Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#201

Post by labcomputer »

tjoff wrote: post #45
argulane wrote: post #28

Earlier quoted context omitted.

Everything should get its IPv6 configuration via SLAAC. DHCPv6 is only useful when you plan to provide prefix delegation for extra routers or network boot information.

So how do you do DNS then? Not sure if this is a good source but it had some history to recap, and it doesn't look pretty... https://www.reddit.com/r/networking/comments/ajb2ec/comment/... [...] To be honest because of this hot mess if you want to reliably support any possible client you'll need to do both DHCPv6 and RDNSS for DNS information. [...]

That source is, at best, dated.

Sending DNS info is one of the options in SLAAC (just like how it is an option for DHCPv4).

You just configure your router to advertise DNS servers via SLAAC Router Advertisements (RAs) the same way you would via DHCP.

One of the benefits is that any configuration changes propagate almost immediately—you don’t have to wait for DHCP clients to renew their lease to get new DNS servers.

Also, you can (if you want) have the DNS server advertise itself using the same mechanism.

The only common clients that can’t use SLAAC-based DNS configuration are older (unsupported) versions of windows. Even then, setting up DHCPv6 (in unmanaged mode) to send DNS servers is easy.

Re: Tell HN: IPv6-only still pretty much unusable

#202

Post by jraph »

lazide wrote: post #186
lzaaz wrote: post #163

Earlier quoted context omitted.

That's like saying that a bad firewall implementation leaks like a sieve. This is not what I was talking about.

Any router running a poor NAT implementation (aka most of them) essentially has a built in firewall bypass for the right attacker. A naive NAT implementation can allow an attacker to bypass the firewall.

Curious, could you expand on this?

Re: Tell HN: IPv6-only still pretty much unusable

#203

Post by fulafel »

cletus wrote: post #106

IPv6 is a case study in the second sytem effect [1]. Realizing you need to make breaking changes and it being rare that you get to do so you decide to make all the changes. The truth is IPv4 only had 2 real problems: 1. Lack of address space due to 32 bit addresses; and 2. Lack of a solution for roaming since your IP address is a core part of connection identity (between the source and destination address and port).…

You can get PI v6 space, and if you are somewhere where a RIR won't give it to you, that's not the protocol's fault.

Also ports weren't removed, they work just like in v4.

The long addresses with subnettable space for everyone is very valuable and useful and doesn't remove any functionality.

Re: Tell HN: IPv6-only still pretty much unusable

#204

Post by zekica »

exabrial wrote: post #99

ipv6 would be completely unnecessary. Only a handful of things on the internet actually need to be publicly addressable. Even something as simple as SRV record support in browsers would solve 99% of the invented ipv4 "crisis". Furthermore if people could come up with actual technical reasons why NAT is bad, rather than "I don't like it"... because guess what? It's here, it's now, and it's been working just fine for 3…

NAT is not working fine. Have you ever needed to set up STUN + TURN?

Re: Tell HN: IPv6-only still pretty much unusable

#206

Post by tjohns »

tjoff wrote: post #185
tjohns wrote: post #142

Earlier quoted context omitted.

What? No. You connect a device, and SLAAC (and optionally DHCPv6, on enterprise networks) configures everything. It just works. SLAAC is more than capable of sending DNS settings to devices. There's no manual configuration involved.

My post said to use DHCPv6 and RDNSS. Follow up claimed to use SLAAC instead. SLAAC does not do DNS. Clear as day?

SLAAC does DNS, with the RDNSS extension enabled. (RDNSS is a feature that was added to SLAAC.)

Some older devices [1] do not support RDNSS. I haven't run into them, but if you're at all worried about it, you can run DHCPv6 in parallel just to hand out DNS settings.

Personally, I just use SLAAC (with RDNSS) and it just works.

[1]: https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_...

Re: Tell HN: IPv6-only still pretty much unusable

#207

Post by convolvatron »

throw0101a wrote: post #171
jedberg wrote: post #143

Earlier quoted context omitted.

