Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Going IPv6 Only [pdf]

pc.nanog.org

Post reply on HN
Print view View original

91–100 of 112 posts

Re: Going IPv6 Only [pdf]

#91

Post by tialaramex »

pilif wrote: post #49
devereaux wrote: post #5

On my home network, all my device have IPv6. Unfortunately, it not native IPv6: the AT&T LTE device I use for my home internet doesn't support IPv6. (Why LTE? It's a long story- I frequently travel, and I take my connection with me. Comcast doesn't make much sense. LTE latency and bandwidth are good enough) Anyway, whenever I get a server, I make sure IPv6 is supported. No IPv6, no business from me -- even for a VPS.…

> I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. Exposing an sshd to the public internet seems very risky. IPv6 or not. Even with v6 in your LAN, you probably still want the firewall to drop all incoming connections and then use some kind of VPN or bastion host to get inside

If you just choose a completely arbitrary IPv6 address in your subnet for the server, random bad guys won't find it.

This feels unintuitive, after all my IPv4 SSH servers have people banging on them 24/7, but that's orders of magnitude for you, bad guys who can try one host per second every second of every day, for a lifetime, can explore all of the actively deployed unicast IPv4 space. But those same bad guys will drown in the enormity of a single 64-bit IPv6 home subnet, never finding anything unless a well known address (e.g. ::80 for a web server is popular) was used for a server.

If you use the default static addressing ("default" in the protocol sense, it's not the default in any major desktop OS today) they might find you, in a lifetime's worth of searching, by being clever and looking at specific device manufacturers. You probably have a MAC address from a popular company like Intel or 3Com, and there are only a few billion of those laying around, so it's a headstart.

But you don't have to give them that headstart. So don't, just pick a random address from the other half of the pool. Roll dice if you don't trust your RNG.

Re: Going IPv6 Only [pdf]

#92

Post by arbitrage »

bogomipz wrote: post #54
kazen44 wrote: post #20

Earlier quoted context omitted.

the "clusterfuck" the introduced is mostly a nice thing in my opinion. Things like MTU path-discovery, NDP and SLAAC make a lot of sense and are definitely improvements over the solutions we have in IPv4. Broadcast makes little sense on a layer 3 perspective. The use of link-local and unique-global addresses also makes sense, and having a different address class for multicast makes implementing multicast more conveni…

I agree with all of your points. I didn't understand this however: >"and having a different address class for multicast makes implementing multicast more convenient." IPV4 has a different class for multicast as well - the first 4 bits are 1110. IP range 224.0.0.0 - 239.255.255.255. Or did you mean something else?

I doubt it, it's conceptually the same, as you say. I think this is just exemplary of just how much most people, even tech people, don't understand the underlying networking paradigm.

Re: Going IPv6 Only [pdf]

#93

Post by neojima »

ancarda wrote: post #80
neojima wrote: post #65

Earlier quoted context omitted.

As mentioned/hinted by ancarda: a) You missed Belgium. (Common oversight, due to the size on the map.) b) Google's stats have something of a US-centric bias; https://stats.labs.apnic.net/ipv6/ is a little less biased (which also shows Belgium and India in the lead).

Thanks for that link, it's good to see more measurements. Would you elaborate a bit on APNIC's data having less bias than Google? As far as I know, Google is quite popular worldwide, with the exception of China, so measurements taken on Google servers should give decent accuracy for every country. Do you know how APNIC get their data? I'm happy to switch over to it if it's more representative and accurate.

https://labs.apnic.net/?p=479

https://labs.apnic.net/?p=655

From what I've gleaned, the use of Google ads catches the use case of people who don't actively use Google -- based on the delta in metrics between Google's stats and APNIC's, I would suspect that Google isn't quite as popular globally as you think it is (but their ad platform is!).

Re: Going IPv6 Only [pdf]

#94

Post by supertrope »

bcaa7f3a8bbc wrote: post #90
pilif wrote: post #86

Earlier quoted context omitted.

oppressive regimes will assign people static IPv4 addresses tied with their legal identities.

If IPv4 pools and carrier-grade IPv4 NATs spreads all over the network, a user's identity is revealed to the oppressive regimes in primarily two ways: a) IP pool logging, requires a known IP address and time. b) NAT logging, requires a known IP address, outgoing port number, and time. It means the cost of tracking users is moderate to ISPs and authorities, also, for a random observer without access to internal record…

Belgium limited ISP side NAT to 16:1 for law enforcement/national security log retention reasons.

