[HN Gopher] Reasons for servers to support IPv6
___________________________________________________________________
Reasons for servers to support IPv6
Author : pingiun
Score : 233 points
Date : 2022-01-29 14:15 UTC (8 hours ago)
(HTM) web link (jvns.ca)
(TXT) w3m dump (jvns.ca)
| dopa42365 wrote:
| My ISPs v4 is down sometimes (Vodafone in Germany), while v6
| continues working just fine. Severe loss of legacy internet
| services in those situations (no twitter, reddit, pornhub,
| battle.net, twitch...)
| she46BiOmUerPVj wrote:
| I have the same with Comcast in south east US. Browsing the
| internet IPv6 only is depressing unless you only use Google :/
| gtirloni wrote:
| Here it's the opposite. My ISP's IPv6 network is so bad I've
| had to request them to disable IPv6 at my router.
| woile wrote:
| What is a good resource to learn about ipv6? some course or book?
| zamadatix wrote:
| I've read many an IPv6 book and led many an IPv6 projects/in
| person training classes and, as lame as it may sound, the
| Wikipedia page is an amazing resource to get the background
| needed to understand home and homelab setups.
| https://en.wikipedia.org/wiki/IPv6
|
| I'd recommend diving into the more detailed articles it links
| on SLAAC (alternative to DHCP, most common way to dynamically
| assign addresses) and NDP (replaced ARP) for a full
| understanding. If you want to go all in for v6 only setups with
| access to the v4 internet NAT64 is worth reading as well.
|
| Obviously it doesn't cover how to configure/implement for your
| specific scenario but it gives a solid background that lets you
| better understand what guides for doing it with Linux or
| prosumer hardware or typical consumer hardware are actually
| talking about.
| curious_cat_163 wrote:
| I tend to think that a lot of issues on the global internet are
| not technical problems. They tend to be economics problems.
|
| v6 is a mechanism like container ships. It will dominate when the
| incentives and disincentives make sense for the participants.
| spockz wrote:
| What is the best way to get ipv6 if your ISP doesn't support it?
| I tried getting HurricaneElectric to work for tunnelling on my
| Ubiquity USG3 but couldn't make it to work.
|
| What would be the best way to get ipv6?
| justincormack wrote:
| Tunneling with HE is usually the easiest way...
| xfer wrote:
| Not if they already block icmp traffic.
| withinboredom wrote:
| Agree and would like to add that you may want to disable ipv6
| tunneling for streaming services. (Google it) because they
| consider it a "vpn" thus you must be a copyright thief. (Yet
| any other "real" vpn will stream just fine lol)
| hippyup wrote:
| I'd love to read an honest post from somebody from Twitter (or
| GitHub or...) on why they don't support IPv6. Not a shaming
| thing, it's something I don't quite get. Like I get why an old
| school bank wouldn't: their infrastructure predates IPv6 and it's
| a project that has to be financially justified and I can
| understand how that can be hard. But presumably something like
| Twitter had an experienced networking team, who surely know all
| the advantages here and want to somewhat future-proof, build up
| their infrastructure and they decided not to support IPv6 and I
| would love to understand the reasoning. Is the extra cost really
| that high?
| tw611345 wrote:
| Why would they?
|
| - IPv6 is basically an abandoned standard. I wouldn't expect
| them to support gopher either.
|
| - Residential ISP support for ipv6 is spotty, and anyone who
| does offer ipv6 offers ipv4 as well.
|
| - When it is supported, ipv6 tends to be substantially slower
| than ipv4 in practice.
|
| - The addresses are a pain to look at and work with.
|
| - You now have twice as many things to fail.
| throwaway2048 wrote:
| ipv6 is hardly an abandoned standard, 35% of google users
| access google over ipv6, and it continues to grow every year.
|
| https://www.google.com/intl/en/ipv6/statistics.html
|
| IPv6 is also usually faster than ipv4 these days, because the
| overhead of fragmented ipv4 routing is large. In the past it
| was slower because of lack of understanding/support for it
| from larger ISPs, and consequently poor routes, or really
| suboptimal tunneling setups.
| yjftsjthsd-h wrote:
| I have no special insight, but it's probably something like
| "we're working on it, but there are lots of legacy things that
| expect v4 (including non-obvious like anti-abuse systems) and
| since all our users have _some_ sort of v4 connectivity it 's
| not urgent".
| boris wrote:
| I am guessing the reasoning goes like this: if we only support
| IPv4, then it's on all these ISPs with IPv6-to-IPv4 CGNAT to
| make sure their stuff works properly (and chances are they will
| notice if it doesn't). But if we support IPv6, it will be on us
| to make sure people behind those ISPs can still reach us
| (because hardly anyone goes via this IPv6 route and if it
| doesn't work it's likely nobody at the ISP will notice).
| Symbiote wrote:
| 35% (by number of users) isn't "hardly any".
|
| It should be a greater proportion by bandwidth, cause several
| huge sites support IPv6 (Netflix, Youtube, Facebook etc), but
| I can't find figures.
| [deleted]
| teddyh wrote:
| _The Case for IPv6_ (1999):
|
| https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv...
|
| (EDIT: Updated to non-archive link provided by cesarb)
| cesarb wrote:
| Non-archive link: https://datatracker.ietf.org/doc/html/draft-
| iab-case-for-ipv...
| teddyh wrote:
| Thank you! (I have edited my link to use yours.) The link I
| originally had went bad due to the renaming from "draft-ietf-
| iab-case" to "draft-iab-case", so I assumed that the document
| had somehow vanished, and changed to an archive.org link.
| Thank you for pointing me to the correct link again!
| ClumsyPilot wrote:
| IPv6 is a 'tragedy of the commons' issue just like recycling: you
| get no benefits to you individually from addressing the issue.
|
| However the day the issue is solved, and ee can forget IPv4, a
| myriad issues dissapear - routing, port forwarding, P2P software
| for torrents and calls, multiplayer games, etc.
| drran wrote:
| IPv6 has a political issue. Support for IPv4 addresses
| (::0.0.0.0) was removed, because IPv6 users were able to
| connect to IPv4 hosts directly, bypassing IPv4 NAT's and
| firewalls.
| drran wrote:
| yjftsjthsd-h wrote:
| > Support for IPv4 addresses (::0.0.0.0) was removed, because
| IPv6 users were able to connect to IPv4 hosts directly,
| bypassing IPv4 NAT's and firewalls.
|
| How's that work? It can't be sending actual v4 traffic or
| it'd work like normal v4.
| wyufro wrote:
| It was using IPv6 in IP, just like 6to4, protocol 41.
|
| I haven't heard it called a political issue before though.
| It just had problems, like being blocked in firewalls and
| security problems where the encapsulated packet wasn't
| checked properly, etc.
| drran wrote:
| I'm not a native speaker, so I apologize.
|
| > The "IPv4-Compatible IPv6 address" is now deprecated
| because the current IPv6 transition mechanisms no longer
| use these addresses.
|
| <<We forbid you to go right because we are going left.>>
| It doesn't look like a technical issue. How I should call
| it?
| wyufro wrote:
| Right. Neither am I, so take this with a grain of salt.
| But I'd use "committee decision" in this case.
| drran wrote:
| IPv6 is large enough to represent the whole IPv4 range.
| Multiple times. Initially (at the very beginning) it was
| possible to connect to IPv4 address using IPv6 socket. They
| were called <<IPv4-Compatible IPv6 Address>>[0]. For
| example, I can ping both ipv4 and ipv6 addresses using
| ping: $ ping 127.0.0.1 PING 127.0.0.1
| (127.0.0.1) 56(84) bytes of data. 64 bytes from
| 127.0.0.1: icmp_seq=1 ttl=64 time=0.048 ms $
| ping ::1 PING ::1(::1) 56 data bytes 64 bytes
| from ::1: icmp_seq=1 ttl=64 time=0.044 ms
|
| However, this feature allowed to bypass NAT and connect to
| IPv4 hosts directly via IPv6, so it deprecated. (I skipped
| names to avoid scapegoating). $ ping6 ::1
| PING ::1(::1) 56 data bytes 64 bytes from ::1:
| icmp_seq=1 ttl=64 time=0.043 ms $ ping6
| 127.0.0.1 ping6: 127.0.0.1: Address family for
| hostname not supported
|
| It's not a technical issue, see above: it's possible to
| serve both protocols at the same time. It worked for a
| brief period. It's purely political decision: backward
| support for IPv4 in IPv6 was disabled because some people
| are thinking that such behavior is dangerous.
|
| [0]: https://datatracker.ietf.org/doc/html/rfc4291#section-
| 2.5.5....
| ATsch wrote:
| As often when people reference the metaphor of the tragedy of
| the commons, which had no historical basis in reality (quite
| the opposite), there's more going on here.
|
| IPv4 addresses are a significant competitive moat for incumbent
| businesses. Existing companies have no interest in making IP
| addresses a non-scarce resource that aids competitors or
| alternatives (on-prem hosting, p2p, local ISPs, etc).
|
| The only reason things have begun changing recently is
| government mandates and that the moat has gotten so big that
| they've started falling into it themselves.
| jaystraw wrote:
| Tangent, but as someone who often finds the tragedy of the
| commons as the simplest explanation to many things, I'm
| interested in hearing your take on it
| spookthesunset wrote:
| > port forwarding
|
| Well, you are gonna have to replace port forwarding with
| firewall rules instead. At least for me, I really don't excited
| about my parents or in-laws internal networks being wide open
| to the internet. Thus their entire subnet would need to sit
| behind a "default deny" firewall. And if they need to expose
| some service to the internet, they'd need to punch a hole in
| the firewall--which is exactly the same dance you'd have to
| play with port forwarding.
|
| The only thing IPv6 brings to the table for consumers is each
| device gets a globally routable address. But that doesn't mean
| each device can or should be be reachable from outside the
| router. One way or another client software will not get away
| from having to open ports on the router.
| DarylZero wrote:
| > And if they need to expose some service to the internet,
| they'd need to punch a hole in the firewall--which is exactly
| the same dance you'd have to play with port forwarding.
|
| The difference being, with IPv4 only one machine in the house
| can have a port open. You don't just open a port, you choose
| _which_ single machine gets the port. Sometimes you can't
| open a port on a machine because the port's already taken.
|
| With IPv6 any/every machine can have the same port open at
| the same time.
|
| One of these scenarios is obviously just broken.
