Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockers to IPv6 Adoption

labs.ripe.net

Post reply on HN
Print view View original

101–110 of 154 posts

Re: Blockers to IPv6 Adoption

#101

Post by sliken »

4ad wrote: post #76
sliken wrote: post #46

Earlier quoted context omitted.

Very weird, the Comcast consumer lines support IPv6 quite well. Their default is to give a /60, which seems appropriately overkill. Generally it "just works", and my roku, android phones, and similar average over 50% of the packets on IPv6. Comcast seems like one of the largest deployments of IPv6 for normal consumers outside of the cell companies.

> Their default is to give a /60, which seems appropriately overkill. A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it. The recommended size of block that every ISP should give is /48 (RFC 6177)…

Seems pretty huge to me. I could give just about every person on the planet (call it 8 billion or 2^33) each their own personal IPv4 (2^32) worth of IPs.

I've got a larger then normal home router with 6 ports. I can have a /64 for each, and still have a bunch left over if I want to split up wireless into more secure, medium secure, less secure, and least secure networks.

I'm all for more address space, but I'm at a loss as to why a normal even a sophisticated home user needs more than a /60.

I wouldn't turn down a /48, but realistically I've got 30 or so IPs in use. Sure recently I added an IP for a wristwatch, TV, and a stereo. Clearly cheaper devices are getting Wifi. It's becoming more common in appliances, thermostats, door locks, electrical outlets, light bulbs etc. But 2^64 pennies is quite a bit, and I doubt anything will be consuming more than one IP per $0.01 of cost anytime soon.

Re: Blockers to IPv6 Adoption

#102

Post by vetinari »

beagle3 wrote: post #86
vetinari wrote: post #68

Earlier quoted context omitted.

> Yes you can punch holes in NAT, but that's an explicit action (well side-stepping the insanity that is UPnP) for for non-technical users sitting behind a NAT router will effectively mean that they're unlikely to receive direct inbound network attacks from the Internet. Hole punching the NAT does not mean that the user will configure port forwarding. It means that the outside is able to send packets inside, without…

> without any explicit user action. It works, because most NAT implementations do not check the source IP address, so when user sends packets from port A to ip X, and the router receives packets to port A from ip Y, it will dutifully forward them, even if they are not related. That is completely untrue. The vast majority of home routers (I would venture 99% of them) run Linux, and use the built in NAT, which does che…

> That is completely untrue. The vast majority of home routers (I would venture 99% of them) run Linux, and use the built in NAT, which does check source IP, for both TCP and UDP connections

Of course it is true. The true thing you wrote is, that Linux is one of the few implementations that do check the source IPs. However, even if many home routers do run Linux, it does not mean that they use Linux's NAT. Many do not have enough CPU power to route/NAT at the speeds needed, so they have hw acceleration for that, and that is a separate implementation.

But hey, why do you think hole punching is a thing? Because it works, relatively large scale.

Re: Blockers to IPv6 Adoption

#103

Post by zAy0LfpBZLC8mAC »

MR4D wrote: post #58
grandinj wrote: post #20

What we should take away from the IPv6 debacle is a fine lesson in hubris. I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated. The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it." Except that new router hardware and new incrementa…

Well said! I was in the camp hoping for two octects at the beginning of the address (so they could be zeroes). Actually, a single i text would have taken us to a trillion IPs and given us enough time to think about the topic a bit more. Large changes rarely succeed. Perl 6, Mozilla (back in the 1990’s) and others come to mind. This is hard stuff, and we were made to swallow the kitchen sink.

So, what are the changes in IPv6 other than change in address size that hinder adoption?

Re: Blockers to IPv6 Adoption

#104

Post by 4ad »

detaro wrote: post #78
4ad wrote: post #76

Earlier quoted context omitted.

> Their default is to give a /60, which seems appropriately overkill. A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it. The recommended size of block that every ISP should give is /48 (RFC 6177)…

How does a household with 3 people need 14 subnets? I agree a /60 is stingy, but "not enough even for a normal household of 3 people" sounds like massive hyperbole. Even as a tech enthusiast filling that would be some work, unless you insist I use a /64 for point-to-point links.

> Even as a tech enthusiast filling that would be some work

Have you ever used VMs on a laptop? How many virtual networks do you need? Only one? With only one you only need one extra bit bit for routing, so you could give a /63 instead of a /64 to your laptop, except that IPv6 allocation is supposed to be done in nibbles (and you need to overprovison anyway, what if tomorrow you need two networks?), so the next logical step is a /60, which means your ISP should give you at least a /56. Personally, I use much more than one virtual network on my laptops, so I would need a /60 anyway (if I want to keep all the nice properties of IPv6, that is).

As long as you want to keep everything nice with IPv6, the block you need is /64-(4*n), where n is the level of routing you plan to do.

> unless you insist I use a /64 for point-to-point links.

Each p2p link on IPv6 uses a /64 (even though it's only assigned an /127).

> How does a household with 3 people need 14 subnets?

In the IoT era (where S stands for security), if you don't put each IoT device in its own VLAN, you are in for a surprise.

Re: Blockers to IPv6 Adoption

#105

Post by 4ad »

sliken wrote: post #101
4ad wrote: post #76

Earlier quoted context omitted.