Re: Going IPv6 Only [pdf]

#95

Post by neojima »

ajdlinux wrote: post #68
ancarda wrote: post #52

Earlier quoted context omitted.

Belgium (50.02%) is ahead of the USA (37.19%) on that chart, although you may have missed that as it's quite a small country. Click "Europe" to zoom in a bit. Alternative data from Facebook -- https://www.facebook.com/ipv6/?tab=ipv6_country -- is quite a bit different but shows Belgium (50.45%) and India (50.27%) are both slightly ahead the US (49.28%). It's very hard to measure IPv6 adoption. I would personally go w…

Ah, I did indeed miss Belgium. Surprising they don't have a table.

That's another benefit of https://stats.labs.apnic.net/ipv6/ -- the tables, including down to ASN.

Re: Going IPv6 Only [pdf]

#96

Post by supertrope »

clord wrote: post #89
unethical_ban wrote: post #81

Earlier quoted context omitted.

My IPv4 lease has been static for the past several months. It very rarely changes; I would have to spoof a MAC address on my WAN router to get it to change.

you don't have to spoof, just leave the WAN device off around the time when your dhcp lease expires. When you come back online, you'll find you have a new lease with likely a new address.

My ISP no longer issues a new IP address upon router change. I'd probably have to go offline for at least a few hours or simultaneously change modem and router. In the meantime my household would notice, our phones would consume more of our cellular quota, my IP phone wouldn't ring, and even my thermostat would lose remote control functionality.

I'm not sure if it's the IPv4 shortage or copyright infringement/government surveillance pressure to maintain tight linkage between IP address, account, and legally liable person or address to raid.

Re: Going IPv6 Only [pdf]

#97

Post by supertrope »

tialaramex wrote: post #91
pilif wrote: post #49

Earlier quoted context omitted.

> I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. Exposing an sshd to the public internet seems very risky. IPv6 or not. Even with v6 in your LAN, you probably still want the firewall to drop all incoming connections and then use some kind of VPN or bastion host to get inside

If you just choose a completely arbitrary IPv6 address in your subnet for the server, random bad guys won't find it. This feels unintuitive, after all my IPv4 SSH servers have people banging on them 24/7, but that's orders of magnitude for you, bad guys who can try one host per second every second of every day, for a lifetime, can explore all of the actively deployed unicast IPv4 space. But those same bad guys will d…

No longer letting ssh listen on IPv4 address definitely cuts down on brute force attempts. One caveat is someone cleverly found a workaround to do the seemingly impossible task of scanning IPv6 address ranges. They hosted a NTP server and harvested live addresses. So I guess those who disable NTP on the most sensitive VMs might be right. One is already suppose to have a local NTP server anyway, if only by pointing hosts to the firewall's ntpd.

Re: Going IPv6 Only [pdf]

#98

Post by supertrope »

pilif wrote: post #85
jacob019 wrote: post #83

Earlier quoted context omitted.

disable password authentication, ssh keys are secure enough

would you rather emergency security patch opensshd on 10 machines or one bastion host?

If you're worried about zero days you might consider not allowing SSH through firewall and requiring connecting to VPN first. That'd require a flaw in both OpenVPN and SSH.

Re: Going IPv6 Only [pdf]

#99

Post by nickik »

pilif wrote: post #87
nickik wrote: post #48

Earlier quoted context omitted.

You can get static IPv6 from Fiber7.

I know. And they even delegate the ip6.arpa domain so you can do reverse lookups with your own DNS server. source: I'm fiber7 customer since 2014 and they offered me to do the delegation when I asked them for the static prefix.

Nice. I had the FTTH.300 and only got Fiber7 yesterday. I don't have my own DNS as friend hosts my stuff.

The static prefix is nice and they will also basically give you static IPv4 even without paying.

Re: Going IPv6 Only [pdf]

#100

Post by jacob019 »

pilif wrote: post #85
jacob019 wrote: post #83

Earlier quoted context omitted.

disable password authentication, ssh keys are secure enough

would you rather emergency security patch opensshd on 10 machines or one bastion host?

Not worth the added complexity. Exposing sshd (w/ disabled passwords) is common practice and fine for most use cases. Special use cases may require special precautions, but even airgapped systems can be compromised with enough effort. I'll take my chances with the industry standard and update as needed.
Post reply on HN