Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#241

Post by bartwe » Sat, Jan 05, 2019, 10:13 PM UTC

Dagger2 wrote: post #211

AnIdiotOnTheNet wrote: post #188

Earlier quoted context omitted.

And in practice what that means is that the router's own IP is the destination and the packet ends up at a closed port. Unless of course you're talking about using NAT outside the context of the RFC1918/internet boundary, in which case you're absolutely right, but that wasn't what was being discussed.

Isn't it? I thought we were talking about NAT, not about RFC1918. Even NAT in combination with RFC1918 doesn't give you security. The use of RFC1918 would certainly limit the set of people that could connect to your LAN machines, but it would be hard to call the result secure since anybody sharing your upstream L2 network, plus your ISP and anyone who can trick, force or coerce them into cooperating could still acces…

Terminology shifted, when NAT is talked about it is generally considered to be MASQ NAT to RFC1918 ranges

Re: Is there hope for IPv6?

#242

Post by pedrocx486 » Sat, Jan 05, 2019, 10:15 PM UTC

gerdesj wrote: post #225

4bpp wrote: post #198

Earlier quoted context omitted.

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general…

>- If you go around memorising addresses then you are doing IT wrong in general.

Because I'll surely have an TLD for my local nginx and for my home router...

Re: Is there hope for IPv6?

#243

Post by selectodude » Sat, Jan 05, 2019, 10:16 PM UTC

bsder wrote: post #201

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

You missed: - No real competition in ISPs If you had a national ISP in the US who ran IPv6 with end-to-end connectivity without NATs, a killer app would move to it and then drag all the other ISPs onto IPv6.

Comcast runs native IPv6, along with Verizon Wireless and T-Mobile. A full 40 percent of US traffic to Google is over v6.

Re: Is there hope for IPv6?

#244

Post by pixl97 » Sat, Jan 05, 2019, 10:18 PM UTC

geofft wrote: post #57

magila wrote: post #53

Earlier quoted context omitted.

The thing about NAT that for network operators it is a negative externality. For them it often simplifies their job. They do not feel the searing pain it inflicts on network application developers. It's hard to come up with a carrot to convince operators that NAT is wrong because from their perspective it isn't, even if it harms the internet as a whole.

As a network application developer I haven't felt much pain from NAT - I need to run a central server to relay connections, but that's about it. And oftentimes I need to run a central server anyway for discovery or authentication. (A few years ago I worked at a startup that enabled secure remote access to corporate networks, as in you could connect from a roaming laptop or mobile app into the network, browse the web,…

>we asked people to install and forward a port on their NAT for

At this point I no longer believe you. Having worked in the ISP industry for quite some time, only a very small portion of the more technically advanced users can do this successfully. Most users dont remember their passwords to even get in their device.

Just because windows firewall security is balls doesn't justify writing a nat helper or proxy for every protocol their is. You have just accepted the abuse that nat doles out as a norm.

Re: Is there hope for IPv6?

#245

Post by gerdesj » Sat, Jan 05, 2019, 10:24 PM UTC

lowercased wrote: post #232

4bpp wrote: post #198

Earlier quoted context omitted.

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

Your point (and reply) about memorization was good. Yes, I'm not constantly remembering "210.40.138.43" but enough tech people need to remember some of these things - for debugging, support, etc - that IPv6 is painful. Asking someone to verify an IPv4 in a dialog setting is doable - an IPv6 is not. I've maintained for 2 decades that simply adding another 2 slots for 0-255 would have opened up a greatly usable amount.…

I use copy and paste for both IPv4 and IPv6 addresses.

I understand where you are coming from by adding a few more bytes to the address scheme but one of the things IPv6 was designed for was massive address aggregation which means really short routing tables. Your 192.192.168.168.0.0 (say) scheme does not go far enough. Also, your scheme needs to be efficient in the world of bits and bytes and I don't think it is. Your scheme would probably need to be 64 bit to start with and not 48 bit because silicon, etc doesn't work like that.

However that simple routing scheme was blown out of the water by private addressing - ie get your own ISP independent address range. When you change ISP you end up with another prefix and hence all your addresses change. All addresses. So you buy your own range (about £3000 set up and £3000 per year from memory. You also need an ISP(s) to route it and if more than one then a BGP peering arrangement.

