[HN Gopher] Thinking about our passive exposure to IPv6 issues
       ___________________________________________________________________
        
       Thinking about our passive exposure to IPv6 issues
        
       Author : jesprenj
       Score  : 34 points
       Date   : 2023-04-25 05:21 UTC (1 days ago)
        
 (HTM) web link (utcc.utoronto.ca)
 (TXT) w3m dump (utcc.utoronto.ca)
        
       | ehPReth wrote:
       | I am now supreme leader, IPv6 is mandatory for everyone with at
       | least a /48 prefix available per location by 2025 or we'll break
       | down your doors and take over; no IPv6 NAT allowed.
       | 
       | ..if only. :(
        
         | icedchai wrote:
         | IPv4 started like that. I worked at several ISPs, one of which
         | had a ton of address space, and we gave every dedicated
         | customer site a /24 by default. We had public IPs on all the
         | desktops, no NAT, and generally no firewalls. The good old
         | days...
        
       | greyface- wrote:
       | What are you going to do when your students need to access an
       | IPv6-only service? How do the instructors of your networks
       | courses feel about this approach? Do you think the lack of
       | exposure to IPv6 puts your students at an advantage or
       | disadvantage compared to those graduating from an institution
       | running dual stacks?
        
         | fafqg wrote:
         | Something they will have to think about the day that there are
         | IPv6-only services. Which is not today or anytime soon.
        
           | eqvinox wrote:
           | > Something they will have to think about the day that there
           | are IPv6-only services. Which is not today or anytime soon.
           | 
           | Let me guess, you live in and/or operate setups in the US?
           | 
           | Yeah, the US has disproportionately many IPv4 addresses.
           | 
           | Meanwhile if one of our services doesn't need IPv4, it
           | doesn't get IPv4. And if it does need IPv4, it's increasingly
           | common to be IPv6 behind an IPv4 reverse proxy.
           | 
           | And as a result, due to the extra reverse proxy, you'll
           | increasingly just get worse performance on IPv4 than native
           | IPv6.
        
             | fafqg wrote:
             | What you call the "extra reverse proxy" is cgnat and cgnat
             | doesn't add more latency than any other host in the path to
             | the destination server.
        
               | eqvinox wrote:
               | It's called CGNAT when you do it near the end user /
               | eyeballs and do it generically for all services on the
               | internet.
               | 
               | When you do it near the service being provided, and only
               | for your own services, it's called a Reverse Proxy.
               | 
               | You are right that these two things are similar, but they
               | aren't identical; CGNAT attempting to handle you trying
               | to talk to _who knows what_ on the Internet (e.g. game
               | servers, VoIP) is a much harder problem to solve than a
               | Reverse Proxy handling a known set of protocols you want
               | to expose.
               | 
               | And, yes, an unloaded CGNAT or Reverse Proxy is not
               | noticable in terms of performance. However, both of them
               | have load limits where you need to scale them up, and
               | particularly CGNAT frequently degrades (due to larger
               | tracking tables) before completely falling over.
        
           | Arnt wrote:
           | Well, I've seen several. Nothing for the general public. But
           | things like the CMS/admin interface of a big web site. The
           | site itself is on v4, the admin interface not.
        
           | hippich wrote:
           | There were (haven't checked for awhile) very cheap vps
           | offerings that come only with ipv6 with no possibility to
           | obtain ipv4 at all. While not useful for typical stuff, I've
           | successfully used a swarm of these for personal project. I
           | expect these things to become more common as companies like
           | ovh start charging $10+ for a small fallback ipv4 address
           | range.
        
           | pantalaimon wrote:
           | IoT networks come to mind. There is nothing like 6LoWPAN for
           | IPv4
        
       | yrro wrote:
       | A brand new UK ISP, YouFibre, is providing FttP in many UK
       | cities. It's incredible being able to get a symmetric 1 Gbit
       | connection for PS30 pcm.
       | 
       | It's also incredible that, despite putting all their users behind
       | CGNAT, they don't provide IPv6.
       | 
       | I mean technically they are no _worse_ than their major
       | competition here (Virgin Media which has failed to move on IPv6
       | for 20 years, why start now). But it's baffling that a _new_
       | network would be built without IPv6 provision!
        