| franga2000 wrote:
| The difference is that with a firewall, you open the port and
| that's that. With port forwarding, you get whatever port
| happens to be available. If done manually, you have to tell
| the other sode which port to use. If done automatically (like
| upnp), you need to do that every time your port changes.
| tsimionescu wrote:
| There is no difference of opening a port in a firewall or a
| NAT (well, as long as there is a single machine that wants
| to listen on that port, at least).
|
| And some kind of UPnP will still be required even if your
| internal network were using ISP-assigned IPv6 addresses for
| protocols that want to open multiple connections, like VoIP
| conferencing, bit torrent etc.
|
| Of course, if you have an internal network where you
| actually communicate between your various machines, you
| won't want to use ISP-assigned publicly routable IPs, since
| those can change at any time, so you'll also need some kind
| of network address translation at the edge.
| franga2000 wrote:
| > well, as long as there is a single machine that wants
| to listen on that port, at least
|
| Well yes, most networks have more than one machine and
| multiple users might want to run the same service.
|
| > you'll also need some kind of network address
| translation at the edge.
|
| Not at all, each machine gets two addresses - one
| routable from the ISP and one non-routable from the
| router. Internal services simply use the non-routable
| ones.
| cm2187 wrote:
| There is one individual incentive though: the increasing cost
| of v4 addresses.
| netr0ute wrote:
| Why do IPv4 addresses even cost money? They're no better than
| NFTs and don't even have a "token" of their own.
| Nextgrid wrote:
| They're a scarce commodity, and unlike NFTs, have a real
| use-case.
|
| Until everyone moves to IPv6, if you want people to be able
| to reach your service, you need an IPv4 address. If you're
| an ISP or cloud provider, you need those so your customers
| can still communicate with v4-only peers.
| fishtacos wrote:
| Not sure how they're even comparable on any aspect.
|
| IPV4 addresses are scarce due to lack of foresight and
| useful.
|
| NFTs are scarce by design and useless.
| netr0ute wrote:
| > NFTs are scarce by design and useless.
|
| That's rich
| ignoramous wrote:
| > _NFTs are scarce by design and useless._
|
| So, I know of one real-world usecase that's not useless:
| Some startups have begun legally selling properties
| (homes, ranches, plots) via NFTs.
| fishtacos wrote:
| What does the use of NFTs change in the transaction?
| panqueque wrote:
| simonw wrote:
| Oh fun, which startups are those?
|
| Real estate on the blockchain is my favourite bad
| blockchain idea because if someone loses access to their
| wallet they presumably lose the ability to ever sell
| their house.
| ignoramous wrote:
| > _Oh fun, which startups are those?_
|
| Some are covered in this article:
| https://archive.is/k3w7F
|
| > _...if someone loses access to their wallet they
| presumably lose the ability to ever sell their house._
|
| It is software at the end of the day and seems like there
| is already a solution for it:
| https://en.bitcoin.it/wiki/Multi-signature
| Dylan16807 wrote:
| So two escrow companies and I each have 2-of-3 keys.
|
| At this point what is the blockchain providing that
| normal title records don't?
| simonw wrote:
| The startups in that article don't seem to be selling
| entire properties on the blockchain though - it looks
| like they're doing things like buying a property and then
| selling fractional interest in that property to different
| investors as tokens.
|
| I'll believe that multi-sig wallets solve this when I
| hear frequent stories about regular human beings (not
| highly sophisticated tech insiders) who both understand
| them and use them successfully.
| mrkurt wrote:
| You just gotta etch the block into the foundation. Then
| it's physically part of the house. Maybe make a
| radioactive label and bury it on the property. That way
| people now the property they're standing is on actual
| property.
| tialaramex wrote:
| Nah, it just becomes one of those impediments to sale
| that you wave aside during purchase and earns lawyers a
| few bucks.
|
| There are a few of these in England, Chancel Repair
| Liability is the most famous. In _theory_ you could be
| forced to pay for repairs to a nearby church you never
| visit and have no interest in, on account of land you own
| was historically liable for such repairs and this was
| never cancelled. A real person, this century, had to pay
| about PS350 000 as a result, so that 's not
| inconsequential (although the circumstances were pretty
| unusual). But that's scary enough that a real estate
| lawyer might argue they're not _sure_ the property you
| want to buy is unaffected, you should take out Insurance
| against the liability, conveniently sold by another
| lawyer.
|
| The government tried to "fix" this, but the problem with
| lawyers is, obviously no fix will be good enough to
| prevent lawyers saying what if the fix didn't work, so
| chances are you get persuaded to buy insurance _even
| though the liability probably no longer exists_ because
| hey, if I 'm wrong I'm not going to pay PS350 000 so...
|
| Fifty years from now, if the fact there's "an NFT on the
| blockchain" for a property you want to buy is even
| something anybody knows about, your lawyer will know, and
| they'll tell you that another lawyer offers $1000
| insurance, buy that and if "the blockchain" ever tries to
| sue you and take the property back they'll have your
| back...
| codechad wrote:
| kazen44 wrote:
| what?
|
| ipv4 addresses are unique in the default free zone. they
| cost money because without having a prefix that is unique,
| you cannot route across the internet.
| patmorgan23 wrote:
| IPv4 addresses have utility. You still need one in order to
| participate in the largest communication network in the
| history of the earth. And theirs a limited number of them.
| Demand + Scarcity = non-zero price.
|
| What utility do NFTs provide other than
| entertainment/status?
| netr0ute wrote:
| Who enforces the price? I can just advertise any address
| I want with BGP.
| baq wrote:
| and be promptly kicked off the internet by your isp... or
| somebody elses.
| netr0ute wrote:
| Unless you own routers that other ISPs almost depend on,
| then you can say "take it or leave it"
| iso1631 wrote:
| So lets say Centurylink decide to start advertising
| blocks they don't own, people like Cogent and Tata drop
| their links, people with multiple ISPs drop their links
| (shifting traffic to other tier 1 ISPs), and those with
| centurylink only change their ISP because they can no
| longer get to facebook.
| netr0ute wrote:
| That would work if most people had multiple ISPs, but
| most don't actually. Thus, you have some bargaining
| power, especially if you have some network advantage or
| feature nobody else has.
| midasuni wrote:
| If your local ISP advertises the wrong prefixes they get
| cut off by transit and peers and their customers complain
| they can't get to any sites.
| netr0ute wrote:
| Then that ISP can take it or leave it if their customers
| are complaining.
| baq wrote:
| another reason why folks holding large chunks of ipv4 address
| space don't want ipv6 - they don't want to see their asset
| drop in value.
| js2 wrote:
| > When I try to ping an IPv6 address (like example.com's IP
| 2606:2800:220:1:248:1893:25c8:1946 for example) I get the error
| ping: connect: Network is unreachable. Why? (answer: it's because
| my ISP doesn't support IPv6 so my computer doesn't have a public
| IPv6 address) $ ssh freenas.local
| freenas$ ping6 2606:2800:220:1:248:1893:25c8:1946 ping6:
| UDP connect: No route to host
|
| Crap I should fix that. Login to web-interface, click the "IPv6
| Autoconfigure" checkbox, click test, click save.
| freenas$ ping6 2606:2800:220:1:248:1893:25c8:1946
| PING6(56=40+8+8 bytes) 2600:1700:3d40:6300:6a05:caff:fe58:a370
| --> 2606:2800:220:1:248:1893:25c8:1946 16 bytes from
| 2606:2800:220:1:248:1893:25c8:1946, icmp_seq=0 hlim=54
| time=11.408 ms
|
| Wow, IPv6 _is_ easy! :-)
|
| (AT&T is my ISP and it took a bit of screwing around over a
| weekend with my router a couple years ago to get IPv6 working
| properly on my home network. But it's been painless ever since.)
| zamadatix wrote:
| If you like tinkering and you've got the AT&T fiber service and
| don't use the voice/TV U-Verse stuff) you can get significantly
| better IPv4 and IPv6 performance not using their gateway (even
| if it's just in bridge mode with every service disabled). It's
| not officially supported and they actually 802.1x auth the
| modem but there are convenient scripts out there to proxy the
| auth packets allowing you to use your own router directly.
| Particularly helpful for maxing out their gig service or for
| drastically improving jitter at any service speed.
| js2 wrote:
| Yup, this is me: https://github.com/jaysoffian/eap_proxy
|
| AT&T has transitioned to issuing a combined ONT/Router, where
| this will no longer be possible, but apparently the newer
| gear doesn't have any of the performance issues of the Pace
| 5268AC.
|
| BTW, I was annoyed that AT&T installed the ONT on the
| southern wall of my home where it was baking in full sun
| everyday, so I relocated it myself into my network closet.
| You can just unplug the ONT and extend the existing fiber
| with an optical coupler and an SC-APC to SC-APC single-mode
| patch cable.
| zamadatix wrote:
| Lol HN is amazing, this was actually the first one I got to
| work a few years back! Kudos for the tool - it worked
| wonders.
|
| Have you heard what gear they are using for the new >1G
| deploys? I haven't kept as up to date with ONT/GPON gear
| the last couple of years but I'm curious what they have
| that does 5 gigabit NAT.
| iso1631 wrote:
| So despite spending thousands of dollars on time getting your
| router to work, ipv6 didn't work, but you didn't notice for 2
| years?
| js2 wrote:
| No, it's been working fine on all my Apple devices. I just
| hadn't configured the interface on my freenas server.
|
| And my free time isn't billable.
| stevefan1999 wrote:
| in case you didn't know you can either try Tunnel Broker project
| or 6to4 [1] relay, both proudly presented by Hurricane Electric
|
| [1]: https://en.wikipedia.org/wiki/6to4?wprov=sfla1
| nunez wrote:
| IPv6 is cool in theory and the idea of literally everything
| having its own directly-reachable IP address is extremely
| compelling, but I never use it because so many services STILL
| don't support it or don't support it correctly. (As Julia pointed
| out, some HUGE websites don't have quad-A records, so good luck
| dealing with NXDOMAIN for like everything.)
|
| Shoot, Kubernetes _just_ got support for IPv6 in 1.23 (it was in
| beta since 1.20). I know that 6to4 exists and many kernels can do
| it out of the box, but that comes with problems, as Julia
| rightfully pointed out here, and at that point, you might as well
| just NAT over IPv4.
| she46BiOmUerPVj wrote:
| You mean you explicitly disable it? Or you never use sites like
| Google or Netflix? Why would you get NXDOMAIN for anything with
| IPv6 enabled? No ISP would only offer IPv6 without IPv4 as
| well.
