Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What drives IPv6 deployment?

potaroo.net

Post reply on HN
Print view View original

51–60 of 100 posts

Re: What drives IPv6 deployment?

#51

Post by Uh7seidu »

erikb wrote: post #46
tuyiown wrote: post #36

> These days it's a client server network. Clients do not need persistent network-wide identity, and only need addresses as and when they communicate with servers. Servers do not need persistent identity either these days, as the identity of a server is a name-based distinguisher rather than an address-based identifier. This is not the internet I've been sold in my youth, and this statement makes me sad and angry.

Why does it make you sad and angry? It sounds quite reasonable to me. I'm especially happy that we went for human readable names rather than wierd letter/number combinations. Also nobody seems to know when to use these [] brackets around the addresses, and they are even hard to type for people who don't use the US keyboard layout. Last but not least NAT is not just a IP-range splitter but also a security feature. I l…

The end-to-end principle where any node on the internet can talk to any other one. This allows anyone to start a service and services (and people) talk to each other without intermediaries. It levels the playing field. Losing that concentrates power and takes options from individuals.

Re: What drives IPv6 deployment?

#52

Post by Uh7seidu »

krupan wrote: post #40
kiallmacinnes wrote: post #30

Earlier quoted context omitted.

NAT, including CG-NAT really provides no security benefits. Too many comments, blogs, etc, have been written on this topic for me to reiterate the specifics here. NAT, including CG-NAT, provides near zero privacy benefits. Nobody is tracking by IP address - there are far, far, far, more accurate ways, again, I won't reiterate all the ways this happens, Google it (or is the TLS session resumption one still on the fron…

I agree with the statement that NAT provides no privacy benefits, but there are security benefits to NAT. As Robert Graham says, "NAT is a firewall. It's the most common firewall. It's the best firewall." https://blog.erratasec.com/2017/01/nat-is-firewall.html

Any IPv6-capable CPE I have seen also has an IPv6 firewall that blocks incoming connections without the downsides of NATs.

Re: What drives IPv6 deployment?

#53

Post by lostapathy »

luckman212 wrote: post #4

In the US, Verizon is one of the worst offenders. They should be ashamed, touting FIOS as a premium service while it's been close to a decade since they put up their pathetic "IPv6 is coming soon..." announcement[1]. Their largest competitors, Spectrum (formerly Time Warner Cable) and Comcast have supported IPv6 for years already. [1] - https://www.verizon.com/support/residential/internet/getting...

Spectrum doesnt’t really support ipv6 either. I have turned it on at times, run for weeks without issue, and then something breaks. When i pushed support, they always tell me its not really supported.

Re: What drives IPv6 deployment?

#54

Post by zAy0LfpBZLC8mAC »

BurnGpuBurn wrote: post #19
thomseddon wrote: post #14

We're an ISP, most of our customers are businesses. Of those, around 50% opt for a pre-configured LAN (i.e. we do NAT and usually CGNAT too). For the rest we provide a static IP address, so we'll allocate a /30 (block of 4), and they get a single usable address which they will assign to their own manged router/firewall. For the majority of our customers "networking" is either handled as overflow for their in/out IT r…

Those are basically the same reasons why I don't use v6 at home and have turned it off in my home router. Everything just works with v4. v6 is a potential source of error and/or security risk. I haven't felt the need to learn more about v6, and it is quite complex so it'll take me a day or so to learn enough to be able to configure my network and know that I haven't screwed that up. But I keep putting that off. There…

> I haven't felt the need to learn more about v6, and it is quite complex

No, it isn't.

> I would've gladly accepted and adopted a version that's just IPv4 plus 16 bits of extra address space

That's what IPv6 is for the most part.

> That would've solved the original address shortage problem, and would be a breeze to configure.

So is IPv6.

Re: What drives IPv6 deployment?

