[HN Gopher] I spent a week without IPv4 to understand IPv6 trans...
___________________________________________________________________
I spent a week without IPv4 to understand IPv6 transition
mechanisms
Author : pattyj
Score : 167 points
Date : 2023-03-06 15:06 UTC (7 hours ago)
(HTM) web link (www.apalrd.net)
(TXT) w3m dump (www.apalrd.net)
| soebbing wrote:
| I am quite happy that all those shady IoT devices cannot be
| reached from the internet directly when I am using IPv4 and NAT -
| what would be the best way forward to keep it that way in a
| IPv6-only future?
|
| The best idea I can come up with (at least right now) is: put all
| less trustworthy (read: Closed source) devices into a special
| legacy IPv4 network and only use IPv6 on my workstation and
| little Raspis?
| wolrah wrote:
| > I am quite happy that all those shady IoT devices cannot be
| reached from the internet directly when I am using IPv4 and NAT
| - what would be the best way forward to keep it that way in a
| IPv6-only future?
|
| The same exact way you do it right now.
|
| Think of NAT as an implicit default-deny firewall rule, that's
| all it's doing.
|
| Basically any firewall worth using will do exactly the same
| thing in IPv6, deny unsolicited inbound traffic unless
| explicitly allowed.
|
| For some reason there's this belief out there that a device
| having a globally routable IP address inherently means it's
| globally reachable, and that's just not true. Your firewall
| still works exactly the same way.
| jiggawatts wrote:
| Not to mention that 99.99% of IoT devices connect to the
| mothership using an _outbound_ connection, which is permitted
| by default on both IPv6 and IPv4+NAT.
| wyager wrote:
| Put internet of shit devices on their own VLAN(s). Almost all
| wifi APs today support multiple SSIDs with separate VLANs. Have
| your firewall block inbound connections to devices on that
| VLAN. Every OS firewall has built-in support for this.
|
| I spent a lot of time figuring out how to do all this in the
| most efficient way (in terms of my time and effort) during
| covid, and I suggest getting any arbitrary box with 2 ethernet
| ports and putting freebsd on it.
| philjohn wrote:
| I go one further - the IoT VLAN (Sonos, Philips Hue, wifi
| controlled light strips, TV's) is hard segmented from my
| "trusted" VLAN (except for some specific holes punched so
| things like SSDP and streaming from a media server work).
| soebbing wrote:
| I actually thought about that for a minute when I set up my
| home network a while ago, but that seems to be a pretty hard
| (or at least inconvenient) problem.
|
| Often I need to access a device from my local network (think:
| use my phone to control Wi-Fi LED Strips, Sonos speakers,
| etc.), which makes it impossible (I guess?) to separate these
| devices into their own network completely (if they aren't
| controlled by an online service in general). Or is it
| possible to allow access from my trusted network INTO the
| restricted network, but not the other way around?
|
| Total network noob here, in case you haven't figured that out
| yet. :)
| wyager wrote:
| > Or is it possible to allow access from my trusted network
| INTO the restricted network
|
| Yes, my home network works exactly like this. I have a vlan
| called "trusted" which can connect to any other vlan. One
| line in pf.conf.
|
| My VLANs are something like: trusted, guest, media,
| cameras, printer, etc.
|
| Many of these aren't allowed inbound _or_ outbound
| connections (e.g. cameras and printer can only talk to
| things on their subnet).
|
| Only downside is that stuff that works off broadcast
| packets (like bonjour) does not work across subnets.
| kube-system wrote:
| There are mDNS repeaters that can in some cases make
| bonjour work across different networks. In my experience
| I spend more time fighting with mDNS than I do enjoying
| it.
| labcomputer wrote:
| Each of the VLAN is (or can be) just another network from
| the router's and firewall's perspective. So you just have
| to set up appropriate firewall rules to allow traffic
| between the networks that you want to communicate.
|
| You could, for example, allow only TCP traffic initiated by
| hosts in the "normal" VLAN to hosts the IoT VLAN. So IoT
| stuff can't initiate outgoing connections to any other
| network, and can only receive TCP connections from one
| network.
|
| You can also set up an MDNS reflector on your router if
| your IoT devices use that (e.g. HomeKit) to send data
| proactively back to "normal network" hosts.
| throwaway742 wrote:
| >Or is it possible to allow access from my trusted network
| INTO the restricted network, but not the other way around?
|
| Yes
| nickstinemates wrote:
| Network segmentation, i.e use of vlans is the traditional way
| to solve this.
| Godel_unicode wrote:
| Not sure why you're being downvoted, this is a very good
| answer. Maybe because you left out the implied "and then
| firewall off that vlan"?
| soebbing wrote:
| Yeah, it seems to be the common consensus to just block
| everything going in and just make exceptions, where you
| really want to offer a service to the internet.
|
| Makes total sense, thinking about it. I guess, all those
| years of just sitting behind a NAT makes one forget all
| these networking basics if you're not using them regularly.
|
| Moving closed-source IoT devices into a special vlan, with
| some even more rigid rules (something like: only allow
| http/https traffic into the internal network) might be an
| additional level of security.
|
| Thank all of you for your replies!
| screamingninja wrote:
| It's worth noting that NAT is not a security feature in itself,
| but rather a way of conserving public IP addresses and hiding
| the internal network structure. The best way is to use a
| stateful firewall that is built into nearly every router.
|
| Another option is to use IPv6 Unique Local Addresses (ULA),
| which are similar to private IPv4 addresses and can only be
| used within a specific site. This approach enables internal
| connectivity for devices that do not require direct access to
| the Internet. I use it for several IoT devices that I do not
| want reaching out to the mothership.
| adriancr wrote:
| Although I'm going to get comments saying this is wrong...
|
| What I did was:
|
| - IPv6 DHPC - private address range within: fc00::/7
|
| - IPv6 NAT, same as for IPv4.
|
| - Firewall.
|
| Why:
|
| - digital ocean only allowed ~16 IPv6 addresses.
|
| - I wanted a local IPv6 network exiting through digital ocean.
|
| - I see no reason to give public route-able addresses to each
| device in my home (allows remote websites to determine who is
| calling it and set up profiles/target each remote device).
|
| - Sure, privacy extensions which cycle unique addresses, but it
| still allows profiling based on source address, even if a bit
| of work is needed for each new addresses.
| Xelynega wrote:
| Why would your firewall allow your ipv6 IoT devices to
| receive inbound connections from the internet? Whats the
| difference between "ipv6 Nat" and a firewall when theres not
| likely to be any address overlap.
| adriancr wrote:
| > Why would your firewall allow your ipv6 IoT devices to
| receive inbound connections from the internet?
|
| It does not, problem is with outbound connections.
|
| > Whats the difference between "ipv6 Nat" and a firewall
| when theres not likely to be any address overlap.
|
| Outbound connections can be profiled by remote websites.
|
| With NAT (Well... Port-address-translation to be fair, so
| single outgoing address), traffic can't as easily be
| profiled.
|
| Imagine ISPs/Ad providers having easier time identifying
| you, your spouse, your kids, etc. (and device, and so on
| just by observing addresses)
|
| With initial SLAAC it is even nicer as MAC address is
| included in the address... Can look up device much easier
| just cross reference manufacturer database...
| xnyanta wrote:
| Digital Ocean has horrible IPv6 support, I would just move to
| another provider. Most VPS providers will, at the very least,
| provide you with a /64.
| nijave wrote:
| >cannot be reached from the internet directly
|
| Stateful firewall that allows outgoing connections and blocks
| incoming (or maybe blocks both)
|
| In general, you probably don't want to allow unsolicited
| incoming connections to any devices, regardless of IoT.
| cnorthwood wrote:
| You'd probably do it in the same way you'd do it with NAT, by
| using a stateful firewall blocking inbound connections (it's
| just that you get this for "free" with NAT)
| jhoelzel wrote:
| You can configure your local ipv6 net without SLAAC (Stateless
| Address Autoconfiguration).
|
| Or differently put, you don't need to use the net your isp
| provides everywhere, ipv6 can still use NAT if you want it to:
| https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6
| vel0city wrote:
| > what would be the best way forward to keep it that way in a
| IPv6-only future?
|
| Firewalls. You configure what traffic should be allowed from
| who to who. Default deny incoming traffic, and its the same
| behavior as when you had a NAT.
|
| Something having a routable IP address doesn't mean it needs to
| receive all traffic addressed to it.
| candiddevmike wrote:
| The problem I have had with this setup is allowing inbound
| traffic to things that need it becomes tricky. Some devices
| don't support DHCPv6 like Android) and some firewalls don't
| let you do suffix matching. With a dynamic block via PD, the
| rules to allow inbound traffic to say an Xbox become quite
| complicated.
| nrabulinski wrote:
| You can still have a firewall on the router level, just as
| you do with IPv4. You shouldn't allow any external traffic
| by default anyway and NAT shouldn't be a security measure.
| candiddevmike wrote:
| I know, I'm saying that when you want to embrace global
| routable addresses for outbound AND inbound, it's hard
| with Prefix Delegation and spotty DHCPv6 support.
|
| ISPs should be forced to let customers get IPv6 prefix
| reservations. Yes, PD doesn't change for most, but I'd
| rather not use PD at all.
| groestl wrote:
| My ISP does not allow BYOM (bring your own modem) and assigns
| me a /64 net, so I have a hard time running an (ipv6) router
| behind it that would do the firewalling.. I guess I'm stuck
| with ipv4 for the time being...
| aaronax wrote:
| A firewall can be run "in-line" and not have IP addresses
| on the interfaces. On a Palo Alto firewall this would be a
| "virtual wire", and "transparent firewall" or "bridging
| firewall" would be other common terms.
|
| Examples: https://docs.opnsense.org/manual/how-
| tos/transparent_bridge.... https://docs.netgate.com/pfsense
| /en/latest/bridges/index.htm... https://www.fortinet.com/re
| sources/cyberglossary/transparent...
| groestl wrote:
| Thanks for the hints. Currently, I have a fully routed
| setup with two routers behind the IPSs box, multiple
| wireless networks and VPN uplinks (via wireguard) to my
| servers. It's just that all of this is ipv4, because I
| don't see any way of doing that using a single /64
| network.
| throwaway742 wrote:
| https://www.fortinet.com/resources/cyberglossary/transparen
| t...
| justeleblanc wrote:
| Does your ISP's router not have a firewall?
| groestl wrote:
| A very very inconvenient one.
| samcat116 wrote:
| Most consumer routers will disable inbound connections for the
| IPv6 prefix by default from what I've seen. If not thats easy
| to enable.
| Steltek wrote:
| > The biggest hurdle to implementing IPv6 on your own isn't
| usually ISP support, router support, or client support.
|
| I'm fully ready to start using IPv6 but my packets won't get past
| my antiquated ISP. That seems like a pretty big hurdle, no?
| superkuh wrote:
| >There seems to be a lack of drive (judging by forum posts) to
| enable IPv6 on internet services by admins, either because they
| don't care to, or it's more work to manage a public IPv4 and
| public IPv6 presence
|
| If you run a mailserver adding ipv6 support is far more risk to
| your domain's mailserver reputation than it is worth. And if
| you're just a human person and not a megacorp that new ipv6
| address, even if it it doesn't immediately hurt you, will take a
| very long time to get accept, longer than an ipv4.