| baggy_trough wrote:
| Still waiting for Google Cloud Platform to support IPv6 to the
| box...
| uji wrote:
| It is already supported.
| https://cloud.google.com/compute/docs/ip-addresses/configure...
| baggy_trough wrote:
| Still waiting in my region (they only support asia-east1,
| asia-south1, europe-west2, us-west2). Hopefully some year.
| l0b0 wrote:
| By now I'm semi-convinced ISPs are deliberately holding back IPv6
| in order to make a buck selling static IPs. They charge a good
| chunk of money per month for an IPv4 address (at least in
| Switzerland, the UK, and New Zealand), which is basically just
| rent extraction from artificial scarcity. And it's pretty obvious
| that once they transition to IPv6 there is no good reason not to
| give every single customer enough static IPs for a lifetime of
| devices.
| yjftsjthsd-h wrote:
| A few of these reasons boil down to "it's faster to not NAT".
| That makes some intuitive sense, but does anyone know of any
| studies/tests so we can get numbers? Are we talking higher time
| to first connect? Slight increase in hops/latency on every
| packet?
| cm2187 wrote:
| Joining the other thread about ipmi/iLO interface being exposed
| to the WAN: make your server non discoverable by the different
| services that scan the entire internet address space. It is
| security by obscurity and you must have other layers of security
| but it's not an insignificant layer.
| oofabz wrote:
| >reason: to avoid NAT issues with home servers
|
| Home servers are not quite as easy as the article makes it sound.
| Home routers block incoming IPv6 packets, the same as they do for
| IPv4. To make a home server accessible, you need to explicitly
| allow that incoming IPv6 traffic in your router's firewall. This
| is analogous to adding a port forward rule in IPv4 NAT. The only
| benefit IPv6 has here is you can use the same port (e.g. SSH) for
| multiple home servers.
| kim0 wrote:
| Does anyone have an explanation about "reason: to own your IP
| addresses" .. does that actually work?
| rmoriz wrote:
| As a LIR you can request network address space tied to your
| organization. To my knowledge there are almost no cloud hosting
| providers that support "bring your own IP space". Vultr.com
| seems to be the sole exception.
| ugjka wrote:
| > A few people mentioned that it's much easier to use IPv6 with
| home servers - instead of having to do port forwarding through
| your router, you can just give every server a unique IPv6 address
| and then access it directly.
|
| My ISP firewalls IPV6 addresses on their end, so no ssh to my
| IPV6 Machines from the outside, not even ping works. I don't know
| why they do this
| dspillett wrote:
| A lot of residential ISPs block certain incoming traffic (any
| that doesn't seem to be part of a stream originated at the user
| side in some cases) by default because many home users who have
| something open did not open it intentionally themselves so it
| could be an insured attack vector.
| kijin wrote:
| Unless you have a gazillion servers at home, port forwarding
| through a router is fairly simple and has the additional
| benefit of a rudimentary firewall. So there isn't a clearly
| visible benefit for most people. Most people can't even tell
| whether they're behind carrier-grade NAT. It makes no tangible
| difference in their lives.
|
| Techies like you and I can appreciate the technical arguments,
| but if we want to convince anybody else who can actually make
| decisions for large numbers of ordinary people, we're going to
| need better arguments.
| zekica wrote:
| But this is only because everything mainstream that is P2P
| uses some kind of a centralized relay server. P2P would be
| much much cheaper for everyone if everyone used IPv6, so it
| makes a difference.
| spookthesunset wrote:
| > P2P would be much much cheaper for everyone if everyone
| used IPv6, so it makes a difference.
|
| I dunno how true that is gonna be. P2P clients will still
| have to traverse a firewall that may do deep packet
| inspection. A lot of the problems faced by P2P will still
| exist even in a pure IPv6 world.
| kijin wrote:
| Tell that to management. As soon as they hear "P2P" they
| will decide to perpetuate the status quo that makes P2P
| hard, because P2P is evil and illegal in their books.
|
| And we sit here wondering why the powers that be are not
| interested in faster IPv6 adoption. Few if any of the
| reasons we exchange on HN have any bearing outside of this
| bubble. A typical business in 2022 still has no incentive
| to embrace IPv6, facilitate P2P, or make the internet more
| decentralized.
| tsimionescu wrote:
| How would you facilitate P2P in an IPv6 world? Do you
| stop using a firewall and just let anyone open
| connections to your machine on any port from the
| internet? If not, how do you allow connections from peers
| but not random botnets?
|
| Not to mention, would you really use IPv6 addresses that
| your ISP assigns for your internal network as a business?
| Do you really want to re-IP everything if you find a way
| to switch ISPs?
| tsimionescu wrote:
| > P2P would be much much cheaper for everyone if everyone
| used IPv6, so it makes a difference.
|
| How would P2P work any different in an IPv6 world? You
| still need to open a port for each incoming connection,
| which still isn't secure unless the target machine is
| explicitly requesting this.
| nrabulinski wrote:
| I don't get the "firewall" argument. You can use the firewall
| the same way with v6 as you do with v4, only allow incoming
| traffic on specific ports, just minus the NAT which makes
| everything simpler and better for everyone
| davidmurdoch wrote:
| They likely still sell static ipv4 addresses, which made sense
| back in the day, but ipv6 doesn't work with the existing
| monetization model. I had the same sort of issue and when I
| called about it they tried to upsell me to a business account.
| johnklos wrote:
| It's good to wonder publicly and have a discussion!
|
| I set up IPv6 on all my servers in 2001 and thought we'd all be
| on IPv6 in just a couple of years :P
|
| What's interesting is how much resistance there is to adding IPv6
| which comes from entrenched IT. People who never learned (much)
| about IPv6 seem to be afraid of it and often respond with some
| variant or another of "don't fix it if it ain't broke", or "it's
| extra work for no return", or "we'll have to pay licensing to add
| IPv6 because we bought crap routers, so let's not", et cetera.
|
| My favorite is, "we have no record of people trying to use IPv6"
| - yes, that's real :D
|
| It just shows their ignorance. Adding IPv6 has myriad advantages
| - no need for NAT, proxies or port forwards to share addresses,
| no need to renumber networks if allocations or upstream change,
| redundancy, valid security-through-obscurity (imagine port
| scanning a /64 looking for open ssh ports)...
|
| What's really interesting is how many of these "we fear change"
| IT people don't realize they're already using IPv6 on their
| phones every day, with a majority of the sites they visit.
| red_trumpet wrote:
| > What's really interesting is how many of these "we fear
| change" IT people don't realize they're already using IPv6 on
| their phones every day, with a majority of the sites they
| visit.
|
| Not true on my german mobile carrier O2. They only provide IPv4
| behind a CGNAT.
| yjftsjthsd-h wrote:
| > What's interesting is how much resistance there is to adding
| IPv6 which comes from entrenched IT. People who never learned
| (much) about IPv6 seem to be afraid of it
|
| Right, you're only suggesting that they change out a
| fundamental part of the network for no benefit that they can
| see; why would they possibly object except out of fear and
| ignorance? After all, their fears are totally unfounded; most,
| probably all, of the random breakage and slowdowns that
| happened last time they tried to enable v6 have been fixed now.
|
| I mean, yes, plenty of people don't want to learn new things
| for bad reasons, but plenty of people have insufficient time
| and have to make cost/benefit decisions - and you not liking
| their conclusion doesn't make them wrong - and there are a fair
| number of people who _were_ all on board with upgrading a
| decade ago and got bitten by the _then very real_ problems with
| IPv6 (which mostly boiled down to "not everything supports it
| properly, and lots of things fail ungracefully and create weird
| breakage").
| throwoutway wrote:
| It's easy to blame IT, but usually they have either business
| objectives assigned to them or they need to justify it to the
| business.
|
| So I see the "if it ain't broke don't fix it" more of a
| business problem and not an IT problem. I worked at one
| organization where for any networking work, you had to bill
| that time to a business project (which was usually a customer
| contract). proponents of IPv6 inside a business probably seem
| to the business like they've got excited over pointless science
| projects with nothing to 'bill' their time against
| zokier wrote:
| > Adding IPv6 has myriad advantages - no need for NAT, proxies
| or port forwards to share addresses, no need to renumber
| networks if allocations or upstream change, redundancy, valid
| security-through-obscurity (imagine port scanning a /64 looking
| for open ssh ports)...
|
| problem is that adding ipv6 gives none of those. Removing ipv4
| would do so, but realistically most people are going to run
| dual-stack of some sort for a while, and as long as that is the
| case then adding ipv6 is mostly just additive effort.
| stingraycharles wrote:
| I think most corporate network should be able to do pure IPv6
| internally, and then tunnel to IPv4 at the gateway.
|
| The number one complaint I hear (and have myself) is that
| maybe I don't _want_ all devices on my LAN to have public IP
| addresses. NAT makes security a lot easier to reason about.
| iso1631 wrote:
| This simple workflow, a new internal network deployed on
| IPv6 only
|
| Edge Firewalls -- source natting to allow access to IPv4
| networks
|
| Edge Firewalls -- destination natting to allow access from
| IPv4 to a service hosted on IPv6
|
| Doesn't seem to widely adopted. It's all dual stack stuff,
| which means more work and more things to go wrong for no
| benefit.
|
| Of course there's then the renumbering of your entire
| internal network every time you change ISP because you're
| using public IPs rather than private ones
| NavinF wrote:
| NAT doesn't improve security if port numbers are easy to
| guess, which is usually the case.
|
| If you wanna block inbound connections, just drop them with
| your firewall. Most home routers already do this by default
| and if yours doesn't, you better enable it for IPv4 too.
| stingraycharles wrote:
| "Block everything" works as long as you aren't actually
| opening any services on the local network.
|
| If I want to open up a device with a single port, I
| should open that in the firewall. But wait, my IPv6
| addresses aren't stateful, so they can change any time.
|
| And then suddenly someone decides to just open port 80
| and 443 on the main router, and bam! I've just opened up
| those ports for _all_ IPv6 clients in my LAN.
|
| You think all those IP cameras and ring doorbells were
| vulnerable when they are behind a NAT? Just wait what
| happens when they all get assigned public IPv6 addresses.
|
| I'm not saying that these problems are unsolvable. But I
| think it's important to at least recognize that, yes,
| this is different than how we did things with NAT, and
| you now have more tools to shoot yourself in the foot
| with.
