Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#231

Post by yesco »

cj wrote: post #178
yesco wrote: post #122

Earlier quoted context omitted.

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…

I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in…

I generally see IPv6 being a better reflection of reality vs the illusion presented by IPv4/NAT. To put it another way, even if your server has no public IP address, if someone punches through your firewall it's not like that matters anymore right? If they have the keys to the kingdom they can change your network to be however they like.

If your network is a house, and your firewall is the front door, then all NAT does is force you to have a weird fractal room layout where rooms are inside rooms, inside rooms. But if a dude breaks in through your front door, it doesn't matter how many rooms you have, he will find what he wants.

IPv6 lets you have as much rooms as your want and lets you optionally send mail to specific ones. If someone breaks in they still have access to everything, but instead of having to navigate a fractal house, they have to navigate a house with a nicer layout and a trillion doors.

The metaphor is falling a part a bit here but my point is that if your server has some form of physical network connection that eventually leads to the internet, it's address scheme isn't going to help you much, even if it makes you sleep better.

Re: Tell HN: IPv6-only still pretty much unusable

#232

Post by noipv6 »

trey-jones wrote: post #175

The furthest I ever got was creating firewall rules for ipv6 that mostly corresponded to our ipv4 rules. These were never used, but they were tested and ready. This was around "ipv6 day" (2014? 2015?) I've thought about it on and off since then and wondered whether I should be doing more with ipv6, but haven't actually taken any action in that direction. I wonder if there's a relatively simple solution to at least mo…

> Edit regarding World IPv6 day. I must be thinking of June 6, 2012: "This time, it's for real."

world ipv6 day (24 hours) was in 2011.

world ipv6 launch (turn it on & leave it on) was in 2012.

(ppl mix the two up all the time, understandably!)

Re: Tell HN: IPv6-only still pretty much unusable

#233

Post by bravetraveler »

Indeed, I've had similar difficulties... and my needs are rather low! Basically get to the distribution-provided repositories.

This doesn't reliably work. If I get lucky and get a mirror with AAAA, all's well. If not, I may get stuck in an annoying retry loop.

I resorted to making a dumb router VM. It has v4 that everything else uses to route public traffic through

Re: Tell HN: IPv6-only still pretty much unusable

#234

Post by maximaximal »

marinesebastian wrote: post #200
maximaximal wrote: post #188

We are IPv6-only on our institute-internal CPU compute cluster based on slurm. Only the head node has an IPv4 address, so that it can be reached from IPv4 only clients (sadly, there are still quite a lot). All nodes inside the cluster talk over IPv6. And all other computers with IPv6 access use that to communicate to the head node. We are transitioning to IPv6-only for internal services and try to avoid using IPv4 ad…

With all these limitations, why did you prefer IPv6 over IPv4?

Because we don't want to use 20 IPv4 addresses for the cluster of 20 nodes, when we only have so much addresses assigned to our institute. We could have gone the NAT route, but then we'd need to have some router. And if we designate the head node as router, all traffic would not go through the switch directly, but first through the head node and then out. This would mean that the nodes are less independent, as they have this one additional choke-point. Our university gave us a /64 for this network, so we just used that and it worked flawlessly, also for university-internal distro-package fetching and host-cluster connections.

Also, research software is usually working nicely with IPv6. If we encounter something that would really need IPv4, we could update the thing and give it some local subnet - but currently we were lucky.

Re: Tell HN: IPv6-only still pretty much unusable

#235

Post by cryptonector »

miyuru wrote: post #77
cryptonector wrote: post #54

Earlier quoted context omitted.

> hosts file 1986 wants a word.

I actually run a separate DNS proxy that does it automatically for me. (HN and lot of other sites) I only mentioned hosts file because it is the easiest way to spoof the domain.

That's still the same thing: you're manually adding a mapping where you shouldn't have to. HN should just publish the AAAA RRs and be done.

Re: Tell HN: IPv6-only still pretty much unusable

#236

Post by noipv6 »

IcePic wrote: post #212
withinboredom wrote: post #46

Earlier quoted context omitted.

It’s not that ipv4 space is exhausted, there’s plenty of it available. It’s that early on it was mismanaged to the point that people / companies were able to buy entire /8’s for basically nothing and hold them forever.