         | ignoramous wrote:
         | Perhaps, the IPv4 space is easier to police?
         | 
         |  _IPv6 Transition /Co-existence Security Considerations_,
         | https://datatracker.ietf.org/doc/rfc4942/
         | 
         |  _Operational Security Considerations for IPv6 Networks_ ,
         | https://datatracker.ietf.org/doc/rfc9099/
        
         | radicaldreamer wrote:
         | This behavior was rare in the US market, but it is very common
         | now that our wireless providers are entering the home internet
         | market. T-Mobile and Verizon both use CGNAT (but do issue
         | individual ipv6 addresses to end user devices).
        
           | throw0101b wrote:
           | > _T-Mobile and Verizon both use CGNAT (but do issue
           | individual ipv6 addresses to end user devices)._
           | 
           | More specifically, T-Mobile US only assigns IPv6 addresses to
           | devices, and to reach the IPv4 world you have to go through a
           | translation mechanism.
           | 
           | Presentations from T-Mobile at NANOG and Rocky Mountain IPv6
           | Taskforce:
           | 
           | * https://www.youtube.com/watch?v=d6oBCYHzrTA
           | 
           | * https://www.youtube.com/watch?v=nNMNglk_CvE
        
           | sjcoles wrote:
           | It's been a nightmare for my org. We have several people with
           | T-Mobile and Verizon home internet and it's always a game of
           | "What shenanigans will I have to use this week to get VPNs to
           | work?" Sometimes it seems like their 6to4 implementation is
           | just broken but I'm not a network engineer.
        
           | gormandizer wrote:
           | > _T-Mobile and Verizon both use CGNAT_
           | 
           | FWIW Verizon FWA does NOT use CGNAT for IPv4.
        
         | fpanzer wrote:
         | Same thing here in Germany, Fibre ISP in my hometown (80k
         | population). Started 5 years ago, widely used already, but
         | still no ipv6.
        
         | sidewndr46 wrote:
         | I have IPv6 available through one of my ISPs at my home, but it
         | doesn't work properly. Packets are just dropped for random
         | intervals here and there.
        
         | chinaman425 wrote:
         | [dead]
        
       | nubb wrote:
       | ipv6 has been "around the corner" since 2010 and it sucks we're
       | trying to force a protocol everyone hates. i get all the reasons
       | it's great but when everyone on earth hates a single thing all
       | together maybe it's a sign???
        
         | blacksmith_tb wrote:
         | Hmm, in the US at least it's pretty much ubiquitous on cell
         | networks? My home ISP also at least does 6rd, not as nice as
         | native, but a start.
        
         | pantalaimon wrote:
         | https://www.google.com/intl/en/ipv6/statistics.html
        
       | nikanj wrote:
       | 1) When was the last time you fixed networking issues by turning
       | on IPv6?
       | 
       | 2) When was the last time you fixed networking issues by turning
       | off IPv6?
       | 
       | For me, the answer to 1) remains "never", the answer to 2) is
       | currently "Late winter"
        
         | icedchai wrote:
         | I've been running IPv6 since roughly 2007, starting with SiXXS
         | tunnels, then HE.net tunnels, then moving to native. In that
         | time, all problems "due to IPv6" were fixable. Turning off IPv6
         | was never the actual answer.
        
         | eqvinox wrote:
         | 3) When was the last time you fixed networking issues by
         | turning on IPv4?
         | 
         | About a year ago, when I noticed wikipedia still doesn't have
         | IPv6 reachable DNS resolvers.
         | 
         | 4) When was the last time you fixed networking issues by
         | turning off IPv4?
         | 
         | A few weeks ago, IPv4 was just slow for some reason I couldn't
         | quite determine.
        
         | lolc wrote:
         | I frequently "turn on" IPv6 by disconnecting from my company
         | VPN. Some things work better that way.
        
         | jeroenhd wrote:
         | 1. Yesterday, actually!
         | 
         | 2. Never, because altering my network in a way that I'm no
         | longer able to reach my own servers isn't really a "solution".
        
         | patrakov wrote:
         | > 1) When was the last time you fixed networking issues by
         | turning on IPv6?
         | 
         | In 2017. The problem was that file copying via scp was very
         | slow between the servers (one in Germany, one in China). I set
         | up a he.net tunnel in China, got an IPv6 address, and it went
         | much faster via IPv6.
        