> Their default is to give a /60, which seems appropriately overkill. A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it. The recommended size of block that every ISP should give is /48 (RFC 6177)…

Seems pretty huge to me. I could give just about every person on the planet (call it 8 billion or 2^33) each their own personal IPv4 (2^32) worth of IPs. I've got a larger then normal home router with 6 ports. I can have a /64 for each, and still have a bunch left over if I want to split up wireless into more secure, medium secure, less secure, and least secure networks. I'm all for more address space, but I'm at a l…

That's not how IPv6 works. In IPv6 the lower 64 bits are essentially random, and the most significant 64 bits are used for routing. Each additional level of routing must use up one bit, except because of over-provisioning concerns, and to keep everything nice, you are supposed to use a nibble (4 bits).

A /64 can't be subnetted any more (one host, NO VMs!).

A /60 can support one level of extra routing.

A /56 can support two levels of extra routing.

If you plan to run VMs on your laptop, you need a /60 on your laptop, which means you need a /56 from your ISP. If you want to keep everything nice and future proof, that is, if you want to fuck up with special configurations, you can use your /60 from your ISP, and give a /62 to your laptop, then each laptop can have 4 networks for VMs. But that is limiting and a PITA to set-up.

Re: Blockers to IPv6 Adoption

#106

Post by JdeBP »

atemerev wrote: post #32

Of course it is the NAT. It always was the NAT. NAT is the easy thing, nearly effortless, that dramatically improves network security — there is a "bastion host" (router) and private network computers, almost impossible to be accessed from the outside without breaking the bastion host first. This is good security, and with NAT, everybody was getting it for free. With IPv6, it doesn't work this way, everybody needs to…

I recommend reading the likes of https://security.stackexchange.com/questions/8772/ , https://superuser.com/questions/237790/ , https://security.stackexchange.com/questions/155159/ , https://f5.com/resources/white-papers/the-myth-of-network-ad... , and a lot of other writings in this vein.

Re: Blockers to IPv6 Adoption

#107

Post by tinus_hn »

mino wrote: post #85
alex_duf wrote: post #80

Yet adoption is still growing exponentially https://www.google.com/intl/en/ipv6/statistics.html It's not as fast as past me would have hoped for and I think the criticism is perfectly valid but I'm quite happy to look at this graph no and again

Not really, see slide 4 of Geoff Huston's talk at RIPE76: https://ripe76.ripe.net/wp-content/uploads/presentations/9-2... It is actually growing slower and slower and looking as a logistic curve, which is perhaps unsurprising. Also note the increasing gap between weekdays and weekends, which is a sign that enterprises don't care about v6.

Enterprises move very slowly and don’t implement unnecessary changes. Unsurprising indeed.

Re: Blockers to IPv6 Adoption

#108

Post by beagle3 »

vetinari wrote: post #102
beagle3 wrote: post #86

Earlier quoted context omitted.

> without any explicit user action. It works, because most NAT implementations do not check the source IP address, so when user sends packets from port A to ip X, and the router receives packets to port A from ip Y, it will dutifully forward them, even if they are not related. That is completely untrue. The vast majority of home routers (I would venture 99% of them) run Linux, and use the built in NAT, which does che…

> That is completely untrue. The vast majority of home routers (I would venture 99% of them) run Linux, and use the built in NAT, which does check source IP, for both TCP and UDP connections Of course it is true. The true thing you wrote is, that Linux is one of the few implementations that do check the source IPs. However, even if many home routers do run Linux, it does not mean that they use Linux's NAT. Many do no…

Hole punching refers to cooperative nat traversal, that is, with help from the inside - in every discussion I have ever seen.

Care to point to 3 examples of common home routers that do not check source IP? I’ve verified many TP-Links, Linksys (when they were owned by Cisco) and Netgears, and all used the kernel to NAT (and yes, they couldn’t do the 1Gb while NATting - usually 300-700 or so. And much lower if you use IPSEC)

Re: Blockers to IPv6 Adoption

#109

Post by dvfjsdhgfv »

grandinj wrote: post #20

What we should take away from the IPv6 debacle is a fine lesson in hubris. I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated. The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it." Except that new router hardware and new incrementa…

> Instead we have this baroque construction, which I _still_ have to explicitly disable in my work environment because various bits of supposedly IPV6 software don't play nice together.

Most security-conscious people do the same.

Re: Blockers to IPv6 Adoption

#110

Post by detaro »

4ad wrote: post #104
detaro wrote: post #78

Earlier quoted context omitted.

How does a household with 3 people need 14 subnets? I agree a /60 is stingy, but "not enough even for a normal household of 3 people" sounds like massive hyperbole. Even as a tech enthusiast filling that would be some work, unless you insist I use a /64 for point-to-point links.

> Even as a tech enthusiast filling that would be some work Have you ever used VMs on a laptop? How many virtual networks do you need? Only one? With only one you only need one extra bit bit for routing, so you could give a /63 instead of a /64 to your laptop, except that IPv6 allocation is supposed to be done in nibbles (and you need to overprovison anyway, what if tomorrow you need two networks?), so the next logic…

> Have you ever used VMs on a laptop? How many virtual networks do you need?

Very few, to the point of "if it's more than one, the other ones aren't intended be reachable and thus don't need public space".

> Each p2p link on IPv6 uses a /64 (even though it's only assigned an /127).

No, it doesn't, since my routers don't need to do SLAAC between each other, but can happily live with static IPs.

> In the IoT era (where S stands for security), if you don't put each IoT device in its own VLAN, you are in for a surprise.

Never felt the need to put each device in it's own subnet, sensible firewalling seems enough. I tend to avoid devices that really want to talk to the internet though, so most of the time it's "you don't get to talk to the internet"-subnet. But ok, if you love connected stuff and want to split it in very fine ways, that'd be a bunch of subnets.

So yes, as I said /56 would be nice and should be the default but /60 is likely to be enough for the vast majority of users.

Post reply on HN