Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

40% of Google users now connect via IPv6

google.com

Post reply on HN
Print view View original

301–310 of 353 posts

Re: 40% of Google users now connect via IPv6

#301

Post by p_l »

kortilla wrote: post #237
kazen44 wrote: post #178

Earlier quoted context omitted.

compared to rolling out IPv6? definitely, especially on the longer term. For instance, most Core/Edge routers (my experience is mainly with juniper MX series, but i assume the model is roughly the same for other vendors), you need specific licenses or interface card's to do stateful services like NAT. Compared to doing IPv6, which is "just forwarding packets" and doesn't require the hardware to track state in nearly…

You’re presenting a false dichotomy. The choice for an ISP today is not “v4 or v6”, it’s either “v4 or v4+v6”. A v6 only connection in the US is unusable.

Having your core as v6 only lets you push NAT to limited places (one of the many options for 4x6x4 NAT, including stateless options if you're willing to cut certain corners off v4).

And v6 connections help drop the pressure on NAT resources - and sites that are optimizing for mobile connections are already going to be on IPv6 where possible (due to mobile networks prioritizing v6 traffic for various reasons, including licensing - and NAT resource costs)

Re: 40% of Google users now connect via IPv6

#302

Post by p_l »

welterde wrote: post #204
oxplot wrote: post #168

Earlier quoted context omitted.

IPv6 amounts to a firmware update which the current hardware is and any future hardware will be capable of. The major hurdle in scaling Starlink is fast and cheap deployment of 1000s of satellite hardware. At the moment, the sole focus of SpaceX in relation to Starlink is to get their V2 satellites to orbit in order to keep up with bandwidth demands. V2 requires the Starship system which is yet to make it to orbit. T…

They already had IPv6 support while they were still using google cloud for connectivity (not sure why they went with google for their initial phase instead of a more traditional carrier) and when they moved to their own network they disabled IPv6 for some reason.

The funniest bit is that I'm not sure you can get normal v6 on GCP yet...

Re: 40% of Google users now connect via IPv6

#303

Post by CMCDragonkai »

rubatuga wrote: post #174
NelsonMinar wrote: post #35

I sure wish Starlink supported IPv6. They're a brand new ISP planning for millions of customers and decided from the start they couldn't get enough IPv4 addresses for everyone. Fair enough! But we're stuck with Carrier Grade NAT and it is a drag. On Starlink it's impossible to host a server socket directly, which makes any peer to peer networking a PITA. Geocoding IP addresses doesn't work so I have to bend over back…

Many of our customers are on Starlink, and use our service to bypass the CGNAT allowing them to host web servers, SMTP servers, etc. Our service is called Hoppy Network, it provides a unique and publicly accessible IPv4 and IPv6 range over WireGuard. https://hoppy.network

Does this work if I'm already using tailscale?

Re: 40% of Google users now connect via IPv6

#304

Post by somat »

ajsnigrutin wrote: post #74
neilalexander wrote: post #57

Earlier quoted context omitted.

> Firewalls are more complex on IPv6 This is not true. Firewall rules work exactly the same in IPv6 land as they do in IPv4 land. > you need to pass a bunch of ICMPv6 through, to make it work Indeed you shouldn't block ICMPv6, but that is not really making anything "more complex". > some residential routers have very bad or even zero firewall support for ipv6 Is there a proven set of routers that go through the troub…

> Firewall rules work exactly the same in IPv6 land as they do in IPv4 land. Yes, rules do work exactly the same, but with IPv4, you just let all the connections out through, and let just the established and connected ones back. > Indeed you shouldn't block ICMPv6, but that is not really making anything "more complex". But it is... you need a bunch of new rules to pass through, limit or block a bunch of ICMPv6 messag…

People keep saying "the sky is falling, with ip6 all the hosts are open to the internet" but not really it is usually one rule.

on openbsd pf

block outside connections from initiating connections to your hosts

block in on $external_if from any to $ip6_network

on ip4, if the world was just you would have the same rule(in ip4). however the world is not just and you usually only get one address so you have to pull some shenanigans to spoof that address across all your hosts

match out on $external_if from $internal_net to any nat-to $external_if

Really we all have a sort of Stockholm syndrome and think yes, this is normal, this is correct and being able to end to end address a host is weird and wrong.

