161–170 of 649 posts
Hetzner should provide free CGNAT IPv4 Addresses (IPv4 Gateway) for IPv6-Only VMs
A whole lot of ISPs are doing CGNAT for IPv4 now, mostly in Asia. Starlink does it. It's mostly OK but has a lot of drawbacks, particularly IP-based geolocation. (Starlink does not support IPv6 although they seem to be rolling it out this month.)
Earlier quoted context omitted.
It is a substitute to an actual firewall because I don't need a firewall since NAT makes all of my listening ports unavailable to my WAN.
Oh you don't need a firewall then? I guess accessing a routers web interface from the WAN is a-okay
Earlier quoted context omitted.
It is a substitute to an actual firewall because I don't need a firewall since NAT makes all of my listening ports unavailable to my WAN.
Depending on the NAT implementation this can be incredibly naive. Many home routers will send ANY traffic incoming on a port to the NAT'd IP address, even if the sources don't line up. So say Alice is behind a crappy NAT and wants to talk to Bob. Alice's router opens a port on its edge, lets say 1234, and sends traffic to Bob on port 80. Let's say Charles knows Alice's IP address. Charles starts spamming Alice's rout…
IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…
This exists:
> Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For example, ::ffff:192.0.2.128 represents the IPv4 address 192.0.2.128. A previous format, called "IPv4-compatible IPv6 address", was ::192.0.2.128; however, this method is deprecated.[61]
* https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresse...
* https://datatracker.ietf.org/doc/html/rfc4291#section-2-5-5
You still need to upgrade bit of networking kit between the source and destination to understand "IPv4+", and this (lack of) upgrading and enabling is what is hampering deployment.
What makes you think that companies would have been willing to make the effort to deploy "IPv4+" any more than IPv6?
I was thinking about ipv6 the other day. I concluded in my head that adoption was just around 5-10%. Luckily I went to verify that with statistics. https://www.google.com/intl/en/ipv6/statistics.html While price of ipv4 addresses are increasing, the world has slowly been adopting ipv6. From the graph above, I'd say we cross over 50% in about 2-3 years time. At some point the "dash" to adopt ipv6 starts, and brave fol…
> At some point the "dash" to adopt ipv6 starts, and brave folks will drop support for ipv4. I wouldn't be sure about that. I don't see any "dash" to support v6 in our future, when the option to just keep working around issues with v4 is so much easier and cheaper in the moment. Really, what does anyone have to gain by switching to v6?
30-40% global adoption in ~10 years may or may not be a "dash", but it's also not nothing.
"easier and cheaper" is very much not the case at larger scale. legacy ip space is only growing more expensive, & cgnat platforms are not cheap. even if a carrier HAS TO deploy cgnat, deploying ipv6 first means you don't need to buy cgnat capacity for any v6-native traffic (which is a non trivial volume)
> Really, what does anyone have to gain by switching to v6?
the above, & also a future-proofed, infinitely scalable network. any org's that do alot of m&a don't have to play as many stupid rfc1918 integration games.
if you don't deal w/ scale, yea, hard to see the benefits. fair.
Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more complicated than IPv4, but maybe that's just because I'm just not familiar with it. Are there any good resources on setting up IPv6 support from first principles? I still get confused as to the "right" way to set up internal networks for IPv6, especially when DHC…
A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…
The biggest problem remains cloud and CDN companies with poor to nonexistent IPv6 support. Most ISPs, especially on mobile, have it now or are adding it very soon. I've wondered whether some might be dragging their feet because they see an advantage in IP address scarcity to sell cloud gateways, CDNs, and other middle box type services. But the most likely explanation remains that not enough customers are asking for…
> Most ISPs, especially on mobile, have it now or are adding it very soon. Except Charter/Spectrum in the US.
Earlier quoted context omitted.
My shitty cable modem which is also a router does not expose its web interface to the world by default. I don't understand why you'd need a firewall if - you trust devices on your network (yes, big if, but even then: the only reachable ports of a machine from the outside are those explicitly open to the outside, most stuff listens to 127.0.0.1 anyway) - you only configure your NAT to forward ports you would open on y…
My shitty router also firewalls incoming IPv6 connections by default, unless I manually allow them per-device, so I don't get your point.
I didn't think of my cable modem as a firewall. Maybe technically it has one to provide the feature of blocking access to its web interface from the world, or maybe it just listens to the right network. I don't know, but for all intent and purposes, setting up a firewall myself does not seem necessary.
To be fair, I was also a bit annoyed by staringback's phrasing.
Earlier quoted context omitted.
Actually HN is available via IPv6 over Cloudflare. You have to add a CF IPv6 it to the hosts file. In fact I am posting this comment over IPv6.
Your comment has no useful information.
2a06:98c1:3120::5 news.ycombinator.com
Cloud/hosting services only need one IPv4 per machine, making them relatively cheap, and easy to include in pricing. ISPs need one IPv4 per customer, or resort to CGNAT or IPv4-sharing. This often means that customers might have better IPv6 than IPv4 performance. All of this does not apply to oldest ISPs that all have a war-chest of IPv4 they got for cheap (free).
Where I'm getting at is that the usecase you're testing is basically worst-case scenario. Fun that Hetzner does not even have AAAA records for their API. Do they have at least RFC1918 (private) IPv4 addresses ?