| dheera wrote:
| Yeah I have zero motivation to deal with IPv6.
|
| I also have all my IPv4 addresses memorized, and IPv6 addresses
| are too long to remember with all the hex-double-colon
| nonsense.
|
| If they could have turned
|
| 1.2.3.4
|
| into
|
| 1.2.3.4.5.6
|
| I'd probably use it, but instead they opted for some scary
| stuff that looks like
|
| d0ff::eefa::0010::faff:::://::92::0
|
| which I'd rather not look at. Product management fail.
|
| Anyhow, IPv4 still works for me, so I have no pressing need to
| even try to understand these hex-colon monstrosities.
|
| My DNS server is 8.8.8.8.
|
| Why the hell isn't the IPv6 DNS server
|
| 8888:8888:::8888:8888?
|
| Instead it's 2001:4680::... wtf?
| SoftTalker wrote:
| Yep I'm in your camp. I have zero problems using IPv4 (and
| NAT when necessary), unless and until that stops working I'm
| staying with it.
| hot_gril wrote:
| I've been saying this too. Don't tell me that going from
| 8.8.8.8 to :whatever::the::heck:::: is an upgrade.
|
| First step of dual-stack networks should've been, every
| device's IPv6 address is the same as the IPv4 address, just
| padded technically, and represented textually the same. If I
| put in 8.8.8.8 and the systems want to speak IPv6 instead, go
| ahead. A little hacky but addresses (no pun intended) both
| technical and marketing problems. You could even use a v4
| DHCP server and DNS but speak IPv6, instead of trying to sell
| people on a whole stack change at once.
| zamadatix wrote:
| : separates groups of 4 while optionally :: abbreviates a
| bunch of 0's and leading 0's in groups are optional. The
| address can be longer, sure, but it's really near identical
| to dotted decimal beyond the lengths.
|
| I wouldn't mind a simpler DNS server IP though seeing as it's
| one of the few locations you need to treat as an address
| regularly. Sprint/T-Mobile has 2600::, which is not only
| short but seemingly a phreaking reference, active so why
| can't something similar be active for DNS. I get not wanting
| 8888 or whatnot, those blocks aren't assigned and advertising
| random bits for vanity can be annoying, but there are plenty
| of short IPv6 addresses that could be in use for the most
| common DNS servers on the planet. Even I have my personal DNS
| server running on an XXXX:XXXX:: public IPv6 address!
| hot_gril wrote:
| > separates groups of 4 while optionally :: abbreviates a
| bunch of 0's and leading 0's in groups are optional. The
| address can be longer, sure, but it's really near identical
| to dotted decimal beyond the lengths.
|
| Consecutive colons aren't readable or easy to remember.
| bushbaba wrote:
| The biggest miss of ipv6 was on usability. is a large
| contributor for the slow adoption.
| Symbiote wrote:
| If you would like to write IPv6 addresses in the same style
| as IPv4, they would look something like
| 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9
| dheera wrote:
| And that's the problem! Who can memorize all that?
|
| I mean look, a few days ago Comcast had an outage and I
| plugged my phone into my USB port to tether it for internet
| access. It hijacked my DNS entirely, and I couldn't turn on
| my damn lights or change my thermostat which were on my
| LAN. Thankfully I know their LAN IPv4 addresses from
| memory, 10.10.10.x and 10.10.10.y, and I was able to issue
| CURL commands directly to their local, non-cloud APIs to
| manipulate them. With IPv6 hell knows what their hex-colon
| monstrosities would be.
| hot_gril wrote:
| I agree with the complaint about IPv6, but in this
| situation couldn't you just use nmap?
| xnyanta wrote:
| > With IPv6 hell knows what their hex-colon monstrosities
| would be.
|
| You would know exactly, because every IPv6-enabled
| interface has a link-local predictable IPv6 address
| derived from its MAC address.
| dheera wrote:
| And so now I have to stick stickers on every light bulb
| with a huge address on it and then get up on a chair
| several times per bulb while I transfer chunks of its
| address from the sticker to my terminal?
|
| The reality is with IPv4 I can memorize all of the IPv4
| addresses of every light bulb, every robot, every
| thermostat, every plant watering device in my residence,
| and I can hammer out CURL commands to control everything
| almost from muscle memory in the event of a DNS
| hijacking.
| rahkiin wrote:
| Seems like a complicated solution to a problem that does
| not exist. You cannot turn on lights at all without a
| working network? If your router crashes your whole house
| is stuck? Seems like there is a bigger issue than the
| IPv6 protocol
| [deleted]
| voytec wrote:
| Lazy people like you (opinion based entirely on your comment)
| are why the world is not moving forward (fast enough). You
| should not be responsible for administering IT
| networks/servers/services if you're not willing to adapt to
| changes.
| dheera wrote:
| > are why the world is not moving forward
|
| I'm not an IT admin, but I disagree the world is not moving
| forward.
|
| If I need to use IPv6, I would switch. But the reality is
| people are able to still build rocket ships, electric cars,
| and large language models with IPv4. The world is moving
| forward just fine.
| hot_gril wrote:
| I hope you're on the new version of everything then, not
| just in your area of expertise. You're expecting people to
| want something that's worse for them if anything, and
| calling them lazy isn't going to help. What would've helped
| is making IPv6 more user-friendly.
| [deleted]
| voytec wrote:
| Not new version, but reliable version. I'm not a
| bleeding-edge fanatic, but I was testing IPv6 during the
| 6bone[1] phase while networking was not in my scope. It
| simply made sense to get to know the future.
|
| The person who's comment I was responding to, is in
| denial 20 years later because they feel comfortable with
| IP addresses they can remember.
|
| [1] https://en.wikipedia.org/wiki/6bone
| Arnavion wrote:
| https://news.ycombinator.com/item?id=26615231
| dan1234 wrote:
| I'd love to embrace ipv6, but my ISP's official line, for as long
| as I can remember, is 'planning it, details to come'.
|
| I don't expect them to move forward on it until significant sites
| become ipv6 only as they've admitted that they have more than
| enough ipv4 addresses for their subscriber base, so there's very
| little incentive for them to do anything atm.
| tinus_hn wrote:
| You can request free IPv6 connectivity through the Hurricane
| Electric tunnel broker at ipv6.he.net
| dan1234 wrote:
| Thanks, I've actually looked at that in the past, but I'm not
| sure what their throughput is, and I'd have to configure each
| device individually as the router I have can't be configured
| for it.
|
| I think I've still got my HE IPv6 t-shirt somewhere, from
| when I completed their readiness quiz so years ago!
|
| Edit: I actually decided to set up a tunnel, just to see how
| well it worked, and it turns out my ISP supplied router won't
| forward the protocol 41 packets anyway, so that's a total no-
| go.
|
| I suppose I could probably set up a small VPS and Wireguard
| vpn, then forward the IPv6 packets that way?
| toast0 wrote:
| https://route48.org/ provides 6 in 4 tunnels and wireguard
| is an option. Their webpage is a mess, but more info is
| available behind the login, IIRC. I got part way through
| and then decided to just use a Hurricane Electric tunnel
| because HE has presence at the nearest internet exchange
| and it was more familiar.
| KomoD wrote:
| My ISP went "we're planning it", "it's in progress", "we
| cancelled it", "there's not enough demand", and they're a
| pretty large ISP in my country.
| bittermandel wrote:
| Is there any risks of nodes assigning same IP if there's no
| central DHCP?
| screamingninja wrote:
| Unlike in IPv4, in IPv6 there is a lower risk of nodes
| assigning the same IPv6 address if there's no central DHCP.
| This is because IPv6 uses a unique interface identifier (IID)
| that is automatically generated by the node based on its MAC
| address and a random value. This makes it highly unlikely that
| two nodes on the same network would generate the same IID and
| therefore, the same IPv6 address.
| ilyt wrote:
| Not if you don't have same MAC in the network .
|
| SLAAC reserves bottom 64 bits for autoconfiguration, and while
| incredibly wasteful it does ensure every MAC can have its own
| IP address
| riobard wrote:
| Don't worry coz DAD (Duplicate Address Detection) will come to
| your rescue :p
| p1mrx wrote:
| You can generate sqrt(2^64) random suffixes before the
| probability of collision becomes significant. That number is in
| the billions for a single /64 network.
|
| In other words, no.
| teddyh wrote:
| Firstly, normally nodes base their automatic IPv6 address on
| their MAC address, so there will be no conflict between these,
| since MAC addresses are supposed to be unique to the hardware.
| Otherwise, it's a random 64-bit number (actually a few less
| bits, but not many). It's very unlikely a collision will
| happen. And even if it does, there is a protocol (Duplicate
| Address Detection) to detect it, and avoid it.
| screamingninja wrote:
| The IPv6 transition is challenging because it requires
| coordination and cooperation from many different stakeholders,
| including site admins, CDNs, network designers, and device
| manufacturers. However, as the author realized, IPv6 is ready for
| prime time and offers significant benefits over IPv4. Looking
| forward to the transition to IPv6 for unlock its full potential
| for a more secure, efficient, and connected internet.
| j1elo wrote:
| Microsoft's GitHub Actions (continuous integration) runner
| machines do not have IPv6, and cannot be used for things like
| unit tests that require an IPv6 network interface for whatever
| thing they are testing.
|
| Add that to the list of thousand cuts.
| trabant00 wrote:
| It's been ~10 years since IPv6 became "ready for prime-time" and
| I wouldn't touch it unless I absolutely have no other choice. In
| practice you are going to run into bugs and problems at every
| level, from client software to the OS networking, your router,
| your ISP, their ISP, their router, their server and so on and so
| forth. I absolutely support other people using it to iron out all
| the kinks, so that I can finally do it without headaches in 10
| more years.
| somerandomqaguy wrote:
| I've still got some misgivings about IPv6.
|
| Biggest one for me personally is that my current ISP doesn't give
| stable prefix. Power outages or firmware updates requiring a
| router reboot thus can cause the PD to be changed and potentially
| break firewall rules that are sensitive to the PD. In an absolute
| worst case, it also means that none of your hosts can reach the
| internet anymore if for whatever reason they're not updated of
| the prefix change.
|
| No, the ISP is not supposed to that. But I don't see them
| changing this behavior any time soon. Yes there are ways to
| mitigate (ULA, mDNS, DNS, DHCPv6, etc) but now you're introducing
| additional complexity that didn't exist before into the network
| when I keep hearing how Ipv6 is supposed to reduce complexity.
| And IPv6 is complex enough to make my head spin without
| considering those workarounds.
|
| Other issue I can think of off the top of my head is how to deal
| with an organization that would requires multi-WAN fail over or
| load balancing? The only solutions I've see thus far are far
| beyond my level of skill and budget. I assume also that there's
| similar problems when asking about a load balancer between
| multiple gateways to the internet.
| jhoelzel wrote:
| I have built a couple of dual stack Kubernetes clusters already
| and they work much better to be honest. Most of the problems are
| solved and especially for node-based-ranges it works really well.