Re: 40% of Google users now connect via IPv6

#305

Post by Dylan16807 »

kazen44 wrote: post #276
londons_explore wrote: post #221

Earlier quoted context omitted.

You have a per user counter. So instead of 1200 bytes it's 1201 bytes per user.

how are you going to keep this counter? Do you identify the bytes that are processed in individual flows? Which system will keep track of this? the control plane of the router maybe? great... you just added additional complexity instead of just pushing packets through a forwarding plane.

When an unrecognized flow shows up, punt it to software. Handle the counter there, and if it overflows then you drop the packets. No need to add anything to the control plane.

Re: 40% of Google users now connect via IPv6

#306

Post by Dylan16807 »

dsr_ wrote: post #31
ngetchell wrote: post #23

Earlier quoted context omitted.

While I understand the sentiment, NAT does so much to protect most users, it should be considered a security feature.

NAT doesn't. 1:many NAT does. 1:many NAT requires an affirmative choice on where to route incoming packets that aren't part of an existing stream. In adaptation to that, most attacks are malware spread by email, or attack browser vulnerabilities, or attack services running on network devices, especially remote management systems.

> NAT doesn't.

> 1:many NAT does.

This is technically correct but how often do you really see 1:1 NAT.

Re: 40% of Google users now connect via IPv6

#307

Post by Dylan16807 »

p1mrx wrote: post #253
legrande wrote: post #21

Earlier quoted context omitted.

IPV6 is sort of like the new MAC address hardware identifier. An IP for every atom in the universe!

There are a lot more atoms (10^80 or so) than IPv6 addresses (10^38). How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use?

> How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use?

By putting the hardware part in the second half, and the ISP part in the first half.

You know, like how it works by default.

Re: 40% of Google users now connect via IPv6

#308

Post by imoverclocked »

0xbadcafebee wrote: post #256
jacooper wrote: post #246

Earlier quoted context omitted.

Wait, GitHub still doesn't support IPv6?

Neither does DuckDuckGo. Been a feature request for >5 years now. I'm 99% certain that they turn off IPv6 to avoid complaints. Implementing IPv6 on a frontend load balancer is a trivial networking change. But the only way to ensure an IPv6 connection works is for the user's OS, networking, firewall, router, modem, ISP backend network, ISP DNS resolver, target website DNS, and target website load balancer & firewall,…

I’m looking forward to the day when this same argument is made for IPv4 by default instead.

Re: 40% of Google users now connect via IPv6

#309

Post by p1mrx »

Dylan16807 wrote: post #307
p1mrx wrote: post #253

Earlier quoted context omitted.

There are a lot more atoms (10^80 or so) than IPv6 addresses (10^38). How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use?

> How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use? By putting the hardware part in the second half, and the ISP part in the first half. You know, like how it works by default.

Most devices randomize the second half by default, using RFC3041 and its successors.

Re: 40% of Google users now connect via IPv6

#310

Post by lmm »

kortex wrote: post #235

Question for the peanut gallery: Suppose I have a legacy ipv4 host which simply cannot do ipv6. Why couldn't I put some black box on my network connection in between my host and my uplink, which translates my host's IPv4 into a 4-over-6 IPv6 address? The black box can accept either v6 traffic and translate it for my host, or v4 and pass it straight through. The host only ever sees v4 traffic. V6-only clients can reso…

> I imagine this black box could be a relatively inexpensive ASIC or FPGA that could be a stand-alone widget, baked into hardware network adapters, or just built into routers, middleboxes, etc.

It's not that simple:

- The box has to translate IPv6 address space into IPv4 address space, but it's too big to fit. So the box has to be some kind of stateful reverse NAT, with all the problems that that involves, and the hardware requirements go way up.

- The IPv4-only host might make all sorts of assumptions about IPv4 addresses that are no longer valid. E.g. it might cut off addresses that it detects an attack from - but now as soon as two IPv6 addresess get mapped to the same IPv4 address you're going to block a legitimate user (in fact, since changing IPv6 address is easy, you're probably going to pretty quickly block the whole internet). E.g. it might expect to use an IPv4 geoIP database. E.g. it might be speaking a protocol like FTP where it's supposed to make an outbound connection to the client, so now your middlebox has to not only keep track of TCP streams but also the details of every protocol you want to be able to support.

Post reply on HN