Tell HN: IPv6-only still pretty much unusable • Hacker News Board

Re: Tell HN: IPv6-only still pretty much unusable

#481

Post by bert64 » Thu, Dec 08, 2022, 2:51 AM UTC

theamk wrote: post #342

throw0101a wrote: post #300

Earlier quoted context omitted.

> I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me. And exactly how would you accomplish this switch to a larger address space? Please explain the steps exactly how they would be done. Because IPv4 has 32 bits of address. Anything after IPv4 needed >32 bits of address. How exactly do you fit in…

OK: Let's use "IPv4+" scheme as described by redox99: we still have dotted-decimal, and IPv4 addresses are guaranteed to be accessible via IPv4+ interface. Right now, most application software need non-trivial rewrite to add ipv6 support: it has to support 2 sockets instead of 1, and ":" in address breaks basically every address parsing function out there. With IPv4+, you do search/replace "sockaddr_in"->"sockaddr_in…

How you represent the address is arbitrary, using a colon instead of a dot matters little as underneath it's just an integer with the only difference being 32 or 128bit.

Using a dot causes its own problems, because it conflicts with DNS. DNS allows fully numeric domain names, but they conflict with legacy ip so are not used on a the public DNS. Using hex would make the problem worse as it's perfectly valid to have an ipv6 address ending "de" for example, which is the TLD for germany.

Legacy addresses can be represented via hex too - try ping 0xdeadbeef.

The socket apis between v6 and legacy ip are largely as compatible as they can be, you need to use sockaddr_in6 and AF_INET6 which is the same as you propose. You can open an AF_INET6 socket and still connect to legacy addresses with it.

For higher level languages that don't deal with fixed size memory structures directly it's pretty much fully compatible, you can just say "connect www.google.com tcp/443" or equivalent, and the system takes care of resolving what protocol and address to connect to.

Re: Tell HN: IPv6-only still pretty much unusable

#482

Post by bert64 » Thu, Dec 08, 2022, 2:55 AM UTC

throw0101c wrote: post #405

Spooky23 wrote: post #348

Earlier quoted context omitted.

You just need to do what the world did - NAT. IPv6 is more than just address space extension. There’s all sorts of stuff packed in there that complicates the process. All mobile clients are behind CG-NAT. We should have built standards around that instead of worrying about extending IP space to Mars or whatever.

> All mobile clients are behind CG-NAT. Demonstrably false. T-Mobile US mobile clients are IPv6-only and connect via IPv6 to IPv6 sites: * https://www.youtube.com/watch?v=d6oBCYHzrTA * https://www.youtube.com/watch?v=nNMNglk_CvE NAT is only used to connect to IPv4-only hosts via DNS64 (with or without 464XLAT). As of 2022Q2, T-Mobile US has 110 million customers: * https://www.statista.com/statistics/219577/total-cus…

A lot of mobile telcos use IPv6, but there are virtually no telcos around the world that don't force the use of some form of NAT (CGNAT, NAT64) for connecting to legacy sites. NAT64 is effectively another form of CGNAT, you only have a proper end to end connection if you're using IPv6 directly.

TMO US has 110 million customers, but they don't have 110 million legacy IP addresses, and most other telcos are in the same boat.

Re: Tell HN: IPv6-only still pretty much unusable

#483

Post by mianos » Thu, Dec 08, 2022, 2:56 AM UTC

ipython wrote: post #404

gnfargbl wrote: post #333

Earlier quoted context omitted.

I think you're being unfair to the audience. The main complaints here aren't about the consequences of those legacy problems, they're about the fact that IPv6 is just such a mediocre designed-by-committee protocol. Your point about mobile networks kind of illustrates this. There are all sorts of weird and wonderful protocols used in the mobile world, and it doesn't matter because 99.999% of us never have to deal with…

What parts of ipv6 used in consumer grade equipment are not understandable or “consumer grade”? Ipv6 in some areas is actually simpler than ipv4. I gave the example of mobile networks because it’s one of the few places consumer facing networks are growing rapidly and in some cases build entirely greenfield networks. And they have overwhelmingly chosen to build using ipv6 to do so.

It is worse than that. They implement 'carrier grade NAT' on top of double NAT.