| zamadatix wrote:
| You should use one of your PDs as a DMZ not putting your
| externally exposed web server in the same subnet as your
| IOT or other outbound only devices. If you're hosting a
| lot of things(tm) you should be using a static DMZ, same
| as you would on IPv4.
|
| For the more general user case ("I want to host a game
| session with my friend") I'm not sure if there is
| something like UPnP for dynamically registering allowed
| ports without needing to actually do any NAT work but
| that would certainly seem useful.
| spookthesunset wrote:
| > you now have more tools to shoot yourself in the foot
| with
|
| And the tools for managing IPv6 firewall rules suck on
| "SMB grade" stuff like ubiquiti and are virtually non-
| existant on any consumer grade router. If I have to SSH
| into the router and treat it like a "real" router to set
| up IPv6 firewall rules... it is never gonna fly for
| anybody who isn't proficient with "real" routers (i.e.
| >99% of the world).
|
| Hell I'm pretty sure comcast's cable modem doesn't even
| have IPv6 firewall capabilities and if they do it is
| default wide open. Thats not what I want. I have no
| interest in outsiders being able to ping hosts on my
| network or even know of their existence. I have no
| interest in letting random IoT devices expose open ports
| to the entire world (by default).
|
| IPv6 is cool and all, but no consumer gear sets it up
| even remotely secure. At least with NAT a "script kiddy"
| grade attacker won't see what is behind your router. NAT
| isn't perfect but it solves a lot of problems. Not so
| with IPv6.
|
| Honestly I just don't really see IPv6 replacing IPv4. It
| introduces too many problems and offers too little
| benefit. Whatever actually replaces IPv4 will either need
| to be 10x better than IPv4 in every way or be a
| completely transparent migration that works with IPv4
| "but with more addresses".
| X-Istence wrote:
| > Hell I'm pretty sure comcast's cable modem doesn't even
| have IPv6 firewall capabilities and if they do it is
| default wide open. Thats not what I want. I have no
| interest in outsiders being able to ping hosts on my
| network or even know of their existence. I have no
| interest in letting random IoT devices expose open ports
| to the entire world (by default).
|
| Comcasts cable modem also doesn't have any firewall for
| IPv4... it's a cable modem, it passes packets.
|
| Your CPE (customer premises endpoint) is where the
| firewall lives.
|
| > IPv6 is cool and all, but no consumer gear sets it up
| even remotely secure. At least with NAT a "script kiddy"
| grade attacker won't see what is behind your router. NAT
| isn't perfect but it solves a lot of problems. Not so
| with IPv6.
|
| Most newer consumer gear that does IPv6 blocks all in-
| bound traffic on IPv6, just like it does on IPv4.
| spookthesunset wrote:
| > Comcasts cable modem also doesn't have any firewall for
| IPv4... it's a cable modem, it passes packets.
|
| Most of the new stuff comcast ships is an "all in one"
| device that acts as an access point, a router and a cable
| modem. You can buy third party cable modems that do what
| you describe but what comcast gives you is much more
| fancy.
| pixl97 wrote:
| You should almost always buy a 'dumb' cable modem and
| have your own router that you manage behind it. These
| devices are commonly behind on firmware and may have
| completely insecure settings that you'll never have
| insight into.
| nomel wrote:
| Having an outdated firmware (which could be solved by
| mandatory updates from the ISP, which appears to be the
| direction AT&T is going) is still much better than having
| no firewall at all. An incredible minority of people, who
| "manage" their household internet access are aware of any
| of this.
| deadbunny wrote:
| > And the tools for managing IPv6 firewall rules suck on
| "SMB grade" stuff like ubiquiti and are virtually non-
| existant on any consumer grade router. If I have to SSH
| into the router and treat it like a "real" router to set
| up IPv6 firewall rules... it is never gonna fly for
| anybody who isn't proficient with "real" routers (i.e.
| >99% of the world).
|
| Umm, the IPv6 firewall interface is exactly the same as
| the IPv4 firewall interface on UniFi[1].
|
| 1. https://i.imgur.com/waISjwe.png
| nitrogen wrote:
| It's not just about inbound connections, people also
| generally don't want to have their outbound devices
| clearly visible by counting unique IPs, or MAC addresses
| (and thus manufacturer) of devices sent out with every
| packet when MAC is used to generate the address, or
| another globally unique identifier for ad networks to
| track.
| Notanothertoo wrote:
| This is why I haven't swapped, but I didn't realize
| they've accounted for this at the client level. Makes
| sense, still makes me think about IoT devices though and
| things I don't have 'control' over like my chrome cast.
| X-Istence wrote:
| With IPv6 and SLAAC your external IPv6 address changes on
| a schedule using privacy extensions...
|
| Mine at home is configured to change every 30 minutes.
| kstrauser wrote:
| I think all major OSes have privacy extensions enabled by
| default, and therefore use random addresses that change
| regularly.
| tolien wrote:
| As sibling points out, that's already covered by the IPv6
| privacy extensions, which every major OS has some support
| for [1]
|
| 1: https://datatracker.ietf.org/doc/html/rfc4941
| thrashh wrote:
| NAT sucks but is harder to misconfigure.
|
| I've never accidentally let something through NAT.
|
| But accidentally not configuring a firewall? Everyone
| does that and has done that and will forever do it.
| blibble wrote:
| there's plenty of instances of shitty applications
| setting up massive port forwarding rules using upnp
| BenjiWiebe wrote:
| I hear this and I'm always curious how this happens. The
| Linux distributions I've used, the home routers I've
| encountered, etc, all default to a restrictive firewall
| that only needs to be changed if you want stuff allowed
| through.
| withinboredom wrote:
| The thing is, once you start to do any complicated
| firewall setup where defaults can no longer be
| restrictive, you are bound to screw it up at some point.
| mentat wrote:
| What kind of firewall work didn't have default drop? Once
| you take that off the table you really do have a problem
| but I've only seen that one in 20 years of professional
| work.
| withinboredom wrote:
| I've had to do it fairly recently due to a lot of dynamic
| bridges and routing on the internal network vlan. I
| wanted to allow all traffic through the vlan from any
| device. However, wanted a default drop on the external
| interface.
| X-Istence wrote:
| Once you are working with VLAN's you are out of the
| bailiwick of consumer hardware, and you should be looking
| at more enterprise grade gear.
|
| At that point having a default drop on the external
| interface and different rules for traffic traversing
| VLAN's is entirely possible, in fact that is what it is
| designed and built to do.
| withinboredom wrote:
| My consumer router has vlan support...
| nunez wrote:
| Yeah, incorrect firewall rules are a HUGE problem at
| super large companies that aren't doing infra-as-code at
| scale yet.
|
| Sysadmins/server engineering/DevOps/SRE, Networks, and
| Security are usually hard silos at big companies.
|
| "DevOps" gets a request from an app team to open a port
| between subnet A and subnet B.
|
| DevOps asks Networks to do it. Security needs to approve
| it before Networks can do it (usually). A cohort of VPs
| somewhere need to approve it if those subnets are
| "production" (i.e. subject to serious fines if the data
| therein fails audit).
|
| Networks outsources the request to their global services
| team in India/Phillippines/China/Brazil since it's
| literally a single command, but they are done in bulk.
| These changes are only done afterhours, partly because of
| outsourcing latency, partly because of regulations.
|
| The firewall person types in the wrong port. Emergency
| change request gets filed to fix. Fixed in 1-3 days after
| the CTO/CIO and some SVPs approve it (and maybe yells at
| people for wasting their time).
|
| The requester asks for the wrong port. Too bad, so sad,
| you're waiting another week.
|
| The app team asked for the wrong port. Same outcome as
| the DevOps person.
| yakkers wrote:
| As far as consumer routers go, wouldn't it be trivial to
| re-tool the usual port forwarding interface to simply
| accept connections to a specific address-port? That
| combined with a internal block-all-inbound rule would be
| quite hard for a user to footgun themselves horribly
| with.
|
| From a quick search, UPnP seems capable of automating
| this for user convenience, especially with stateless
| addressing.
| redprince wrote:
| > I think most corporate network should be able to do pure
| IPv6 internally, and then tunnel to IPv4 at the gateway.
|
| With the amount of legacy applications and systems
| populating the typical internal network that idea won't be
| going far.
|
| Where IPv6 actually can be used and should be deployed in
| addition to v4 is in the perimeter networks. Offering or
| being able to use services on the internet over v6 (via
| proxy) overcomes the real shortage of ipv4 addresses in the
| internet at large.
|
| I expect internal networks to be last places to be moved to
| IPv6 only.
| nunez wrote:
| IPAM, subnetting and firewalls still exist, though. That's
| just a lazy excuse.
| redprince wrote:
| > The number one complaint I hear (and have myself) is that
| maybe I don't _want_ all devices on my LAN to have public
| IP addresses.
|
| This isn't a goal in itself. The formerly problematic and
| unwanted side effects of NAT, namely a broken peer to peer
| relationship of hosts on the internet, are now understood
| as a feature. Machines were forced by this technology to be
| clients and the initiators of all connections to the
| internet. Historically this has interfered greatly with
| several internet protocols (ftp, IRC DCC, p2p file sharing,
| ...) all mostly dead now or reworked to operate in a world
| full of NAT gateways.
|
| IPv6 would reverse this state of affairs. If machines need
| to be denied the server role, this can be enforced by a
| firewall. As far as tracking of clients by IP goes, dynamic
| address assignment via DHCP or IPv6 privacy extension take
| care of that.
| imoverclocked wrote:
| One can still have intentionally unroutable addresses in
| IPv6.
| tsimionescu wrote:
| Sure, but then you're again on par with IPv4+NAT in the
| area of connectivity - no worse, but no better. So why
| switch?
| gumby wrote:
| Because you have all the overhead of NAT plus losing
| functionality that cannot operate through NAT. If all you
| want is to have addresses that done leave the local net,
| just do that.
|
| You'll lose weight in a famine but nobody would suggest
| it as a diet plan.
| gumby wrote:
| > The formerly problematic and unwanted side effects of
| NAT, namely a broken peer to peer relationship of hosts
| on the internet, are now understood as a feature
|
| A feature? I've never heard that. If you want to break
| the end to end nature of the net you can do that in your
| router, easily and more powerfully, without all the
| overhead of NAT.
|
| The net has turned back to the old mainframe days, and
| things like NAT make it hard to go the other way.