         | toast0 wrote:
         | > 1) When was the last time you fixed networking issues by
         | turning on IPv6?
         | 
         | I've used IPv6 to help users behind CGNAT; enabling IPv6 for
         | client -> server often means those clients no longer go through
         | carrier stateful firewalls and their sometimes tragically low
         | idle timeouts (I've seen timeouts as low as 10 seconds).
         | 
         | I've also used IPv6 to help in a proxy config when I couldn't
         | get the upstream servers configured for more listening ports;
         | it's super easy to get extra v6 source addresses for the proxy
         | servers and harder to get v4 addresses. With high volumes and
         | low session times, you run into port reuse issues at around
         | 10k-20k sessions per {source ip, dest ip, dest port} tuple;
         | theoretically you can get to 64k, but TIME_WAIT takes time to
         | clear and you don't want to be too aggressive.
         | 
         | Probably less going forward, but v6 and v4 often have different
         | routed paths, and sometimes you want to get off of one path and
         | onto another. If you're using a tunneled v6 connection, you
         | almost certainly have a different path for most destinations.
         | 
         | > 2) When was the last time you fixed networking issues by
         | turning off IPv6?
         | 
         | My previous DSL modem would crash when receiving fragmented
         | IPv6 packets. My current one doesn't crash, but adds a lot of
         | internal latency. Temporarily fixed by disabling IPv6;
         | permanently fixed by using the modem in bridge mode and doing
         | PPPoE on my own personal equipment (at great cost to my own
         | sanity, PPPoE is gross, and I built a multi-node redundancy
         | setup, so PPPoE sessions can be transferred between my
         | redundant routers, bleh)
        
         | doodlesdev wrote:
         | 1) Last week
         | 
         | 2) Never
        
       | imoverclocked wrote:
       | IPv6 is pretty great. You don't run out of numbers locally, you
       | don't run out of numbers globally. Most software and OSs just
       | support it these days... many embedded things still don't.
       | 
       | I think the biggest pain point with IPv6 adoption is probably the
       | large number of customers with a little netgear router that
       | doesn't know how to pass IPv6 through it. I also think local
       | administrators that still purchase stuff that doesn't support
       | IPv6 are just shooting themselves in the foot. After all, the
       | writing has been on the wall for over two decades.
        
         | fafqg wrote:
         | >IPv6 is pretty great. You don't run out of numbers locally,
         | you don't run out of numbers globally.
         | 
         | If that's everything IPv6 has going for it it's no wonder its
         | adoption is still so low.
        
           | anecdotal1 wrote:
           | Based on the way IPv6 is currently allocated we only leverage
           | about 56 bits of usable address space but IPv4 with NAT gives
           | us a max of 96 bits of address space
           | 
           | Edit: don't know why I'm being downvoted, I guess the network
           | gurus here don't research
           | 
           | https://www.potaroo.net/ispcol/2017-09/natdefence.html
        
             | ElectricalUnion wrote:
             | > IPv4 with NAT gives us a max of 96 bits of address space
             | 
             | But then you need NAT piercing everywhere for even "basic
             | use". How is not being able to connect to things "usable"?
             | 
             | By that same metric, you also get a bare minimum, naive
             | count of of 144 bits of IPv6 address with 2 layers of link-
             | local address + all ports.
             | 
             | 144 is much larger that 96.
             | 
             | Even the naive 64 bits "just use one layer of link-local"
             | is still larger that the entire current 32-bits of IPv4.
        
               | yjftsjthsd-h wrote:
               | I think the point is that 96 is quite enough to not run
               | out. Which is plausibly fair, if you can actually get
               | that many bits (or close enough to actually cover
               | everyone) and can deal with the ugliness of NAT. It's
               | especially fair, I think, to argue that the reason that
               | IPv6 adoption has been so slow is because IPv4+NAT is
               | good enough for most people. Just because IPv6 is
               | _better_ doesn 't mean that people will want it if the
               | old option can be hacked up to keep working.
        