#55

Post by toast0 »

privateSFacct wrote: post #43
thomseddon wrote: post #14

We're an ISP, most of our customers are businesses. Of those, around 50% opt for a pre-configured LAN (i.e. we do NAT and usually CGNAT too). For the rest we provide a static IP address, so we'll allocate a /30 (block of 4), and they get a single usable address which they will assign to their own manged router/firewall. For the majority of our customers "networking" is either handled as overflow for their in/out IT r…

I made a major push to try to get IPv6 running at a small business. In the end, despite the ISP at the business supplying IPv6, and getting some client side IPv6 going with OTHER ISPS (a pain) it fell over because. 1) Things like the VPN client software didn't get routes right when client side network was IPv6 oriented so VPN connections broke - a no go. 2) We had to continue to offer ipv4, as folks in the field were…

The key thing with ICMP is for the love of Pete, don't drop valid ICMP type 3 (destination unreachable), specifically subtype 4 (fragmentation needed, but don't fragment set), because that breaks many real world connections on both IPv4 and IPv6.

Re: What drives IPv6 deployment?

#56

Post by vbezhenar »

thomseddon wrote: post #26
gant wrote: post #24

Earlier quoted context omitted.

Is there a reason you assign a /30 instead of doing point-to-point routing?

Too many customer devices don't support /31 subnets unfortunately, for example with Draytek we've seen an issue where it would accept the 255.255.255.254 subnet but we'd see a whole raft of connection issues making the connection unusable. If we provide a dedicated IP for a connection where we provide the LAN we just put a single /32 on the loopback and NAT onto this which is obviously much more economic with address…

Why this subnet thing is even needed? I don't understand it. Why not provide just a single IP address? Seems like big waste of addresses.

Re: What drives IPv6 deployment?

#57

Post by pixl97 »

Uh7seidu wrote: post #51
erikb wrote: post #46

Earlier quoted context omitted.

Why does it make you sad and angry? It sounds quite reasonable to me. I'm especially happy that we went for human readable names rather than wierd letter/number combinations. Also nobody seems to know when to use these [] brackets around the addresses, and they are even hard to type for people who don't use the US keyboard layout. Last but not least NAT is not just a IP-range splitter but also a security feature. I l…

The end-to-end principle where any node on the internet can talk to any other one. This allows anyone to start a service and services (and people) talk to each other without intermediaries. It levels the playing field. Losing that concentrates power and takes options from individuals.

Yep. CG-NAT puts all the power on your ISP.

You want VOIP, sorry your double nat'ed connection messes up about half the time, you better by telephone service with us instead.

Re: What drives IPv6 deployment?

#58

Post by pilif »

privateSFacct wrote: post #43
thomseddon wrote: post #14

We're an ISP, most of our customers are businesses. Of those, around 50% opt for a pre-configured LAN (i.e. we do NAT and usually CGNAT too). For the rest we provide a static IP address, so we'll allocate a /30 (block of 4), and they get a single usable address which they will assign to their own manged router/firewall. For the majority of our customers "networking" is either handled as overflow for their in/out IT r…

I made a major push to try to get IPv6 running at a small business. In the end, despite the ISP at the business supplying IPv6, and getting some client side IPv6 going with OTHER ISPS (a pain) it fell over because. 1) Things like the VPN client software didn't get routes right when client side network was IPv6 oriented so VPN connections broke - a no go. 2) We had to continue to offer ipv4, as folks in the field were…

>Too much of pain to figure out who is right and if/how ipv6 changed ICMP

then let me make this easy for you: ICMP has become a vital part of the inner workings of an IPv6 network. You will break all kinds of functionality by dropping ICMPv6 packets.

If you are concerned, then drop ICMP echo requests and replies, but absolutely do not drop any other ICMP packets or you'll be one of those people that turn off ipv6 "because it's too hard to make it work" (no shit - when you actively break something, it's hard to make it work).

Re: What drives IPv6 deployment?

#59

Post by netheril96 »

Slartie wrote: post #9

The outliers that surprised me the most are the big Chinese providers (ChinaNet and China Unicom) in the provider table. Despite them having much less IPv4 addresses than users, they appear to make no significant effort to get IPv6 deployed. What are they doing instead? Putting all users behind carrier-grade NAT that don't need dedicated IPv4 addresses? That must be hundreds or even thousands of users behind a single…

Actually the Chinese central government has issued multiple ordinances pushing IPv6 adoption, the latest in 2017/11/26. If you can read Chinese, you can read it here http://www.xinhuanet.com/2017-11/26/c_1122012631.htm.

But from my own experience, the actual execution of the plan is glacially slow. I don't know why. Chinese government usually is very good at execution, but not when it comes to IPv6.

Post reply on HN