Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

601–610 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#601

Post by otabdeveloper4 »

Dagger2 wrote: post #594
otabdeveloper4 wrote: post #568

Earlier quoted context omitted.

Three decades of IPv6 mis-adoption shows otherwise. "Running out of IPv4 addresses" is not a problem you face unless you're an internet service provider or a mobile network. 99.99999% of the rest of us don't care because we use 192.168.0.0/16 or 10.0.0.0/8 when we have to do networking. Yes, NAT is complex. That sucks. No, blindly stating "you don't need NAT and you're holding it wrong" is just plain incorrect. Pleas…

It causes no end of problems, not just for ISPs and mobile networks but also for people running server networks and for end users like us. I suppose it can be hard to see that when you grew up with the problems and have never used a network where you didn't need to deal with them though. The world can mostly function without NAT. It's mainly only used to work around address shortages, which aren't an issue on v6, so…

No, NAT is not for network address shortages.

NAT is a cruicial privacy and security feature.

"No need to use NAT" is, of course, a horrible anti-feature, not a benefit of IPv6. (And, of course, in the real world the vast majority of IPv6 is rolled out with NAT anyways.)

Re: Tell HN: IPv6-only still pretty much unusable

#602

Post by Symbiote »

AtlasBarfed wrote: post #580
Symbiote wrote: post #530

Earlier quoted context omitted.

45% of users are on IPv6. Clearly almost half of ISPs have adopted it, probably more than half of consumer ISPs.

How many of those are Mobile? And how many of those mobile ipv6 addresses are communicating with the "real" internet through a carrier grade NAT to translate/intermediate with IPV4 servers/addresses? And about the most offensive, disgusting thing to ipv6 people is the NAT. It's the thorn in their side that 1) IPV6 "trivially" solves (allegedly) but even worse 2) it's what keeps ipv4 on life support with the ISPs. Can…

Plenty of cable/fibre ISPs use IPv6, but it varies by country.

In the UK, the two largest providers have been running IPv6 for years (BT and Sky), that's about 55% of the market.

Virgin and TalkTalk are ignoring it, that's a further 25%.

Vodafone are working on it ("next year due to Covid"), 5%.

The remaining 20% is small ISPs, and many of these support it.

Re: Tell HN: IPv6-only still pretty much unusable

#603

Post by viraptor »

chillfox wrote: post #557
viraptor wrote: post #533

Earlier quoted context omitted.

If you have enough nodes to care and manually assign and at the same time don't automate deployment that sounds like an issue in general... and not with IPv6. You're likely to typo IPv4 just as well with enough entries.

Yep, but in my experience you have to manage about 2000+ machines before management will allow you to spend time on setting up deployment automation. So around the time you are setting multiple new machines a week.

I've done automatic deployment for 16. It was still totally worth it.

Re: Tell HN: IPv6-only still pretty much unusable

#604

Post by pflanze »

Dagger2 wrote: post #578
pflanze wrote: post #558

Earlier quoted context omitted.

> > NAT punching does require cooperation of programs on the protected machines > As does listening to a port. Listening on a port is for incoming connections, exactly the kind that we're blocking with either a (stateful) firewall or NAT. Listening on a port is a declaration of a program (a server) to communicate with whichever counter party can connect to this port (until the server program decides to close the conn…

> I have always understood NAT's protection to be limited to prohibiting incoming connections It doesn't actually do this. NAT rewrites the source address of outbound connections. Inbound connections aren't outbound connections so it does nothing to them, which means it doesn't prohibit them. That is why you don't need NAT for security: it doesn't give any in the first place.

> which means it doesn't prohibit them

OK. I want to dig down into this. Let's say I have a router `R`, which I'm running NAT and optionally other iptables rules on. I've got a client machine `C` sitting in a private network "behind" `R`. `R` is connected to the internet via a gateway `G`. `A` is some machine out there owned by an attacker. There's a vulnerable TCP service running on `C` listening on *:1313.

       A
       |
    internet
       |
       G
       | 4.3.2.1
       |
       | eth_public 4.3.2.77
       R
       | eth_private 10.0.0.1
       |
       | 10.0.0.2
       C
`A` can't connect to 10.0.0.2:1313 since it's not routable from their position. Thus, the fact that NAT on its own doesn't prohibit traffic to `C` doesn't matter in this scenario, practically `A` still can't reach it. So far so good?

The only issue I can see is that if `A` can hack `G`, because `G` doesn't have to depend on routing to reach `R`, it can send traffic to `R` with a target address of 10.0.0.2, which `R` then forwards to `C`. I haven't verified that this works (don't have enough devices with me). Is this what you're after? Fair point.

If I'd add the following rule to `G`, `C` would be safe even if `G` is hacked[*]:

   iptables -A FORWARD -i eth_public -d 10.0.0.0/16 -j REJECT
[*] Of course that requires that any outgoing connections that `C` makes are not vulnerable against the possible packet manipulation from `G`.

Am I missing anything?

Edit: simplified the rule

PS. I'd welcome a good pointer (book or other) on network security and also IPv6; I'm a software developer, and only occasionally dealing with networks.

Re: Tell HN: IPv6-only still pretty much unusable

#605

Post by oceanplexian »

crest wrote: post #211
spookthesunset wrote: post #81

Earlier quoted context omitted.

