Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is there hope for IPv6?

internetgovernance.org

Post reply on HN
Print view View original

391–399 of 399 posts

Re: Is there hope for IPv6?

#391

Post by vbezhenar »

vetinari wrote: post #384
vbezhenar wrote: post #223

Earlier quoted context omitted.

I never truly delved into low level networking, but I generally got a grasp for IPv4, I can setup simple networks and I think that I understand what's going on on every level. Now despite the fact that I tried to understand IPv6 multiple times, I failed miserably all the time. I tried to setup IPv6-over-IPv4 OpenVPN, it did not work despite all efforts. IPv6 is just too complex. At this point I wish that IPv6 would b…

Configuring OpenVPN ipv6-over-ipv4 are exactly two lines in your server config: server-ipv6 your-ipv6-subnet-for-clients push "route-ipv6 subnet-you want-to-route" (either your real subnet, or 2000::/3 for all traffic). You need the same for the IPv4 side of things too. Clients need no change.

Unfortunately it does not work for me.

Re: Is there hope for IPv6?

#392

Post by sliken »

dennisgorelik wrote: post #380

A couple of months ago voted for IPv4 by paying $1/month for every IPv4 IP address on my new server. 128 IP addresses total. That is well over $1k/year voting power. The reason for that purchase is that IPv4 addresses represent internet reputation while crawling websites. I am not interested in getting IPv6 at all. How much did you pay for IPv6?

Comcast gives regular home users 2^68 of them.

Re: Is there hope for IPv6?

#393

Post by HankB99 »

Require that porn sites use only IPV6 addresses. Or provide some free benefit to people who access those sites using IPV6. I'm pretty sure adoption will surge. It worked for VHS.

Re: Is there hope for IPv6?

#394

Post by pas »

KMag wrote: post #365
pas wrote: post #220

Earlier quoted context omitted.

Could you expand on these problems? Why is SS7 an issue? (Aren't telcos moving to IP based platforms? Device registration on towers can work on whatever protocol the device supports the base station encapsualtes/proxy-es/processes that further, and the telco can use whatever routing it wants internally - eg iBGP. Or even some fancy OpenFlow based control plane.) And of course the issues with BGP seem even more intere…

I presume they're referring to the ease of hijacking SS7 where SMS is so widely used for authentication / authorization.

Ah, yes, good point. Maybe forcing phones to use 3G/4G/LTE will help a bit, but using SMS and phone number as a second factor is laughable while it's completely at the mercy of a large easily soc.eng.-able company, which very-very much does not care about your SMS-sign-in security.

I don't like TOTP apps, but they are significantly better.

Re: Is there hope for IPv6?

#395

Post by pas »

xvilka wrote: post #341
pas wrote: post #220

Earlier quoted context omitted.

Could you expand on these problems? Why is SS7 an issue? (Aren't telcos moving to IP based platforms? Device registration on towers can work on whatever protocol the device supports the base station encapsualtes/proxy-es/processes that further, and the telco can use whatever routing it wants internally - eg iBGP. Or even some fancy OpenFlow based control plane.) And of course the issues with BGP seem even more intere…

The SS7 protocol stack is soaked with security problems, but also because it doesn't represent the modern nature of traffic. Of course, telecoms moving to IP cores and such, but SS7 still widely used mostly because of the interoperability and roaming. Positive Security recently made a summary report of the current status of the problem[1]. BGP main problem is the inherent trust to users and servers, thus allowing mal…

Thanks for the reply, links, and details!

Regarding BGP, it seems that the basic protocol and implementations are okay. ("No implementation allowed BGP OPENs with the wrong AS or from non-configured peer to reach BGP ESTABLISHED state—as a result, TCP spoofing is required to inject data", and when you can spoof TCP between routers ... it's probably too late anyway. In a peering scenario between ASes people either use a direct cable, a separate VLAN or other direct "transport", in a IXP the IXP operates a big switching fabric and the peers exchange traffic over that, but the BGP sessions use fixed IPs and basically they are fixed to switch ports, and even if currently not every IXP monitors the spoofing/abuse of those, it is easy and they should be doing so. Sure, the reality is always bleaker, but that's security. Maybe next-next-next gen will have crypto built in so far down the stack that without a shared secret no packets will flow. But then humans will just put the PSK on a bright sticker, or will continue to use "chang3me" for decades.)

