Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is there hope for IPv6?

internetgovernance.org

Post reply on HN
Print view View original

251–260 of 399 posts

Re: Is there hope for IPv6?

#251

Post by Dagger2 »

spullara wrote: post #166

There is no hope. Without backwards compatibility with IPv4 addresses we will always have IPv4. The specification was a complete failure.

v6 has dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... it has pretty much every possible backwards compatibility method that can work with v4.

You could make a reasonable argument that it has too many of them, even. Where did you get the idea that it didn't have backwards compatibility?

Re: Is there hope for IPv6?

#252

Post by yardstick »

magila wrote: post #151
geofft wrote: post #111

Earlier quoted context omitted.

No, I think that argument makes perfect sense. A stateful firewall doesn't depend on NAT but you get all the downsides of NAT from a working stateful firewall in default-deny mode: you still have to talk the firewall into allowing the relevant traffic through, and without that you still have connections that work in one direction and not the other. The only thing that's different is address discovery, but you can sol…

As someone who works on P2P applications, if all I had to do was use PCP to open a pinhole in a firewall it would still be a big improvement over dealing with NAT. For one thing lack of NAT makes it much easier to deal with multi-homed systems. For various reasons, multi-home is much more common with IPv6 than IPv4. Without NAT I can discover thing like what an address's scope is without querying the network . Having…

> For one thing lack of NAT makes it much easier to deal with multi-homed systems.

It’s the opposite imo. Lack of NAT makes it impossible to do policy based routing enforced at a router level, eg route VoIP over ISP 1, and Web over ISP 2. Without NAT, each IPv6 PC is issued one or more IP addresses per WAN, but has no idea when it’s appropriate to use one over the other. (SLAAC router advertisements aren’t sophisticated enough)

Re: Is there hope for IPv6?

#253

Post by spullara »

Dagger2 wrote: post #251
spullara wrote: post #166

There is no hope. Without backwards compatibility with IPv4 addresses we will always have IPv4. The specification was a complete failure.

v6 has dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... it has pretty much every possible backwards compatibility method that can work with v4. You could make a reasonable argument that it has too many of them, even. Where did you get the idea that it didn't have backwards compatibility?

It doesn't have any backwards compatibility. You can't turn off IPv4 and just have IPv6 and still use IPv4 addresses. If it had it, you wouldn't need all those hacks.

Re: Is there hope for IPv6?

#254

Post by ckocagil »

logifail wrote: post #205
mrweasel wrote: post #63

Earlier quoted context omitted.

>I have been getting native IPv6 from my ISP for nearly six years now. Meanwhile Danish ISPs refuse to implement IPv6 because: There's no demand. That completely missing the point and their responsibility in my opinion. There's never going to be any significant IPv6 demand from private users. At work however we have customers that have started to request IPv6 only devices and networks, because there's no need for IPv…

>> Meanwhile Danish ISPs refuse to implement IPv6 because: There's no demand. That completely missing the point and their responsibility in my opinion. Responsibility to whom ? If there's no significant demand from end-users for something, then we're relying on there being a benefit for access providers. >> For IPv6 to be successful the ISPs need to role it out, regardless of demand. >> regardless of profitability Ca…

If industries can't self regulate and play nicely, the big bad government will come with their regulations and I'm sure they won't like those.

Re: Is there hope for IPv6?

#255

Post by d00bianista »

geofft wrote: post #14

This article completely fails to mention that IPv6 is not just an extension of the address space but a whole different worldview about how to run a network: - IPv6-to-IPv6 NAT has only been accepted very recently and very begrudgingly. Whatever your views are on NAT, the fact is that lots of people have network designs that rely on it, and if you want them to stop, you're now asking them to couple two major transitio…

> an attempted deployment of IPv6 caused packet storms in the MIT Computer Science and AI Lab's network

They were relying on Spanning Tree in a who knows how big broadcast domain. Firstly, that's just begging for things to hit the fan. A single device having a meltdown will cause exactly this, a broadcast storm that is able to take down the entire campus, because it was a single broadcast domain.

Secondly, it is a security nightmare. No amount of links or switch capacity will suffice in a single broadcast domain campus, relying on STP, if port isolation and proxy-arp is enabled, along with DHCP snooping, arp inspection etc. So, port isolation is not turned on. Isolation also creates a requirement for a pyramid-shaped network so nobody wants to do that anyway. But back on point, MITM-heaven, anyone can do what ever they want because the L2-infrastructure is not limiting anything. Ethernet does not care about security and Internet Protocol only implements or allows to implement security in gateways that interconnect subnets that reside on separate broadcast domains.