               | labcomputer wrote:
               | So is 56. That's about 9 million addresses for every
               | human on earth.
               | 
               | And, of course OP is wrong about 56 anyway, but so it
               | goes
        
               | yjftsjthsd-h wrote:
               | Oh, sure; arguing that IPv6 doesn't, in any way shape or
               | form, have enough addresses would be extremely misguided.
               | I was reading it as "IPv4 already has enough address
               | space (if we include NAT) so we don't need to deal with
               | v6".
        
             | eqvinox wrote:
             | FYI: After skimming the article, I'm downvoting because you
             | conflated what the article calls "This 96-bit NAT address
             | space is a highly theoretic ceiling, [...]" became a plain
             | unqualified "96 bits of address space" in your comment.
             | Which you're then comparing with the "56 bits of usable
             | address space" in IPv6.
             | 
             | Also, that sentence continues in the article with: "[...]
             | but the pragmatic question is how much of this space can be
             | exploited in a cost-effective manner such that the marginal
             | cost of exploitation is lower than the cost of an IPv6
             | deployment."
        
               | anecdotal1 wrote:
               | Pretty much anything is lower than the cost of IPv6
               | deployment if you already have a large IPv4 deployment.
        
               | lmm wrote:
               | CGNAT routers aren't cheap. At some point you're spending
               | more keeping your IPv4 running than it would take to
               | replace it.
        
           | JohnFen wrote:
           | > If that's everything IPv6 has going for it it's no wonder
           | its adoption is still so low
           | 
           | IPv6 has numerous things going for it. But it also has
           | numerous downsides. I suspect that's why the adoption is so
           | slow.
        
         | kps wrote:
         | > many embedded things still don't.
         | 
         | For home IoT, Matter uses IPv6, and may start picking up this
         | year. (I worked on some IPv6-related things for it for my then-
         | employer.)
        
         | JohnFen wrote:
         | > After all, the writing has been on the wall for over two
         | decades.
         | 
         | That IPv6 has been around so long and is still not ubiquitous
         | means that writing is faded and partially obscured by graffiti.
        
           | imoverclocked wrote:
           | Anything as large and hodgepodge as the Internet isn't going
           | to change in a day. I'd say that the writing has been kept
           | fresh [1] and the underlying need hasn't gone away.
           | 
           | [1] https://www.google.com/intl/en/ipv6/statistics.html
        
         | RealStickman_ wrote:
         | A real pain point with IPv6 is being unable to make subnets
         | smaller than /64. So much wasted space and hassle to get more
         | than one network going.
        
           | jeroenhd wrote:
           | There's no technical reason why you can't if you use active
           | DHCPv6 and other such tricks. They make life harder than
           | standard IPv6, but there's no reason why you can't turn one
           | of your /64s into /120s. With a /56 being the standardised
           | assignment for ISP customers (=256 subnets), I think there's
           | more than enough space for a home network. /48s used to be
           | the recommended space assignment but I think these days you
           | can only get those as a business customer or through an
           | independent party (i.e. Tunnelbroker).
        
           | icedchai wrote:
           | IPv6 subnets are supposed to be super cheap. As an
           | individual, through a RIPE LIR, I was able to get a /44 (2^20
           | /64 subnets), no questions asked. I have these tunneled into
           | my home lab and a couple other locations. I realize my setup
           | is unusual: I have my own ASN and am running BGP.
        
           | zamadatix wrote:
           | Are you looking to deploy 100 subnets at your house or
           | something? I just don't follow the relation to the /64 size
           | and any hassle.
        
           | labcomputer wrote:
           | This sounds like and A/B problem. You're asking how to do A
           | but what you really want is B. But you're asking about A
           | because that's how you think you'd get B in the ipv4 world.
           | 
           | Your ISP should give your router a /56 prefix via PD, which
           | you can divvy up into 256 networks internally. Alternatively,
           | if you don't need globally-routable addresses, just pick a
           | ULA prefix and have your router advertise it internally.
        
       | drpixie wrote:
       | I was somewhat amazed that a significant university _doesn 't_
       | handle IPv6 - sigh.
        
         | throw0101b wrote:
         | UToronto does:
         | 
         | * https://bgp.he.net/AS239#_prefixes6
         | 
         | It's just that particular department may not have bothered.
        
