Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockers to IPv6 Adoption

labs.ripe.net

Post reply on HN
Print view View original

111–120 of 154 posts

Re: Blockers to IPv6 Adoption

#111

Post by detaro »

mehrdadn wrote: post #98
detaro wrote: post #89

Earlier quoted context omitted.

Interesting. Name and shame a few brands/models? That stuff needs to be widely warned about.

You know, I really have to apologize, because it seems I missed a critical detail that changed the entire story. Thanks to both of you for making me go double-check. What happened was I vividly recalled seeing "stateless" as the default option for the router I had in mind over a year ago. Which was indeed correct. However, in response to the other comment I went back and checked again, and just noticed that "stateles…

Thanks for checking. I actually also expected this to be an issue when IPv6 started to become a thing, but I've seen very little in the way of reports of it and am positively surprised that manufacturers appear to be copying templates that do it properly, so I'm more worried about crap like the "forgotten" backdoors, exposed management interfaces like UPnP, ... right now.

Re: Blockers to IPv6 Adoption

#112

Post by dvfjsdhgfv »

mino wrote: post #59
cornholio wrote: post #6

I think the author is approaching this the wrong way, it's trivial to show the advantages listed are mostly not true. The marginal benefits are more than negated by the risks and costs of IPv6. IPv6 is not the product that needs to be sold, and deploying it usually has negative cost benefit on short term, for most businesses. IPv6 needs to be deployed today because the internet literally cannot move forward without i…

Enterprises are doing the right thing, ignoring v6. No advantage whatsoever for a long time to come, only added complexity and training. As a network engineer and enthusiast, I would do the same.

I wouldn't say it's "the right thing", but it definitely makes sense in most scenarios. Who in their right mind would voluntarily welcome a new layer of complexity into their network when it's not really necessary?

Re: Blockers to IPv6 Adoption

#113

Post by zAy0LfpBZLC8mAC »

mehrdadn wrote: post #62
ge0rg wrote: post #61

Earlier quoted context omitted.

It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?

The one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...

> Which reduces the attack surface immensely.

No, it doesn't. The "attack surface" is a IP stack that looks in some hash tables whether there is anyone listening on the port, and then rejects the connection. Vs. a huge browser with a javascript interpreter and JIT and what have you that is accessible regardless of NAT or firewalls or whatever else you do on the network level. The fear of inbound connections is completely irrational.

Re: Blockers to IPv6 Adoption

#114

Post by mehrdadn »

detaro wrote: post #111
mehrdadn wrote: post #98

Earlier quoted context omitted.

You know, I really have to apologize, because it seems I missed a critical detail that changed the entire story. Thanks to both of you for making me go double-check. What happened was I vividly recalled seeing "stateless" as the default option for the router I had in mind over a year ago. Which was indeed correct. However, in response to the other comment I went back and checked again, and just noticed that "stateles…

Thanks for checking. I actually also expected this to be an issue when IPv6 started to become a thing, but I've seen very little in the way of reports of it and am positively surprised that manufacturers appear to be copying templates that do it properly, so I'm more worried about crap like the "forgotten" backdoors, exposed management interfaces like UPnP, ... right now.

Interesting. Note that this router manufacturer is probably one of the better ones, so I wouldn't weight this data point too much for generalizing, but that's good to know.

Re: Blockers to IPv6 Adoption

#115

Post by [deleted] »

detaro wrote: post #110
4ad wrote: post #104

Earlier quoted context omitted.

> Even as a tech enthusiast filling that would be some work Have you ever used VMs on a laptop? How many virtual networks do you need? Only one? With only one you only need one extra bit bit for routing, so you could give a /63 instead of a /64 to your laptop, except that IPv6 allocation is supposed to be done in nibbles (and you need to overprovison anyway, what if tomorrow you need two networks?), so the next logic…

> Have you ever used VMs on a laptop? How many virtual networks do you need? Very few, to the point of "if it's more than one, the other ones aren't intended be reachable and thus don't need public space". > Each p2p link on IPv6 uses a /64 (even though it's only assigned an /127). No, it doesn't, since my routers don't need to do SLAAC between each other, but can happily live with static IPs. > In the IoT era (where…

[deleted]

Re: Blockers to IPv6 Adoption

#116

Post by majidazimi »

4ad wrote: post #105
sliken wrote: post #101

Earlier quoted context omitted.