| DarylZero wrote:
| > I've never heard that.
|
| It was in the parent comment!
| ipaddr wrote:
| The benefit of switching doesn't outweigh the costs yet. The
| switch to ssl was largely over google rankings vs greater
| security. What is going to be the reason people switch?
|
| Many think cost of ip4 addresses but that hasn't panned out
| with solutions like NAT.
| danpalmer wrote:
| That's only one side of the issue, the server side. There's
| also the client side to consider. Carrier-grade NAT for
| mobile/home use is expensive and harder to run than just
| giving everyone an IP address, and generally means a lower
| quality connection so you can't charge as much as an ISP,
| which is why ISPs are increasingly using IPv6. They otherwise
| need a lot of IP addresses!
| vetinari wrote:
| ISPs are also making it more difficult to themselves: if
| there is a support for IPv6 at all, it is DS-lite, not full
| dual stack.
|
| So let's say I'm willing to migrate to IPv6, but I still
| need IPv4 for some reason (maybe I need to do the migration
| with multiple independent ISPs and every single of them is
| traveling at different speed wrt IPv6). This approach makes
| it impossible for me to switch where it would be possible,
| I cannot drop IPv4 yet, CGNAT-ed connection is unusable,
| but also I cannot use IPv6 where I otherwise could.
|
| So I stay with IPv4.
| IgorPartola wrote:
| So basically if Google added IPv6 support into its ranking
| algorithm we would get adoption virtually overnight.
| eppp wrote:
| No, because isps dont care about page rank. I have to
| operate a small isp. IPv6 solves nothing for us and just
| makes even more problems. The comments in here keep saying
| that ipv6 will fix everything but it is hogwash. It just
| means I have to support two things instead of one. IPv4 on
| the internet will not go away even if I do the ipv6
| transition perfectly.
|
| It is one of the more frustrating parts of trying to
| explain why we don't all just jump to do this.
| IgorPartola wrote:
| That's fair. My ISP not only doesn't provide IPv6 but
| actively blocks using 6to4/6in4. They claim they don't
| but I can clearly see that they do. It's bad.
| vetinari wrote:
| Cable modem? Some Intel Puma 6 modems have a bug, where
| traffic over protocol 41 (6in4) is very slow.
| mhitza wrote:
| What problems do IPv6 cause for your small ISP?
| eppp wrote:
| I have an IPv6 block from ARIN. Now what?
|
| Think of all of the hours I have to spend researching the
| following and implementing it:
|
| 1. Does all of the intermediate equipment support it
|
| 2. Does my IPAM support it
|
| 3. How do I even give ipv6 addresses to my ONTs?
|
| 4. How do I keep track of all of the address assignments
| for x months
|
| 5. Does my staff even understand how ipv6 works?
|
| 6. Does the off hours call center understand it?
|
| 7. Build the servers and add them to all of the
| monitoring, backups, do updates on them
|
| 8. What if I do this and the choice for ipv6 dhcp was
| wrong and in a year I have to redo it all
|
| etc etc
|
| There are no good answers for any of this that I have
| seen. There are sometimes 5+ options for everything to do
| with ipv6. How do I even weigh the pros and cons of
| approaches I have never used before.
|
| Its hundreds of man hours at a minimum for no benefit
| other than to be ideologically on the correct side of
| technology. It will continue to work as it is now with
| absolutely no hours or risk for 10+ years at least.
| IgorPartola wrote:
| Isn't it incredibly expensive to get your own block?
| eppp wrote:
| Since we already have an ASN, its free basically. I
| already have one. Its at least a /32 and maybe a /28.
|
| My upstreams support it, my ONTs support it but there
| isnt a nice ipv6 dhcp server with logging and a lookup
| interface that I have found yet. It probably exists but I
| don't know what it is.
| toast0 wrote:
| IPv6 blocks are usually quite reasonably priced. You
| might even get them for free, if you're already paying
| maintenance on an IPv4 block (which are expensive to
| obtain these days)
| daydream wrote:
| I completely understand that it's a huge amount of work.
| But v6 has been around for 20 years. Spread across
| decades the work becomes a much smaller lift.
| twistedpair wrote:
| If I provided users with an IPv6 block to allowlist for my
| apps, I think most IT directors' heads would explode, but
| _everything_ works with 32 bit CIDR ranges.
|
| I certainly support it, but I'm not sure we'll see an end to
| NAT for some time, even with an IPv6 option.
| quaintdev wrote:
| Some big nation should decide to switch off IPv4 over a course
| of maybe a month and maybe we will start seeing servers
| deploying IPv6 then.
| yjftsjthsd-h wrote:
| Why and how would they even do that?
| jl6 wrote:
| > "we fear change"
|
| Regardless of the IPv6 situation, IT departments take this
| position for a reason. It might be obvious to individual
| engineers how to safely deploy IPv6 on their home network if
| they fully understand all the moving parts. But large
| corporations with deep legacy to maintain don't have the luxury
| of running a fully understood system. Isn't that a big risk?
| Hell yeah, and of course they've all got modernization projects
| running. But in the meantime, they fear change - legitimately.
| roamerz wrote:
| Calling people ignorant because you don't agree with their
| opinions or reasons is a non starter for constructive
| discussions. Using IPV4 has never ever caused me a problem and
| I will never ever run out of addresses. I prefer to focus my
| time on real issues that actually affect end users and improve
| their experiences.
| tyingq wrote:
| There's a fair amount of "who goes first" or "who sees that it
| works end-to-end". My personal experience has been several
| situations where some piece of software that doesn't work, or
| is slow, suddenly works when I disable ipv6. That includes vpn
| client software I had to use for a job, dns configuration at
| another job, a mesh network for some hobby thing, etc.
|
| Had I spent the time to dig into it, I'm sure I'd have found
| the issue. And it probably wouldn't have been directly a true
| ipv6 problem. But I had more important things to deal with, so
| it moved to number 11 on my "top 10 list".
|
| I'm guessing I'm not alone in that. So while individual teams
| and products might be working to support it, end users often
| see that it doesn't, because of some peripheral thing that's
| misconfigured, doesn't have support, etc. So they give up,
| which reduces perceived demand.
| withinboredom wrote:
| If you don't have AAAA records and you don't have Interfaces
| listening to those addresses. You won't "see" ANY "demand."
| So since they don't see ipv6 traffic, they think there's no
| demand for it. It's a self-fulfilling statistic.
| zamadatix wrote:
| It's far more likely the statement refers to a lack of user
| tickets, project requests, or compliance requirements as
| that's normally how IT finds out what to do next. I've
| never seen an IT staff with so little to do they are
| monitoring the network looking for packets for ideas of
| what they should implement next instead of implementing
| things they've been trying to get time for for the last 5
| years. Link utilization maybe but that's a completely
| different beast.
|
| Not to mention it's extremely hard to know how to check the
| statistic you described without becoming aware you don't
| have the things needed to generate the statistics so this
| reasoning kind of rules itself out with the exception of
| AAAA records - you'll actually see those requests even if
| all you have is A records on an IPv4 only DNS server.
| pm90 wrote:
| > My favorite is, "we have no record of people trying to use
| IPv6" - yes, that's real :D
|
| Have you ever worked at a IT department for a medium to large
| company? It's usually a total shit show. IT gets blamed (justly
| or unjustly) for any issue with computers. As a result they
| become rather thick skinned and incredibly conservative in the
| projects they undertake.
|
| So it's not surprising that folks are unwilling to spend time
| on something they don't have prior art for, haven't operated
| before, and doesn't offer significant benefits over what they
| already have.
| belter wrote:
| "Comparison of IPv6 support in common applications"
|
| https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_...
| otabdeveloper4 wrote:
| mrkurt wrote:
| I mean, the original purpose of NAT was to let you move hosts
| between networks without renumbering them. No one really does
| that though, your laptop or phone happily renumber themselves
| when you move networks.
|
| No one's going to use NAT for keeping IPv6 between networks.
| fishtacos wrote:
| Default deny from external access isn't an IPV4 NAT-only
| feature, but it does come out of the box.
|
| The same would need to be set up for IPv6 and move on past
| that.
|
| It's a firewall issue, not a protocol issue.
| BenjiWiebe wrote:
| The devices I've seen have default deny for IPv6 as well.
| justsomehnguy wrote:
| Do you know you can have DENY FROM ALL by default in any IPv4
| firewall?
|
| Do you know what you would be hardly pressed to find a router
| without firewall not only in the year 2022, but in the year
| 2012 too, when there was 10G *switches* capable of routing
| AND firewalling traffic almost at the line rate?
| otabdeveloper4 wrote:
| Firewall and NAT are orthogonal. You need both.
|
| Exposing your LAN configuration for the whole world to see
| is insanity. (Yes, we sometimes do this, but only because
| we still don't have sane VPN solutions here in the year
| 2022.)
| tyingq wrote:
| I'll admit to not understanding this position. Without NAT,
| you could do the same sort of firewalling, where the inbound
| allow list is driven dynamically. The only thing I can think
| of is that not using NAT exposes more detail about an
| internal network. Is that the reason you're hinting at, or is
| the reason something else?
| 300bps wrote:
| Not OP but that's how I think of it.
|
| If my internal network is 10.0.0.0/8 and I have 100,000
| hosts and a single IPV4 address that they all appear to be
| to the public Internet, I'll sleep a lot better than if I
| had all 100,000 hosts with public routable IPV6 IP
| addresses attached to them.
|
| Yes, you can depend on a firewall to protect you but at the
| very least it exposes information about your internal
| network and at worst opens you up to future firewall flaws.
|
| I remember the days when people used to have every system
| have it's own public IP address. People would scan for
| broadcast addresses of their networks and we got Smurf
| attacks as a result. Obviously those wouldn't work with
| properly firewalled hosts but it still scares me.
| fishtacos wrote:
| This is why we have firewalls. My pfSense router e.g.
| blocks external access by virtue of it being a firewall
| with sensible defaults.
|
| All routers w/ firewalls will/should have them.
| pm90 wrote:
| Firewalls are fine but having the ability to make
| machines unroutable is even more powerful, no?
|
| While I get that firewalls are probably safe like 99.99%
| of the time... I've gotta say, I just don't trust
| software to not have vulns of some sort that someone
| important already knows how to break. So eg for a
| corporate network I would be hesitant to do this, for my
| personal network not so much (unlikely that a 3 letter
| agency gives a shit about what I do).
