is no fun.
172 179
... ...
@@ -206,22 +213,20 @@ If there are no free subnets of the size you want, you may split a larger block
206 213
207 214
Check the registry (data/inetnum) to make sure no-one else has allocated the same prefix. There are some IP ranges that are not open for assignments or are reserved for specific uses, so you should also check that the parent block has an 'open' policy. A quick and simple way to see the block policies is to run `grep "^policy" data/inetnum/*`.
208 215
209
-| Size | Comment |
210
-|-----:|:-------------------------|
211
-| /29 | starter pack |
212
-| /28 | usually enough |
213
-| **/27** | **default allocation** |
214
-| /26 | usually enough |
215
-| /25 | still a lot of IPs! |
216
-| /24 | are you an organization? |
216
+| Size | IP addresses | Comment |
217
+|-----:|:-------------|:-------------------------|
218
+| /29 | 8 | tiny allocation |
219
+| /28 | 16 | may be suitable for small networks |
220
+| **/27** | 32 | **default allocation** |
221
+| /26 | 64 | more than enough for the largest networks |
217 222
218
-The current guideline is to allocate a /27 or smaller by default, keeping space for up to a /26 if possible. Don't allocate more than a /25 worth of addresses and please **think before you allocate**.
223
+Please **think before you allocate**; the current guideline is to allocate a /27 by default.
219 224
220
-dn42 typically uses point-to-point addressing in VPN tunnels making transit network unnecessary, a single IP address per host should be sufficient. If you are going to have 2-3 servers, a /28 is plenty; same will go for most home-networks. You cannot, however, allocate prefixes smaller than /29. dn42 is not the public internet, but our IPv4-space is valuable too!
225
+New users will not be allocated an IP block larger than /26.
221 226
222
-If you need a /24 or larger, please ask in the IRC chan or on the mailing list and expect to provide justification. You should also ensure the range you've requested is in a suitable block.
227
+dn42 typically uses point-to-point addressing in VPN tunnels making transit networks unnecessary, a single IP address per host or public service will be sufficient and you should consider IPv6 first or NAT for devices that do not directly offer dn42 services. dn42 is not the public internet, but our IPv4-space is valuable too!
223 228
224
-**Note:** Reverse DNS works with _any_ prefix length, as long as your [recursive nameserver](/services/dns/Overview) supports [RFC 2317](https://www.ietf.org/rfc/rfc2317.txt). Don't go for a /24 _just to have RDNS_.
229
+**Note:** Reverse DNS works with _any_ prefix length, as long as your [recursive nameserver](/services/dns/Overview) supports [RFC 2317](https://www.ietf.org/rfc/rfc2317.txt).
225 230
226 231
example: data/inetnum/172.20.150.0_27
227 232
```conf