Another wrong in the name of IPv6: 64 bit IPv6 prefixes from an ISP means you can only have one subnet. No way to put your dodgy IoT stuff on its own VLAN.

Re: Is there hope for IPv6?

#246

Post by Dagger2 » Sat, Jan 05, 2019, 10:25 PM UTC

4bpp wrote: post #240

Dagger2 wrote: post #235

Earlier quoted context omitted.

Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and use it for your network. Your computers then assign themselves randomly-selected addresses from the /64. The prefix might be 2001:db8:1:2300::/56, the first network 2001:db8:1:2301::/64, and the machines on that network 2001:db8:1:2301:random:numbers:go:here. Th…

Oh, I see where the misunderstanding is. In cases like the one addressed in Belgium, the ISP actually assigns the same outward-facing IP address to multiple unrelated customers, and NAT is performed on the ISP side. Somebody who has merely recorded the IP address that made a request therefore has no legal way of determining that it came from you or someone close to you, rather than a number of complete strangers who…

That would normally be called CGNAT. Yes, that does change things somewhat... except what's actually going to happen is that people will record the port number and the time as well as the IP, and the ISP is going to record every single connection you make in a big database, and then bill you for the privilege of doing it. Law enforcement will still be able to identify you, now your ISP has a record of everything you've done, and you're still dealing with the headaches of NAT all the time. Doesn't really seem worth it to me.

Re: Is there hope for IPv6?

#247

Post by Dagger2 » Sat, Jan 05, 2019, 10:26 PM UTC

apple4ever wrote: post #76

dghughes wrote: post #46

I like IPv6 it can actually be easier to set up stuff instead of using IPv4 for example OSPF. But I find IPv6 is not as intuitive as IPv4 just looking at an address in IPv4 vs IPv6. You can create new networks for IPv4 pretty easily just by eyeball but not IPv6. At least I can't.

It can be done (using each :XXXX: block as a network instead of splitting it up), but its definitely not quite as easy to eyeball.

It's quite a bit easier to eyeball than v4, because it's much easier to make sure that your network falls on a character boundary (multiple of 4 bits out of 128) than it is to make it fall on an octet boundary (multiple of 8 bits out of 32).

If you find v6 harder than it's just down to a lack of practice.

Re: Is there hope for IPv6?

#248

Post by mncharity » Sat, Jan 05, 2019, 10:28 PM UTC

phicoh wrote: post #116

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

> IPv6 was promoted way before there was demand.

No? My recollection is the original primary objective of IP Next was to prevent the net's flat address space from collapsing into NATed fragments. The need was immediate and pressing. We failed. Now we all live in what was feared - a post-collapse wasteland of centralized systems.

Re: Is there hope for IPv6?

#249

Post by yardstick » Sat, Jan 05, 2019, 10:31 PM UTC

gregmac wrote: post #110

magila wrote: post #53

Earlier quoted context omitted.

The thing about NAT that for network operators it is a negative externality. For them it often simplifies their job. They do not feel the searing pain it inflicts on network application developers. It's hard to come up with a carrot to convince operators that NAT is wrong because from their perspective it isn't, even if it harms the internet as a whole.

NAT is only painful for applications that implement arbitrary inbound connections, such as peer-to-peer connections, and applications that use separate control/data connections. The former is understandable because it's necessary, the latter is arguably lazy application developers. Peer-to-peer is largely solved with UPnP port forwarding, but most of these apps can also at least be configured to use a specific port r…

UPnP is a security flaw, not a feature.

Re: Is there hope for IPv6?

#250

Post by gerdesj » Sat, Jan 05, 2019, 10:32 PM UTC

pedrocx486 wrote: post #242

gerdesj wrote: post #225

Earlier quoted context omitted.

I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general…

>- If you go around memorising addresses then you are doing IT wrong in general. Because I'll surely have an TLD for my local nginx and for my home router...

You can buy a DNS domain for a few quid per year or you can use a dynamic DNS service such as freeDNS for err free.

If you go around exposing services on the internet then you should know how to do it properly. If you can get a name on it then you can put a SSL certificate on it (cheers Lets Encrypt).

If you have a SSL cert on it then you can be fairly sure you are talking to your gear and not a MitM if you take other precautions.

I absolutely do have a LE SSL cert for my home router and all my home web sites. pfSense has a ACME and dynamic DNS client for many services and HA Proxy built in. What more could you want!