| Even in ipv6 only mode calico will manage amazingly and so do my
| OpenWRT routers.
|
| HOWEVER,
|
| My ISP regularly messes up with its ipv6 routing (deutsche
| Telekom (so as big as it can get for me) and if that's not the
| problem, the mesh networks on my (current gen) fritz networking
| equipment (very widely used in de) eats itself and sometimes just
| routes my traffic to nirvana.
|
| This is especially bad with online gaming services like xbox
| live, who for the love of themselves don't have a fallback to
| ipv4 implemented, once ipv6 drops. "i have an ipv6 so I'm gonna
| use it no matter what".
|
| Therefore I have dual stack vpns hooked up to my office network
| which connect to the datacenters I am using. My private network
| is ipv4 and sadly will remain like that for a while.
| martinald wrote:
| Yeah I found the same on Hyperoptic in London. Works fine 99.9%
| of the time, but occasionally ipv6 drops until I restart the
| router/restart the WAN connection. Which of course I barely
| ever notice because most stuff switches back to ipv4.
|
| I think unless we start seeing ipv6-only stuff this will be the
| case, there's really no incentive for a lot of
| testing/debugging on at least consumer ipv6 connections until
| stuff actually breaks.
|
| Would be cool if Google added a 'ipv4' warning to Chrome
| similar to how they do with HTTPS (maybe not as strong though).
| That would drive a lot of adoption.
| miyuru wrote:
| > Would be cool if Google added a 'ipv4' warning to Chrome
| similar to how they do with HTTPS (maybe not as strong
| though). That would drive a lot of adoption.
|
| You can kinda already do this by setting search to
| ipv6.google.com
|
| Images search does not work on that domain, looks like the
| new Google devs don't know about it.
| cooljacob204 wrote:
| > My ISP regularly messes up with its ipv6 routing
|
| Can you expand on this? I recently upgraded my network to
| support ipv6 but a big concern I have is what if they (Verizon
| Fios) change my assigned block? How can I make sure my PI hole
| and server has the same static IP address?
| xnyanta wrote:
| I got so fed up with IPv6 being either straight up unavailable
| or being deployed in a botched fashion by residential ISPs in
| my area in the last 10+ years that I picked up an ASN and a /44
| last year. I advertise it from a VM on Vultr in a datacenter
| close to home and the experience is just amazing.
|
| I also got fed up with people discriminating against Hurricane
| Electric's tunnel broker (streaming services, etc) so now I
| just have my own tunnel broker. It's really great to have my
| own addresses, use them in my kubernetes clusters (via calico
| and cilium) and have my homelab directly advertised to the
| internet, knowing I will never need to re-number.
|
| Networking is a helluva drug
| orcajerk wrote:
| There's a reason most haven't moved to ipv6. ipv6 is a solution
| looking for a problem. What we really need is an ipv7 that takes
| the best of ipv4 and ipv6 instead of trying to force ipv6 down a
| reluctant user group.
| growse wrote:
| It's not that the reluctant user group doesn't like IPv6, they
| don't like _change_.
| cornholio wrote:
| You can't have the best features of the two - in the sense of
| interoperability - because they are different on a fundamental
| level: it's impossible for IPv4 nodes to talk to IPv6 nodes
| without understanding the much larger address space.
|
| There were proposals back in the day (early 90s) for IPng (IP
| Next Gen, as IPv6 was called back then) to be a hierarchical
| routing algorithm, that could have kept backwards compatibility
| with IPv4 and transparently allow seamless operation and
| routing of IPng islands over IPv4 infrastructure, taking full
| advantage of the address space expansion.
|
| Think of a sort of CGNAT that instead of stateful hacking with
| port numbers and the like, would have dedicated fields in the
| IPv4.x packet, allowing the gateway to statelesly route between
| the two domains (public IPv4 internet and internal 10.x.x.x
| network), while maintaining end-to-end connectivity.
|
| Alas, the ITEF guys really wanted a clean slate design and
| willfully ignored the economic problem, that IPv6 is only
| useful when everybody upgrades, and as a consequence nobody
| upgrades. It's probably one of the most costly failures in the
| history of computing, along with the NULL pointer, 640kB and
| the likes.
| bityard wrote:
| Question from a (relative) IPv6 newbie that wasn't addressed in
| TFA:
|
| Let's say I have a very small home lab. I have a handful of hosts
| that get their IP addresses via DHCP from my router. In the
| router, DHCP and DNS are tightly coupled such that the router
| essentially always knows the MAC address, IP address and hostname
| of each device.
|
| Now I want to run IPv6 on this network as a first-class citizen.
| Since DHCPv6 is apparently frowned upon by v6 purists, and not
| all devices on my network support it, that leaves SLAAC. My
| understanding of SLAAC is that each node essentially picks its
| own globally unique IP instead of asking a router for the IP. My
| question then is: is there some standard for the DNS server on
| the router to somehow know the v6 IPs of the hosts on the network
| so that it can automatically create the right A records?
| unethical_ban wrote:
| Can't answer your main question, but from what I recall, DHCPv6
| is kind of necessary anyway. It's the easiest/main way for the
| client to receive DNS server information, even if default
| gateway discovery is now down through multicast.
|
| I believe there is another way, but the router has to support
| it and I forget what it's called.
| jesterpm wrote:
| RA (Router Advertisement) handles announcing the prefix for
| SLAAC addresses and DNS.
| magicalhippo wrote:
| But not other services like NTP, so DHCPv6 is still needed.
| Arnavion wrote:
| For NTP, an alternative is letting the LAN devices
| connect to whatever NTP server they want to, and just
| NAT'ing outgoing udp/123 to your NTP server.
| magicalhippo wrote:
| Well yes, but that's a suboptimal hack.
| vetinari wrote:
| yes, but RDNSS is a relatively new option (only since 2007
| ;) ), so some implementations ignore it.
| dmm wrote:
| It's important to distinguish between stateful and stateless
| DHCPv6. stateless DHCPv6 is fine. It's just a way for nodes to
| get dns/ntp/etc. Nodes still select their addresses with SLAAC.
|
| Stateful DHCPv6 is the bad one. It assigns hosts specific
| addresses.
|
| > the router essentially always knows the MAC address, IP
| address and hostname of each device.
|
| You can still have this with ipv6 addresses. They easiest way
| is to use eui64, the original ipv6 addressing scheme where the
| address is calculated from the subnet + the MAC address of the
| interface. That way server VMs get deterministic addresses. If
| you use network-manager you can configure eui64 with the "add-
| gen-mode=eui64" setting.
|
| In my homelab, I have a few server VMs that use eui64
| addressing whereas the end user devices use privacy addresses
| randomly selected from the subnet.
| Latty wrote:
| It isn't really true that DHCP and DNS are coupled, it's just a
| common feature for power user routers as it's convient.
|
| There are options for IPv6: PFSense, as an example, has
| "Assisted" RA mode where devices can use SLAAC or DHCPv6, so
| you have SLAAC for general clients that don't need more (e.g:
| phones that don't support DHCPv6), but clients that want more
| can use DHCP to provide specific reserved addresses and DNS
| names, etc...
| Arnavion wrote:
| >Since DHCPv6 is apparently frowned upon by v6 purists, and not
| all devices on my network support it, that leaves SLAAC.
|
| It's not a dichotomy between DHCPv6 and SLAAC. You can hard-
| coded addresses too. Since it's your homelab you presumably
| already know all the devices that will be connected. It's what
| I do.
|
| You may not even need to hard-code the prefix everywhere. Eg
| with systemd-networkd you can configure the device as:
| [Network] IPv6AcceptRA=yes [IPv6AcceptRA]
| Token=static:::1:2:3:4
|
| ... which will give that interface the address $prefix::1:2:3:4
| based on whatever $prefix was advertised by radvd. So the only
| place where you'd need to hard-code $prefix is in your DNS
| server.
|
| >My question then is: is there some standard for the DNS server
| on the router to somehow know the v6 IPs of the hosts on the
| network
|
| NDP discovery (`ip -6 neigh show`) will let you know about
| other IPs (and corresponding MAC addresses) on the link. It
| won't do anything for matching them up to DNS names.
| samcat116 wrote:
| In what way is DNS and DHCP tightly coupled? Automatically
| creating A records for DHCP hosts is not normal in my
| experience, especially for consumer routers. If some device
| your using supports this it could work for IPv6 as well as
| devices will broadcast on the network for routers when using
| SLAAC I believe.
| vetinari wrote:
| Many home devices use dnsmasq as their DHCP server and DNS
| resolver, and it can optionally use hostnames from the DHCP
| part of its business during resolving DNS too.
|
| The point GP had that it won't work, then DHCPv6 is not used.
| justeleblanc wrote:
| It's not usual for your router to create A or AAAA records for
| the hosts connected to it. Look into Multicast DNS.
| jacob019 wrote:
| Maybe not, but it's super convenient and well supported by
| isc-dhcp-server/bind9. I do it on all my networks.
| throw0101c wrote:
| > _Since DHCPv6 is apparently frowned upon by v6 purists, and
| not all devices on my network support it, that leaves SLAAC._
|
| The main hold out against DHCPv6 is Android:
|
| * https://issuetracker.google.com/issues/36949085
| mixdup wrote:
| that thread is amazing. Google's stance makes me want to
| deploy DHCPv6 simply to spite them. I guarantee in 10 years
| when some Fortune 500 company or top 20 research university
| IT department, who has no idea about that thread, goes live
| with a DHCPv6-only IPv6 stack because it's very similar to
| their IPv4 network, and 30,000 users can't join their Android
| devices to the campus wifi, this attitude _will_ change
| vetinari wrote:
| There is not really an equivalent for what dnsmasq does.
|
| I ended up with bind and rfc2136 dynamic updates. Not all
| devices are capable of doing it, but it is what Active
| Directory does by default.
| jacob019 wrote:
| I have a similar setup. I wouldn't say that DHCPv6 is frowned
| upon, it works quite well and is the only way to automatically
| add client hostnames to the local name server. I use both SLAAC
| and DHCPv6 mainly because Android refuses to support DHCPv6,
| but I don't need to refer to my phones by hostname anyway.
| joshspankit wrote:
| I'm in a similar spot as the OP, and one thing that is
| important to me about knowing the hostnames is that defining
| (then tracking) a hostname is the only universally-
| implemented method that lets me scan through the hosts on the
| network and understand what they all are.
|
| - I'm never going to remember MACs
|
| - Even when IPs are carefully thought out, if something
| happens to the DHCP server and it needs to be rebuilt, IP no
| longer tells you anything about what device it is
|
| Whereas hostname/DHCP client name shows up in almost every
| router UI, is viewable from any *nix machine on the network
| (when DHCP and DNS work together), and is typically a first-
| class citizen in the DHCP lease settings themselves. Super
| handy. As a side bonus: rogue hostnames are immediately
| obvious, but rogue MACs or IPs require investigation before
| you know whether they are benign.
| ectospheno wrote:
| If I want to connect to something by name then I setup a
| wireguard connection with a fixed ip. The few things that don't
| allow for that all use mdns anyway.