|
| Additionally. Firewall changes can sometimes fail for
| whatever reasons so you might have accidentally exposed a
| node publicly for some time.
|
| Making those nodes not reachable from the internet seems
| prudent. It's like your office building has a public
| address but your office assignments don't need to be
| public.
| zekica wrote:
| No. There is no difference between the two from a
| security point.
| justsomehnguy wrote:
| >Firewalls are fine but having the ability to make
| machines unroutable is even more powerful, no?
|
| For the whole world there is absolutely no difference
| betwen routable address, non-routable address or even an
| absense of the machine... behind a firewall with drop all
| on a public interface.
| 300bps wrote:
| Your statement doesn't address the point you are
| responding to so it makes me think you completely missed
| the point you are replying to.
|
| You are correct _in theory_. What you don't seem to be
| taking into consideration are firewall vulnerabilities or
| other unknown things that could happen that make it
| different from a practical standpoint.
|
| I started an ISP from the ground in 1996. I've seen a lot
| of weird stuff. You seem to just hand waive it away like
| firewalls are this perfect bastion of security.
|
| Maybe you have more experience than I do?
| blibble wrote:
| where do you think the NAT and associated connection
| tracking is occurring exactly?
| floatboth wrote:
| Even firewalls are just a last resort defense IMO. The
| primary thing is not having any crap listening on ports
| in the first place.
| mrkurt wrote:
| Anything smaller than a IPv6 /48 is effectively
| unroutable. Your ISP has to route smaller blocks, like
| /64s, privately (because only /48s hit public bgp). And
| then you have to route the /64 they assign you privately
| once again.
| mrkurt wrote:
| IPv4 with nat is effectively routing your 100,000 hosts
| through one of 4,294,967,296 possible IP prefixes (a
| /32).
|
| IPv6 with a /64 routes one of
| 18,889,465,931,478,580,854,783 possible IP prefixes to
| your router. Everything that happens behind that is
| opaque. There are so many IPs in that prefix that people
| can't even guess which ones you're using. It's easier to
| guess internal IPv4 NAT addresses.
|
| The internet can't see your IPs. "Publicly routable"
| doesn't mean much when you're talking about prefixes.
| otabdeveloper4 wrote:
| Unless you're planning to assign random IPv6 addresses
| for each connecton then it's not at all the same thing.
|
| And anyways, when you have a NAT you're probably routing
| traffic through a level 4 balancer or jumphost or using a
| VPN somewhere in your LAN.
| blibble wrote:
| > Unless you're planning to assign random IPv6 addresses
| for each connecton then it's not at all the same thing.
|
| SLAAC
| Dylan16807 wrote:
| SLAAC has an option to randomize, but it's a lot slower
| than per-connection.
| mrkurt wrote:
| We assign IPv6 deterministically. Incrementing them is
| the most boring way to use IPv6 space.
|
| You can also just start in the middle of a block and make
| a sequence of 10,000 IPs effectively unguessable.
|
| I don't buy that keeping addresses private has much
| value, but IPv6 still isn't worse than NAT in that
| respect.
| doubleunplussed wrote:
| As soon as one of the computers in the subnet initiates
| traffic outside the network, its IP address becomes
| public knowledge though, right? Doesn't matter how large
| the space is, that information leaks, whereas with NAT it
| doesn't.
| Hnrobert42 wrote:
| Some of our service providers require us to provide the IP
| addresses of our services to them for them to safelist.
| It's stupid, but it's not something we can control.
|
| Rather than constantly update them as our servers change,
| we route through a NAT. I wouldn't know how to do it with
| IPv6. Maybe the service provider could safelist a subnet?
| pm90 wrote:
| They probably wouldn't support that. Most non software
| heavy companies outsource these sorts of projects and to
| make changes to their systems requires a bunch of upfront
| capital costs which can be expensive so they will push
| back against changes unless you are big enough to force
| them to or you convince them of the merits of such
| changes.
| miyuru wrote:
| >Maybe the service provider could safelist a subnet?
|
| Yes, thats what prefixes are for. Although its
| unpractical in IPv4 world, in IPv6 it is the way to
| whitelist a range of ips.
| antxxxx wrote:
| Depending on the type of connection it's fairy easy to
| set up squid as a proxy for outbound connections so
| everything appears to come from the squid box which can
| have a static address and can be added to an allow list
| justsomehnguy wrote:
| It's extremely funny how a network with NAT needs hole
| punching in the firewall and network without NAT sudenly
| doesn't have firewall at all. Like OK, in 1995 a router
| would have been a dedicated machine or appliance, but since
| 2005 anyone can buy a sub $30 device which routes,
| firewalls, provides a bunch a of (unnecessary) services...
| but suddenly incapable of firewalling if IPv6 is involved.
| spookthesunset wrote:
| > but suddenly incapable of firewalling if IPv6 is
| involved.
|
| It's been a few years but I've yet to see a consumer
| grade router that lets you mess with IPv6 firewall rules.
| I don't even know what these routers use for a default
| policy.
|
| They all seem to have web ui's for IPv4 firewalls and
| port forwarding though...
| vetinari wrote:
| Ever seen an average IPv6 firewall, even on $500 devices?
|
| You can have dynamic prefix that can change with every
| moment on your wan interface, but then you have static
| IPv6 rules and you cannot specify something like _use
| current prefix_ there.
|
| So I understand if the first reaction is _screw that_.
| otabdeveloper4 wrote:
| Yes, of course.
|
| Exposing your LAN confguration for the world to see is
| insanity, it's like hiding your private SSH keys in a
| password-protected Excel file.
|
| And yes, you need both NAT and firewall. They're
| complimentary technologies and do not replace each other.
| [deleted]
| rr808 wrote:
| NAT is a very simple idea that works very well. In fact for my
| private network with 20 odd devices I'd prefer to keep it.
| xibo9 wrote:
| The problem is, it is NOT a simple idea, but one that
| requires a lot of relative heavy lifting with deep packet
| inspection for a lot of protocols that have to deal with the
| spaghetti that is NAT.
| spookthesunset wrote:
| Yeah but even if it isn't simple it is mostly a solved
| problem at this point. NAT has been around for, what, 15
| years now?
|
| And quite honestly the default configurations for IPv6 on
| consumer routers is "wide the fuck open"--which is not at
| all what I want. But if they don't make it "wide the fuck
| open" suddenly you are asking normal people to learn how to
| punch holes in their firewall.
| fsh wrote:
| I have never seen a consumer IPv6 router without a
| restrictive firewall enabled by default. Could you give
| some examples where this is not the case?
| spc476 wrote:
| Pv6 and NAT were developed in the mid-90s. They've both
| been around for far longer than just 15 years.
| MrStonedOne wrote:
| dheera wrote:
| > no need for NAT
|
| Yeah everyone says this but I can't access any ports on my IPv6
| address from outside my home network.
|
| Back to IPv4 + NAT + port forwarding, I guess.
|
| I have bigger problems I need to solve in my life right now.
| When one day I can just ssh <my-ipv6-address> from the outside
| I'll do that. Thanks.
|
| Also, there's the DNS problem. I can remember 10.0.0.3,
| 10.0.0.20, etc. pretty damn easily. I can't remember
| 8cef::fasd:8000:c00a:::99aa:::::81/42:8fe that easily.
|
| Which is an issue when things like 'foobar.local' don't work
| half the time. I have the IPv4 addresses of all my internal
| machines memorized thanks to the the fact that .local just
| doesn't work, period.
| bombela wrote:
| .local not working might be your router trying to be helpful
| and snoop multicast to limit it to pairs of devices.
| Something about iptv optimization or whatever I don't really
| understand. Since I turned this feature off .local works as
| it should.
| zekica wrote:
| You are using it wrong.
|
| You can't access a service on a server on your local network
| using your router's global IP. You should use server's global
| IP address (and open the port for that IP on the firewall).
|
| If your server uses SLAAC, it will always use the same local
| address (whether using EUI-64 or stable privacy), or you can
| configure it manually. In either case the address won't
| change.
|
| NAT made you think in a different way, but if you started
| with IPv4 before there was NAT, this setup is exactly the
| same as it was with IPv4 a long time ago.
| dheera wrote:
| Too much work.
|
| If I type ifconfig on my machine I only have one 'inet6'
| address and it isn't reachable from the outside.
|
| The relevant people who want to popularize IPv6 should make
| that "just work". Until then IPv4 works for me, and a port
| forward is easy to understand, I don't need to google what
| SLAAC and EU-64.
|
| They advertise it as "oh you don't need a NAT" but in
| reality IPv4+NAT is easier to deal with.
|
| Most of us have actual jobs and don't have time to also be
| devops people.
|
| I realize this sounds like a shitpost, but this UX is
| exactly why IPv6 isn't popular yet. If you want something
| to be popular, you need to make it _easier_ not harder than
| the current thing everyone uses.
| Symbiote wrote:
| Half the discussion is FUD that a consumer router
| wouldn't have an IPv6 firewall.
|
| Your router, like every other, has a default deny
| firewall for IPv6. You'll find the settings near to where
| you set up IPv4 port forwarding. My router calls it
| "pinholing" or something.
|
| Then you can SSH directly to the servers you allow access
| to, using port 22 for all of them if you wish.
| dheera wrote:
| I tried enabling IPv6 on my router just now. It asked me
| for a delegation size. How TF do I know. I just randomly
| put in 60. It's what a google search told me to put in.
| Save changes.
|
| Go to main screen. Still only shows my IPv4 WAN address.
| No IPv6 "pinhole" setting near the port forwarding.
|
| Back to making breakfast and doing what I needed to
| actually do.
|
| I use a UDM Pro by the way.
| Symbiote wrote:
| Sorry, I thought you were asking about a home broadband
| connection with the typical basic router supplied by the
| ISP.
|
| The UDB Pro looks like something for a small/medium
| business, so you presumably have a business connection.
| You'd need to ask your ISP for the configuration, as it
| will depend on what service they're providing. (Just like
| for IPv4 you'd need configuration if the ISP is providing
| you with 4, 16, 32, ... IPv4 addresses -- also a common
| situation.)
|
| If ifconfig is showing IPv6 addresses starting with
| fe80:, these are local/private, a bit like 169.254.x.y
| IPv4 addresses.
|
| So far, all global/routable IPv6 addresses begin with 2.
