Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

311–320 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#311

Post by Yuyudo_Comiketo »

acdha wrote: post #307
Yuyudo_Comiketo wrote: post #289

All ipv6 shortcomings discussion aside; What I think is the more vital problem to focus on is that the governments clearly don't want us mere mortals to expose our own servers running on our own hardware to the outside world (most often justifying that with "it's for your own security" mantra, for we're all deemed too dumb to figure that out for ourselves). ISP-imposed ipv4 double NAT (imposed on ISPs by the governme…

This seems like a poorly-researched conspiracy theory. Nobody is forced to use double-NAT, and if there was some secret policy which somehow has avoided leaking for a couple of decades, you'd think they'd have blocked IPv6 deployments, too.

I expected that someone would plant this prefabricated gag phrase of "conspiracy theory" as an argument, thanks for confirming my gut feeling.

Re: Tell HN: IPv6-only still pretty much unusable

#312

Post by topspin »

> The GitHub API and its code load endpoints are not reachable via IPv6

Should it matter that GitHub or whatever doesn't support IPv6? I understood that it is possible to bridge the divide through an IPv6IPv4 gateway. IPv6 is designed to incorporate the IPv4 32 bit address space as a segment of the IPv6 address space and automatically translating between the two is relatively straightforward.

At least that what I believe. The next time someone asks me about supporting IPv6 will be the first, so I've been able to avoid the matter for a couple decades now.

Re: Tell HN: IPv6-only still pretty much unusable

#313

Post by CountSessine »

throw0101a wrote: post #300
theamk wrote: post #259

Earlier quoted context omitted.

Mayne RFC exists, but it os not used in teal world anywhere. In all servers, I configure IPv4 and IPv6 separately. Network setup is separate. DHCP daemons are separate. Firewall rules are separate. Network monitoring is separate. I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me.

> I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me. And exactly how would you accomplish this switch to a larger address space? Please explain the steps exactly how they would be done. Because IPv4 has 32 bits of address. Anything after IPv4 needed >32 bits of address. How exactly do you fit in…

In theory this could be handled by stuffing the extra 96 bits in an IP extension header. But this solves nothing because then any switch that isn’t IPv4+ aware will route packets incorrectly. Literally every single switch on the internet needs to be updated/replaced before you could start generating IPv4+ traffic otherwise the one outlier will send your IPv4+ packets off to Uzbekistan.

OR

Maybe you don’t use those 96 bits for routing. But then it becomes nothing but a sort of subnet address and you haven’t fixed the routing table size problem. And actually every endpoint needs to upgrade too because endpoints that don’t recognize the header extension will generate crazy responses and confuse TCP packets from different computers as coming from the same machine.

There’s no useful and backward compatible way of extending IPv4.

Re: Tell HN: IPv6-only still pretty much unusable

#314

Post by ipython »

I have to say I’m super disappointed in the ignorance and negativity in the comments on this thread. Ignorance of both the difficulties inherent in upgrading a fixed size wire protocol designed for a research network fifty years ago, and the widespread adoption of ipv6 for real customer deployments. Heck most of you are probably using ipv6 through your mobile carrier and don’t even know it!

Re: Tell HN: IPv6-only still pretty much unusable

#315

Post by maltris »

Various software vendors who dont support IPv6 and render IPv6 only setups without any kind of tunneling useless. And for the worst part play it down with stupid reasons in 202x. My favs "Why you need IPv6, just use 6to4 tunnels", "what do you mean IPv6 only?", "We dont have the resources", "It will take some time die to major changes in the software" - jesus...

I tried running IPv6 only with one machine (VPS in own hypervisor) but gave up after 2-3 hours of yak shaving and quickfixing things that should just work out, official Ubuntu repos not speaking v6 was one of them.

Re: Tell HN: IPv6-only still pretty much unusable

#317

Post by LinuxBender »

noipv6 wrote: post #227
LinuxBender wrote: post #210

I have not seen a practical way to go IPv6-Only. If I made my DNS, Web, Chat, Time and other servers IPv6-Only I would only be able to access them from a few mobile networks, most VPS providers and a handful of ISP's. One might be tricked into thinking adoption is high, but the VPS and mobile providers really throw off the statistics. Mobile providers due to sheer numbers of clients and being late to the allocation g…

> I could see doing IPv6+IPv4 in a corporation and terminate everything on load balancers, allowing anything behind the LB to be any combination of IPv4/IPv6. But IPv6 only? I don't see any big companies doing that in my lifetime. facebook started migrating to ipv6-only datacenters in 2014 or so. i think all of them are converted at this point. they only support legacy ip at their network edge, & use siit (iirc) to f…

The legacy IP at their edge is what I meant by terminating IPv4+IPv6 at the load balancers.

The tricky part is that almost all datacenters today need to talk out to other datacenters. Not all of them use IPv6 which means they will still need some way to speak IPv4 until all their 3rd party data processors are also doing IPv6 and for Facebook I happen to know that is a lot of 3rd parties. If they are truly IPv6-only in the datacenter then they would have to forward-proxy all outbound connections through something with an IPv4 address on the edge as well and that can not go away until all their partners and vendors are also purely IPv6.

Re: Tell HN: IPv6-only still pretty much unusable

#318

Post by anilakar »

spookthesunset wrote: post #81
redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

RFC7084 says a NAT-like stateful firewall mechanism should be enabled by default on customer IPv6 routers.

Re: Tell HN: IPv6-only still pretty much unusable

#319

Post by Arnavion »

AdamH12113 wrote: post #316

Given how long it's been since IPv6 was released, I'm surprised that there hasn't been a big proposal for an IPv7 that would fix the alleged problems with IPv6. Has anyone worked on anything like that?

The "alleged problems" are not with IPv6. They're with not-IPv4.

Re: Tell HN: IPv6-only still pretty much unusable

#320

Post by Arnavion »

cj wrote: post #178
yesco wrote: post #122

Earlier quoted context omitted.

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…

I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in…

>Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets?

Define "public/private". Your server has an IPv6 address that is globally identifiable. Your gateway may not necessarily route traffic to it.

>(in ipv4 world, you know that server is truly unreachable via public internet)

You don't know that, because a port forward rule on the gateway would route traffic to it after doing NAT. And if you made the effort to know that your gateway doesn't have such a rule, then you can equally make the effort to know that your gateway doesn't have a rule to forward traffic to the server's subnet.

Post reply on HN