Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IAB Statement on IPv6

iab.org

Post reply on HN
Print view View original

81–90 of 131 posts

Re: IAB Statement on IPv6

#81

Post by buzer »

lmm wrote: post #76
_red wrote: post #60

Earlier quoted context omitted.

So you don't want stateful inspection on your private LAN router? Its ok for every hacker to portscan the 100's of IoT devices in your house? You're a very trusting fellow.

How many IoT devices need to allow incoming connections at all? And how many connections do they need to make? IoT devices, if I had any use for them, would go on my private LAN. My private-public router can do complex stateful tracking, because it only has to handle a few connections at a time. Meanwhile my grown-up internet devices go on the public side and get actual internet access, meaning that e.g. two people i…

> How many IoT devices need to allow incoming connections at all? And how many connections do they need to make?

If they need outgoing connections, they likely also need incoming when we are speaking about stateless filtering. Without incoming connections only UDP would be allowed and it would be usually impossible to determine if the packet should be send again (it would only be possible if there was out of band method to detect it).

Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.

Re: IAB Statement on IPv6

#82

Post by fulafel »

icedchai wrote: post #79
fulafel wrote: post #35

Earlier quoted context omitted.

IPv6 and a return to end-to-end addressing isn't really aligned with the AWS style of proprietary platform lock-in.

This makes no sense. AWS can give you IPv4 elastic IPs, which provide end-to-end addressing on IPv4. IPv6 will be no different in this regard. "End-to-end addressing" is typically an end user issue, where end users use NAT. In the early days of the internet, nobody used NAT.

AWS encourages you to use VPCs for service-internal addressing. Yes, you can rent "elastic IPs", but in the AWS mindset they are special and to be used only for NATing Internet endpoints to your services. It's based on end-to-end addressing being special and a scarce resource. This is compatible with the traditional corporate intranet style of thinking, but it's also in the opposite of internet end-to-end addressing and they are in no hurry to change it.

Re: IAB Statement on IPv6

#83

Post by lmm »

buzer wrote: post #81
lmm wrote: post #76

Earlier quoted context omitted.

How many IoT devices need to allow incoming connections at all? And how many connections do they need to make? IoT devices, if I had any use for them, would go on my private LAN. My private-public router can do complex stateful tracking, because it only has to handle a few connections at a time. Meanwhile my grown-up internet devices go on the public side and get actual internet access, meaning that e.g. two people i…

> How many IoT devices need to allow incoming connections at all? And how many connections do they need to make? If they need outgoing connections, they likely also need incoming when we are speaking about stateless filtering. Without incoming connections only UDP would be allowed and it would be usually impossible to determine if the packet should be send again (it would only be possible if there was out of band met…

> Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.

I have more faith in that than I have faith in a router that does complex state-tracking logic to not contain RCE vulnerabilities itself.

Re: IAB Statement on IPv6

#84

Post by lisivka »

cm2187 wrote: post #77
daurnimator wrote: post #2

IMO the major thing holding back IPv6 on the web is amazon. A huge proportion of services are hosted on AWS, and the lack of IPv6 addressing of instances cannot be forgiven.

I'd say ISPs to start with. In the UK, BT still hasn't rolled out IPv6. Neither has vodafone. Also I have servers in colocation with two datacenters, and for both I had to ask to the support to get an IPv6 range. We are very far from IPv6 becoming a standard feature.

It's time to switch HN to be IPv6 only forum, so 100% of HN'ers will be on IPv6 almost instantly. ;-)

Re: IAB Statement on IPv6

#85

Post by cm2187 »

Spooky23 wrote: post #38

I've not run into a problem solved by IPv6. There's no incentive for ISPs to provide good service, so they can just follow the mobile carrier route and nat/proxy when exhaustion becomes an issue. As other countries go IPv6, more IPv4 addresses become available for the big cloud providers.

IPSec is one. You would burn two IPv4 to enable IPSec between two machines you control. That's a no brainer with IPv6. It is cumbersome and expensive with IPv4.

And given that most datacentres (outside of cloud services) are IPv6 enabled, this makes sense to secure server to server communications.

Re: IAB Statement on IPv6

#86

Post by Latty »

cm2187 wrote: post #77
daurnimator wrote: post #2

IMO the major thing holding back IPv6 on the web is amazon. A huge proportion of services are hosted on AWS, and the lack of IPv6 addressing of instances cannot be forgiven.

I'd say ISPs to start with. In the UK, BT still hasn't rolled out IPv6. Neither has vodafone. Also I have servers in colocation with two datacenters, and for both I had to ask to the support to get an IPv6 range. We are very far from IPv6 becoming a standard feature.

> I'd say ISPs to start with. In the UK, BT still hasn't rolled out IPv6.

BT have at least partially rolled out support, as I have a v6 allocation on a BT broadband service.

Re: IAB Statement on IPv6

#87

Post by cm2187 »

Latty wrote: post #86
cm2187 wrote: post #77

Earlier quoted context omitted.

I'd say ISPs to start with. In the UK, BT still hasn't rolled out IPv6. Neither has vodafone. Also I have servers in colocation with two datacenters, and for both I had to ask to the support to get an IPv6 range. We are very far from IPv6 becoming a standard feature.

> I'd say ISPs to start with. In the UK, BT still hasn't rolled out IPv6. BT have at least partially rolled out support, as I have a v6 allocation on a BT broadband service.

I have read I can get it by upgrading to the very latest version of BT Home Hub (I am using 5). I ordered it yesterday. But my current Home Hub 5 is compatible, and I still don't have IPv6.

Re: IAB Statement on IPv6

#89

Post by tptacek »

proactivesvcs wrote: post #62
ncw33 wrote: post #51

Earlier quoted context omitted.

Not much! Just a few bytes for each packet. Running a NAT service requires a big table of all the active connections, ie. it's stateful - IPv6 with no NAT needs no per-connection state in the router so that's a big space-saving.

As I understand it, there have been a few nation-scale Internet outages that have been a result of IPv4 address tables reaching their resource ceiling (not relating to NAT) - another example of how IPv4 is no longer fit for purpose regarding hardware resources.

If 32 bit address tables are reaching capacity, increasing the size of the address space is unlikely to resolve the problem.

Re: IAB Statement on IPv6

#90

Post by cm2187 »

Spooky23 wrote: post #56
proactivesvcs wrote: post #46

Earlier quoted context omitted.

I run into NAT almost every single day. It wastes time, breaks things, consumes router resources, rules out certain technologies/products/services and duplicates so much work it's just unreal.

IPv6 != No NATing. Example: Verizon Wireless.

You mean IPv6 != No Firewall. Firewall are going to cause pretty much the same problems as NAT.
Post reply on HN