|
| (And for most home users, IPv6 is just as easy as IPv4,
| i.e. they don't know anything about either. After a test
| period, ISPs that support IPv6 generally enable it for
| all the normal home users -- it saves them money! That it
| is the default is how we got to 35% of Internet users
| using IPv6.)
| spookthesunset wrote:
| Totally agree. The UX for IPv6 sucks. Every time I poke
| with it I get worried I'm exposing the guts of my
| internal network onto the internet. With NAT, at least I
| know nothing is getting in without me intentionally
| punching a hole. With IPv6 to do the same I have to go
| fiddle with the router's command line interface and rules
| by hand. And even then who knows if I fucked something up
| or missed something... its just a lot of work.
|
| There is no web UI for managing IPv6 firewall rules but
| there is for IPv4. On the consumer grade routers I've
| touched there isn't even a way to configure the IPv6
| firewall rules (and again, they all offer web UX for IPv4
| rules).
| Symbiote wrote:
| The interface on the router provided by the UK's largest
| ISP is almost identical to the interface for IPv4 port
| forwarding: https://imgur.com/a/NXqwoA6
| spookthesunset wrote:
| Awesome!
|
| I wish my edgerouter had something like that...
| [deleted]
| iso1631 wrote:
| I can't go v6 only, so why double my workload by supporting
| ipv4 and ipv6.
| throw0101a wrote:
| > _What 's really interesting is how many of these "we fear
| change" IT people don't realize they're already using IPv6 on
| their phones every day, with a majority of the sites they
| visit._
|
| For example see the video "T-Mobile's path to IPv6 Only":
|
| * https://www.youtube.com/watch?v=nNMNglk_CvE
| Tijdreiziger wrote:
| Wow, interesting to see such a video coming from T-Mobile. We
| have a DSL connection with T-Mobile Netherlands and they
| still don't support IPv6. Any inquiries about this on their
| community forums are met with a reply of 'there are currently
| no plans for IPv6 support'.
| X-Istence wrote:
| T-Mobile here in the US is a mobile provider, they don't
| have any landline service.
| Tijdreiziger wrote:
| They used to be just a mobile provider here, but a number
| of years ago they acquired Vodafone's DSL division. They
| don't actually own any DSL lines though, they just rent
| line access from KPN (the country's incumbent telco).
| floatboth wrote:
| Different countries' T-Mobiles are quite different,
| especially the US one..
| MrStonedOne wrote:
| Alekhine wrote:
| Wait, if my phone is IPv6, then what does it mean that a site
| 'supports' v6? I can get on HN just fine.
| [deleted]
| jakub_g wrote:
| Websites have separate DNS records for ipv6 (AAAA record) and
| ipv4 (A record). Since ipv6 is not universally supported, the
| de facto expectation is that if website has ipv6 DNS record,
| it should also have an ipv4 one for the users who can't talk
| ipv6.
|
| Your device's network stack first learns if your mobile ISP
| supports ipv6 or not, and based on that and DNS reply decides
| how to connect to a given website.
| throw0101a wrote:
| > _Wait, if my phone is IPv6, then what does it mean that a
| site 'supports' v6? I can get on HN just fine._
|
| It means that the phone doesn't have to talk through a
| network-translation box, which may add latency. For some
| things (gaming?) this may be important, while for others it
| may not be.
|
| Further, the price of each IPv4 address is going up, and so
| having your hosts on IPv6 may allow for the lowering of your
| costs, which you can pass onto your customers or add to your
| margin.
|
| About a year ago they were US$ 30/IPv4, and they now seem to
| be in the $50 range:
|
| * https://auctions.ipv4.global
|
| * https://auctions.ipv4.global/prior-sales
| fpoling wrote:
| We use VPS from tilaa.com and they charge 2 Euro per extra
| IPv4 and for the third etc. address per server one needs to
| submit a technical reason for doing that that they manually
| review.
| tolien wrote:
| Does your phone _only_ have a v6 address though? If it did,
| you would need some kind of proxy (6to4 [1], the most likely
| example) connecting to HN 's IPv4 address on your behalf.
|
| As the sibling points out, if both site and device support v6
| the intermediate translation isn't required.
|
| 1: https://en.wikipedia.org/wiki/6to4
| fishtacos wrote:
| That's exactly what it is. There is always a proxy, which
| negates part of the argument, but is a very useful tool in
| transitioning over the next 2 other decades at least... the
| way this is going.
| Dagger2 wrote:
| It definitely wouldn't be 6to4; that requires a v4 address.
|
| It'll be NAT64.
| tolien wrote:
| Ah you're right, 6to4's a 1:1 IPV6 to IPv4 translation.
| nunez wrote:
| You establish a TCP session with the IPv6 address of that
| site instead of its IPv4 one by way of getting its AAAA
| record and your phone having dual-stack networking enabled.
|
| (Most US carriers have IPv6 enabled and issue IPv6 addresses
| to their phones.)
| rmoriz wrote:
| Running containers dual-stacked is still surprisingly difficult
| or annoying.
| zokier wrote:
| What I haven't quite fathomed with IPv6 is that as a home user
| without my own AS, am I supposed to use my ISP provided addresses
| in my internal network? ISP provided addresses that I have no
| control over and could change at any time? With IPv4, I just use
| RFC1918 addresses as I like and I have full control over the
| addresses and their allocation and I can then very easily set up
| iptables rules, dhcp pools, dns records etc. Then I just NAT at
| the edge of my network, and the configuration is practically
| completely isolated from my ISP and whatever addressing they do.
| BitPirate wrote:
| If you don't have a static subnet, you can still use ULAs.
| BenjiWiebe wrote:
| Exactly. With IPv6 you are expected to have multiple
| addresses. Some to access the internet with that may change,
| some that don't change and aren't globally routable to access
| your own stuff with. Though you can also (if your router
| supports it) assign hostnames to your devices so you can
| access them via their non-static global addresses.
| infiniteloop0 wrote:
| infiniteloop0 wrote:
| franga2000 wrote:
| IPv6 has private addresses too. In my network, all computers
| have 3 addresses: public, private and link-local. All local
| services use the private ones and those never change. (I don't
| think they're called "private" in the spec, but the idea is the
| same)
| benttoothpaste wrote:
| In addition IPv6 has this weird restrictions on which prefixes
| are valid. For example if your ISP gives you /64 prefix, most
| consumer routers will not recognize it as valid. And even if
| you have a very configurable router it will take lots of work
| to configure that - even though in theory you should have tons
| of addresses available. And if you get a /128 prefix, good luck
| that - NATs are apparently disallowed in IPV6 world.
| zamadatix wrote:
| > For example if your ISP gives you /64 prefix, most consumer
| routers will not recognize it as valid.
|
| A /64 is the most valid IPv4 prefix there is. Most consumers
| should be given multiple (usually about 16) and the router
| starts with the first one.
|
| > And if you get a /128 prefix, good luck that
|
| No kidding, that's a single address subnet!
|
| > NATs are apparently disallowed in IPV6 world.
|
| It's allowed it's just not the right answer in the vast
| majority of cases.
| mjevans wrote:
| RIPE approved prefix lengths for end customers are /48, /52,
| /56, /60, and /64; though the prefixes longer than /56 are
| strongly discouraged and probably reflect either an ISP that
| doesn't get IPv6 or that is anti-consumer if they do.
|
| https://www.ripe.net/publications/docs/ripe-690#4-2--
| prefix-...
|
| ... "Each hexadecimal character in an IPv6 prefix represents
| one nibble, which is 4 bits. The length of a delegated prefix
| should therefore always be a multiple of 4.
|
| A single network at a customer site will be a /64. At
| present, RIR policies permit assignment of a /48 per site, so
| the possible options when choosing a prefix size to delegate
| are /48, /52, /56, /60 and /64.
|
| ...
|
| The following sections explain why /48 and /56 are the
| recommended prefix assignment sizes for end customers.
|
| ...
|
| It is strongly discouraged to assign prefixes longer than /56
| unless there are very strong and unsolvable technical reasons
| for doing this."
| tsimionescu wrote:
| Is RIPE a law? Can they force my ISP to give me a /56 if
| they're giving me a /128?
| [deleted]
| zekica wrote:
| NAT is not disallowed in IPv6, it's just discouraged as it
| breaks end-to-end principle. You can still have stateful
| firewalls that work for the majority of cases and you can
| also use NPT (network prefix translation also called 1-to-1
| NAT) if you want. There is even a RFC specifying on how to do
| NPT without creating compute overhead for routers by making
| the packets have the same CRC.
| Spivak wrote:
| NAT is actually probably preferred too for homelabbers one
| because you don't have to re-address things ever and also
| because you can use your whole ISP assignment as a pool of
| dynamically assignable/attachable public addresses.
| DarylZero wrote:
| Are you thinking of prefix translation?
| amluto wrote:
| I'll add one: for servers accessed only via private networks,
| IPv6 still allows easy use of globally unique addresses. The
| finance world is full of IPv4 systems using 10.x.y.z, and there
| aren't enough of those addresses to go around.
| hexo wrote:
| my ISP uses IPv6. actually with some sort of 4-in-6. i can access
| v4 and v6 world with no artificial problems.
| yjftsjthsd-h wrote:
| This seems like a good place to mention a neat trick: If you're
| behind cloudflare or such, you can probably trivially go _pure_
| IPv6 on your servers and not even have to worry about NAT because
| cloudflare will provide v4 to users that use it. So you end up
| with (your server) -v6- > (cloudflare) -v4/v6-> (users). (Which I
| admit is a sort of NAT, just not at the IP level)
| dekhn wrote:
| I noticed that effectively all my home machines support dual
| stack right now. I decided to make an experiment and move to only
| IPv6.
|
| It was a huge mess (the autoconfig functionality, naming,
| routing) that all sort of failed in ways that involved deep
| hacking to debug. Ultimately I realized that since most sites on
| the net aren't ipv6, I'd need to NAT or proxy my traffic to them
| anyway.
|
| Let me know when we're ready to turn off IPv4.
| tomsmeding wrote:
| > Apparently you can buy IPv6 addresses, use them for the servers
| on your home network, and then if you change your ISP, continue
| to use the same IP addresses?
|
| > I'm still not totally sure how this works but it sounds cool.
|
| Naively I would say this is completely impossible without some
| form of your home router (or ISP?) relaying your traffic, or
| perhaps telling the sender that I am now actually located in a
| different subnet somewhere. If anyone can have IP(v6) addresses
| and keep them and take them with you, then wouldn't that result
| in an unmanageably large lookup table at routing nodes to know
| where to route stuff to?
