Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

391–400 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#391

Post by Yuyudo_Comiketo »

Klonoar wrote: post #376
Yuyudo_Comiketo wrote: post #328

Earlier quoted context omitted.

- Comment sections getting closed for anonymous replies almost everywhere over the course of the last 15 years - Undisguised surveillance becoming the new normal - Confinement of all communication to a handful of platforms - Snowden's disclosures - Huge datacenters built by NSA to tap into telecom - Crackdown on p2p sharing - Push for The Cloud - Closure of Lavabit and other independent email providers - Rabid push f…

Sigh, I need to stop engaging with obvious tinfoil hats.

Oh boy, all my points are definitely beaten with this single one of ineffable precision and efficiency!

What you need is to learn to reinforce your opinion with counterarguments instead of allegorically admitting your inability to formulate them.

Re: Tell HN: IPv6-only still pretty much unusable

#392

Post by throw0101c »

theamk wrote: post #342
throw0101a wrote: post #300

Earlier quoted context omitted.

> I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me. And exactly how would you accomplish this switch to a larger address space? Please explain the steps exactly how they would be done. Because IPv4 has 32 bits of address. Anything after IPv4 needed >32 bits of address. How exactly do you fit in…

OK: Let's use "IPv4+" scheme as described by redox99: we still have dotted-decimal, and IPv4 addresses are guaranteed to be accessible via IPv4+ interface. Right now, most application software need non-trivial rewrite to add ipv6 support: it has to support 2 sockets instead of 1, and ":" in address breaks basically every address parsing function out there. With IPv4+, you do search/replace "sockaddr_in"->"sockaddr_in…

> I should be able to write "-m tcp --dport 80 -j ACCEPT" once and have it work with both.

Kind of like how PF does it?

    tcp_services = "{ ssh, smtp, domain, www, pop3, auth, pop3s }"
    udp_services = "{ domain }"
    block all
    pass out proto tcp to any port $tcp_services keep state
    pass proto udp to any port $udp_services keep state
* https://docs.freebsd.org/en/books/handbook/firewalls/#pf-tut...

If an address family ("af") is not specified, the rule applies to both:

     […]

     pf-rule     = action [ ( "in" | "out" ) ]
        [ "log" [ "(" logopts ")"] ] [ "quick" ]
        [ "on" ifspec ] [ route ] [ af ] [ protospec ]
        hosts [ filteropt-list ]

     […]

     af      = "inet" | "inet6"

     […]
* https://www.freebsd.org/cgi/man.cgi?query=pf.conf

    action [direction] [log] [quick] [on interface] [af] [proto protocol]
       [from src_addr [port src_port]] [to dst_addr [port dst_port]]
       [flags tcp_flags] [state]
* https://www.openbsd.org/faq/pf/filter.html#syntax

Perhaps the protocol isn't the problem and you're just using firewall software that doesn't have very good syntax?

Re: Tell HN: IPv6-only still pretty much unusable

#393

Post by zahllos »

viraptor wrote: post #280
est31 wrote: post #157

Earlier quoted context omitted.

One of the ideas of ipv6 was to reduce routing tables, those tables that backbone providers have to keep in memory and look up for incoming traffic. With ipv4's fragmented allocation scheme, these routing tables are huge. With ipv6, even huge companies like amazon only have a couple of global allocations. A "ipv4 with more octets" scheme would have kept that fragmentation around. That being said, Amazon currently has…

> where your local address is horribly long, for the sake of global uniqueness, which is something that most people don't really need Apart from debugging where you can copy-paste anyway, does it matter? I've got a few services on the local network and over zerotier that all talk IPv6. In the last 3 years or so I've never used an ipv6 address directly. There's enough DNS and discovery protocols that I never needed to…

Plus if you're using enough IPv4 addresses it is going to be the same problem anyway. I can barely keep track of what I've assigned everything to in just a /24 so I have local DNS and I don't need to.

Re: Tell HN: IPv6-only still pretty much unusable

#394

Post by psyclobe »

I tried to deploy ipv6 with my vlans on my Ubiquiti stuff. Good luck debugging or calling any tech support when stuff doesn't work, no one understands it heh. Hell even comcast couldn't answer the question as to the delegation subnet size on their provisioned routers (key for deploying more then 1 vlan behind it).

Re: Tell HN: IPv6-only still pretty much unusable

#395

Post by andix »

rnhmjoj wrote: post #111
redox99 wrote: post #69

Earlier quoted context omitted.

