Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#161

Post by amluto » Sat, Jan 05, 2019, 7:46 PM UTC

gregmac wrote: post #110

magila wrote: post #53

Earlier quoted context omitted.

The thing about NAT that for network operators it is a negative externality. For them it often simplifies their job. They do not feel the searing pain it inflicts on network application developers. It's hard to come up with a carrot to convince operators that NAT is wrong because from their perspective it isn't, even if it harms the internet as a whole.

NAT is only painful for applications that implement arbitrary inbound connections, such as peer-to-peer connections, and applications that use separate control/data connections. The former is understandable because it's necessary, the latter is arguably lazy application developers. Peer-to-peer is largely solved with UPnP port forwarding, but most of these apps can also at least be configured to use a specific port r…

> Peer-to-peer is largely solved with UPnP port forwarding, but most of these apps can also at least be configured to use a specific port range, education can then be configured on the router to forward.

Until Comcast helpfully replaces the cable modem in a working setup with a router/WiFi/hotspot abomination, so the network ends up double-NATted, and anything that tries to punch through UPnP- or TURN-style stops working.

Re: Is there hope for IPv6?

#162

Post by geofft » Sat, Jan 05, 2019, 7:47 PM UTC

Dagger2 wrote: post #142

geofft wrote: post #24

Earlier quoted context omitted.

NAT absolutely is security. It prevents naming a resource that an attacker shouldn't have access to, which is the fundamental principle behind many successful security schemes: capability models, containers / virtualization, MMUs, etc. Sure, there are implementation flaws (as there have been in other such schemes), and sure, just clicking a NAT button and walking away doesn't get you security any more than just click…

It doesn't actually do that though. If you give a machine an IP of X, and then you turn on NAT on the upstream router so that its outbound connections appear to come from Y instead, the machine is still called X . NAT won't prevent someone from sending a packet to X, and it won't cause the router to somehow drop the packet when it sees it either. That stuff is handled by firewalls, not by NAT.

On Linux at least, NAT isn't handled by routing, it's handled by a separate layer (the firewall layer, in fact). I think that's the obvious way of implementing NAT: you're not routing at all. On the public side you're not accepting any packets not addressed to you. On the private side you're converting all packets, so you're not doing normal packet forwarding.

When packets arrive on the public side, you have to translate addresses sent to the router to convert Y to X, so you might as well drop packets that aren't sent to a valid target. I'd expect you have to go out of your way to get NAT "wrong," possibly by trying to stuff the functionality on top of actual routing. Home routers generally don't need to do actual routing ever (and if they do, they're in a non-NAT mode) so it would be surprising for them to get this wrong.

Re: Is there hope for IPv6?

#163

Post by iagovar » Sat, Jan 05, 2019, 7:48 PM UTC

joeseeder wrote: post #21

Yup, now you have to go out of your way to not support it. Literary, every modern ISP, hosting or Cloud provides it. Every Operating System, be it server or client or router, supports IPv6.

No, most ISPs don't. In fact they are afraid of the transition, because of the many glitches, the total lack of support of MANY devices on the consumer side, retraining helpdesk, and so many more.

I work for a large ISP and we've done our tests. We ran one about five years ago and it was a total disaster.

We're currently doing another one and we smoothed many things. Anyway it's not something welcomed by the helpdesk side. If a client with IPv6 calls with problems, the've found out that most of the times the only way to not spend lot of time with the customer is change the setup to a ppoe v4 and forget about it. And we've used competent people for this test, not you average joe with 2 prior weeks training in networking.

Helpdesk agents hate it, and the come up with very good reasons.

Re: Is there hope for IPv6?

#164

Post by zamadatix » Sat, Jan 05, 2019, 7:49 PM UTC

Pxtl wrote: post #47

dpark wrote: post #19

Earlier quoted context omitted.

IPv4 is for machines. IP addresses were never intended for humans, which is why domain names exist.

Except that setting up domain names for devices in your network is out of reach for most humans, while IP addresses are trivial. My cheap router that I have to reboot nightly lets me bind an ipv4 address to every device on the network so I have known address for everything. There is no comparable functionality for a domain name, or a subdomain or whatever. If my ISP offered free dyndns (and there was a well-adopted g…

Your cheap home router that lets you assign private IP addresses to everything could just as well be a cheap home router that serves DNS using a private TLD.

Things like Chromecast already do this for you automagically via mDNS and the .local TLD.

Re: Is there hope for IPv6?

#165

Post by geofft » Sat, Jan 05, 2019, 7:50 PM UTC

sliken wrote: post #118

39% of Google's traffic is IPv6, clearly there's no hope.

Only if the end state is that the public internet will be dual-stack IPv4/IPv6 forever and everyone will need some form of IPv4 connectivity, either a real IPv4 address or NAT to one (from either private IPv4 or private IPv6). Is that the world we want? Have we solved the address space exhaustion problem if that's the route we take?

Re: Is there hope for IPv6?

#166

Post by spullara » Sat, Jan 05, 2019, 7:51 PM UTC

There is no hope. Without backwards compatibility with IPv4 addresses we will always have IPv4. The specification was a complete failure.

Re: Is there hope for IPv6?