Seems pretty huge to me. I could give just about every person on the planet (call it 8 billion or 2^33) each their own personal IPv4 (2^32) worth of IPs. I've got a larger then normal home router with 6 ports. I can have a /64 for each, and still have a bunch left over if I want to split up wireless into more secure, medium secure, less secure, and least secure networks. I'm all for more address space, but I'm at a l…

That's not how IPv6 works. In IPv6 the lower 64 bits are essentially random, and the most significant 64 bits are used for routing. Each additional level of routing must use up one bit, except because of over-provisioning concerns, and to keep everything nice, you are supposed to use a nibble (4 bits). A /64 can't be subnetted any more (one host, NO VMs!). A /60 can support one level of extra routing. A /56 can suppo…

> A /64 can't be subnetted any more (one host, NO VMs!).

Why not directly bind all VMs to laptop's NIC? This way, they can get IP from the same /64 subnet. On firewall, only enable public access to those VMs that are needed.

I do have a home lab, but every VM is directly bridged to NIC and gets its IP from home router. So a single /64 is sufficient for me.

Re: Blockers to IPv6 Adoption

#117

Post by 4ad »

majidazimi wrote: post #116
4ad wrote: post #105

Earlier quoted context omitted.

That's not how IPv6 works. In IPv6 the lower 64 bits are essentially random, and the most significant 64 bits are used for routing. Each additional level of routing must use up one bit, except because of over-provisioning concerns, and to keep everything nice, you are supposed to use a nibble (4 bits). A /64 can't be subnetted any more (one host, NO VMs!). A /60 can support one level of extra routing. A /56 can suppo…

> A /64 can't be subnetted any more (one host, NO VMs!). Why not directly bind all VMs to laptop's NIC? This way, they can get IP from the same /64 subnet. On firewall, only enable public access to those VMs that are needed. I do have a home lab, but every VM is directly bridged to NIC and gets its IP from home router. So a single /64 is sufficient for me.

Sometimes it's fine to do that, other times it isn't. If you plan to test network topology, firewalls, you can't do that. If you plan to run untrusted VMs, you also can't do that.

Re: Blockers to IPv6 Adoption

#118

Post by okket »

4ad wrote: post #117
majidazimi wrote: post #116

Earlier quoted context omitted.

> A /64 can't be subnetted any more (one host, NO VMs!). Why not directly bind all VMs to laptop's NIC? This way, they can get IP from the same /64 subnet. On firewall, only enable public access to those VMs that are needed. I do have a home lab, but every VM is directly bridged to NIC and gets its IP from home router. So a single /64 is sufficient for me.

Sometimes it's fine to do that, other times it isn't. If you plan to test network topology, firewalls, you can't do that. If you plan to run untrusted VMs, you also can't do that.

I'd use a unique local address network (/32) for this

https://tools.ietf.org/html/rfc4193

Re: Blockers to IPv6 Adoption

#119

Post by 4ad »

okket wrote: post #118
4ad wrote: post #117

Earlier quoted context omitted.

Sometimes it's fine to do that, other times it isn't. If you plan to test network topology, firewalls, you can't do that. If you plan to run untrusted VMs, you also can't do that.

I'd use a unique local address network (/32) for this https://tools.ietf.org/html/rfc4193

That's fine for some scenarios, but in general for my use cases, I wouldn't, because most often I want my VMs to be accessible from the Internet.

Re: Blockers to IPv6 Adoption

#120

Post by y0ghur7_xxx »

kazen44 wrote: post #37
y0ghur7_xxx wrote: post #14

I deployed a dual ipv4 + ipv6 stack on my home lan a few years ago. I got myself a /48 from hurricane electric, and did everything like it's in the book: SLAAC for subnets, fixed addresses on servers, every device had a public ipv6 and the firewall allowed or denied stuff. Everything worked as it should work. One day something stopped working on the he tunnel, and as I was about to debug what went wrong, I just asked…

IPv6 brings some pretty nice features in terms of network engineering. the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue.[1] We need IPv6 to remove the horrible IPV4 space fragmentation. http://bgphelp.com/2017/01/01/bgpsize/

> the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue.

But that's not a problem for me. It's a problem for my isp. And if he does not care, why should I?

Post reply on HN