       | UpToTheSky wrote:
       | This is one of the reasons I do not support IPv6 anywhere. It
       | would take a _lot_ more work to support two types of network
       | requests.
       | 
       | I hope I can ignore it up to the point where I can make a
       | complete switch, use _only_ IPv6 and stop supporting IPv4
       | everywhere.
       | 
       | I wouldn't be surprised if that point never comes and I can be a
       | happy "IPv4 only infrastructure" person forever.
       | 
       | Or IPv7 comes out before running an IPv4-only infrastructure
       | becomes a problem.
       | 
       | I think the mistake of IPv6 was to not be a superset of IPv4.
        
         | elevation wrote:
         | It does take more work to run dual stack. I wanted to avoid
         | duplicating efforts when I set out to learn ipv6, so I disabled
         | ipv4 routing on my network and just ran ipv6 with DNS64/NAT64
         | to provide my clients access to legacy services. In this
         | configuration, most of my traffic was end-to-end ipv6. I tested
         | iOS, Android, Windows, and Ubuntu clients with no issues, even
         | my aging printers support it!
         | 
         | The only issue I have is the same issue found in the article,
         | but in reverse: now that I have a securely configured ipv6
         | network, how can I ensure that my hosts are fully prevented
         | from communicating over a rogue ipv4 net?
        
         | jeroenhd wrote:
         | Does it? If you pretend IPv6 doesn't exist, sure, but that's
         | like pretending UDP doesn't exist because all of your
         | applications use TCP, or only logging traffic going to port 80
         | because you don't have HTTPS yet.
         | 
         | Every firewall I've come across has a default deny rule for
         | incoming IPv6 traffic, giving the firewall the same properties
         | as any IPv4 network. Host firewalls are the same; anything
         | ranging from Windows Firewall to UFW and firewalld have presets
         | to block all traffic except for the applications you've
         | whitelisted. Once you get to huge enterprise routers managing
         | routable IPv4 addresses and IPv6 addresses the situation may
         | become different, but it's still not that much overhead.
         | 
         | The biggest problem with securing IPv6 seems to be ignoring it
         | assuming that makes it disappear. If you configure your
         | firewall to drop all IPv4 traffic not on a whitelist but
         | somehow manage to forget to add the same rule for IPv6, you
         | should re-evaluate your networking knowledge and maybe get up
         | to speed with how the internet has changed since 2015.
        
           | UpToTheSky wrote:
           | Its not just firewalls.
           | 
           | Its also all kinds of code that interacts with the internet
           | in all kinds of ways. Extending all that code to two kinds of
           | IPs, writing tests, setting up two types of IPs in
           | development, staging and production, monitoring real life
           | implications ... that would be a huge cost with no benefit at
           | all.
        
             | jeroenhd wrote:
             | If you're writing code, you'll be either manually
             | specifying the IP address family (so there's no real IPv6
             | risk) or you're probably using middleware that does all the
             | hard parts for you anyway. If anything, I'm annoyed how
             | hard it is to get a socket listening on both IPv4 and IPv6
             | in many low level libraries. I just want a socket to
             | receive data on, who cares what address family it's from.
             | 
             | In my experience, IPv6 Just Works (tm) with modern
             | software. There are some mid 00's frameworks for
             | blacklisting abusive hosts that can't parse IPv6 addresses,
             | or don't understand the /64 subnet you need to treat as a
             | single IP address, but that's all I've ever run into. If
             | anything, that gave me an excuse to finally get rid of an
             | old Perl network filter running on my server.
             | 
             | I'm not sure how many tests the average piece of software
             | needs that deals with the type of address family
             | connecting. I suppose it matters if you want to test your
             | rate limiting middleware or your logging library? That
             | should only matter for the vendored code of course because
             | modern libraries all have those tests themselves already.
             | It's not like you need to run and write every test twice,
             | only one or two very specific subcomponents if any.
             | 
             | If you're writing firewalls or kernels or router firmware
             | then yeah you'll have your hands full with this stuff, but
             | that's far from the standard developer experience. In those
             | cases, IPv6 is a reality as much as TCP and UDP are.
        
               | znpy wrote:
               | > if you're writing code, you'll be either manually
               | specifying the IP address family (so there's no real IPv6
               | risk)
               | 
               | AF_ANY is a thing, and it's a best practice.
               | 
               | gethostaddr (iirc) was the old interface, but nowadays
               | getaddrinfo is almost the default and supports AF_ANY.
        