Given the top rate* for handing out ipv4 some 10 years ago, every such "wasted" /8 would give you days to weeks before being used up again. What do you intend to do when those 2 weeks are up? *) https://en.wikipedia.org/wiki/IPv4_address_exhaustion#/media...

the global burn rate was 4-6 weeks for a /8, iirc

but there are waitlists to fulfill, so...you're probably still right.

(tl;dr: "repatriate the poorly allocated legacy ip space" is a losing proposition)

Re: Tell HN: IPv6-only still pretty much unusable

#237

Post by justin_oaks »

yesco wrote: post #122
justin_oaks wrote: post #14

Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more complicated than IPv4, but maybe that's just because I'm just not familiar with it. Are there any good resources on setting up IPv6 support from first principles? I still get confused as to the "right" way to set up internal networks for IPv6, especially when DHC…

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…

Thanks, that helps a lot.

This got me reading about IPv6 again. I'm trying to figure out how we'd set up an IPv6 network in the case where we have 1) Two upstream ISPs, mostly for failover, but could be loadbalanced too. 2) Internal servers with assigned DNS

My initial thoughts were that for each of the two ISPs, each host (e.g. personal desktop or laptop) would use the IPv6 prefix and end up with two addresses. But in the interest of having an internal address for internal servers, we'd need yet another IPv6 prefix for internal use. That makes 3 IPv6 addresses per host.

Does that make sense? I read about getting Provider Independent (PI) address prefixes, which would allow use to consolidate to a single IPv6 prefix, but from what I read, that costs money and should generally be used for large organizations. Ugh.

Re: Tell HN: IPv6-only still pretty much unusable

#238

Post by jcranmer »

jedberg wrote: post #143
rnhmjoj wrote: post #111

Earlier quoted context omitted.

But IPv4+ is incompatible, so it requires to maintain two network stacks until reasonably everything has moved over to it. You need to duplicate the configuration for DNS, routing, firewalls etc., exactly as for dual stack IPv6. I don't really see a difference.

Imagine I own a company and I already have a bunch of IP4. I upgrade my network equipment to IP4+, and then keep all my routing and firewall configs. Everything just works the same as before. Now I want to access IP4+, so I add a route entry for all the IPs above 255.255.255.255. In fact, if that entry is just "send everything to my upstream" it might already work! Now I want to add some new resources but I'm out of…

The evidence at this point I think refutes your argument. It's been the case for a while now that basically all the hardware, all the networking stacks, all the major libraries and software supports IPv6. So the reason people haven't switched to IPv6 as quickly is because there's all sorts of hidden IPv4 assumptions that take significant effort and energy to get rid of--and there's relatively little resources being devoted to rooting those out.

The kinds of things I'm talking about are places where an IP address is stored in a uint32_t in the middle of your core business app somewhere. Or maybe you've got some log sniffing that only looks for four dotted octets and can't pick an IPv6 address. Those are the sorts of things that if you move to any system that's not IPv4, it's just not going to work period. And you're often not going to discover that you have these issues until you try forcing things to use not-IPv4.

A migration I've been working on--admittedly not in networking--has been LLVM's opaque pointer migration, and the vast majority of the time has been spent not figuring out how to get rid of every "pointer_type->getPointerElementType()" call, but in quashing all of the assumptions like "this input operand has to be a bitcast of a global variable" that is violated by the pointer migration. I have no reason to expect that the IPv4-to-IPv6 migration is not similar, in that most of the effort is going to be spent on code that you didn't think would assume it is using IPv4.

Re: Tell HN: IPv6-only still pretty much unusable

#239

Post by cryptonector »

Dagger2 wrote: post #70
cryptonector wrote: post #51

Earlier quoted context omitted.

> anyone who thinks "ipv6mess" is still relevant in 2022, doesn't understand the problem space it describes. It was relevant then -and it is relevant now- because there are good lessons in how to migrate from thing A to thing B, even if some of the then-missing necessary bits are in place now. Still, it's almost certainly the case that DJB's rant had no real effect, and that the necessary steps were bound to be taken…

I'm not sure it was ever relevant. All it does is describe the problem, which was already well-known at the time by the people working on v6. It doesn't give a fix for it. It doesn't give a fix because no fix is possible. Because the problem comes from the design of v4, not from v6. For some reason djb wasn't able to get his head around that, and people have been pointing to that damn page as if it's some big gotcha…

It talks quite a bit about how to tackle migrations. It doesn't specify specific solutions for IPv6, no, but it does talk about what doesn't work and what should be looked into. It's a blog, not an Internet-Draft.
Post reply on HN