Maybe mobile devices don't need incoming connectivity but doing a hack on a hack to save IPv4 addresses is a reflection on the genuine expertise at some of the national carriers.

When I was younger, telecom providers had all the professional expert engineering talent.

(I'm on superloop down under here, they actually have engineers and seem to have deployed a, what seems to be to me, a faultless IPV6 setup. The only issues I have found have been with toy things like pihole not behaving properly. Once I went to the Technitium thing my ipv6 experience over the last few years has been faultless.

Re: Tell HN: IPv6-only still pretty much unusable

#484

Post by bert64 » Thu, Dec 08, 2022, 3:03 AM UTC

chillfox wrote: post #475

viraptor wrote: post #280

Earlier quoted context omitted.

> where your local address is horribly long, for the sake of global uniqueness, which is something that most people don't really need Apart from debugging where you can copy-paste anyway, does it matter? I've got a few services on the local network and over zerotier that all talk IPv6. In the last 3 years or so I've never used an ipv6 address directly. There's enough DNS and discovery protocols that I never needed to…

Any sysadmin for a medium sized company with their own servers are likely to end up having to type in IP address or get them off shitty management consoles that don't support copy paste in any way.

Using IP addresses directly is a bad practice in general, it introduced security risks in many scenarios.

SSL - usually cannot verify the cert, defeating the point of SSL SMB - windows will fail over to less secure ntlm auth instead of kerberos

If your using IP addresses instead of hostnames to reference machines, you're doing it wrong.

Also IPv6 is easier to remember in general... We have a single large IPv6 allocation (eg 2001:db8::/32), and everything sits under that in a logical layout. For legacy IP, we have several different allocations in different class A blocks (104.x, 66.x, 62.x etc) plus all the RFC1918 space used internally

Re: Tell HN: IPv6-only still pretty much unusable

#485

Post by butlerm » Thu, Dec 08, 2022, 3:06 AM UTC

throw0101a wrote: post #164

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

> And regarding compatibility, with ipv4+ if you have a 0.0.0.0.x.x.x.x ip address you would be able to talk to both ipv4+ aware and legacy ipv4 devices natively without any tunneling (because you also own the legacy, non quad 0 ip address). This exists: > Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For…

> What makes you think that companies would have been willing to make the effort to deploy "IPv4+" any more than IPv6?

The hallmark of a good IPv4+ solution is that it autodeploys without anyone at the network configuration and administration level having to think too much about it. IPv6+IPv4 by contrast generally doubles the configuration complexity of more things than you can count.

It is true that for IPv4+ to be successful nearly everyone currently using IPv4 would need some sort of behind the scenes upgrade to be IPv4+ compatible first before the extended address space would be portable. And that includes incremental upgrades of just about everything that touches IPv4 or IPv4 compatible addresses.

Re: Tell HN: IPv6-only still pretty much unusable

#486

Post by bert64 » Thu, Dec 08, 2022, 3:14 AM UTC

fernandomm wrote: post #191

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

Let's not forget about the idea that ISPs would distribute a /56 range to residential users. You could split it in /64 ranges according to your requirements and everything would work fine. There is only one "minor" issue: all major ISPs in my country ( Brazil ) only provide a single /64. You can't get another /64 unless you upgrade to a very expensive business plan. That makes IPv6 not only useless but also a huge se…

Those ISPs are broken and not following the RFCs or RIR guidelines.

There's nothing stopping you from using NAT with IPv6, people just don't do it because the only benefit of NAT is conserving limited address space. NAT on IPv6 just brings all downsides and no benefit because you (should) have no shortage of address space. In any case v6 with nat is no worse than legacy ip with nat, its just stupid because they're forcing a newer and better protocol to run in a degraded mode.

Consumer oriented routers and firewalls do not allow arbitrary inbound IPv6 connections by default, you have to explicitly enable them.

I still don't get scanned over IPv6, despite having a static /56 range for more than 10 years. Everything that's reachable over legacy IP is also reachable over v6, and i have several v6-only devices because i simply don't have enough legacy addresses for everything. Scanning v6 is extremely difficult, while the legacy blocks get scanned continuously.

Modern operating systems are not sitting there with exposed services by default, you have to manually open them up if you want. Simply connecting a win11 box to an open IPv6 connection is not going to get you joined to a botnet like connecting a winxp machine directly to a legacy connection did.