It's been decades. The vast majority of network equipment already has been replaced multiple times since IPv6 became a thing that people "understood" we would switch in the future. The difference is that instead of their ipv6 being broken, partial, or correct but non functioning because it needs additional configuration, it would properly work and support with the much simpler "ipv4+"

But IPv4+ is incompatible, so it requires to maintain two network stacks until reasonably everything has moved over to it. You need to duplicate the configuration for DNS, routing, firewalls etc., exactly as for dual stack IPv6. I don't really see a difference.

IPv4+ would be backwards compatible as long as the first 4 bytes are zero. So you could just replace the existing ipv4 stack.

Ipv6 is not backwards compatible at all.

Re: Tell HN: IPv6-only still pretty much unusable

#396

Post by pifm_guy »

bauruine wrote: post #365
cranekam wrote: post #329

Earlier quoted context omitted.

According to this Stack Exchange post from last year a full IPv4 routing table requires on the order of a few hundred MBs of RAM. This is indeed a tiny fraction of the cost of maintaining the global internet infrastructure. https://networkengineering.stackexchange.com/questions/76562...

The problem is that the routers that have to hold the routing table can only handle a limited number of routes. There is a good article from APNIC about the topic. https://blog.apnic.net/2021/03/03/what-will-happen-when-the-...

Said routers could be redesigned...

And besides, there is no need to keep the whole routing table in RAM. Instead all that's necessary is a single integer per route representing which port packets to each route needs to be sent down. So even for a large router with 64 ports, the whole routing table fits inside 1 megabyte.

Re: Tell HN: IPv6-only still pretty much unusable

#397

Post by therealmocker »

yesco wrote: post #122
justin_oaks wrote: post #14

Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more complicated than IPv4, but maybe that's just because I'm just not familiar with it. Are there any good resources on setting up IPv6 support from first principles? I still get confused as to the "right" way to set up internal networks for IPv6, especially when DHC…

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…

One thing I wish they had done with the much larger address space is make it easy for an individual to get their own block of IPv6 addresses. Letting enthusiasts experiment with their own address space seems like it would help with knowledge / adoption.

Re: Tell HN: IPv6-only still pretty much unusable

#398

Post by FateOfNations »

rekoil wrote: post #382
babypuncher wrote: post #256

Earlier quoted context omitted.

All the big cable and fiber internet providers I've worked with in the US support IPv6, even evil nasty ones like Comcast have supported it for a decade now.

Is it enabled by default on customer equipment?

On their leased hardware, it is enabled from what I've seen. And if you are running your own modem and router, you will get IPv6 if you configure your setup to request it (via DHCP). They will even give you a /60 if your DHCP client asks for it.

Re: Tell HN: IPv6-only still pretty much unusable

#399

Post by __d »

Dagger2 wrote: post #355
icedchai wrote: post #352

Earlier quoted context omitted.

IPv4 will never disappear, it will just fade into obscurity. (We'll probably be dead and buried long before that time.)

Just like IPX. It's still necessary and in use for some things -- so it hasn't reached its end of life -- but when was the last time you ever thought about it? By this metric, we still haven't finished migrating to v4.

I'm curious: what still uses IPX in 2022?

Re: Tell HN: IPv6-only still pretty much unusable

#400

Post by yesco »

nottorp wrote: post #335
pantalaimon wrote: post #293

Earlier quoted context omitted.

The internal address is optional, it's only useful if you want to have a known address if your uplink is down so you can do maintainance. You only need two addresses: - a global address - a link-local address

Not clear. How do i reach a device in my local network? Via the optional internal address if my uplink is down and via my link-local address if my uplink is up? Is the link-local address any good if i'm on wifi but want to ssh into a wired host in my home? Are you getting my point yet? Edit: actually I won't wait. The point is it's needlessly overcomplicated. It was done by a commitee that didn't even consider people…

> Is the link-local address any good if i'm on wifi but want to ssh into a wired host in my home?

Lets breath and think about this for a second, you want to know how to reach a device on your local network, your host has a "link-local" address. Could there be a connection here?

The answer is yes because it's in the name, it's literally in the name, why are you confused? What is over complicated about this?

Back when I was in college I did IPv6 compliance testing as a part time job. Me and random other freshman computer science + IT students were able to pick this up after a day or two of training (aka reading RFCs) with next to zero network experience. I really can't help but see your complaints about complexity as nothing but the whining of a child. (we also exclusively used the commandline)

Post reply on HN