531–540 of 649 posts
Earlier quoted context omitted.
Sigh, I need to stop engaging with obvious tinfoil hats.
Oh boy, all my points are definitely beaten with this single one of ineffable precision and efficiency! What you need is to learn to reinforce your opinion with counterarguments instead of allegorically admitting your inability to formulate them.
Have a good one, mate.
Hey all... unquietwiki from r/ipv6; been lead-mod there for a while now (though the rest of the folks are really amazing on the mod-side). IPv6 has saved my bacon more times in the past 15 years, than IPv4 has fought with me. No clashing of IPv4 ranges. No fighting with NAT. Ability to easily have concurrent networks, for different purposes. Ability to assign multiple network addresses. Internally, it "just works" on…
The issue I have with IPv6 is that it's so complex compared to the IPv4 I know, and still has lacking support in routers and similar.
For example, I want to be sure my local devices uses my local NTP server. With IPv4 it's trivial, I just add an option to the DHCP server. With IPv6 I can't do that with RA, I have to use DHCPv6. But Android doesn't support DHCPv6, so I have to run both RA and DHCPv6, and hope it just works out.
Next there's firewall rules. I used to run pfSense, and it just didn't support changing prefixes. Everything was configured based on the full IPv6 address, so everything had to be reconfigured when the prefix changed. Not only that, but stuff like DNS server address didn't get updated properly, so all the clients still tried to connect to the DNS server (my router) using the old prefix, so no internet for any of the clients all of a sudden.
Additionally, using the full IPv6 address internally is a PITA, since even if I assign a server a nice ::2 ending, my prefix is a full 64 bits of random noise (which changes, yay!). So I ended up using ULAs, which at least preserved some of my sanity, but it's another thing to manage.
So yeah, once I start having IPv6 issues and have to figure out some solution I wonder why bother. Mostly because it's so different, and it's still under development, both specification wise and the implementations. IPv4 for most people is quite simple in comparison, due to an established ecosystem. IPv6 on the other hand feels quite rough, including the impedance mismatches due to clearly being designed for large enterprise networks.
That being said, I've now had IPv6 enabled at home for over a year, things mostly work well. The key change was to ditch pfSense and switch to OpenWRT.
Earlier quoted context omitted.
Using IP addresses directly is a bad practice in general, it introduced security risks in many scenarios. SSL - usually cannot verify the cert, defeating the point of SSL SMB - windows will fail over to less secure ntlm auth instead of kerberos If your using IP addresses instead of hostnames to reference machines, you're doing it wrong. Also IPv6 is easier to remember in general... We have a single large IPv6 allocat…
Sure, but most places are not setup to using DHCP on servers or automated installs. So you will be typing in IP addresses through some kind of console to configure the machine in the first place and you will be typing in that IP address in the DNS system and when someone remotely fucks up the routing or IP config then you will be manually typing in lots of IP addresses to fix it.
Earlier quoted context omitted.
> And lastly... a lot of IT guys still don't care for IPv6; as those biases show up in these & on Reddit; so that perpetuates the cycle You know the 3rd and 7th largest networks on the internet still can't reach each other over IPv6, right? It is super awesome that it "just works" for you, but recognize you might just not have the perspective of one of the people who has to make it "just work" for you.
>You know the 3rd and 7th largest networks on the internet still can't reach each other over IPv6 Who is responsible? Which networks are those?
The reason as an end user you can access both sides of the spit is because network engineers for end user/eyeball networks will buy transit from both.
Earlier quoted context omitted.
Depending on the NAT implementation this can be incredibly naive. Many home routers will send ANY traffic incoming on a port to the NAT'd IP address, even if the sources don't line up. So say Alice is behind a crappy NAT and wants to talk to Bob. Alice's router opens a port on its edge, lets say 1234, and sends traffic to Bob on port 80. Let's say Charles knows Alice's IP address. Charles starts spamming Alice's rout…
> Alice's router is dumb. It sees traffic on port 1234, checks its NAT table, and sees that data is supposed to go to Alice. While in principle that is possible, in practice almost all home routers are based on Linux, and Linux netfilter NAT implementation distinguish connections based on port and IP, not just port, so this would not work.
BT, one of the largest ISP's in the UK, only allow the configuration of destination IP and external/internal ports[0].