             | znpy wrote:
             | To add a trivial example: if an application is coded well,
             | it's ready to connect to hosts both on ipv4 and ipv6, in
             | the sense that when resolving a dns name, it will ask for
             | addresses of any kind (unless it supports being explicitly
             | told to only use ipv4).
             | 
             | So now you're getting a record with multiple ip addresses,
             | some of which are ipv6, but ipv6 is blocked... there you go
             | with random connection delays and possibly timeouts.
             | 
             | Ipv6 exists and it's getting more and more adoption, no
             | matter if some people keep their head under the sand...
        
               | kps wrote:
               | > multiple ip addresses, some of which are ipv6, but ipv6
               | is blocked... there you go with random connection delays
               | and possibly timeouts.
               | 
               | RFC6555 "Happy Eyeballs" discusses this.
        
               | xemdetia wrote:
               | A/AAAA records are a special sort of hell to debug
               | remotely. "My browser can find it but I can't ping it!
               | What do you mean ping6?"
               | 
               | In some environments that is maddening and I don't blame
               | people for just deciding not to either at all or only
               | translating at WAN.
        
             | ElectricalUnion wrote:
             | > that would be a huge cost with no benefit at all.
             | 
             | Internet facing IPv6 infrastructure is usually much cheaper
             | that their equivalent IPv4 enabled peers.
             | 
             | So supporting IPv4 can be the huge cost with no benefit at
             | all, if all your clients/peers can use IPv6
        
               | yjftsjthsd-h wrote:
               | > if all your clients/peers can use IPv6
               | 
               | Including the case where you have something else in the
               | middle already - for example, if you're fronting a
               | website through cloudflare, then you can only have IPv6
               | on your server and still support dual-stack for clients:)
        
           | nubinetwork wrote:
           | Why firewall it when you can straight up turn it off?
           | 
           | net.ipv6.conf.all.disable_ipv6 = 1
           | net.ipv6.conf.default.disable_ipv6 = 1
        
         | tux2bsd wrote:
         | [dead]
        
       | idatum wrote:
       | My fiber provider inherited network equipment that is preventing
       | them from deploying IPv6. On their subreddit they responded from
       | multiple inquiries that they are ready to provide a /60 once they
       | upgrade their equipment.
       | 
       | I imagine this may be a problem for other providers.
       | 
       | Thankfully no CGNAT, so I have a couple VLANS that use he.net in
       | the meantime.
        
       | schoen wrote:
       | I'm working on a project to increase the supply of IPv4
       | addresses, and people often complain that attempting to do so
       | undermines confidence in (or, allegedly, the pressure to adopt)
       | IPv6, thereby harming the IPv6 transition.
       | 
       | I don't think we could possibly be anywhere near the top of the
       | things harming the transition when we regularly encounter people
       | _actively encouraging others not to use IPv6_ for either security
       | or convenience reasons!
        
         | bell-cot wrote:
         | > people often complain that attempting to do so undermines
         | confidence in...
         | 
         | A miserably common human behavior pattern.
         | 
         | Anyone have a copy of the DSM-5 handy, to tell us the technical
         | name for it?
        
       | AndyMcConachie wrote:
       | IPv6 is such a mess. If I could go back in time to 1995 I would
       | kick some people at IETF meetings. All they had to do was
       | increase the number of octets from 32 to 64. Instead they
       | redesigned almost everything about how IP works and IMHO made
       | things much more complicated than they needed to be.
        
         | icedchai wrote:
         | So any increase in address size meant updates on all hosts and
         | routers. If you're going to do a huge, global infrastructure
         | update, it better be worth it. The changes made with IPv6
         | actually _simplified_ deployment compared to IPv4.
        
         | eqvinox wrote:
         | So... you have learned from this and are now actively
         | monitoring and participating at the IETF, so your expertise can
         | be taken into account to prevent similar messes in the future?
         | 
         | (An octet is a byte btw, so it'd be an increase from 4 to 8.)
        
         | viraptor wrote:
         | We'd likely be in the same situation right now, just with fewer
         | extra features which are actually good. The C API would have to
         | change in almost the same way. The network hardware would have
         | to have separate paths anyway. Rules would still have to cover
         | both cases separately.
         | 
         | Sure, we'd save a little bit of time from the extra features,
         | but I don't see how anyone's deployment approach would be
         | different.
        