| kenada wrote:
| The way I handle this on my home network is to advertise a ULA
| prefix in addition to the one delegated by my ISP. The ULA
| addresses are not routed. They're just used for my network. My
| home DNS server advertises AAAA records using the stable, ULA
| addresses for those servers I want to advertise. For other
| machines (like computers, laptops, etc), I rely on mDNS.
| saul_goodman wrote:
| "Apple has excellent IPv6 support on their devices, fully
| supporting automatic configuration of 464XLAT on devices with
| NAT64, and overall an excellent attitude to forcing IPv6 support
| from developers"
|
| Other operating systems are bit of hit or miss"
|
| My iPhone works, what's wrong with the rest of you for not doing
| this??!!
|
| But in all seriousness, I think this will be a security nightmare
| for quite a while if there is some forced conversion to ipv6. I
| realize IPv6 wasn't created yesterday, but I assume it's got
| plenty of security holes waiting to be discovered until I see
| otherwise. The only way you are going to see it be used by end-
| users is if the various *nix distros roll out IPv4-less images.
| Same for Windows/etc. Otherwise you are begging for a security
| nightmare of epic proportions with software that is accidentally
| using the wrong stack by default, firewalls not filtering
| anything as expected, etc.
|
| And who thinks it's a good idea to make all the things globally
| accessible? It's an internet of shit out there already, this
| would make it even worse.
| skywhopper wrote:
| From my POV, IPv6 overshot and tried to solve too many non-
| problems while addressing the only real issue with IPv4, the
| address space. That fact alone explains the relentless failure to
| adopt IPv6, because it's not just a matter of adopting IPv6.
| Nearly every assumption about networking changes, all the tooling
| is different, and the risks and concerns are all changed. There
| was an easier path to follow, but we missed that chance 20 years
| ago, and now we're likely stuck with a dual stack mess for the
| rest of our careers.
| 1970-01-01 wrote:
| My #1 gripe with IPv6 is that it is too big. You never ever will
| use all the octets.
| justeleblanc wrote:
| That's pretty much the whole point.
| xnyanta wrote:
| You will use the octets when you find out how useful they are
| to build a structured addressing plan.
| TekMol wrote:
| I still think IPv6 can be safely ignored.
|
| This articles section "here are some reasons you should start
| using IPv6 within your own network" seems to comfirm this. None
| of the 6 "reasons" speak to me.
| mgbmtl wrote:
| Here's an easy one for you: if you have a gigabit connection,
| most home routers can barely handle the load of NAT. That's why
| gamers push for IPv6. It's mentioned in the article but few
| people realize how inefficient NAT can be at gigabit and more.
|
| My ISP router could do max 800 mbps, which isn't so bad, but it
| degraded when we were multiple people using the link. With IPv6
| it's much less of a problem, we can easily saturate the 1gbps
| without the router having a meltdown.
| AnIdiotOnTheNet wrote:
| > if you have a gigabit connection
|
| Rare in the US. Hell, we don't even have a 1Gb connection at
| work.
| TekMol wrote:
| I don't even know what type of connection I have. I only know
| the speed is way more than I need.
|
| fast.com says 50 "Mbps". Whatever that is.
| jaywalk wrote:
| You aren't qualified to speak on this topic. Sorry.
| favaq wrote:
| >Here's an easy one for you: if you have a gigabit
| connection, most home routers can barely handle the load of
| NAT.
|
| [citation needed]
|
| >That's why gamers push for IPv6.
|
| [citation needed]
| jonathantf2 wrote:
| I have a symmetrical gig connection, ISP doesn't provide
| IPv6. Can route full line speed using their router, no matter
| if it's 1 device or 50 connected.
|
| I don't know of a single game that supports IPv6, although
| some consoles might?
| lxgr wrote:
| > if you have a gigabit connection, most home routers can
| barely handle the load of NAT.
|
| I remember reading about this as well. Wouldn't that also
| apply to stateful firewalling, though? Or is NAT inherently
| more computationally difficult (e.g. due to having to
| recompute IP and/or TCP/UDP checksums) than checking a state
| table?
| layer8 wrote:
| > if you have a gigabit connection
|
| Yeah, not anywhere close. In ten years I'll have one maybe.
| wankle wrote:
| > if you have a gigabit connection, most home routers can
| barely handle the load of NAT
|
| We are on AT&T Fiber, the router has no issues. I've never
| seen a router have issues with any speed for that matter,
| where NAT is concerned.
|
| > That's why gamers push for IPv6.
|
| I'm a gamer, I know a lot of gamers, no one is pushing for
| IPv6 that I'm aware of.
| [deleted]
| thesuitonym wrote:
| Everyone always goes with the "You don't need NAT, everything is
| globally routable!" argument, as if that's something that anybody
| wants. Everything on my network is going to go through my
| firewall anyway. I don't _want_ anything on my network to be
| globally routable.
|
| Of course, this is not a good reason to not use IPv6, don't get
| me wrong. It's a problem that's easy to overcome, I just think
| it's not a good way to get people excited about the transition.
| jcalvinowens wrote:
| There is no downside to everything to be globally routable.
| It's completely orthogonal to firewalling.
|
| What is the risk you're picturing here? I'm really curious.
| Features like RFC4941/8981 mean nobody can infer anything about
| your network from the source addresses they see making requests
| out if it.
|
| If you want to use link-local V6 addresses and NAT to a global
| one, you can do that. But IMHO that's sacrificing one of the
| greatest advantages of IPv6 for no tangible benefit.
| adriancr wrote:
| > nobody can infer anything about your network
|
| They can infer that one IPV6 address matches to exactly one
| device. (reverse is not true, one device may have multiple
| addresses per privacy extensions)
|
| Once device is identified all its past traffic is
| discernible.
|
| Changing addresses means identification needs to be done
| again but once done it can be associated with past addresses
| and again, all its history is visible.
|
| Identification might just mean querying a data broker with
| HTTP headers.
|
| NAT does not have this issue.
| jcalvinowens wrote:
| > They can infer that an address matches to a single device
|
| No they can't: the whole point of RFC4941/8981 is to
| prevent that. The source address for external connections
| is effectively randomized.
|
| All that can be inferred is that it came from your network,
| but even with NAT you know that anyway.
| adriancr wrote:
| > The source address for external connections is
| effectively randomized
|
| It's still unique to one device right?, even if random my
| argument still holds.
|
| Or do you mean to say multiple devices can use the same
| address?
|
| note: I've read the RFCs and they just mean - initial
| address is random but unique to a device. Each day the
| address will likely change but new address is still
| unique to the device (otherwise how would routing work).
|
| This is what I structured my inital argument on. Do you
| see any fallacy in logic?
| throw0101c wrote:
| > _Each day the address will likely change but new
| address is still unique to the device (otherwise how
| would routing work)._
|
| If you set up your device to spin up a new IPv6 address
| every hour (or even every minute), how will they track
| you using IPs?
|
| On macOS it's 24h, but it doesn't have to be:
| $ sysctl -a | grep temppltime
| net.inet6.ip6.temppltime: 86400
| adriancr wrote:
| I mean, it's the same point, single address to single
| node, just more often, so need to identify more often.
|
| Minutes or less I guess would defeat tracking, but then
| what's the point?, it's almost equivalent to NAT it still
| breaks reverse connectivity? and does it actually work?
|
| It also feels like a workaround for an oversight.
| throw0101c wrote:
| > _I mean, it 's the same point, single address to single
| node, just more often, so need to identify more often._
|
| But how would they know it is to the same node?
|
| I have my DSL router-modem reboot every night, and I get
| all sorts of crazy results for ads: I'm in southern
| Ontario, as is my ISP, but they service folks in Quebec,
| and so sometimes I get Youtube ads in French since (per
| my IP) I'm "in" Quebec.
|
| Similarly with the reboot I get a new /64 prefix
| delegation (actually /56), so I would hazard to guess if
| IPv6 starts getting tracked, I'd get the same crazy
| results.
| justeleblanc wrote:
| You literally wrote "Once device is identified all its
| past traffic is discernible." How is that compatible with
| devices changing their address every day?
| adriancr wrote:
| you identify device each day, identity is X, daughter of
| Y on iPad. Once identified via data broker all its
| traffic is identifiable including torrents for example
| and porn websites, etc (say X goes to facebook with new
| address it now has real name)
|
| Once identity is known for address X you know its traffic
| for the day, including past traffic for the day.
|
| once address changes you do the whole identification
| again.
|
| All these logs where address is identified goes to bucket
| X.
|
| On addresses where you couldnt identify that day you put
| them in unknown bucket.
|
| Once you have a profile of the network, you can do
| exclusion (Only 4 people in household, 3 active with
| known addresses, not X, one unknown address, you can
| assume its X)
| jiggawatts wrote:
| Nobody bothers to do this kind of tracking because web
| browsers leak 100x more information by default anyway.
|
| The "I don't care if they track my _household_ but it's
| critical that Daddy's activity not get disambiguated from
| my dealing daughter" is just not a valid reason to
| abandon the benefits of IPv6.
|
| Please stop with this line of argument.
|
| If you're really desperate to ensure that the ads shown
| to your daughter are based on your porn viewing habits,
| then just set up IPv6 NAT.
| adriancr wrote:
| > Nobody bothers to do this kind of tracking because web
| browsers leak 100x more information by default anyway.
|
| That's a broad assumption, and I can assure you they will
| due to lower costs (no need to pay data broker if you
| already know target, no need for extra traffic, load,
| etc). Also due to better targetting you get better prices
| per ads served.
|
| > just not a valid reason to abandon the benefits of IPv6
|
| What are the benefits to allow each device its own
| address if I'm going to firewall them anyway?
|
| > Please stop with this line of argument.
|
| Why?, my concern is valid, all you've said so far is
| nobody cares. I disagree.
|
| > If you're really desperate to ensure that the ads shown
| to your daughter are based on your porn viewing habits,
| then just set up IPv6 NAT
|
| That says a lot about yourself if you resort to this sort
| of snarky comments, I have no wish to continue this
| conversation.
|
| Note: I said in another comment I have set up IPv6 NAT
| and it works great.
| wankle wrote:
| Thank you adriancr, barkingcat and flangola7 for making
| the salient points about IPv6. When I've tried to make
| the same points over the years, it didn't work out well.
| I see there's a new topic today, someone "outraged" that
| Roku devices don't use IPv6. It's always like that,
| people who seem to want to heavily push IPv6 are so
| outraged. All that does is confirm my view of IPv6 is
| right.
| flangola7 wrote:
| > Nobody bothers to do this kind of tracking because web
| browsers leak 100x more information by default anyway.
|
| If I told my security information officer "We don't
| protect against foreseeable threat X because we assume no
| one will bother to try X" she would not be very happy
| with me.
|
| When a valid data concern has been expressed and
| described, putting your head in the sand is the incorrect
| response. I want IPv4 to die as much as the next person
| but at a minimum organizations such as hospitals and
| government installations will not accept that sort of
| outside visibility into their network.
