Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

351–360 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#351

Post by Dagger2 »

tlb wrote: post #277
est31 wrote: post #157

Earlier quoted context omitted.

One of the ideas of ipv6 was to reduce routing tables, those tables that backbone providers have to keep in memory and look up for incoming traffic. With ipv4's fragmented allocation scheme, these routing tables are huge. With ipv6, even huge companies like amazon only have a couple of global allocations. A "ipv4 with more octets" scheme would have kept that fragmentation around. That being said, Amazon currently has…

I'm not up to date, but when I knew about this stuff the cost of memory for routing tables was only a tiny, tiny fraction of the cost of a network. Most of the cost is burying and maintaining fiber. So unless something big has changed, it seems like a terrible choice to twist the whole system into uselessness to try to save a small amount of RAM cost.

It's not "twisted into uselessness"... the reduction in routing table size comes from the large address space. No twisting was needed.

Also, the routing tables we're talking about here need to be stored in TCAM. Content-addressed memory is a lot more expensive than regular DRAM.

Re: Tell HN: IPv6-only still pretty much unusable

#352

Post by icedchai »

cramjabsyn wrote: post #226
neilalexander wrote: post #160

Earlier quoted context omitted.

There is no “backwards compatible with IPv4”. If you have to modify the existing packet headers, you no longer have backward compatibility. If you change anything involving how a flow is identified (like the source/address destinations and ports) then you have broken backward compatibility. Firewalls need to understand new address formats, routers need to understand new address formats, end systems need to understand…

> It’s just that transition is expensive It’s impossible to finish a transition when the old version has no end of life in sight.

IPv4 will never disappear, it will just fade into obscurity. (We'll probably be dead and buried long before that time.)

Re: Tell HN: IPv6-only still pretty much unusable

#353

Post by yyyk »

Yuyudo_Comiketo wrote: post #289

All ipv6 shortcomings discussion aside; What I think is the more vital problem to focus on is that the governments clearly don't want us mere mortals to expose our own servers running on our own hardware to the outside world (most often justifying that with "it's for your own security" mantra, for we're all deemed too dumb to figure that out for ourselves). ISP-imposed ipv4 double NAT (imposed on ISPs by the governme…

Your theory is contrary to what happened in reality: It was governments mandating router and OS support of IPv6 that jump-started protocol support. Had the mandate not existed, MS would not have added IPv6 as early as Win XP (in preview during Win 2000).

Re: Tell HN: IPv6-only still pretty much unusable

#354

Post by rootusrootus »

cj wrote: post #178
yesco wrote: post #122

Earlier quoted context omitted.

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…

I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in…

> Is the general model of public/private subnet still valid?

You're getting replies that are tiptoeing around the truth, saying that the answer to this is basically 'yes' when it sure looks like the answer is firmly 'no.' My home IPv4 network isn't routable, it is a private network. If my IPv6 address is globally unique and addressable by someone across the world, my network is not private in the way that most people have come to understand the term. I'm just part of the public network but with a firewall to stop unwanted packets from reaching my local nodes.

Re: Tell HN: IPv6-only still pretty much unusable

#355

Post by Dagger2 »

icedchai wrote: post #352
cramjabsyn wrote: post #226

Earlier quoted context omitted.

> It’s just that transition is expensive It’s impossible to finish a transition when the old version has no end of life in sight.

IPv4 will never disappear, it will just fade into obscurity. (We'll probably be dead and buried long before that time.)

Just like IPX. It's still necessary and in use for some things -- so it hasn't reached its end of life -- but when was the last time you ever thought about it?

By this metric, we still haven't finished migrating to v4.

Re: Tell HN: IPv6-only still pretty much unusable

#356

Post by gnfargbl »

zamadatix wrote: post #338
gnfargbl wrote: post #333

Earlier quoted context omitted.

I think you're being unfair to the audience. The main complaints here aren't about the consequences of those legacy problems, they're about the fact that IPv6 is just such a mediocre designed-by-committee protocol. Your point about mobile networks kind of illustrates this. There are all sorts of weird and wonderful protocols used in the mobile world, and it doesn't matter because 99.999% of us never have to deal with…

IPv6 is very similar to IPv4 it's just IPv4 wasn't a consumer grade protocol either. The problem isn't the protocol it's that there is little incentive for the average user to switch to anything else on their own volition when most didn't even really set up what they are switching from (and already working on today) anyways.

Again, this is kind of making my point. IPv4 had an excuse for being a bit crap, because it was designed in the early 1980s. IPv6 should have been much better than it is.

Adoption was always going to be slow, but it never needed to be this slow. If the designers had thought a but more about usability and not done stupid stuff like making the address space contain twice as many bits as it actually needs, then we would have transitioned by now.

Re: Tell HN: IPv6-only still pretty much unusable

#357

Post by mappu »

buildbuildbuild wrote: post #11

This problem led us to self-hosting Gitlab four years ago, I can't believe it's still an issue in 2022. It's appalling that a "developer product" like Github remains such a blocker to IPv6 adoption, especially for highly Github-reliant communities like the Golang ecosystem. Launch an IPv6-only VM and try to build a mainstream Go project.

Most of Go dependencies these days come from your $GOPROXY, which by default (proxy.golang.org) is available over IPv6 just fine.

Re: Tell HN: IPv6-only still pretty much unusable

#358

Post by Dagger2 »

nathanaldensr wrote: post #102

I disabled IPv6 on my home network completely because it interferes with my use of my Raspberry Pi as a DNS blocker. I was never able to get DNS working properly, which, apparently, is intentional with regards to the IPv6 protocol. Meh.

It definitely doesn't do any of that.

Your problem was having a non-Pi-hole DNS server configured. If you want to run all of your DNS queries through Pi-hole, don't configure a DNS server that's not the Pi-hole server (or which doesn't forward its queries to it).

Re: Tell HN: IPv6-only still pretty much unusable

#359

Post by russdill »

jeroenhd wrote: post #245
gnfargbl wrote: post #189

Earlier quoted context omitted.

Huh, so I can effectively use a NAT64 gateway as an unauthenticated open proxy? Let's try it. First look up the IPv4 for a site that reads back your IP address: $ dig +short a icanhazip.com 104.18.115.97 104.18.114.97 (Those are Cloudflare IP; icanhazip.com is hosted on CF.) Next, try connecting to the IP-readback site via a NAT64 gateway, but presenting the correct Host header so that Cloudflare knows what to do wit…

> How does this not see more abuse by bad actors? Because this tech goes unused in almost all cases. Also doesn't work if your DNS client is secure against tampering (i.e. uses DNSSEC) without more configuration. To make this work, you need to intercept and modify the victim's DNS traffic or reconfigure the victim's DNS server somehow. With that amount of control, IPv6 or IPv4 no longer matter; you apparently have fu…

Ugh, I was under really looking forward to trying out NAT64 one day. Potential complications with DNSSEC never occurred to me. Thanks for the reality check.

Re: Tell HN: IPv6-only still pretty much unusable

#360

Post by jraph »

vel0city wrote: post #273
jraph wrote: post #202

Earlier quoted context omitted.

Curious, could you expand on this?

I gave an example just a few comments above this. Alice never wanted Charles' traffic, the firewall should not have let it through. But because the NAT is dumb, and the firewall rules are often tied to the NAT on these crappy home routers, it's allowed. So now because Alice wanted to talk to Bob, she opened a port to the world that she never wanted opened as wide.

Thanks! (you added this afterwards, right? Or it's just me being tired and skipping this)
Post reply on HN