Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockers to IPv6 Adoption

labs.ripe.net

Post reply on HN
Print view View original

41–50 of 154 posts

Re: Blockers to IPv6 Adoption

#41

Post by kazen44 »

atemerev wrote: post #32

Of course it is the NAT. It always was the NAT. NAT is the easy thing, nearly effortless, that dramatically improves network security — there is a "bastion host" (router) and private network computers, almost impossible to be accessed from the outside without breaking the bastion host first. This is good security, and with NAT, everybody was getting it for free. With IPv6, it doesn't work this way, everybody needs to…

NAT is not a firewall. You are confusing the firewall function of your home router with NAT. NAT does nothing to prevent packets from flowing into your network, as NAT hole punching is fairly doable to accomplish.

Also, all consumer routers simply block any incoming IPV6 packets, this has been the default for more then 10 years now. (the only thing not blocked is ICMP for MTU path-discovery, which is actually a good thing).

Re: Blockers to IPv6 Adoption

#42

Post by kazen44 »

atemerev wrote: post #40
okket wrote: post #34

Earlier quoted context omitted.

Actually, I don't know one CPE IPv6 router that ships _without_ blocking the home network from the outside by default.

It is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.

what? this makes no sense?

For a corporate network, their requirements usually result in them having to manage their own ACL's anyways. It does not matter if that is IPV4 or IPV6. There is no "easy default" for corporate networks because they don't have easy requirements.

On a enterprise grade firewall/router, the end rule of an ACL is a DEFAULT DENY ANY ANY, on both ipv4 and ipv6. (this assumes you actually enable ACL's. But that depends on your platform).

Re: Blockers to IPv6 Adoption

#43

Post by [deleted] »

atemerev wrote: post #40
okket wrote: post #34

Earlier quoted context omitted.

Actually, I don't know one CPE IPv6 router that ships _without_ blocking the home network from the outside by default.

It is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.

[deleted]

Re: Blockers to IPv6 Adoption

#44

Post by Avamander »

M_Bakhtiari wrote: post #19
GvS wrote: post #16

I've enabled ipv6 on my ubuntu server recently and it was 100x slower. The only solution I found is to go back to ipv4: https://askubuntu.com/questions/759524/problem-with-ipv6-sud...

Was all IPv6 traffic slower or just this one apparently misconfigured host? If the former I'd image this is a kernel bug and has nothing to do with any Ubuntu servers.

It honestly doesn't matter what bug it is. It should be promptly investigated further and solved. Random blame assignment doesn't help anyone. In this case though, seeing how most mirrors still can't do HTTPS I would not be surprised if the IPv6 issue is caused by the mirrors - another thing not yet properly configured.

Re: Blockers to IPv6 Adoption

#46

Post by sliken »

lwhalen wrote: post #17

Comcast is my biggest blocker to IPv6 adoption. I maintain a static v4 block with them, they tell me I have to give that up if I want a v6 block. Until I give up v4, v6 works on my network right up to the Comcast modem, and is promptly dropped on the floor. Regrettably, that is 'no bueno' for a multitude of reasons. :-(

Very weird, the Comcast consumer lines support IPv6 quite well. Their default is to give a /60, which seems appropriately overkill. Generally it "just works", and my roku, android phones, and similar average over 50% of the packets on IPv6.

Comcast seems like one of the largest deployments of IPv6 for normal consumers outside of the cell companies.

Re: Blockers to IPv6 Adoption

#47

Post by atemerev »

skrause wrote: post #38
atemerev wrote: post #32

Of course it is the NAT. It always was the NAT. NAT is the easy thing, nearly effortless, that dramatically improves network security — there is a "bastion host" (router) and private network computers, almost impossible to be accessed from the outside without breaking the bastion host first. This is good security, and with NAT, everybody was getting it for free. With IPv6, it doesn't work this way, everybody needs to…

It's actually just as easy with IPv6. All you need is a stateful firewall which allows all outgoing connections and only allows incoming packets for already established connections. This was the default setting on my home router and behaves exactly like a NAT.

It is easy enough, but it is fragile. If NAT is misconfigured, your network stops working. If firewall is misconfigured (or e.g. your network topology has changed and you forgot to update the firewall configuration), the network works, but it is exposed to the elements and security goes away. We have enough security problems with IoT even in mostly IPv4 world; with massive IPv6 deployment, it wilk be a total nightmare.

Re: Blockers to IPv6 Adoption

#48

Post by Jack5500 »

I still think that while the hardware may be ready by now, the software certainly isn't. Not only does an IPv6 break a lot of old software,that's not designed for the stack. Even today, not all network librarys do support IPv6. It's nothing that can't be worked out, but we are just not there yet and will never be there until a forced adaption comes into play.

Re: Blockers to IPv6 Adoption

#49

Post by atemerev »

kazen44 wrote: post #42
atemerev wrote: post #40

Earlier quoted context omitted.

It is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.

what? this makes no sense? For a corporate network, their requirements usually result in them having to manage their own ACL's anyways. It does not matter if that is IPV4 or IPV6. There is no "easy default" for corporate networks because they don't have easy requirements. On a enterprise grade firewall/router, the end rule of an ACL is a DEFAULT DENY ANY ANY, on both ipv4 and ipv6. (this assumes you actually enable A…

You a talking about large corporations. I am talking about small and medium business where networks are abused and misconfigured in every way, and the only thing holding them relatively undamaged is the NAT. There are millions of them.

Re: Blockers to IPv6 Adoption

#50

Post by olavk »

m0dest wrote: post #22

Decades from now, the story of IPv6 will be a cautionary tale about the danger of ignoring incentives when enhancing open standards. So much of the spec seems to have been designed in an idealist vacuum that the promoters are blind to its own failures. The addresses are ugly and impossible to memorize but that shouldn't matter because... There are no performance advantages but that was out of scope because... There a…

IPv6 was designed in the early 90'ies where the internet looked very different - this was even before the web. Large scale changes were much easier to coordinate and roll out. I dont think the players at that time needed incentives beyond knowing that the upgrade solved the address space problem.

The problems of adoption can be compared to the Python 3 debacle. When Python 3 was first planned, Python were mostly used by enthusiasts which would be quick to adopt a new version - even if it had a few minor incompatible changes. But when the release finally rolled out, Python had become much more popular and entrenched and widely used by business and scientists which were more reluctant to adopt breaking changes.

Post reply on HN