#167

Post by dtech » Sat, Jan 05, 2019, 7:52 PM UTC

votepaunchy wrote: post #157

_0w8t wrote: post #139

Earlier quoted context omitted.

It is not only about intermediate boxes. Just consider how relatively smoothly various parts of WiFi stack was upgraded or how 2G->4G transition happens with mobiles phones. The biggest problem with IPv6 is that it a different protocol that requires special support on all levels starting from applications and down to managed switches.

> consider how relatively smoothly various parts of WiFi stack was upgraded Has WiFi been upgraded? I believe new devices still have support back to 802.11b.

Usually, devices have an "802.11n+" options nowadays, dropping support for 11b and 11g has some benefits. It's often enabled by default on new devices, especially since most 11b/11g devices don't support WPA2-PSK so couldn't connect anyway

Re: Is there hope for IPv6?

#168

Post by geofft » Sat, Jan 05, 2019, 7:53 PM UTC

Dagger2 wrote: post #152

geofft wrote: post #33

Earlier quoted context omitted.

Yeah, it's fascinating here that they've gone from "NAT is bad and we won't let you implement NAT, we need an internet on a single flat 128-bit address space" to "The internet will be IPv4 forever and you should implement IPv6 internally and run NAT, because we like it better than running IPv4 NAT which is what you've done for years and works great".

That's not what the article is saying. They're saying that you still need to provide access to legacy v4-only hosts on the internet somehow, and you either do that via v4 (i.e. dual stack) or by some transition technology of which NAT64 is just one possible option. Nobody is suggesting to not talk native v6 to the internet too, they're just suggesting to not cut your users off from v4-only services.

If all your connections are potentially NATted (i.e., any DNS lookup might only return an IPv4 record), what's the advantage? You still have to build applications that are capable of dealing with NATs / non-end-to-end connections. You just also have to maintain IPv6 infrastructure. That seems strictly worse than staying on IPv4 NAT.

(If you're talking to specific parties that you know have working IPv6, it's less work to run a site-to-site VPN than to both maintain working IPv6.)

The only world in which IPv6 is worthwhile is one in which we can turn off access to legacy v4 hosts and stop having public IPv4 addresses. At this point, it seems like there is no hope of doing so in the current Internet. Perhaps in a few hundred years the Internet itself will be dead and IPv4 will die with it, but not before then.

Re: Is there hope for IPv6?

#169

Post by akira2501 » Sat, Jan 05, 2019, 7:54 PM UTC

AnIdiotOnTheNet wrote: post #74

krylon wrote: post #38

I have been getting native IPv6 from my ISP for nearly six years now. It is not quite as cool as it could be, because I get assigned a new prefix every 24 hours, but still, IPv6 is there, and it "just works". When I connect to machines on my home network in any way involving avahi/zeroconf, the machines talk to each other via IPv6 by default. At work, it's a different story. I have drifted from a sysadmin/helpdesk ro…

> because I get assigned a new prefix every 24 hours Which kinda defeats the purpose of having a globally reachable unique address in a lot of respects. How am I supposed to allow connections to this device in my firewall if the address is always changing?

> How am I supposed to allow connections to this device in my firewall if the address is always changing?

You don't. That's what ESP/AH with PKI is for.

Re: Is there hope for IPv6?

#170

Post by Dagger2 » Sat, Jan 05, 2019, 7:54 PM UTC

paulddraper wrote: post #155

Dagger2 wrote: post #138

Earlier quoted context omitted.

64 bits probably wouldn't be enough to let people avoid going into address conservation mode though. Heck, there are way too many ISPs allocating a single /64 in v6 land today , and there's far more space available in v6 today than there would be after 100+ years of your 64-bit space. Having an unnecessarily large amount of addresses is a good thing, because the alternative is to have too few addresses. You don't wan…

> Heck, there are way too many ISPs allocating a single /64 in v6 land today First, ISPs are allocating them because they can. There are enough total /64 blocks for every living person to have a couple billion blocks . Second, ISPs are allocating /64 blocks because they have to. Well, they don't have to , but there are 20 billion billion total /64 blocks. ISPs will run of capacity in their routing tables long before…

There's no requirement for ISPs to allocate /64 blocks. The requirement is that they allocate enough address space for all of their client's networks to use /64s. As such, all recommendations are for /56 at least (which takes up the exact same amount of space in their routing tables as /64 does: one entry).

If v6 was 64 bits in total, then ISPs would need to be allocating something closer to /48s to users at a minimum... but can you really imagine ISPs giving /48s in a 64-bit space when many of those same ISPs don't even give something larger than /64 in a 128-bit space? And this is despite the fact that a /48-in-64-bits would be 256 networks of 256 IPs each, which is far smaller than a /56's 256 networks of 2^64 IPs each? We know from v4 that 256 IPs in a network is frequently too small.

I'm just not convinced that 64 bits is enough, and I don't think we should expend this much effort deploying something that could be too small. Sure, it might be big enough with careful management, but I think it would be stupid to take the risk.

If you were arguing for an 80 bit address space then I'd have a much harder time calling it a risk, but for some reason 80 bits is an incredibly unpopular length.