Routing is the answer and this is why I route on the access-layer, as well as on aggregation and core -layers. Route loops are very rare with OSPF and broadcast storms are limited to single switches if you route at access-layer. Also the posible issues with untested code-paths are minimized this way, since none of the switches are seeing more than the equal amount of hosts as it has ports.

I do not agree with SLAAC because I do not believe in broadcast domains the size of a /64 so I'd deploy DHCPv6 in every possible braodcast domain that does not have Android devices in them. Luckily there is no place for Android in wired networks and especially datacenters, so I can happily deploy DHCPv6 in those. And if I ever need to service Android-devices, I can dualstack and let the devices know of DNS-service with DHCPv4! Take that, Lorenzo! Hah! Outsmarted you there!

Re: Is there hope for IPv6?

#257

Post by rleigh »

Pxtl wrote: post #229
rleigh wrote: post #127

Earlier quoted context omitted.

Most common routers and systems will automatically register and resolve names automatically on the local network. Plus there's zeroconf on top of that. You don't need to manually edit bind zone files for your local network unless you really want to.

I have literally never ever seen a cheap consumer router that did anything "automatically" successfully other than run DHCP and provide access from the LAN to the WAN.

The last two I've used over the last decade have automatically done this. Every machine requesting a DHCP lease is assigned "$host.lan" in the DNS service on the router, where "lan" is a default but configurable domain name.

But even if you don't have this, then zeroconf/avahi/equivalent should be giving you "$host.local".

Re: Is there hope for IPv6?

#258

Post by Dagger2 »

spullara wrote: post #253
Dagger2 wrote: post #251

Earlier quoted context omitted.

v6 has dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... it has pretty much every possible backwards compatibility method that can work with v4. You could make a reasonable argument that it has too many of them, even. Where did you get the idea that it didn't have backwards compatibility?

It doesn't have any backwards compatibility. You can't turn off IPv4 and just have IPv6 and still use IPv4 addresses. If it had it, you wouldn't need all those hacks.

Yes you can. Those "hacks" are how you do it.

I mean, you can call them hacks, but at the end of the day v4 uses a fixed-width 32 bit address field and has no mechanism to extend it in a way that's compatible with other v4 hosts. All you can do is hack around that. There's nothing that v6 could possibly do to avoid it, because the flaw is in the design of v4 and not in the design of v6.

Re: Is there hope for IPv6?

#259

Post by Osiris »

gerdesj wrote: post #250
pedrocx486 wrote: post #242

Earlier quoted context omitted.

>- If you go around memorising addresses then you are doing IT wrong in general. Because I'll surely have an TLD for my local nginx and for my home router...

You can buy a DNS domain for a few quid per year or you can use a dynamic DNS service such as freeDNS for err free. If you go around exposing services on the internet then you should know how to do it properly. If you can get a name on it then you can put a SSL certificate on it (cheers Lets Encrypt). If you have a SSL cert on it then you can be fairly sure you are talking to your gear and not a MitM if you take othe…

With IPv4 you don't HAVE to buy a domain for your local network. You can do just fine with IP addresses. With IPv6, you probably will need to just to make it sane. That adds a whole new step, and a complex one that most people (general public) won't know how to do.

Re: Is there hope for IPv6?

#260

Post by magila »

yardstick wrote: post #252
magila wrote: post #151

Earlier quoted context omitted.

As someone who works on P2P applications, if all I had to do was use PCP to open a pinhole in a firewall it would still be a big improvement over dealing with NAT. For one thing lack of NAT makes it much easier to deal with multi-homed systems. For various reasons, multi-home is much more common with IPv6 than IPv4. Without NAT I can discover thing like what an address's scope is without querying the network . Having…

> For one thing lack of NAT makes it much easier to deal with multi-homed systems. It’s the opposite imo. Lack of NAT makes it impossible to do policy based routing enforced at a router level, eg route VoIP over ISP 1, and Web over ISP 2. Without NAT, each IPv6 PC is issued one or more IP addresses per WAN, but has no idea when it’s appropriate to use one over the other. (SLAAC router advertisements aren’t sophistica…

This is the sort of thing I was talking about when I mentioned negative externalities elsewhere in this thread. NAT is nice if you want to do things like that, but those sorts of tricks create big problems for people like me. Being behind NAT with multiple external IPs and an unknown policy for which gets used when is a nightmare scenario for P2P applications.
Post reply on HN