Modern devices are often exposed to hostile networks/users - every time you connect a portable device to a public wifi network you are exposing your device to the operators and other users of the network. Depending how that network is configured, you might be exposed to the internet too. You don't have any separate device between you and the hostile network, you are relying on the configuration of your machine itself.

ISP supplied routers are limited and generally garbage, this is a problem for legacy ip just as much as v6.

Re: Tell HN: IPv6-only still pretty much unusable

#487

Post by wankle » Thu, Dec 08, 2022, 3:17 AM UTC

IPv6 drives lock sync AD personalization which represents trillions of dollars; it's no wonder there are so many social engineering attempts to try and herd the public into using it.

Re: Tell HN: IPv6-only still pretty much unusable

#488

Post by bumbledraven » Thu, Dec 08, 2022, 3:20 AM UTC

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

djb proposed this back in 2002: https://cr.yp.to/djbdns/ipv6mess.html

> How do we teach every client on the Internet to talk to servers on public IPv6 addresses [and vice versa]?

> Answer: We go through every place that 4-byte IPv4 addresses appear, and allow 16-byte IPv6 addresses in the same place.

> ...

> Unfortunately, the straightforward transition plan described above does not work with the current IPv6 specifications. The IPv6 designers made a fundamental conceptual mistake: they designed the IPv6 address space as an alternative to the IPv4 address space, rather than an extension to the IPv4 address space.

> ...

> This might sound like a very small mistake: after all, once IPv6 is working, we can move everything to IPv6, so who cares about IPv4? The problem is that this mistake has gigantic effects on the cost of making IPv6 work in the first place.

Re: Tell HN: IPv6-only still pretty much unusable

#489

Post by bert64 » Thu, Dec 08, 2022, 3:23 AM UTC

293984j29384 wrote: post #295

derefr wrote: post #174

Earlier quoted context omitted.

What makes you think that, for critical systems, "IPv4 + NAT + bad firewall" is the default IPv4 deployment paradigm, rather than "IPV4 + bad firewall"? Sure, big IaaS providers like AWS put you in a VPC by default. But most servers on the net are not hosted in an IaaS; they're hosted using a VPS or bare-metal hosting provider, or just coloed in a DC by their owner. And in all those cases, what that kind of deploymen…

While I don't have any factual proof to refute your statements, in my personal experience almost every organization uses NAT & RFC1918 address space. The only client I can think of in my 20 years of experience that used a public IPv4 per VM/machine was the DoD, specifically, the U.S. Army. From your very last statement, I think you've confused self hosting (like buying a VPS from Digital Ocean and hosting your own bl…

People assume that RFC1918 is not routable, but that's not the case... It's fully routable, but there is no global route. Have you ever tested routing to your RFC1918 address space from the ISP, or from a customer in the same neighborhood?

On some ISPs, all the customer routers in a given area are placed in a large legacy subnet, so if another customer adds a manual route to RFC1918 space using your router as next hop - the traffic will arrive on the WAN interface of your router. Some routers will actually route this traffic inside.

Have you ever tested this and verified that your router doesn't do this? Probably not, because most people haven't. They just assume that it can't, and get a nasty surprise if someone demonstrates that it can.

Re: Tell HN: IPv6-only still pretty much unusable

#490

Post by chillfox » Thu, Dec 08, 2022, 3:26 AM UTC

bert64 wrote: post #484

chillfox wrote: post #475

Earlier quoted context omitted.

Any sysadmin for a medium sized company with their own servers are likely to end up having to type in IP address or get them off shitty management consoles that don't support copy paste in any way.

Using IP addresses directly is a bad practice in general, it introduced security risks in many scenarios. SSL - usually cannot verify the cert, defeating the point of SSL SMB - windows will fail over to less secure ntlm auth instead of kerberos If your using IP addresses instead of hostnames to reference machines, you're doing it wrong. Also IPv6 is easier to remember in general... We have a single large IPv6 allocat…

Sure, but most places are not setup to using DHCP on servers or automated installs. So you will be typing in IP addresses through some kind of console to configure the machine in the first place and you will be typing in that IP address in the DNS system and when someone remotely fucks up the routing or IP config then you will be manually typing in lots of IP addresses to fix it.