| barkingcat wrote:
| wait ... when you say nobody bothers ... that's a high
| bar. Most likely a ton of adtech companies are just
| drooling to use (or already are using) this type of
| correlation even if browsers leak more info.
| thesuitonym wrote:
| I'm not saying there's any downside, I'm just saying it's not
| the magic bullet "this is why you should use ipv6" that
| everyone seems to think it is. It's a complete non-issue that
| nobody really cares about.
| jcalvinowens wrote:
| > It's a complete non-issue that nobody really cares about.
|
| Huh. IMHO it's the single most desirable feature, and the
| only reason I care about it at all.
|
| If you're approaching this from the home networking point
| of view, than I suppose I agree: even the most complex home
| network is just too simple for anything like this to matter
| much.
|
| As the network gets bigger, that sweet sweet global
| routability starts to make a lot of things a lot simpler...
| I'm lucky to have worked on an enormous deployment of
| V6-only servers, and it's downright magical in comparison
| to anything of comparable scale I've seen before or since.
|
| But yes, my home network is three NAT'd /24's because I'm
| too lazy to figure out how to make prefix delegation
| work...
| kazen44 wrote:
| Also, IPV6 has far more scalable systems for dynamic
| address allocation compared to IPv4.
|
| SLAAC scales really, really well, and is fairly stateless
| compared to DHCPv4 or V6.
|
| Also, slaac allows one to easily change the global prefix
| of a vm/host if it lives on another layer 3 network.
|
| A good example of this:
|
| you have two seperate datacenter networks based on an
| EVPN-VXLAN solution, and you do no want to stretch layer
| 2 across both datacenters because stretching layer 2 is a
| terrible, terrible idea[0].
|
| Before IPv6, moving VM;s across datacenters which have
| different public ip space was a major pain for two
| reasons:
|
| - IPV4 has no concept of using multiple addresses per
| interface without it having unexpected bahaviour on a
| host. - address management at scale is a major PITA
| because DHCP is not scalable.
|
| How to solve this with IPv6? It's fairly easy:
|
| - Use slaac + prefix delegation of your globally unique
| address space (which is different per Datacenter). - Use
| a different (site local) address to reach the VM for
| management purposes. Because this address is not globally
| routable, you are sure it will never leak into the
| greater internet and be reachable from the outside world.
| - If you are using anycast, you can easily announce this
| prefix to upstream BGP neighbours because you can use BGP
| Neighbour Autodiscovery[1].
|
| Trying to do this with Ipv4 will result in a mess of
| administration, not to mention have to do some clever
| technical hacks to make it work on some operating
| systems.
|
| With IPv6 solving these issues becomes quite manageable.
|
| [0] https://blog.ipspace.net/2021/06/stretched-vlan-
| define-probl... [1] https://www.juniper.net/documentation
| /us/en/software/junos/b...
| growse wrote:
| The point is that it gives you options. You might not want
| to have anything on a network reachable from the internet
| today, but next year you suddenly need that capability and
| it's useful to be able to take advantage of that, rather
| than wading through the buggy mess of NAT.
|
| > It's a complete non-issue that nobody really cares about.
|
| A significant number of people spend a significant amount
| of time trying to carve out and re-use address space in
| their existing IPv4 allocations and RFC1918 space. This
| becomes nightmarish the moment you start thinking about
| networks of any significant size and complexity. All of
| these problems go away with IPv6, and we care about that a
| lot.
| throw0101c wrote:
| > _It 's a complete non-issue that nobody really cares
| about._
|
| The availability of IPv4 addresses is something that more
| people will care about, and getting IPv6 going may help
| folks. From another comment in this sub-thread:
|
| > _I 've actually run into this [CG NAT] helping a friend
| host a game server on their residential internet in a more
| rural part of Texas. They had to call their ISP and request
| a static IP address at an extra cost of something like
| $5/mo._
|
| * https://news.ycombinator.com/item?id=35046929
| audunw wrote:
| > as if that's something that anybody wants.
|
| Of course I do. Why would you not want the option of easily
| allowing a device to be globally routable if you need it to be?
|
| I think routers should be more explicit about how you set up
| each new device on a private network anyway. Guest wifi can
| have a sane default. Private wifi could make a notification pop
| up on your trusted device, asking you if you want the now
| device to have access to the internet, and if the internet
| should have access to the device, and if so, which
| subnets/countries should be able to access it through which
| ports.
| aflag wrote:
| Most people don't need it, so that's why they don't want it.
| OP didn't say people object to it, just that it's not
| something most people cares about.
| ArchOversight wrote:
| That's what a firewall is for, NAT does nothing here.
| thesuitonym wrote:
| I know, did you read my whole post?
| dale_glass wrote:
| It just makes little sense.
|
| With IPv6 instead of NAT deciding that port 2000 maps to
| 192.168.1.3 port 22, you have a firewall that may or not
| choose to route to xx:yy:zz or not, and to allow an
| incoming connection over port 22 to that host or not.
|
| If you don't want to accept incoming connections to a given
| machine or network on IPv6 without NAT that's very easy to
| have.
| AnonymousPlanet wrote:
| Maybe people don't want to disclose the number and
| purposes of interior machines?
| silon42 wrote:
| Yeah, I had an idea to have an IP for each container
| (which means almost every "containerized" application
| soon, possibly even every browser window).
| dale_glass wrote:
| That's what the privacy extensions are for. You can have
| a regularly changing, randomly generated IP address on
| each machine.
| justeleblanc wrote:
| Your machines could change their IPs for every second of
| every day and you wouldn't come close to exhausting your
| /64 subnet for the next billion years.
| TheLoafOfBread wrote:
| Why do network stuff easy, when you can do it hard.
| [deleted]
| petertodd wrote:
| IPv6 has so many addresses that the default is for /64
| subnets to be the minimum network size, allowing devices
| to choose their addresses randomly within that range. If
| they do that, 2^64 is big enough that it's not practical
| to enumerate all devices on a given network. Attempting
| to do so would be a bandwidth DoS attack: attempting to
| ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB,
| roughly equal to total global internet traffic per year.
|
| Now, sometimes NAT is needed anyway: QubesOS supports
| IPv6 using NAT because it splits things up into many
| different VMs on one computer. But that's a pretty rare
| case.
| drbawb wrote:
| EUI64 means that random space is effectively reduced to
| just 48-bits of real entropy, <40 bits if you start
| making assumptions about device vendors. For example
| maybe the attacker has a VMWare exploit: enumerating that
| OUI (00:50:56) leaves them with just 24-bits of address
| space to scan, a measly 1GiB of traffic.
|
| It's security through obscurity at best, i.e: not
| security. You shouldn't be relying on size of address
| space to protect you from anything. An IDS/IPS that
| alerts on abnormal ICMP behavior will be useful whether
| an attack is 1GiB of traffic in size or 1024EiB of
| traffic in size. (Also you don't even need automated
| scanning to find some juicy targets: I've seen a lot of
| routers on the edge of a prefix configured at ::1/64 and
| ::2/64 for instance.)
| temp2022account wrote:
| To be fair that info is already available w/ port
| sequence analysis, the same machine will pick from the
| same set of ephemeral ports for outgoing connections. I'd
| say the time for vanity privacy arguments is over, I'm
| all-in for team globally routable addresses w/ firewalls
| just saying "yes" or "no" to connections instead of
| routers guessing at port mappings.
| waych wrote:
| Port sequence analysis is stifled by SNAT though.
| adriancr wrote:
| > the same machine will pick from the same set of
| ephemeral ports for outgoing connections.
|
| Ports on router are allocated by it and not client
| machines. So far my experience has been they're usually
| sequential without any preferrence.
| IshKebab wrote:
| In theory, sure. In practice firewalls can be misconfigured.
| NAT doesn't have that problem.
| op00to wrote:
| Consumer NAT firewalls have uPnP enabled, right?
| Arnavion wrote:
| The amount of firewall config I have to write to let an
| incoming connection cross from WAN to LAN is the same
| regardless of whether it goes to a NAT'd IPv4 address or to
| an IPv6 address.
| [deleted]
| justeleblanc wrote:
| NAT cannot be misconfigured? Really?
| joshspankit wrote:
| Not without being entirely broken. I think you might be
| bringing in uPnP, DNZ, and other such features. NAT
| itself is more basic.
| buzer wrote:
| One could argue that if e.g. FTP is not working behind
| the NAT then the NAT is misconfigured. NAT needs to aware
| of certain protocols so that it can modify the
| application layer data.
|
| Of course, if the protocol added workaround for NAT and
| NAT is modifying that application layer data then it can
| cause another set of issues.
| lxgr wrote:
| Unconfigured/not activated firewalls usually fail
| reachable; without explicit port forwarding or exposed
| hosts, NATs fail unreachable.
| wolrah wrote:
| > Unconfigured/not activated firewalls usually fail
| reachable
|
| Local firewalls on devices, maybe, but network firewalls
| generally are default-deny on untrusted interfaces, and
| between 0 and 1 interfaces are trusted by default.
|
| Back in 2007 Apple's Airport Extreme Base Station shipped
| with a firmware that defaulted to allowing all IPv6
| traffic, which was quickly pointed out in the tech media
| and fixed in a patch a few months later. A few of the
| garbage pile combo modem/router devices distributed by
| ISPs have had similar issues over the years as well.
| That's not normal behavior though, when it's observed
| it's rightfully considered a security flaw and tends to
| get the kind of attention vendors don't want.
|
| If you know of a mainstream device that would "fail
| reachable" as you claim here, name and shame please.
|
| > without explicit port forwarding or exposed hosts, NATs
| fail unreachable.
|
| I work in VoIP and can say from plenty of direct
| experience this is not true. In the modern work from home
| era I've had to deal with a lot of the aforementioned
| garbage pile consumer devices and a recurring issue with
| some of our clients who had older phones is that their
| users' home routers did the laziest NAT possible and
| literally just opened a two way hole on port 5060 (SIP)
| so as long as the phone was communicating with our server
| and keeping the pinhole open * _ANY*_ other traffic that
| hit port 5060 was also sent to the phone, which meant
| they got all kinds of "phantom calls" from bots looking
| for unprotected SIP relays.
|
| Newer phones generally have an option to only accept SIP
| messages from trusted servers, but older ones sometimes
| don't so when combined with badly implemented NAT that
| happens.
|
| And yea, obviously that's a consequence of a particularly
| bad NAT implementation, but your complaint is about an
| issue that would only occur in a particularly bad IPv6
| implementation.
| [deleted]
| lxgr wrote:
| > Everything on my network is going to go through my firewall
| anyway.
|
| Yes, and that's a very reasonable configuration.
|
| But UDP hole punching (very widely used for VoIP, online gaming
| etc.) works orders of magnitude better with IPv6 than with
| IPv4, since there is no address and port translation to worry
| about.
|
| With IPv4, it's very hit or miss, since it depends on both
| sides' NATs and also requires additional infrastructure (i.e.
| STUN discovery servers).
| throw0101c wrote:
| > _With IPv4, it 's very hit or miss_ [...]
|
| It's also probably impossible if you're with an ISP that does
| CG NAT.
