Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is there hope for IPv6?

internetgovernance.org

Post reply on HN
Print view View original

211–220 of 399 posts

Re: Is there hope for IPv6?

#211

Post by Dagger2 »

AnIdiotOnTheNet wrote: post #188
Dagger2 wrote: post #176

Earlier quoted context omitted.

It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone. There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won'…

And in practice what that means is that the router's own IP is the destination and the packet ends up at a closed port. Unless of course you're talking about using NAT outside the context of the RFC1918/internet boundary, in which case you're absolutely right, but that wasn't what was being discussed.

Isn't it? I thought we were talking about NAT, not about RFC1918.

Even NAT in combination with RFC1918 doesn't give you security. The use of RFC1918 would certainly limit the set of people that could connect to your LAN machines, but it would be hard to call the result secure since anybody sharing your upstream L2 network, plus your ISP and anyone who can trick, force or coerce them into cooperating could still access your network.

And what does NAT add to the situation? Certainly not any security, since any connections that were possible before you added the NAT will still be possible afterwards too. In fact a lot more connections will become possible, so it seems like it reduces the security rather than improves it.

Re: Is there hope for IPv6?

#212

Post by ben0x539 »

mrweasel wrote: post #63
krylon wrote: post #38

I have been getting native IPv6 from my ISP for nearly six years now. It is not quite as cool as it could be, because I get assigned a new prefix every 24 hours, but still, IPv6 is there, and it "just works". When I connect to machines on my home network in any way involving avahi/zeroconf, the machines talk to each other via IPv6 by default. At work, it's a different story. I have drifted from a sysadmin/helpdesk ro…

>I have been getting native IPv6 from my ISP for nearly six years now. Meanwhile Danish ISPs refuse to implement IPv6 because: There's no demand. That completely missing the point and their responsibility in my opinion. There's never going to be any significant IPv6 demand from private users. At work however we have customers that have started to request IPv6 only devices and networks, because there's no need for IPv…

I don't think the success of IPv6 as a whole hinges on these residential ISPs. I think there is enough momentum for IPv6 already (mobile users especially) that we get a healthy coexistence of IPv4 and IPv6, where new stuff gets designed for an IPv6 fastpath and limited support for IPv4 legacy shims for the "long tail" of adoption.

I guess the ISP space isn't competitive enough that they will ever go "looks like our ipv4 users get shitty latency and more congestion on facebook than the competitor's ipv6 users, so we're gonna upgrade next year!", but their IPv4 setups will probably eventually succumb to attrition too and be replaced by IPv6 gear.

Re: Is there hope for IPv6?

#213

Post by nothrabannosir »

jjeaff wrote: post #208
4bpp wrote: post #198

Earlier quoted context omitted.

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

I have no real first hand knowledge of this, but I have wondered if part of the reluctance of ipv6 is the fact that many of the "powers that be" use ip addresses to identify and group traffic and other activity from multiple devices. They also use ip addresses to block scrapers (both Google and Amazon do this heavily). With ipv6, an IP address can be completely disposable. You could scrape Google search results all d…

Wouldn't you be bound to a specific subnet dedicated to you? Or how does it work? Can you really just propagate to the world at any time "I am now baba:fefe:..."? Don't backbone routing tables get crazy mad verbose that way?

I know next to nothing about ipv6, I'm afraid.

Re: Is there hope for IPv6?

#214

Post by pas »

vetinari wrote: post #96
mrweasel wrote: post #63

Earlier quoted context omitted.

>I have been getting native IPv6 from my ISP for nearly six years now. Meanwhile Danish ISPs refuse to implement IPv6 because: There's no demand. That completely missing the point and their responsibility in my opinion. There's never going to be any significant IPv6 demand from private users. At work however we have customers that have started to request IPv6 only devices and networks, because there's no need for IPv…

Elsewhere, the ISPs are doing the IPv6 rollout in the worst possible way imaginable: DS-Lite with no PCP for AFTR (i.e. no way to have incoming IPv4), and allocating only /64 subnet, where their CPE is mandatory in router mode, no way to switch it to bridge mode (thus losing control of your own gateway. I'm talking about you, UPC/Liberty Global). For just consuming the web, it is fine. For switching from public IPv4,…

NAT traversal (hole punching) works for CGN well, doesn't it? sure you need a coordinator/RP between to CGNed users, but that is not really an issue as far as I know.

Re: Is there hope for IPv6?

#215

Post by Dagger2 »

quicklyfrozen wrote: post #195
Dagger2 wrote: post #176

Earlier quoted context omitted.

