Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Going IPv6 Only [pdf]

pc.nanog.org

Post reply on HN
Print view View original

41–50 of 112 posts

Re: Going IPv6 Only [pdf]

#41

Post by Eech0Shu »

okket wrote: post #35
phicoh wrote: post #11

It is weird to call this 'IPv6 Only'. Connectivity to the IPv4 internet is still provided. It is just that to talk IPv4 you have to go through a couple of complex translation steps.

It is IPv6 only with a fallback connection to the legacy IPv4 protocol with little to no chance of a reverse connection. Sadly, too much content is still stuck in this rapidly ageing world. Bandaid after bandaid won't help in the long term. Do we really want a one way connection world? If not, adapt IPv6. By default IPv6 CPE gear blocks incoming connections, which is good. Firewall rules can be changed, if needed. Yo…

There's some RFC suggesting that CGNATs handle PCP requests from the CPE thus allowing incoming connections. But sadly that's not implemented everywhere.

Re: Going IPv6 Only [pdf]

#42

Post by metafunctor »

axaxs wrote: post #2

Credit where it's due. I'm generally against anything the big 4 touch, but TMo has been absolutely on the forefront of IPv6. The first time I saw IPv6 in the wild was while on a TMo data connection.

Sorry, but anything in the US hasn't really been in the forefront of IPv6 adoption.

Re: Going IPv6 Only [pdf]

#43

Post by azernik »

skrause wrote: post #13

Looking at mechanisms like 464XLAT, why are these currently favored over DS-Lite [1]? To me DS-Lite seems like a simple and elegant solution if you don't have a lot of public IPv4 addresses, 464XLAT looks much more compilcated. [1] https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual...

464XLAT is simpler because it gets to piggyback off of other infrastructure that is already in place for forward-compatibility, namely NAT64 and DNS64.

Not sure how much of this background you need, but since Wikipedia doesn't explain it well: as an ISP, you want your IPv6-only customers to be able to access the IPv4 internet. So you represent the entire IPv4 internet as an IPv6 prefix (generally ::ffff:0:0:0/96) and get IPv6 clients to send their IPv4 traffic to that subnet. So e.g. if they user wants to access an IPv4 service at 1.2.3.4, you instead send them a DNS response with the address ::ffff:0:12:34. Then you route packets to the "IPv4 subnet" to a system that both does NAT and translates packets from v4 to v6.

The main point here is that you have to implement this or some other non-DS-Lite solution, because it solves a problem that DS-Lite does not address: support for IPv6-only clients on an IPv6-only ISP that still want to talk to old IPv4 servers.

Where this gets interesting is that once you've implemented NAT64 + DNS64, a solution to the backward-compatibility problem falls out neatly - convert IPv4 packets to IPv6 packets using a reverse of the protocol-aware translation that NAT64 boxes do, and then feed those into the NAT64-enabled network. So the marginal complexity for solving the backward-compatibility problem through 464XLAT is lower than implementing all of DS-Lite.

Re: Going IPv6 Only [pdf]

#44

Post by Arnt »

metafunctor wrote: post #42
axaxs wrote: post #2

Credit where it's due. I'm generally against anything the big 4 touch, but TMo has been absolutely on the forefront of IPv6. The first time I saw IPv6 in the wild was while on a TMo data connection.

Sorry, but anything in the US hasn't really been in the forefront of IPv6 adoption.

An ISP with ten million v6-only users is not on the forefront? Be fair please.

Re: Going IPv6 Only [pdf]

#45

Post by vetinari »

pilif wrote: post #36
singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

> Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? no. If an ISP assigns you a dynamic prefix and the various machines in your network use any one of the various privacy features like temporary addresses then the only additional information you leak is some information about how many devices are in your LAN, but as the devices make up additional addresses,…

Technically, per IPv6 Address Allocation and Assignment Policy[1], there's no such things as a static IPv6 address, only address leased for a long enough period to be effectively static.

[1] https://www.ripe.net/publications/docs/ripe-552#4

Re: Going IPv6 Only [pdf]

#46

Post by _trampeltier »

pilif wrote: post #36
singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

> Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? no. If an ISP assigns you a dynamic prefix and the various machines in your network use any one of the various privacy features like temporary addresses then the only additional information you leak is some information about how many devices are in your LAN, but as the devices make up additional addresses,…

In switzerland we have still no IPv6 on mobile phones at all in 2018 :-(

With my provider green.ch it is not possible to get a static IPv6.

Re: Going IPv6 Only [pdf]

#47

Post by djsumdog »

singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

Besides what others are saying, you also have to keep in mind that IPv4 exhaustion means that at some point, IPv4 addresses could become very expensive. Many countries are already totally out. I worked in one data center where we were purchasing blocks from companies in Africa.

My question is, without continued adoption of IPv6, could we get to the point where there are two Internets? One that is more accessible for companies that can still afford IPv4 addresses for their servers? Or will worrying about IPv4 users be such an edge case that it will be like designing for IE11?

Re: Going IPv6 Only [pdf]

#48

Post by nickik »

pilif wrote: post #36
singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

> Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? no. If an ISP assigns you a dynamic prefix and the various machines in your network use any one of the various privacy features like temporary addresses then the only additional information you leak is some information about how many devices are in your LAN, but as the devices make up additional addresses,…

You can get static IPv6 from Fiber7.

Re: Going IPv6 Only [pdf]

#49

Post by pilif »

devereaux wrote: post #5

On my home network, all my device have IPv6. Unfortunately, it not native IPv6: the AT&T LTE device I use for my home internet doesn't support IPv6. (Why LTE? It's a long story- I frequently travel, and I take my connection with me. Comcast doesn't make much sense. LTE latency and bandwidth are good enough) Anyway, whenever I get a server, I make sure IPv6 is supported. No IPv6, no business from me -- even for a VPS.…

> I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler.

Exposing an sshd to the public internet seems very risky. IPv6 or not.

Even with v6 in your LAN, you probably still want the firewall to drop all incoming connections and then use some kind of VPN or bastion host to get inside

Re: Going IPv6 Only [pdf]

#50

Post by ajdlinux »

metafunctor wrote: post #42
axaxs wrote: post #2

Credit where it's due. I'm generally against anything the big 4 touch, but TMo has been absolutely on the forefront of IPv6. The first time I saw IPv6 in the wild was while on a TMo data connection.

Sorry, but anything in the US hasn't really been in the forefront of IPv6 adoption.

Google's IPv6 statistics (https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...) show that the US is ahead of literally every other country in the world, so I think it's fair to say US ISPs aren't doing too badly.
Post reply on HN