| alyandon wrote:
| I've actually run into this helping a friend host a game
| server on their residential internet in a more rural part
| of Texas. They had to call their ISP and request a static
| IP address at an extra cost of something like $5/mo.
| philjohn wrote:
| At that point, would a cheap VPS not work instead?
| birdman3131 wrote:
| No. Game servers usually want high clock speed.
| op00to wrote:
| You'd just use the VPS as a proxy with a publicly
| accessible IP, and tunnel the connection back to your
| home. That would add latency that might be undesirable
| for a game, but maybe not.
| throitallaway wrote:
| Unless you're playing something like a turn based game,
| adding latency/hops is almost never desirable. Every
| multi-player game that I play is latency sensitive (and I
| don't play FPS games.)
| alyandon wrote:
| The server in this case was the PC version of ARK which
| nom nom noms all the CPU/RAM.
| throw0101c wrote:
| > _Everything on my network is going to go through my firewall
| anyway. I don 't want anything on my network to be globally
| routable._
|
| Globally routable [?] globally connectible.
|
| Your (stateful) firewall will still by default block any
| incoming connection attempts if they are not replies to an
| initial outgoing connection. It's just that it will no longer
| be necessary to go through the rigamarole of STUN, TURN, ICE,
| etc, that goes along with non-global addresses:
|
| *
| https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_...
|
| Your end-user device knows its address and the address of the
| other connection point, and can tell the firewall to open a
| rule between only those two IPs:
|
| * https://en.wikipedia.org/wiki/Port_Control_Protocol
|
| * http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf
|
| Further, because you don't have only one external IP, you don't
| have to futz around with non-default ports if you want multiple
| instances of the same service (e.g., Minecraft), because each
| instance can have its own IP.
|
| Further, if you want certain devices to not able to get
| outside: (a) give them static assignments and block them at the
| firewall, (b) don't give them a default route so they are
| subnet-local, or (c) give them site-local addresses via ULA and
| do not set up NTPv6 translation.
| gxt wrote:
| How does that protect privacy of the private network? I don't
| want to divulge any information about internal topology.
| adgjlsfhk1 wrote:
| what do you mean by topology? the only information leaked
| would be the number of computers making requests.
| Faark wrote:
| And what computer is making what requests. Now that i
| think about it, this cloud be the reason why youtube
| started making recommendations based on stuff i just
| watched in private browser tabs...
| CaliforniaKarl wrote:
| That's a very strong claim to make. I'd appreciate if you
| could provide a source to that statement!
| throitallaway wrote:
| Look at what Android does with MAC address randomization
| on wireless networks. We will probably see something
| similar with IPv6.
| lloeki wrote:
| that's not even true with slaac temporary (a.k.a privacy)
| or secured addresses.
|
| the only thing you'd "leak" is the prefix, which is no
| different than a IPv4 WAN address that you'd get with a
| v4 NAT.
| gxt wrote:
| * * *
| tenebrisalietum wrote:
| > I don't want anything on my network to be globally routable.
|
| Then... don't route anything on your network.
|
| NAT is address translation, not routing.
|
| NAT makes it difficult for you to host services on your
| network, forcing dependency on cloud services, and when ISPs do
| it (CGNAT), it makes it just about impossible unless you want
| to thread your traffic back through a third-party service. If
| you want a good chance of keeping some semblance of an Internet
| around that isn't dominated by huge centralized services, the
| cargo cult of "NAT is security" needs to die hard.
| tinus_hn wrote:
| With NAT it is impossible to make a mistake that causes
| machines with a private address to become reachable to the
| internet. That is a reality that is not going anywhere, no
| matter if you like it or not, no matter if you think it is
| stupid or not.
| unethical_ban wrote:
| Every home router could be built with a default deny
| inbound for traffic, with big flashing lights saying "do
| not override this".
|
| IPv6 has private addressing and a form of NAT as well, were
| it to be the will of router mfg'ers and network admins. No
| need to stay on a legacy protocol.
| kazen44 wrote:
| With Ipv6 this is even easier.
|
| You simply do not host services you do want public on your
| global unicast address but use a private/site local address
| instead.
| tenebrisalietum wrote:
| UPnP?
|
| Also STUN makes your private addresses reachable without
| you making any mistake at all.
|
| Your comment is a good example of the NAT cargo cult
| mentality that is damaging to the Internet.
| michaelt wrote:
| Presumably what thesuitonym means is:
|
| Imagine if I'm a medium-sized ISP, or a medium-sized software
| company, or a medium-sized website.
|
| There's a bunch of hassle involved in deploying IPv6. Who
| knows what it'll do to my users' privacy? Or whether
| everyone's firewall rules will keep working right? Or whether
| it'll have some random impact on e-mail deliverability? Or
| something else?
|
| The main benefit of IPv6 is providing routable addresses for
| home users, thus avoiding CGNAT.
|
| But zealous firewalling and the rise of mobile devices mean
| these days almost everything is sent over HTTPS to a cloud
| server. I haven't had software ask me to open a port on my
| router in a decade or more. Even games and video conferencing
| software know they have to work out-of-the-box on networks
| where the user can't adjust the NAT.
|
| So who's going to benefit from all this hassle - the 0.1% of
| users who are hosting websites from home?
| AtlasBarfed wrote:
| I've always posited that web services didn't become
| widespread because of the church of REST, or even that the
| HTTP protocol is that amazing.
|
| It's because you could get through the firewall without a
| four month review with the firewall team.
|
| Well, and you could reuse web tools and software. Ok,
| that's probably it, but the firewall convenience is
| DEFINITELY a thing.
| unethical_ban wrote:
| If home router manufacturers would get their shit together,
| IPv6 would not be hard to deploy. I get it, it's chicken
| and egg, but nothing about IPv6 is inherently more
| difficult than IPv4 other than the length of the address.
|
| The reason IPv6 on a home network is still difficult is
| because the routers everyone buys at Best Buy still blow at
| supporting IPv6. Ubiquiti blows at supporting IPv6. It is
| laziness and/or incompetence of device manufacturers,
| primarily, holding us back. (and incompetence around IPv6
| in general - I talked to a network guy at a large company
| recently and they were deploying /58s. WHY?!)
|
| The benefits of IPv6 may not be just for you - it's for the
| planet, it's for the developing nations, it's for the
| future where IPv4 _does not cut it_. It 's bigger than your
| home network.
| wankle wrote:
| IPv4 cuts it everywhere. IPv6 does not do anything to
| save the planet. IPv6 does have privacy concerns stated
| by many on this page. IPv6 could be shut down tomorrow
| and the Internet would continue working well.
| xjay wrote:
| The sad part to me is that the original IP header included
| variable-length addresses up to 128 bits, using two 4-bit
| fields called Source Address Length (SAL), and Destination
| Address Length (DAL). [1]
|
| Early hardware implementations could have settled on
| 32-bit, but 48-bit would make more sense to be in line with
| EUI-48/MAC-48 (ethernet frame). The world could then
| gradually upgrade hardware over the decade to handle a
| larger address.
|
| [1] https://www.rfc-editor.org/ien/ien28.pdf
| davikr wrote:
| To "avoid domination by huge centralized services", of
| course. What if you want to run something like a website
| from your own IP, but you can't because you're behind
| CGNAT?
| wankle wrote:
| I use a public VPS and Wireguard. Costs $3.50 for the VPS
| which has a static IP. I host on my laptop. I can take my
| laptop anywhere in the world there's an Internet
| connection and my email and web sites continue to work
| right from the same VPS IP because my laptop connects to
| the Wireguard server on my VPS when it comes up.
| tenebrisalietum wrote:
| Another reason is that NAT is making IPv4 live longer than
| it should, making IPv4 addresses more expensive. Maybe you
| don't want to host cloud services from your home, but if
| IPv4 addresses start costing millions of dollars (I know
| blocks of them can go for that much--if we're already there
| do you want to go further?), that drives up the cost for
| anyone using the Internet even if you are super okay with
| CG-NAT (which you shouldn't be).
|
| IPv6 will fix that.
| [deleted]
| mavhc wrote:
| NAT and a Firewall are two different concepts.
|
| What's wrong with a firewall that blocks everything by default,
| yet all your devices have a public IP?
| waych wrote:
| Maybe you don't want to reveal your internal infrastructure
| to the world? Seems like basic opsec.
| RealStickman_ wrote:
| There's no chance of anybody guessing your infrastructure
| just by looking at your subnet. (Minimum is /64, which is
| HUGE!)
| waych wrote:
| Every packet leaving an IPv6 network that isn't NATed has
| an effective node ID in the packet. No need to guess just
| look at the packets.
| justeleblanc wrote:
| Your machines could change their IPs for every second of
| every day and you wouldn't come close to exhausting your
| /64 subnet for the next billion years.
| waych wrote:
| The limit of changing addresses once every N seconds as N
| approaches 0 is equal to offline.
|
| With any usable N, a clever observer would still easily
| work out what you were doing and still map out your
| infrastructure.
| ianburrell wrote:
| Why would changing N seconds break network? It would
| presumably keep active addresses until connections
| finish. IPv6 requires supporting multiple addresses per
| interface.
|
| More reasonable is to use new address for each
| connection. Then nobody can tell if 10 addresses and 10
| connections are one device or ten.
| waych wrote:
| This looks like NAT pushed down to the endpoint itself.
|
| You've saved the translation in the router, but now
| routing lookups and ARP caches have grown by
| TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.
|
| What are valid values in the scenario you are proposing?
| The defaults are 1 week / 1 day, so 7X. If you chose to
| rotate each second, and say allowed addresses to only be
| valid for say 20 minutes, this still appears to be a
| ~1200X blowup in routing overheads.
| kazen44 wrote:
| > You've saved the translation in the router, but now
| routing lookups and ARP caches have grown by
| TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.
|
| They have not?
|
| The global routing table size for ipv6 at max is a /32
| (if i remember correctly) every customer gets a /56
| prefix to use in their network, so the routing table
| entry would still be the same, no matter how many
| addresses you use to cycle through in your /64.
|
| ARP caches do not exist in IPv6, and Neighbour discovery
| does not have the same "cache" mechanism as ARP does, it
| uses an entirely different mechanism for neighbour
| discovery. (which is also far more lightweight
| considering it is using multicast, compared to the
| broadcast of ARP).
| justeleblanc wrote:
| What kind of observer is 1. able to listen to the
| entirety of your network's outside communications, 2.
| interested at all in it, 3. harm you only on the
| condition that they "map out" your internal
| infrastructure? This isn't a novel, the goal is not to
| solve intricate security non-problems.
| waych wrote:
| "The network is secure" is a common fallacy.
| justeleblanc wrote:
| "Those who don't know what to say quote adages" is a
| common saying.
| Spivak wrote:
| Your ISP, "mapping your network" means being able to take
| data that was previously an amalgam of a household and
| reliably split it into the individual members and devices
| for better targeting.
| bityard wrote:
| Most devices support privacy extensions (temporary v6
| addresses) for this exact reason. https://www.rfc-
| editor.org/rfc/rfc4941
| jlokier wrote:
| Those IPv6 privacy extensions still reveal when the same
| node connects to a sequence of destinations within the
| address change interval, though. E.g. observers can see a
| single device connects to Facebook, OnlyFans, Pornhub and
| PayPal in that order.