The problems I heard with it is that Tier1 providers just can't really filter the routes they get from downstreams, as they'd have to know which Tier2 handles which prefixes for which clients and so on. Though I'm not convinced they are putting much effort into it, as it's easier to just plug in big Cisco boxes and set up peering with your core and your downstream customers and call it a day. (And setting up is always messy already, so it's sort of understandable that there are no easy and custom solutions for somehow verifying announcements from whatever databases.)

Re: Is there hope for IPv6?

#396

Post by pas »

speleding wrote: post #333
pas wrote: post #214

Earlier quoted context omitted.

NAT traversal (hole punching) works for CGN well, doesn't it? sure you need a coordinator/RP between to CGNed users, but that is not really an issue as far as I know.

This will not help you if you have something like an IP camera that you want to access from outside your home, since the address will change frequently. The only good thing about UPC/Liberty global's implementation of DS lite (now "Ziggo" where I live) is that they will switch it back to IPv4 with a single phone call to the help desk. I can live without IPv6, I cannot live without being able to reach my home server a…

For SoHo stuff people already need a DynDNS, and they could bundle that with NAT hole punching pretty easily.

Though of course it'd be nice to get a private static address.

Re: Is there hope for IPv6?

#397

Post by pas »

vetinari wrote: post #263
pas wrote: post #214

Earlier quoted context omitted.

NAT traversal (hole punching) works for CGN well, doesn't it? sure you need a coordinator/RP between to CGNed users, but that is not really an issue as far as I know.

Hole punching works for applications that are designed for it, and can invoke the coordinator. Sometimes, you just want plain old incoming connection (in my case, VPN). BTH, I've never tested whether it works with CGNAT or not. It would be additional hop to jump if I would give up my IPv4 address, which obviously I'm not going to.

End user residential connections usually need a DynDNS as there's no guarantee you'll get the same IP for any foreseeable time period. So dynDNS could be bundled with hole punching. (It just allocates a port on the CGNAT, due to cost concerns I'm guessing these are rather dumb TCP/UDP devices, so almost anything will work through them.)

Of course it's a lot messier than getting a static private address allocated.

Re: Is there hope for IPv6?

#398

Post by devdas »

theamk wrote: post #389
devdas wrote: post #265

Earlier quoted context omitted.

NATs break end to end. This might be acceptable in a HTTP(s) only world though. Of course, some people aren't only using the Internet for browsing. The Internet of things will end up needing unique endpoints, and NAT does not play will with those either. India has a lot of people, and quite a few of them will be IPv6 only (or behind a very degraded carrier grade NAT). If you are talking to customers/clients/vendors t…

> NATs break end to end. This might be acceptable in a HTTP(s) only world though. I was always curious about this argument -- do you mean that NAT elimination will allow any two arbitrary devices to communicate with each other? I would think that even in IPv6 world, the firewalls would still be a necessity. Most ISP would continue shipping routers with stateful firewall enabled by default (to prevent internet exploit…

NAT elimination will indeed allow arbitrary devices to communicate with each other. Whether they do so will depend on the end users.

Stateful packet filters will still be necessary, but those would be end user configurable.

Keep in mind that you are thinking about a NAT you control. If your ISP is NATing you as well, you would have a very different impression.

Re: Is there hope for IPv6?

#399

Post by IPv4Mall »

pas wrote: post #395
xvilka wrote: post #341

Earlier quoted context omitted.

The SS7 protocol stack is soaked with security problems, but also because it doesn't represent the modern nature of traffic. Of course, telecoms moving to IP cores and such, but SS7 still widely used mostly because of the interoperability and roaming. Positive Security recently made a summary report of the current status of the problem[1]. BGP main problem is the inherent trust to users and servers, thus allowing mal…

Thanks for the reply, links, and details! Regarding BGP, it seems that the basic protocol and implementations are okay. ("No implementation allowed BGP OPENs with the wrong AS or from non-configured peer to reach BGP ESTABLISHED state—as a result, TCP spoofing is required to inject data", and when you can spoof TCP between routers ... it's probably too late anyway. In a peering scenario between ASes people either use…

Even though IPv6 quickly established itself as a robust industry there are countless users who prefer the old IPv4 protocol.Even if we compare IPv6 with IPV4 there are many such positive features which makes people still choose IPv4 Ref: https://ipv4mall.com/blogs/ipv4-vs-ipv6-pros-cons/
Post reply on HN