Imagine I own a company and I already have a bunch of IP4. I upgrade my network equipment to IP4+, and then keep all my routing and firewall configs. Everything just works the same as before. Now I want to access IP4+, so I add a route entry for all the IPs above 255.255.255.255. In fact, if that entry is just "send everything to my upstream" it might already work! Now I want to add some new resources but I'm out of…

> Imagine I own a company and I already have a bunch of IP4. I upgrade my network equipment to IP4+, and then keep all my routing and firewall configs. Everything just works the same as before. Now I want to access IP4+, so I add a route entry for all the IPs above 255.255.255.255. It does not. Because 255.255.255.255 only covers 32 bits and "IP4+" is >32 bits. You'd still have to touch every rule to to tweak the mas…

I still don't understand why they shifted from 0:: to ffff::

but point stands, ipv6 is exactly ipv4+, except yes, they did redo arp. I don't think its really that much better...but really? that's what turns something from great into awful?

Re: Tell HN: IPv6-only still pretty much unusable

#208

Post by jeroenhd »

jedberg wrote: post #192
throw0101a wrote: post #171

Earlier quoted context omitted.

> Imagine I own a company and I already have a bunch of IP4. I upgrade my network equipment to IP4+, and then keep all my routing and firewall configs. Everything just works the same as before. Now I want to access IP4+, so I add a route entry for all the IPs above 255.255.255.255. It does not. Because 255.255.255.255 only covers 32 bits and "IP4+" is >32 bits. You'd still have to touch every rule to to tweak the mas…

> You'd still have to touch every rule to to tweak the mask. No you wouldn't. 0.0.0.0.1.0.0.0/40 and 1.0.0.0/8 are the same thing. If the rule says 1.0.0.0/8 then the router converts it to 0.0.0.0.1.0.0.0/40. If you happen to have 1/8 as your rule, then an easy fix is to say ip4+ translates shorthand rules at ipv4 if the mask is under /32. > What makes you think that companies would have been willing to make the effo…

> No you wouldn't. 0.0.0.0.1.0.0.0/40 and 1.0.0.0/8 are the same thing.

I don't see why the CIDR would make a direct difference. Whether it's converting 1.0.0.0/8 to 0.0.0.0.1.0.0.0/40 or 2002:c000:0204::1.0.0.0/96 doesn't seem to matter to me. The only difference I can think of is local networks (10/8, 192.168/16, 172.16/12) but your suggestion would fail in the same way.

Several compatibility systems for IPv6 exist. 6to4 is the most common one I've seen. It all works on a technical level until DNS gets involved.

> Then they would discover they had IP4+ support and maybe start using it.

If your business network is managed by "hey, this feature exists, let's see what happens if we turn it on" then your network admin needs to be more professional.

Re: Tell HN: IPv6-only still pretty much unusable

#209

Post by Quillbert182 »

spookthesunset wrote: post #81
redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

I just started University, and as a result I have had my first experience of Internet without NAT. The firewall rules provided are simply On or Off, which has been very strange to me, and it doesn’t seem all that secure.

Re: Tell HN: IPv6-only still pretty much unusable

#210

Post by LinuxBender »

I have not seen a practical way to go IPv6-Only. If I made my DNS, Web, Chat, Time and other servers IPv6-Only I would only be able to access them from a few mobile networks, most VPS providers and a handful of ISP's. One might be tricked into thinking adoption is high, but the VPS and mobile providers really throw off the statistics. Mobile providers due to sheer numbers of clients and being late to the allocation game did not have much choice but to go IPv6 and set up IPv4 gateways/tunnels.

I could see doing IPv6+IPv4 in a corporation and terminate everything on load balancers, allowing anything behind the LB to be any combination of IPv4/IPv6. But IPv6 only? I don't see any big companies doing that in my lifetime.

My ISP obtained some IPv6 space but have not deployed it yet as they are still trying to decide how to subnet and bill for it so I currently have some static IPv4 addresses. I am on a tiny ISP, so tiny all their C-Levels phone numbers and email addresses are still in whois. Most of the US ISP's doing IPv6 also do IPv4 even if sometimes it is CG-Nat.

Post reply on HN