|
| Behind a NAT, observers can only make that connection
| (using only addresses) for the network as a whole,
| instead of an individual device on the network. So the
| privacy extensions are weaker than NAT
|
| (If the IPv6 privacy extensions used a different address
| for each connection, they would be more like NAT in this
| regard.)
|
| That said, other observable clues still allow connections
| from a single device to be associated, NAT or not.
| There's TCP OS fingerprinting for example, and the close
| timing of related connections.
| waych wrote:
| This helps mitigate correlations over time but doesn't do
| anything to mask the identity of the node within a given
| refresh interval (default one day).
| [deleted]
| mavhc wrote:
| The whole world? How would that happen?
| waych wrote:
| Not the whole world. Just the world is sufficient.
| wjholden wrote:
| For HTTP/HTTPS, proxy servers (forward and reverse) offer
| an equivalent ability to hide addresses and a lot more
| features for security and performance.
| op00to wrote:
| Someone might know your IP, and somehow that information is
| delicious and irresistible to evil .. uh .. spammers?
| r3trohack3r wrote:
| > NAT and a Firewall are two different concepts.
|
| They are, but in practice they are muddled together and I
| suspect people are going to create subnets with IPv6 in the
| name of security. In IPv4 NAT is used to make sure your
| laptop isn't exposed to random script kiddies trying to scan
| for vulnerable services behind your router. A fun exercise is
| to plug a RaspberryPi up directly to a public facing IP
| address and log every packet it receives. Then give those
| scripts a few services to detect (HTTP server, SSH server,
| etc.) and look at how the traffic shifts from scanning for
| ports to scanning for vulnerabilities. Being connected
| directly to the public internet is a real eye opening
| experience.
|
| I do believe future IPv6 networks will have gateway machines
| and/or bastions that are connected to the public internet
| with public IPv6 addresses. And then they'll have an interior
| network that they use NAT for. Individual machines will not
| be routable or discoverable without going through a
| bastion/gateway that explicitly controls the flow of traffic
| into a network. Not because this is the ideal way to
| structure an IPv6 network, but because this pattern is going
| to carry over from the IPv4 world and there is a lot of
| momentum in tribal knowledge using NAT as a form of firewall.
| Arnavion wrote:
| >In IPv4 NAT is used to make sure your laptop isn't exposed
| to random script kiddies trying to scan for vulnerable
| services behind your router.
|
| NAT does nothing for that. Those incoming connections are
| dropped on the WAN interface before NAT would even be
| involved. Which is why it works exactly the same way
| regardless of whether the destination IP for that traffic
| was IPv4 or IPv6.
| Asooka wrote:
| Also I'm not going to expect my ISP to actually give me more
| than one address, so if I have multiple devices at home, I will
| need to do NAT. Heck, back in the day they used to set TTL to 1
| so the packets weren't routable at all without mangling them
| via iptables. Maybe that will be harder now than 20 years ago
| since everything connects online...
| cassianoleal wrote:
| ISPs are expected to delegate a /56 or /64 prefix to
| customers. Some are even delegating /48s. Mine delegates a
| /56.
|
| That should be enough for all your devices to randomly rotate
| IPs for a lifetime or a few without any NAT.
| Arnavion wrote:
| https://news.ycombinator.com/item?id=24999906
|
| Shitty ISPs do exist, or at least they existed two years
| ago.
| cassianoleal wrote:
| Sure they exist, but should you expect your ISP to be
| shitty? Sounds like a terrible deal for you.
| dmuth wrote:
| If you want to test to see if you're successfully sending out
| IPv6 traffic, I have an endpoint for that:
|
| https://httpbin.dmuth.org/ip/v6
| amrb wrote:
| He also has a video for the topic
| https://www.youtube.com/watch?v=e-oLBOL0rDE
| olddustytrail wrote:
| > Addresses are 128 bits long and written as 8 four-letter hex
| blocks separated by colons (i.e.
| fd69:beef:cafe:feed:face:6969:0420:0001)
|
| I suspect you mean "e.g." rather than "i.e."
| sp0ck wrote:
| My experience with IPv6. I have option to enable full dual stack
| with my ISP. After doing this I noticed that YT/FB/Google were
| significantly faster, however my kids started to complaing that
| some games began to have connectivity issues. Minecraft have
| problems to start. On a number of sites load time was noticebly
| longer. Switching off IPv6 as a experiment on one of kids PC
| solved all issues. My conslusion is that it is not worth to
| enable IPv6 and spend time to diagnose constant issues with
| random pages and services.
| mritun wrote:
| If we're talking anecdotally, I am running dual stack IPv6 and
| have had zero issues with Minecraft or any other game on my
| network on Xbox, Switch, iOS and PC.
| Gigachad wrote:
| Minecraft does not support v6 but I wonder what caused the
| issues. Maybe the presence of v6 support caused DNS to give a
| v6 address and this caused problems? Seems unusual.
| hot_gril wrote:
| First thing I do setting up any network is disable ipv6. It's
| caused issues at least once, and that's one time too many for
| something that doesn't benefit me in any other way.
| kitkat_new wrote:
| For me, the first thing is actually enabling ipv6
| dekhn wrote:
| Agreed- I turned on ipV6 and even tried turning off ipv4. All I
| found was a bunch of new, different problems to debug that were
| inevitably because somebody else somewhere doesn't support
| ipv6, or I would have to run some sort of bridge between the
| two networks. Of course this is for home where I don't need a
| gajillion publicly-routed IPs.
| nikanj wrote:
| I have never fixed network problems by turning IPv6 on, but I
| have fixed them numerous times by turning it off.
| justeleblanc wrote:
| I don't think this anecdote proves anything.
| hot_gril wrote:
| It doesn't say a lot. What says more is how often you seek
| home networking advice and one of the first troubleshooting
| steps is to disable ipv6 (though restarting the router is
| probably first).
| speedgoose wrote:
| Why should I spend the time and energy to deal with IPv6 when
| disabling it fix many issues ? The listed advantages are not
| worth the troubles in my experience.
| anderiv wrote:
| It's not so much that the advantages of IPv6 are all that
| compelling. Rather, it's more that the mechanisms put in place
| to deal with a nearly-exhausted IPv4 pool (NAT, and CGNAT in
| particular, etc.) are not great, and any opportunity to negate
| the need for them ought to be pursued.
| speedgoose wrote:
| But you still need these mechanisms for the time being. And
| personally, I do like NAT. I'm not a fan of exposing my
| internal networks to the internet. Having everything hidden
| behind a single address is neat.
| api wrote:
| I've run dual stack at home and at work for years and have had
| no issues. You might have issues if you have really old junk
| that's just broken.
| speedgoose wrote:
| My current internet provider doesn't support IPv6 so I'm
| good. I noticed that removing the AAAA records in the DNS
| configurations of my domains magically fixed a lot of weird
| network issues reported by the users.
| mynameisvlad wrote:
| Works for me, so clearly not an issue amirite?
| screamingninja wrote:
| Increased number of available IP addresses, improved security
| features, simplified network management, reduced network
| complexity, and support for new technologies. The adoption of
| IPv6 will lead to cost savings, improved network performance,
| and increased scalability. Scalability may not matter in the
| typical home network, but in an enterprise environment, the
| cost of up-keeping the network backbone is significant.
| everdrive wrote:
| >simplified network management
|
| I keep hearing this, but it doesn't seem more simple to me.
| My ISP won't reserve me a /48, so I can't control the
| management ips of devices on my network. The solution is
| apparently to set up dynamic dns, which I have no interest in
| doing.
| screamingninja wrote:
| Just split that /64 into smaller /80 subnets. If I were
| your ISP, I would be upset too.
|
| The apparent issue here is that you're falling back to
| what's familiar- static IP addressing. How about mDNS?
| jlokier wrote:
| You can't use a smaller subnet than /64 for devices that
| use SLAAC for address allocation.
|
| (Unless you're putting them behind an IPv6 NAT, so thry
| can have their oen private /64).
| speedgoose wrote:
| But that's in a world where IPv4 doesn't exist. But it does,
| so I see an increased number of available IP addresses that
| many people can't access, so you must keep an IPv4 stack
| which makes everything more complex and more expensive.
|
| I understand the support of new technologies but IPv6 is 27
| years old.
| ip26 wrote:
| The advantage mostly falls to the infrastructure. In theory it
| performs better, but only marginally, which is quickly
| overwhelmed by simple issues like inferior routes. As an end
| user, frankly I stopped caring long ago.
| ec109685 wrote:
| Would have been great if the post quantified the advantages.
|
| For networks (order of preference): IPv6 only > IPv4 Only >
| Dual Stack.
| [deleted]
| redog wrote:
| I think ipv6 could happen if subsidized for long enough.
|
| Something like, I'll-sell-you-my-v4-blocks-at-a-later-date-
| forfreeipv6-bandwidth-today-as-a-service ...
|
| Re-Send them nostalgic AOL CDs as the advertising...
| [deleted]
| czbond wrote:
| Great idea. Now a question for the group.
|
| What are the non-network team business benefits to IPv6 over v4?
| That is what drives adoption.
| api wrote:
| IPv4 is now stretched to the point that you often end up
| requiring multiple layers of NAT, such as carrier-grade NAT
| plus endpoint NAT. That reduces the reliability of pretty much
| all protocols and makes any protocol doing peer to peer
| communication really hard or even impossible to run. The latter
| includes tons of games, video chat, peer to peer VPNs,
| decentralized social networks, and so on.
|
| These problems will only get worse from here on out, but
| they're not as visible to people outside networking because
| this degradation of quality of service is a slow creep. The
| IPv4 Internet just gradually gets more and more limited in
| capability and less reliable for anything beyond the most basic
| use cases.
|
| IPv4's address space is simply too small. There are already
| almost twice as many people on Earth as there are possible IPv4
| addresses, and that assumes perfectly efficient utilization of
| IP addresses which is pretty much impossible. In reality there
| are probably 8-10X as many humans as viable IPv4 addresses. If
| every human being tends to have a computer and a phone that
| means there's at least 20X more devices than IPs.
| PeterisP wrote:
| I get that there are people in the world with severe lack of
| IPv4 addresses and this is a valid reason for _them_ to
| switch to IPv6.
|
| However, assuming that I and my organization have enough IPv4
| addresses (without requiring any of the tricks of multiple
| layers of NAT), is there a sufficient reason for us to
| justify the effort/expense of changing what works?
| cesarb wrote:
| > If every human being tends to have a computer and a phone
| that means there's at least 20X more devices than IPs.
|
| You know, that used to be only "if every human being tends to
| have a computer", since phones didn't have an IP address. Now
| it's "a computer and a phone". A few years down the line,
| you'll have "a computer and a phone and a watch", then "a
| computer and a phone and a watch and a standalone VR
| headset", and so on.