I've never expected my NAT to do anything other than map ports. I can see why the ability to map source IPs to different ports would be useful but relying on that as a security feature feels like a foot-gun. I wouldn't feel comfortable exposing an application that doesn't have some form of authentication and/or blacklisting.
[0] https://portforward.com/bt/home-hub-6/Port%20Forwarding.jpg
Earlier quoted context omitted.
No.... Absolutely no... NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. And how is "You have to think about which ports you want the NAT gateway to forward." any different from thinking about firewall rules? And most consumer CPE devices (i.e. 'router' etc) are perfectly capable of running a firewall, and often do. And any firewall that doesn't drop i…
>NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. This is one of those infosec tenets that is technically true but functionally unhelpful. Like correct-horse-battery-stable debates. The claim is that IPv4 + NAT + bad firewall is better than IPv6 + bad firewall. Yes, both are insufficient and inferior to a good firewall - but how confident are you that…
Even that is not true:
- It takes half-minute to scan an IPv4 public IP (NAT) for vulnerabilities.
- Good luck and have fun to scan a /64 for a potentially vulnerable machine. See you next century.
- And if it is not enough: most internet box support UPnP/NAT-PMP that allow any malware to get your NAT wild opened.
Earlier quoted context omitted.
> At some point the "dash" to adopt ipv6 starts, and brave folks will drop support for ipv4. I wouldn't be sure about that. I don't see any "dash" to support v6 in our future, when the option to just keep working around issues with v4 is so much easier and cheaper in the moment. Really, what does anyone have to gain by switching to v6?
The thing is, it's not v6 or v4, it's v6, v4 with a price premium, or v4 with CGNAT. CGNAT sucks. Stuff blocks you because you get lumped in with other users. You can't take inbound connections. Average users don't know that, but they get annoyed with side effects. Not being able to play multiplayer stuff or it being slow/high latency because of no inbound connection. Having to do extra CAPTCHAs, being straight out b…
Earlier quoted context omitted.
Let's not forget about the idea that ISPs would distribute a /56 range to residential users. You could split it in /64 ranges according to your requirements and everything would work fine. There is only one "minor" issue: all major ISPs in my country ( Brazil ) only provide a single /64. You can't get another /64 unless you upgrade to a very expensive business plan. That makes IPv6 not only useless but also a huge se…
> There is only one "minor" issue: all major ISPs in my country ( Brazil ) only provide a single /64. You can't get another /64 unless you upgrade to a very expensive business plan. I'm curious why you need multiple subnets at home; I at one point had separate subnets because I was using a wifi client as a ip level router, but was wondering what your use-case is. > Although IPV4 + NAT had some issues, it ( accidental…
Not OP, but there are many use cases. First is device isolation so untrusted devices can be put in their own network while you can selectively add ressources from your main network via VLANs and add simple firewall rules because the untrusted network is a different interface on your VM than the others.
Second, you might want to put any managment interfaces (and ssh-enabled IPs) on a seperate network both for ease of organization and security.
Third, if you want to have your network services configured differently for different clients (think VPN vs local clients, adblocking DNS for mobile only) it's a lot easier to do that for whole subnets.
IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…
I find that very wild optimism.
- You will still get two incompatible address space V4 and V4+ and that would imply: -> You still need to modify your software to adapt for V4+ for the transition.
-> Most of your middlebox and firewall rules will get in the way for anything served over V4+. Exactly like for V6
-> DNS would still need to be updated with new record and it will be the same mess
It would be mostly the same mess.
IPv6 has its quirks, but let's be honest: the main problem with Ipv6 is not technical any-more.
The main reason the switch does not happen is that there is no business incentive to switch to IPv6 for most companies and consequently, most companies do not give a fuck.
I was thinking about ipv6 the other day. I concluded in my head that adoption was just around 5-10%. Luckily I went to verify that with statistics. https://www.google.com/intl/en/ipv6/statistics.html While price of ipv4 addresses are increasing, the world has slowly been adopting ipv6. From the graph above, I'd say we cross over 50% in about 2-3 years time. At some point the "dash" to adopt ipv6 starts, and brave fol…
That is a very one-sided view of adoption. It ties directly with the rise of mobile and internet in areas that wasn't able to grab IPv4 addresses in time. Such as India. Not sure what France is doing though, maybe something right. So, from my perspective (which obviously is tied to my location) is that all computers have IPv4 (haven't heard (and I've asked) of a single consumer ISP that offers IPv6) but all mobile ph…
