Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is there hope for IPv6?

internetgovernance.org

Post reply on HN
Print view View original

181–190 of 399 posts

Re: Is there hope for IPv6?

#181

Post by geofft »

phicoh wrote: post #179
geofft wrote: post #130

Earlier quoted context omitted.

Why is IPv6 more attractive for address exhaustion than IPv4 NAT? As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services on the internet because the internet is IPv4. That answer is going to be either publicly routable IPv4, IPv4-to-IPv4 NAT, or IPv4-to-IPv6 NAT. If you do the latter (or if you do dual stack) you can route directly to other IPv6 hosts without NAT - but what's th…

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a…

Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address?

If enough of the Internet is running IPv6 that you save significantly on performance by bypassing NAT for IPv6 sites only, that seems worthwhile, sure. But also I'd intuitively find that surprising, at least at present - maybe my intuitions are just wrong about how much IPv6 there is.

Re: Is there hope for IPv6?

#182

Post by logifail »

phicoh wrote: post #179
geofft wrote: post #130

Earlier quoted context omitted.

Why is IPv6 more attractive for address exhaustion than IPv4 NAT? As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services on the internet because the internet is IPv4. That answer is going to be either publicly routable IPv4, IPv4-to-IPv4 NAT, or IPv4-to-IPv6 NAT. If you do the latter (or if you do dual stack) you can route directly to other IPv6 hosts without NAT - but what's th…

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a…

>> There are limits to how many devices you can put behind a single IPv4 address.

Do you mean ~65k devices behind a single public IPv4 address? [0]

>> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address.

Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply.

[0] https://learningnetwork.cisco.com/thread/81720

Re: Is there hope for IPv6?

#183

Post by vfq »

AnIdiotOnTheNet wrote: post #74
krylon wrote: post #38

I have been getting native IPv6 from my ISP for nearly six years now. It is not quite as cool as it could be, because I get assigned a new prefix every 24 hours, but still, IPv6 is there, and it "just works". When I connect to machines on my home network in any way involving avahi/zeroconf, the machines talk to each other via IPv6 by default. At work, it's a different story. I have drifted from a sysadmin/helpdesk ro…

> because I get assigned a new prefix every 24 hours Which kinda defeats the purpose of having a globally reachable unique address in a lot of respects. How am I supposed to allow connections to this device in my firewall if the address is always changing?

For privacy purposes I hope most ISPs do this.

Looks like the wet dream of adtech, to have everybody use a static IP address. No thanks.

Re: Is there hope for IPv6?

#184

Post by icebraining »

gregmac wrote: post #110
magila wrote: post #53

Earlier quoted context omitted.

The thing about NAT that for network operators it is a negative externality. For them it often simplifies their job. They do not feel the searing pain it inflicts on network application developers. It's hard to come up with a carrot to convince operators that NAT is wrong because from their perspective it isn't, even if it harms the internet as a whole.

NAT is only painful for applications that implement arbitrary inbound connections, such as peer-to-peer connections, and applications that use separate control/data connections. The former is understandable because it's necessary, the latter is arguably lazy application developers. Peer-to-peer is largely solved with UPnP port forwarding, but most of these apps can also at least be configured to use a specific port r…

UPnP only works for small-scale NAT, not carrier-grade, which is what ISPs are using when they can't afford to give everyone their own IPv4.

Re: Is there hope for IPv6?

#185

Post by icebraining »

geofft wrote: post #111
jdblair wrote: post #75

Earlier quoted context omitted.

You're mixing up NAT and ingress blocking. A stateful firewall doesn't depend on NAT, we're just used to ingress blocking as a side effect of NAT.

No, I think that argument makes perfect sense. A stateful firewall doesn't depend on NAT but you get all the downsides of NAT from a working stateful firewall in default-deny mode: you still have to talk the firewall into allowing the relevant traffic through, and without that you still have connections that work in one direction and not the other. The only thing that's different is address discovery, but you can sol…

An ISP won't have carrier-grade firewalls, yet they have carrier-grade NAT.

Re: Is there hope for IPv6?

#186

Post by vfq »

iagovar wrote: post #163
joeseeder wrote: post #21

Yup, now you have to go out of your way to not support it. Literary, every modern ISP, hosting or Cloud provides it. Every Operating System, be it server or client or router, supports IPv6.

No, most ISPs don't. In fact they are afraid of the transition, because of the many glitches, the total lack of support of MANY devices on the consumer side, retraining helpdesk, and so many more. I work for a large ISP and we've done our tests. We ran one about five years ago and it was a total disaster. We're currently doing another one and we smoothed many things. Anyway it's not something welcomed by the helpdesk…

More info about that "total disaster"?

Re: Is there hope for IPv6?

#187

Post by ctime »

I'm curious on how the non-contiguous ipv6 [1] usage will eventually affect the use of the TCAM in vendor hardware. It seems that most TCAM being developed today will never be able to store anywhere near the unfathomably large amount of possible address prefixes being carved - and of course the prefixes are only are going to get more and more fragmented.

Right now the typically default behavior for switches/routers that encounter the exhaustion is to summarize prefixes with a shortened prefix and (possibly) punt the evaluation to the general purpose CPU (example here[1]) - which suffice it to say, introduces a host of security concerns. This means, as a security engineer, in situations where complex/large ACLs exist, I need to be aware of and control how IPv6 TCAM exhaustion failure modes work and plan that eventually my hardware TCAM may be exhausted and fail in a spectacularly bad way.

Or, I just ignore IPv6 almost entirely and just don't have the problem (cleverheadtap.jpg)

[1] https://www.iana.org/assignments/ipv6-unicast-address-assign... [2] https://community.cisco.com/t5/switching/tcam-utilization-is...

Re: Is there hope for IPv6?

#188

Post by AnIdiotOnTheNet »

Dagger2 wrote: post #176
zamadatix wrote: post #148

Earlier quoted context omitted.

"If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor" Yes it is, it's the same scenario as if there was no route to the destination just at a higher abstraction layer. Think about it this way: a packet just hit the NAT IP from the internet, the packet has hit it's destination. There was no NAT table match for the packet so it was not rewritten. Where would the packet be f…

It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone. There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won'…

And in practice what that means is that the router's own IP is the destination and the packet ends up at a closed port.

Unless of course you're talking about using NAT outside the context of the RFC1918/internet boundary, in which case you're absolutely right, but that wasn't what was being discussed.

Re: Is there hope for IPv6?

#189

Post by janci »

AnIdiotOnTheNet wrote: post #58
magila wrote: post #53

Earlier quoted context omitted.

The thing about NAT that for network operators it is a negative externality. For them it often simplifies their job. They do not feel the searing pain it inflicts on network application developers. It's hard to come up with a carrot to convince operators that NAT is wrong because from their perspective it isn't, even if it harms the internet as a whole.

If NAT is wrong, then firewalls that block incoming connections by default are also wrong. I think you'll have a hard time making that argument.

Exactly! They say NAT is wrong, they want every device to be publicly routable and accessible from the whole internet. Nobody sane would allow that. One stateful firewall in between and you have the same problems as with NAT.

Re: Is there hope for IPv6?

#190

Post by jerkstate »

ctime wrote: post #187

I'm curious on how the non-contiguous ipv6 [1] usage will eventually affect the use of the TCAM in vendor hardware. It seems that most TCAM being developed today will never be able to store anywhere near the unfathomably large amount of possible address prefixes being carved - and of course the prefixes are only are going to get more and more fragmented. Right now the typically default behavior for switches/routers t…

I have a theory that announcements will be part of what you pay for in the future, like you pay for ports and bandwidth today.
Post reply on HN