| screamingninja wrote:
| Increased number of available IP addresses, improved security
| features, simplified network management, reduced network
| complexity, and support for new technologies. IPv6 also
| provides significant performance benefits for mobile networks,
| IoT devices, and cloud services. The adoption of IPv6 will lead
| to cost savings, improved network performance, and increased
| scalability.
| [deleted]
| ilyt wrote:
| .... secure ? Is that ChatGPT answer ?
| ianburrell wrote:
| IPv6 being more secure used to be feature back when IPsec
| was cool. IPv6 has better integration with IPsec. But
| everyone is using TLS and other more secure VPNs these
| days.
| screamingninja wrote:
| Unless you're calling NAT "more secure", yes, I maintain
| that IPv6 is more secure. It simplifies network security
| operations and especially makes it easier to understand
| your network when you start visualizing logs and data with
| a real threat hunting platform. Try dealing with IPv4+IPv6
| vs IPv6-only in one of those dashboards.
| crest wrote:
| Less operational complexity. VPN overlays for remote
| management, realtime peer to peer video and audio streaming,
| etc. just work reliably. You also get to build the address plan
| to fit your (business) requirements instead of working around
| which addressspace is available where.
| [deleted]
| vlan0 wrote:
| OPEX and CAPEX costs are significantly reduced with native IPv6
| vs large NAT deployments. Adding layers to stretch IPv4 =
| complexity/gear. Gear/complexity = higher costs.
|
| And if you're already moving away from perimeter defense, to
| more identity based zero-trust, the move to IPv6 makes much
| sense.
| everdrive wrote:
| People are doing "zero trust" about as well as they're doing
| agile. The concept may be real, but businesses' implantations
| are not.
| ianburrell wrote:
| It is unfortunate that businesses are behind in rolling out
| IPv6. I get the impression that IPv6-only is more doable and
| has more advantages for business. It is feasible to run NAT64
| in business cause don't have to support as much old software
| like games that people want to play. It helps with internal
| addressing issues which get complicated in big companies with
| acquisitions. Finally, it adds a security barrier between
| IPv4 for external and IPv6 for internal.
|
| But upgrading a working network is lots of trouble. Most
| existing businesses have plenty of public IPv4 addresses and
| don't have to conserve.
| dilyevsky wrote:
| The benefit for the business is their eng team isn't bogged
| down by working around ipv4 network cruft on big networks. On
| small ones it probably doesn't matter yeah
| MagicMoonlight wrote:
| We should just make an IPv5 which takes a current address:
| 216.3.128.12 and makes it 0.0.0.0.216.3.128.12
|
| So any address of the current length you just treat it as if it
| has zeroes in front, otherwise you use the longer length which
| allows for many more addresses. Problem solved.
| aidenn0 wrote:
| You're leaving out what happens if an ipv4 only host gets a
| packet from an ipv5 host. It only knows how to respond to a
| 4-byte address.
|
| If you manage to solve that problem, you'll probably have
| invented something a lot like NAT64, which TFA talks about.
| throitallaway wrote:
| IPv6 became a draft standard in 1998; good luck with
| introducing "IPv5." Most operating systems/devices have IPv6
| for a very long time now, we just haven't been forced away from
| IPv4 yet. IPv4 addresses are getting to be increasingly
| expensive (and CGNAT really sucks); eventually a market tipping
| point will be reached.
| cooljacob204 wrote:
| I recently upgraded my lab and network to support IPV6. I wish I
| had waited two weeks so I could have read this first.
| [deleted]
| daper wrote:
| I've given a try to IPv6 in a company with few tens on servers in
| a 2 DCs, an office + additional location, 3 ISPs in total. For me
| the real challenge is not just different way to write an IP
| address or doing NAT. The challenge is that IPv6 changes a lot of
| unexpected things:
|
| - Our ISPs support IPv6 but routing quality is way worse than
| IPv4 including occasional inability to connect to some networks
| or greater latency than IPv4. I had to create tickets with such
| issues understood that most probably they just don't have IPv6
| BGP sessions to all their upstream providers they connect.
|
| - How the VPN (an employee / road warrior setup) should be
| configured since from the routing perspective you don't need a
| VPN to connect from your home to the office? Assuming both have
| proper IPv6 connection and all devices in the office and your
| laptop have a globally addressable IP address. Employee can have
| IPv4 or dual stack at his home, where is dual stack in the
| office. Very confusing. Looks like Fortigate also don't have an
| idea and decided to not support such case.
|
| - You have to be careful with site-to-site VPN since even your
| internal services like database are now globally addressable. You
| really need proper firewall rules / routing policies to not leak
| unencrypted packets over internet.
|
| - SLAAC is cool but doesn't provide DNS configuration. (there is
| RFC8106 but is it supported by all OSes?). You need DHCPv6 for
| that. You have to choose: use only DHCPv6 or SLAAC + DHCPv6 or
| just relay on the vast that DNS will be proviedd by DHCP IPv4 in
| a dual stack setup.
|
| - The way of providing high availability gateway address in a
| network is different. You need router advertisement where you can
| provide priorities. That actually is much better than any other
| VIP mechanisms (no issue with MAC table updates, etc.) but you
| need to know that.
|
| - OSPF works a bit differently. For example: there is no
| authentication in router communication in OSPF itself, you are
| supposed to use IPSec.
|
| The list is longer unfortunately...
| apearson wrote:
| > SLAAC is cool but doesn't provide DNS configuration. (there
| is RFC8106 but is it supported by all OSes?)
|
| For the most part, yes it's supported by major OSes. (ND RDNSS)
| https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_...
| joshspankit wrote:
| > You have to be careful with site-to-site VPN since even your
| internal services like database are now globally addressable.
|
| I'd bet that this will be the source of some gnarly leaks in
| future. If it does my bet would be it's going to follow the
| "API keys on GH" trajectory.
| ajross wrote:
| > You should stop thinking of NAT as a security mechanism and
| think of it as the emergency address exhaustion prevention that
| it is.
|
| I hate this attitude. This is isomporphic to saying "stop
| thinking of system call interfaces as a security mechanism and
| think of them as an address space sharing mechanism". It's not
| _technically_ wrong, but it 's wrong in practice.
|
| Even the most naive NAT can't misroute an inbound packet. If you
| have an internal host and it doesn't talk to anything outside the
| firewall, then no one else can reach it. They have no name for
| it, the packets won't go. You get this even if you don't
| understand how it works. You get this even if the _router_ has no
| idea about the host.
|
| Give everything a unique address and now the router needs to know
| who is safe and who isn't. That's a decision point that requires
| configuration by human beings, and human beings get stuff wrong.
|
| No, NAT is your friend. Use NAT. Use it even if you're an IPv6
| nut.
| kazen44 wrote:
| why would NAT not be any configuration compared to Firewall
| rulesets?
|
| heck, they even inventend protocols to do automatic NAT setup
| (UPNP) because configuring NAT by hand confuses people a lot.
| TacticalCoder wrote:
| Not commenting on the whole IPv6 vs IPv4 debate but simply
| answering your question...
|
| There aren't enough IPv4 addresses, so any ISP using IPv4
| addresses is going to give 99.999% of their customers exactly
| _one_ IPv4 address. Not ten. Not two. One.
|
| So NAT _has to work_. Grandma has nothing to configure
| because either NAT works or grandma is calling her ISP to ask
| why her tablet ain 't working.
|
| So when the customer gets exactly _one_ IPv4 address, the ISP
| is _forced_ to hand a router doing IPv4 NAT. They have no way
| around it.
|
| While if you take an ISP handing out hundreds of billions of
| IPv6 addresses to each customer, well... They are not
| _forced_ to hand a router which does proper firewalling.
|
| It's not a question of whether it'd be easier for the ISP to
| give a correctly configured IPv6 router firewall vs handing
| an IPv4 correctly doing NAT.
|
| It's that when they hand one IPv4 address, they don't have
| the choice. NAT must work and there's no way around it.
| ajross wrote:
| I'm sorry, I don't follow. Our grandparents have working,
| secure NAT setups that no human being needed to configure.
| I've never once seen a "firewall ruleset" configured by a
| non-geek.
| justeleblanc wrote:
| Really? I changed ISPs the other day. Got my new
| modem/router. You know what I did in terms of firewalls?
| Nothing. You know what I have? A firewall that blocks all
| unknown incoming connections. Does it work? Yes. Did I even
| have to do anything besides plug in the box? No.
| dragoncrab wrote:
| Happy you.
|
| All the 3 ISPs I dealt with in Hungary in the last 10
| years provided 0 firewall capability for IPv6 in their
| integrated router/modem.
|
| Once you start assigning the addresses, every compatible
| IoT gadget you have is reachable from the public web.
|
| In this state, IPv6 is a pure security stepback for
| average residential users with 0 upside.
|
| I can't take any comment seriously who is speaking of
| configuring a stateful firewall in a residential
| environment.
| AtlasBarfed wrote:
| "although software support is virtually a requirement these days"
|
| Who's fault is this again?
|
| -------------
|
| "- IPv6 is absolutely ready for prime-time and has been for
| awhile
|
| BUT
|
| "- About half of the internet sites I rely on support IPv6
| natively, so there needs to be more pressure on site admins and
| CDNs to support IPv6 natively"
|
| That is a contradiction.
|
| -----------
|
| "There seems to be a lack of drive (judging by forum posts) to
| enable IPv6 on internet services by admins, either because they
| don't care to, or it's more work to manage a public IPv4 and
| public IPv6 presence"
|
| Again, who's fault is it that its so hard? What is the payoff for
| the extra work?
|
| -----------
|
| - Networks should be designed IPv6-first instead of IPv4-first,
| and this design approach largely solves most of the major issues
|
| K thanx, but that's not the way virtually every company works.
| Mayyyyybe a startup? This is unrealistic.
|
| -----------
|
| "Other operating systems are bit of hit or miss"
|
| so... IPV6 is NOT NOT NOT ready for prime time, is that what you
| are saying?
|
| -----------
|
| What dream world are the ipv6 people living in?
|
| I love this. Who should be implementing ipv6 stacks in OS's?
| Probably ipv6 people, but ... where are they again? The amount of
| blame is crazy.
|
| A protocol switchover of this magnitude is about outreach and
| assistance. The ipv6 crowd has NEVER displayed that, just
| arrogance, dismissal, and waited for things to get "so bad" in
| ipv4 that it transferred.
|
| Which is why ipv6 people HATE HATE HATE NAT. It has delayed their
| grand moment by decades.
|
| ...
|
| In an ideal world, the ip++ protocol would have been easier, not
| harder. BLog posts wouldn't be victim blaming, throwing around
| NAT64, 464XLAT, DNS64
|
| DNS64 kills me. WHy is there a totally different service for
| ipv6? Isn't DNS just a key-value store? People put all types of
| crap into DNS, including, I believe, ipv6 addresses.
|
| Why isn't there a DNS record type that basically lists both an
| ipv4 and ipv6 for a name, along with negotiation information?
| Might that make transition a lot easier? Maybe it does, but it
| isn't in this article.
|
| Just ... all the same problematic attitudes, no progress on
| issues, my way or highway, and denial.
___________________________________________________________________
(page generated 2023-03-06 23:00 UTC)