|
| How does that work?
| linsomniac wrote:
| I believe this might be talking about getting an ARIN
| reservation, as elsewhere it is mentioned that it is not cheap
| and points to the ARIN fees page. The list of ARIN requirements
| includes: "You plan to immediately be multi-homed". So you're
| going to need to be connected to multiple ISPs that will talk
| to you via BGP would be my assumption.
| adamcharnock wrote:
| So this is typically what BGP is for, but this is definitely
| not something that is typically offered to residential
| customers, nor even most business AFAIK. This is what you would
| typically get with a Direct Internet Access (DIA) connection.
| This is an uncontended connection where to setup a BGP peering
| with your provider. You then give the provider some
| documentation proving you own a range of addresses, and they
| agree to accept those routes from you via the BGP connection.
| They then advertise that to their upstream providers, and thus
| the routes propagate to the entire internet.
|
| There are a couple of gotchas though. Firstly, there is
| generally a minimum prefix size of routes that will be accepted
| into the global routing table. For IPv4 I think it is a /24,
| and for IPv6 I think it is a /32. You can get a /32 from
| regional IP registry (for free?) but you will probably need to
| become a member which - last time I checked - costs 3-4 figures
| a year. You can use a private-AS number though, as you'll only
| have one upstream provider.
|
| The other gotcha is cost. Depending where you are in the world,
| a DIA connection will cost in the very rough region of
| (EUR/USD/GBP) 1/megabit/month, although it becomes much cheaper
| when going from 1gb to 10gb.
|
| Now maybe there is some cool facility that some nice ISPs offer
| to bypass all this, if so then please let me know. I'm
| personally skeptical it would be worth their while for the
| 0.001% of residential customers that would want this service
| though.
|
| Source: I run a small ISP. I have some industry knowledge, but
| not loads.
| gnopgnip wrote:
| You can get your own autonomous system, and take your IPs with
| you when you change ISPs, or have the same IPs reachable
| through multiple ISPs. This is possible for both ipv4 and ipv6
| but ipv6 is much cheaper. Still not really something that makes
| sense for a residential user. You need to have networking gear
| that handles routing on the internet, bgp advertisement instead
| of having your ISP handle it. There are annual fees, you
| generally need to be on a business plan with the ISP. For ipv4
| the minimum ASN size is a /24, it costs around $12k to buy the
| IPs for a /24. Ipv6 ips are free. It also costs around $1000 in
| annual fees for an ipv4 asn, ipv6 is less. ipv4 ASNs smaller
| than /24 aren't advertised outside of your current ISP and
| aren't really portable.
|
| Currently there are about a million ipv4 prefixes advertised.
| And about 150k ipv6 prefixes. Some older ipv4 equipment has a
| limit of 1024k, or near 1 million advertised prefixes. This
| equipment is usually 15+ years old, but still is what runs the
| internet. Generally equipment that supports ipv6 can support
| many more networks
| metalliqaz wrote:
| its possible but it relies on your ISP being willing to route
| your traffic, and as the article notes, many won't bother
| jlokier wrote:
| My office ISP is a mobile phone running a wifi hotspot.
|
| (Don't judge, it's faster than the last ADSL connection at about
| 80Mbit/s on a good day, much cheaper, and the office goes through
| about 40GB/month no problem.)
|
| The phone has an IPv6 address but no IPv4 address.
|
| Ironic, then, that the hotspot only provides IPv4 to all
| connected devices, not IPv6. As a result, all connected devices
| in the office can only use IPv4.
|
| My home ISP is a mobile 4G router providing wifi.
|
| The router doesn't get an IPv6 from upstream, just IPv4, so it
| only provides IPv4 to connected devices at home. I have no idea
| if it would provide IPv6 service if it got one from upstream. It
| is a little strange that it doesn't get IPv6 from upstream,
| because it's exactly the same type of mobile data contract as the
| office phone-router is using.
|
| It's 2022. I've had IPv6 on my servers since about 2003.
|
| But aside from my actual phone, I've never had IPv6 on any device
| I'm using, living at numerous homes, using many and varied ISPs,
| working at numerous offices, or anywhere else. Not even when
| travelling.
|
| I had to turn off IPv6 on my mail server, because gmail.com was
| rejecting mail from it when sent over IPv6, but not when sent
| over IPv4.
|
| I use LXD and Docker on some of my servers for containers, and
| libvirt/KVM for VMs. In theory they support IPv6 but in practice
| it's easier to work with IPv4 address or port forwarding with
| them. That means the containers and VMs are only reachable from
| the internet over IPv4, even when the host servers have IPv6.
|
| All together, anything I do to support IPv6 ends up poorly tested
| because it's not really used, and everything has to be done with
| IPv4 in parallel anyway.
|
| I still have IPv6 on my servers, and DNS configured
| appropriately. But as it virtually never gets used, it seems a
| bit pointless. Sometimes I don't set up IPv6 on a new server
| straight away, and nothing is missed.
| iqanq wrote:
| tolien wrote:
| There's already a lot of FUD around IPv6 and I'm not sure that an
| article which seems to amount to a survey on Twitter really moves
| the conversation forward much.
|
| Clearly there's pain points to rolling out v6 (although I'd
| question how many of them are still an issue outside the glacial
| pace of Enterprise IT) and we'd be better trying to address that
| than re-hash the same old arguments.
|
| Edit: not much more than 2 weeks ago we had this chestnut [1]
| where Nintendo was telling you to forward thousands of UDP ports
| to a Switch in order to play online but still we hear "but NAT
| works fine for me".
|
| 1: https://news.ycombinator.com/item?id=29919228
| zamadatix wrote:
| I think the decades of dominance of UDP/TCP over IPv4 over
| Ethernet (which comes with the pre-existing knowledge in
| everyone, the years of experience working with it for any IT
| person, the additional workarounds like NAT and UPnP and so on,
| and even the oldest hardware still reasonably running having
| full support) has made people think it was all just always easy
| and obvious from the get-go. Where some of these protocol
| assumptions and ingrained history didn't exist, like the mobile
| carrier space, we see by far the most adoption of IPv6 out of
| any area and even a few non-dual stack players.
|
| The truth is like most topics in computing after 20 or 30 years
| of using one protocol/interface the baggage, limitations, or
| cost of the old keep piling up and eventually the new thing is
| going to seem like less work/cost/baggage than the old.
|
| The thing that seems to be moving it forward the most nowadays
| is cost and baggage (= complexity = long way around to more
| cost). The direct cost is per IPv4 prices going from ~$25/per
| to ~$45/per in the last year alone. The baggage/complexity cost
| is particularly on the carrier or large enterprise side where
| ever growing device counts and ever growing public address
| costs combine to make NAT needs larger and sometimes multi-
| staged (e.g. CG-NAT).
|
| I think the breaking point will be when we start to see most
| hosting providers and carriers continue to either push
| consumers to more IPv6 to reduce NAT load or cost incentivize
| hosted services to do the same. There are limited instances of
| this now, an occasional hosting provider offering IPv6 only for
| a lower monthly cost or a mobile carrier that migrates all of
| it's users to IPv6 transparently, but there are still more
| providers/carriers that don't do anything IPv6 than there are
| that incentivize IPv6. Definitely moving in that direction
| these last few years though.
|
| What I don't think we'll see is a sudden "aha" moment where
| people give up IPv4 and stop being uncertain about v6 just
| because they read about it more or were told some detail.
| tolien wrote:
| > I think the decades of dominance of UDP/TCP over IPv4 over
| Ethernet (which comes with the pre-existing knowledge in
| everyone, the years of experience working with it for any IT
| person, the additional workarounds like NAT and UPnP and so
| on, and even the oldest hardware still reasonably running
| having full support) has made people think it was all just
| always easy and obvious from the get-go.
|
| Yeah, it doesn't feel like that long ago when consumer
| routers with tiny translation tables would crash hard when
| anything opened a load of connections (think games but
| especially BitTorrent) because they didn't have much RAM.
|
| I think for most people the switching moment will be
| something they don't even see - their ISP enables it and off
| they go.
| coredog64 wrote:
| If everyone moved to IPv6, Amazon couldn't charge AWS customers
| for NAT gateways. Won't someone think of the $AMZN shareholders?
| spc476 wrote:
| I read all the time about how great the latest technology like
| Docker and Kubernetes is, and how one should _always_ update
| every 20 minutes or else you 'll have your entire _life,_ much
| less your identity, stolen by hackers, and besides, who wants to
| use software that 's an entire six months old? And yet, trying to
| get anyone to upgrade to IPv6 and suddenly the entire world gets
| super conservative and "hey now! Let's not get too hasty here!" I
| can't quite square this circle.
| EVa5I7bHFq9mnYK wrote:
| I think ipv6 enables easier surveillance and censorship.
| withinboredom wrote:
| A personal bane of my existence is WSL's lack of ipv6 support.
| You can't even use WireGuard and ipv6 because it's missing some
| kernel options.
| jrmg wrote:
| I'm surprised at all the people here saying that they can't get
| IPv6 to 'work' on their home internet connection. In my
| experience, in the Bay Area, with Comcast cable and AT&T DSL
| connections in the last few years (5 or 10), it's 'just worked'
| for any device connected to the router they provide, no
| configuration required.
|
| I kind of assumed that this was true nowadays for most home ISPs.
| deathanatos wrote:
| I was in the Bay Area when Comcast ( _finally_ ) rolled it out;
| it wasn't that long ago; it might have been >5 years now, but
| definitely it was within the last 10.
|
| Now I'm in the Boston MSA (a very rural place, I know /s); the
| ISP here, Verizon, does not offer IPv6. (They state they are
| "rolling it out", but this year will be the fifth anniversary
| of that.)
| buttocks wrote:
| Speaking of Twitter, follow @noipv6 for some great commentary
| and/or heckling of ISPs who make false claims about IPv6 to
| defend their lack of support.
| vardagsnytt wrote:
| The perspective on this one is rather important I'd say. To run a
| service and buying a few IPv4 addresses is quite feasible. But
| operating an ISP and maintaining either large numbers of prefixes
| or costly CGNAT hardware at that scale puts it way more into
| focus.
|
| Of course I'm not implying that IPv6 isn't nice to run inside
| your infrastructure but I guess it isnt at the top of ones
| expenses.
___________________________________________________________________
(page generated 2022-01-29 23:00 UTC)