It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone. There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won'…

The destination IP will be for the router itself, so the router can either re-deliver the packet to itself or drop it. I don't see how NAT isn't an effective inbound firewall by itself in the normal case where it's in front of local non-internet-routable IP addresses.

It won't necessarily be for the router. The packet could be addressed to one of the machines on your LAN, in which case nothing NAT does will stop the router from happily forwarding it right through.

NAT does nothing to stop a router from forwarding any given packet -- and that's something that's still true regardless of what IP range you're using on the LAN side.

Re: Is there hope for IPv6?

#216

Post by zzzcpan »

richardwhiuk wrote: post #197
logifail wrote: post #182

Earlier quoted context omitted.

>> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply. [0] https://learningnetwor…

> Do you mean ~65k devices behind a single public IPv4 address? [0] That's an absolute limit of 2^16 (65k) - the practical limit is much lower. If you only allow one connection per client, then yes, you can get to 65k with TCP/UDP. If you want more than one connection per client (e.g. because the user wants to download content from Facebook while also downloading a YouTube advert), you need to allocate multiple ports…

The 65k limit only applies to concurrent connections to the same remote ip and port. Meaning that you can only make 65k connections from a single IP to the same port of another IP. Which is unlimited for all practical purposes. However, popular services that could potentially see a lot of connections - ban IP addresses, do rate limiting, don't allow that many connections from a single IP. This in turn drives policies of small number of clients per IP, sometimes even rotating IPs, all to minimize effect of bans on users sharing the same IP.

Re: Is there hope for IPv6?

#217

Post by ben0x539 »

Dagger2 wrote: post #138
paulddraper wrote: post #84

Earlier quoted context omitted.

I always wish IPv6 had done example this -- use 64 bits. The address space is still enormous: a couple billion for every currently living person (yes, I know allocating isn't 100% efficient, but even at 0.001% efficiency, that's still tens of thousands per capita). And, the address could fit in a common word size, and be significantly more readable. As is, IPv6's one-address-per-atom-on-Earth is unnecessary, the addr…

64 bits probably wouldn't be enough to let people avoid going into address conservation mode though. Heck, there are way too many ISPs allocating a single /64 in v6 land today , and there's far more space available in v6 today than there would be after 100+ years of your 64-bit space. Having an unnecessarily large amount of addresses is a good thing, because the alternative is to have too few addresses. You don't wan…

Is your complaint that the /64 allocation from ISPs is too big or too small? And are you primarily thinking of residential/"end-user" ISPs?

Re: Is there hope for IPv6?

#218

Post by Dagger2 »

nothrabannosir wrote: post #213
jjeaff wrote: post #208

Earlier quoted context omitted.

I have no real first hand knowledge of this, but I have wondered if part of the reluctance of ipv6 is the fact that many of the "powers that be" use ip addresses to identify and group traffic and other activity from multiple devices. They also use ip addresses to block scrapers (both Google and Amazon do this heavily). With ipv6, an IP address can be completely disposable. You could scrape Google search results all d…

Wouldn't you be bound to a specific subnet dedicated to you? Or how does it work? Can you really just propagate to the world at any time "I am now baba:fefe:..."? Don't backbone routing tables get crazy mad verbose that way? I know next to nothing about ipv6, I'm afraid.

It would be a random address from a given subnet, yes. Basically the privacy, tracking and banning implications of this are more or less the same as they are with v4+NAT, with the v4 public IP mapping to the v6 subnet.

Note that there's still no way to map a subnet to a person, just like there's no way to map a public v4 address to a person.

Re: Is there hope for IPv6?

#219

Post by ben0x539 »

mrweasel wrote: post #66
yjftsjthsd-h wrote: post #55

Earlier quoted context omitted.

> Literary, every modern ISP This is either factually incorrect, or else you're using a definition of "modern" that excludes a substantial portion of real world isps.

It in fact excludes most ISPs in many countries.

Not the truely Scottish ISPs. :>

Re: Is there hope for IPv6?

#220

Post by pas »

xvilka wrote: post #153

IPv6 is already a success in mobile and IoT, and in countries that matter in economical sense. The rest will follow automatically because they have no choice. More worrying issues are BGP and SS7 reliance in global networks, and there are no viable alternatives on the horizon.

Could you expand on these problems? Why is SS7 an issue? (Aren't telcos moving to IP based platforms? Device registration on towers can work on whatever protocol the device supports the base station encapsualtes/proxy-es/processes that further, and the telco can use whatever routing it wants internally - eg iBGP. Or even some fancy OpenFlow based control plane.) And of course the issues with BGP seem even more interesting, if you could detail those too ot'd be great.
Post reply on HN