         | AnIdiotOnTheNet wrote:
         | Hindsight is 20/20. It is easy to see now all the reasons IPv6
         | is not widely adopted, but back then they probably figured that
         | adding more features would make it more attractive or
         | something.
         | 
         | If I had a time machine and had to take a relatively naive
         | crack at the problem, I'd make IPv6 really really simple: it'd
         | just be IP-in-IP.
         | 
         | On the internet you're routed with an outer address, and the
         | local router forwards it using the inner address. Speaking v6
         | over v4 is free because v4 routers ignore the inner packet.
         | Speaking v4 over v6 just doesn't include the inner packet.
         | Other local hosts are just contacted through v4.
        
         | teddyh wrote:
         | > _IPv6 is such a mess._
         | 
         | Maybe.
         | 
         | > _If I could go back in time to 1995 I would kick some people
         | at IETF meetings._
         | 
         | Sure.
         | 
         | But how is any of that relevant enough to bring up _today_?
         | Now, IPv6 is what we have, and the standards are what they are,
         | flaws and all.
         | 
         | The only reason I can think of is psychological: People don't
         | want to learn new things, so they find reasons to dislike the
         | new thing to be able to pretend they don't need to learn it.
         | 
         | 1. https://news.ycombinator.com/item?id=29594017
         | 
         | 2. https://news.ycombinator.com/item?id=11137430
        
       | jesprenj wrote:
       | I have an example from my ISP. While it theoretically started
       | with IPv6 all the way back in around 2012, their IPv6
       | infrastructure still remains quite crippled -- they won't even
       | assign you static prefixes, all you get is a DHCPv6 /56 (meaning
       | you can't set a PTR).
       | 
       | And the example revolves exactly around filtering and firewalls
       | -- on IPv4 they drop outgoing packets whose source address isn't
       | a part of their subnet -- they prevent source spoofing of other
       | addresses.
       | 
       | But on IPv6 they do not do that. I noticed this when their router
       | somehow lost the prefix route to me -- I was informed that their
       | DHCP server adds router dynamically to routers -- and I could
       | still send packets. But I couldn't just send packets from my
       | prefix, but also from any other address, including stuff like
       | 2000::.
        
         | jeroenhd wrote:
         | That's pretty silly. I wouldn't have much faith in my ISP if
         | they'd mess up that badly.
         | 
         | Perhaps the good network engineer that got IPv4 working right
         | left before they could implement IPv6? Or maybe they don't
         | provide enough of a training budget for their engineers to stay
         | up to date on networking technology?
         | 
         | Either way, if their core business is doing networking, I'd
         | expect them to be better at this!
        
         | eqvinox wrote:
         | > their router somehow lost the prefix route to me -- I was
         | informed that their DHCP server adds router dynamically to
         | routers
         | 
         | for the curious, that's (in most cases) DHCPv6-PD relay agent
         | operation, https://www.rfc-editor.org/rfc/rfc8987.html#name-
         | general "Delegating relay":                  Delegating relay:
         | A delegating relay acts as an intermediate device, forwarding
         | DHCPv6 messages containing IA_PD and IAPREFIX options between
         | the           client and server.  The delegating relay does not
         | implement a           DHCPv6 server function.  The delegating
         | relay is also responsible           for routing traffic for the
         | delegated prefixes.
         | 
         | It's generally done by having the relay be a passive observer
         | of the DHCPv6-PD packets it is relaying between client and
         | server, installing and updating routes for prefixes as needed.
         | 
         | That RFC also goes into detail on problems with these setups.
         | What you experienced was probably the loss of state described
         | in section 3.2.
        
           | jesprenj wrote:
           | Thank you!
        
       | dopylitty wrote:
       | The IPv6 Buzz podcast had a recent episode[0] making the claim
       | that IPv6 is happening on your network whether you intentionally
       | enable/control it or not these days and I had a similar reaction
       | to the one in the post. Definitely something to think about
       | though if you're in a position to worry about such things.
       | 
       | 0: https://packetpushers.net/podcast/ipv6-buzz-123-why-you-
       | need...
        
       ___________________________________________________________________
       (page generated 2023-04-26 23:01 UTC)