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

> It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. Have you never had more than a handful of IPv4 addresses? IPv6 works the same in this regard as a router IPv4 network e.g. universities, large/old enterprises etc. NAT started as a workar…

NAT wasn’t started as a way to make the address space last longer. A few decades ago you could get hundreds of thousands of IP’s by filling out a form with ARIN without any serious justification if you wanted them. I worked at an ISP and IP’s weren’t a scarce resource.

NAT started because having a network didn’t mean you were necessarily participating in the Internet. Globally unique addresses weren’t that important. At some point you had this decentralized situation where local networks wanted to bridge their users address space to the Internet without renumbering everything and thus NAT was born.

Re: Tell HN: IPv6-only still pretty much unusable

#606

Post by kavalg »

withinboredom wrote: post #56

Still no ipv6 support with WSL2 in windows. So, if you’re a Microsoft Windows dev in an ipv6 environment, you won’t make it too far.

got bitten by this recently. Another nail in the Microsoft Windows' coffin. It is such a fundamental thing and the fact that the issue has been open for ~2years is nothing short of pure shame.

Re: Tell HN: IPv6-only still pretty much unusable

#607

Post by Dagger2 »

AtlasBarfed wrote: post #597
Dagger2 wrote: post #593

Earlier quoted context omitted.

Too much of the web is mobile these days to be dismissing it. Yes, mobiles on v6-only with NAT64 to reach legacy v4 hosts is a massive success story. How can you say with a straight face that it's not? Most big landline ISPs in the US are doing v6. Comcast, the poster child for awful ISPs, winner of multiple worst company in America awards, has been running v6 over their entire network for years now.

Because you should talk to an ipv6 person and say the word "NAT". They froth at the mouth. It IS a success, but it's a success that is singularly enabled by the #1 thing that ipv6 people hate with a passion: a NAT. The evil NAT that has kept IPV4 address space alive, that was the crutch that kept ipv6 from being adopted earlier. The evil NAT isn't a firewall, the evil NAT can be replaced by string-of-acronyms. And, i…

Mobile carriers want v6 because it saves them money. CGNAT capacity is expensive. Having native v6 means that >50% of your traffic won't need to touch the CGNAT, which reduces your costs significantly.

NAT is a necessary evil to deal with address space exhaustion in v4. NAT64 is just another application of that. In v6, when not dealing with backwards compatibility to v4, NAT is an unnecessary evil. Do you see the difference?

> And, it's a success which paves the way for practically any protocol to replace ipv6 as the real successor, like the casually thrown out ipv4.4++v2, which is getting dismissed right and left by the ipv6 people here.

It's being dismissed because it brings nothing new to the table. The people casually throwing out alternatives aren't thinking through them enough to realize that they've either come up with something that doesn't work, or they've come up with something that's basically v6 and has the same limitations v6 does. There's zero point in replacing v6 -- which 40% of the Internet's clients are already using -- with another protocol that's just as hard to deploy.

Re: Tell HN: IPv6-only still pretty much unusable

#608

Post by chillfox »

viraptor wrote: post #603
chillfox wrote: post #557

Earlier quoted context omitted.

Yep, but in my experience you have to manage about 2000+ machines before management will allow you to spend time on setting up deployment automation. So around the time you are setting multiple new machines a week.

I've done automatic deployment for 16. It was still totally worth it.

Of course it is, automation is very nice, I use it for the handful of machines I have my personal stuff on. I am just saying that from my days as a sysadmin it was usually a years long uphill battle to get approval for automating even minor things.

Re: Tell HN: IPv6-only still pretty much unusable

#609

Post by keiyakins »

est31 wrote: post #571
Sesse__ wrote: post #326

Earlier quoted context omitted.

> One of the ideas of ipv6 was to reduce routing tables That idea was abandoned about 20 years ago. One fairly quickly discovered that hierarchical routing does not work well in the real Internet, where redundancy is done on the IP level with everybody and their dog having provider-indepent IP space. > like that the only standard for local ipv6 addresses Which one is the only standard? Link-local, site-local, ULA, or…

site-local addresses are deprecated since RFC 3879. Link-local addresses are indeed another standard, but have the very same length problem. You have these horribly long ipv6 addresses... those can't reasonably be parsed by humans... There is no 192.168.* equivalent in ipv6. Why don't we have something like fd00::1 being the router and fd00::2, fd00::3, etc being the devices in the local network, assigned by DHCP. Yo…

Why do you care how long the addresses are? That's what DNS is for. Within a link - most home networks are only one, and those are the ones that need to be simplest - there's even mDNS.

Re: Tell HN: IPv6-only still pretty much unusable

#610

Post by keiyakins »

error503 wrote: post #592
victorhooi wrote: post #585

Earlier quoted context omitted.

I'm dealing with this now as well..=( Do you happen to have a reference from the RFC, about it being against spec to hand out just a /64?

Originally (2002) a /48 per site was recommended in RFC3177. More recently (2011) RFC6177 took a more pragmatic / softened approach, but it does say: - it should be easy for an end site to obtain address space to number multiple subnets (i.e., a block larger than a single /64) and to support reasonable growth projections over long time periods (e.g., a decade or more). I don't really understand why ISPs choose to be…

I suspect it's to make business plans artificially more appealing. After all, why offer a better service when instead you can just make your cheaper one worse?
Post reply on HN