Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

501–510 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#501

Post by marcosdumay »

pflanze wrote: post #260
marcosdumay wrote: post #181

Earlier quoted context omitted.

> The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. That is usually not true. NAT punching is a thing for decades now.

- NAT punching does require cooperation of programs on the protected machines, though, no? How is it different from them inviting traffic in any other way (like, requesting a page via https from an infected server could hijack the client on the protected machine if the client has security holes in the right places; the https client is willing to get traffic here, just as some VoIP program is willing to receive a call…

> NAT punching does require cooperation of programs on the protected machines

As does listening to a port.

> And is it any different from a stateful firewall on IPv6?

Hum, not much. And that's the point, all of those are basically the same. NAT doesn't give you much security, and NAT without a firewall usually gives you less security than a firewall, since NAT usually is configured for connectivity, and a firewall for protection.

Re: Tell HN: IPv6-only still pretty much unusable

#502

Post by theteapot »

salmo wrote: post #367
anthropodie wrote: post #262

Earlier quoted context omitted.

> What makes you think that companies would have been willing to make the effort to deploy "IPv4+" any more than IPv6? I'm pretty sure that those who built new protocol were aware of this and were like "anyway we are gonna have to upgrade network devices. Why don't we build a new protocol while avoiding pitfalls of older one" Any comittee that sat down to solve IPv4 issue would have thought of compatibility first. I…

They took much more on with IPv6 than IPv4 replacement. The spec goes much deeper than IPv4 did, replacing ARP, DHCP, etc. It's a product of its time, including a lot of over-engineering by committee. Many of the problems they tried to address didn't pan out to be real issues. You can read the RFCs and compare. IPv4 w/ more bits is a lot more simple. Yes, older network gear wouldn't deal with it well, but that's not…

Agree. Second system effect in action -- https://en.wikipedia.org/wiki/Second-system_effect.

Re: Tell HN: IPv6-only still pretty much unusable

#503

Post by onphonenow »

salmo wrote: post #367
anthropodie wrote: post #262

Earlier quoted context omitted.

> What makes you think that companies would have been willing to make the effort to deploy "IPv4+" any more than IPv6? I'm pretty sure that those who built new protocol were aware of this and were like "anyway we are gonna have to upgrade network devices. Why don't we build a new protocol while avoiding pitfalls of older one" Any comittee that sat down to solve IPv4 issue would have thought of compatibility first. I…

They took much more on with IPv6 than IPv4 replacement. The spec goes much deeper than IPv4 did, replacing ARP, DHCP, etc. It's a product of its time, including a lot of over-engineering by committee. Many of the problems they tried to address didn't pan out to be real issues. You can read the RFCs and compare. IPv4 w/ more bits is a lot more simple. Yes, older network gear wouldn't deal with it well, but that's not…

No kidding - they got rid of dhcp and more but it’s a nightmare getting networks to work with just ipv6 concepts- everything from provisioning phones (dhcp options to push config / NetBoot stuff) and more. Layer in privacy extensions, renumbering on uplink wan flapping (slow too - the failover is pathetic compared to NAT wan failover) - icmp traffic differences - firewalls need to be much more careful with ipv6 and related protocols because things can easy break (it’s fragile) or you create risks. Even min subnet sizes mean crazy 2 node subnet sizes (think isp and cpe management subnet for a customer). Also curious why not 48 or 64 bits or 96 bits? 128 bits is ludicrous

Re: Tell HN: IPv6-only still pretty much unusable

#504

Post by AtlasBarfed »

throw0101a wrote: post #300
theamk wrote: post #259

Earlier quoted context omitted.

Mayne RFC exists, but it os not used in teal world anywhere. In all servers, I configure IPv4 and IPv6 separately. Network setup is separate. DHCP daemons are separate. Firewall rules are separate. Network monitoring is separate. I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me.

> I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me. And exactly how would you accomplish this switch to a larger address space? Please explain the steps exactly how they would be done. Because IPv4 has 32 bits of address. Anything after IPv4 needed >32 bits of address. How exactly do you fit in…

It's like no protocol has ever been extended or revised. Ever.

Let's pretend there isn't an Options and Padding section in the IP header:

"Options and Padding - A field that varies in length from 0 to a multiple of 32-bits. If the option values are not a multiple of 32-bits, 0s are added or padded to ensure this field contains a multiple of 32 bits."

Wow, like I CANNOT think of how that would be used to add more bits. More 32 bit sections? No use for that for ipv4+ or ++ or +++.

Re: Tell HN: IPv6-only still pretty much unusable

#505

Post by stevewatson301 »

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

There have been no experiments to show why this is any better than IPv6 given that you still need to modify routers and end user devices to route traffic, nor does it address the fact that IPv6 has additional features such as flows and prioritization to handle the modern Internet's traffic requirements.

The scheme you propose had already been proposed by Elad Cohen, but with "evil" intentions as they're linked to a IPv4 misappropriation scheme[1].

[1] https://mybroadband.co.za/news/security/367188-the-great-afr...

Re: Tell HN: IPv6-only still pretty much unusable

#507

Post by remram »

dqh wrote: post #474
redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

I am not a network engineer, but for about 20 years I have wondered why we didn't 'just' do something like: 1. Include an extra 32-bits of address information as an IP options header. Call it an IP4.4 packet. 2. (I think?) IP4.4 packets would therefore happily travel over existing IP4 infrastructure. 3. Each existing IP4 address becomes a potential IP4.4 network with 32-bits of address space behind it. IP4.4 aware ro…

"Happily travel" and get to the wrong place? What's the point of that?

Re: Tell HN: IPv6-only still pretty much unusable

#508

Post by neurostimulant »

russdill wrote: post #359
jeroenhd wrote: post #245

Earlier quoted context omitted.

> How does this not see more abuse by bad actors? Because this tech goes unused in almost all cases. Also doesn't work if your DNS client is secure against tampering (i.e. uses DNSSEC) without more configuration. To make this work, you need to intercept and modify the victim's DNS traffic or reconfigure the victim's DNS server somehow. With that amount of control, IPv6 or IPv4 no longer matter; you apparently have fu…

Ugh, I was under really looking forward to trying out NAT64 one day. Potential complications with DNSSEC never occurred to me. Thanks for the reality check.

Just rent a small vps somewhere with dual stack ipv6 and ipv4 and run Tayga on it to make your own NAT64 endpoint.

Re: Tell HN: IPv6-only still pretty much unusable

#509

Post by logic_probe »

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

An even better idea: Right now, the biggest address is 255.255.255.255. Why not just make it go up to 999.999.999.999? Problem solved!

Re: Tell HN: IPv6-only still pretty much unusable

#510

Post by AtlasBarfed »

vlovich123 wrote: post #496
dqh wrote: post #474

Earlier quoted context omitted.

I am not a network engineer, but for about 20 years I have wondered why we didn't 'just' do something like: 1. Include an extra 32-bits of address information as an IP options header. Call it an IP4.4 packet. 2. (I think?) IP4.4 packets would therefore happily travel over existing IP4 infrastructure. 3. Each existing IP4 address becomes a potential IP4.4 network with 32-bits of address space behind it. IP4.4 aware ro…

What happens when your 4.4 packet hits a router box somewhere out there that doesn’t understand 4.4? Where’s it going to send that packet? To the wrong address (or potentially even create an infinite loop). Now what?

I understand what you're saying, but isn't IP supposed to be about routing things around failure points? So routers that "know" IP 4.4 would "know" what routers aren't 4.4.
Post reply on HN