Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The world in which IPv6 was a good design (2017)

apenwarr.ca

Post reply on HN
Print view View original

231–240 of 318 posts

Re: The world in which IPv6 was a good design (2017)

#231

Post by Dagger2 »

JohnFen wrote: post #171
jeroenhd wrote: post #76

Earlier quoted context omitted.

> The over 99.9% of sites that still have an A record have it for a very good reason A records work on v4 and v6, so they'll probably stick around for a while. Perhaps they'll end up being concentrated around 4-to-6 forwarding NAT-as-a-service companies, but they're the fallback mechanism. I don't think anyone is advocating for dropping A all together unless you're really trying to pinch pennies. > I'd love to see so…

> Unlearning NAT NAT is certainly not a firewall, but it is a very useful router function. I still don't understand how IPv6 makes NAT a thing that isn't useful to know. I want to expose my servers to the internet through a single shared IP address, and to be able to have those servers exist on different IP addresses inside my network. How does IPv6 allow this without NAT?

By reverse proxying. Run a load balancer on a single machine and have that reverse proxy connections to their destination.

But what if you insist on not using a proxy for whatever reason?

When people say "NAT", they're usually talking about SNAT/MASQUERADE, i.e. NATing outbound connections. What you're asking for here is port forwards/DNAT, i.e. applying NAT to redirect an inbound connection.

If you want to NAT inbound connections, you can do it without NATing outbound connections. Essentially: you don't need to "NAT", you just need to port forward.

Honestly, I think you should just suck it up and use different hostnames for different services, because running all of your services on one IP is really bad for security since it makes it much easier to enumerate every service you're running -- it only takes scanning 65k ports on one IP to find them all, rather than 65k ports on 2^64 IPs. That's the difference between megabytes and yottabytes of port scan traffic.

(If you NATed outbound connections to also come from this IP then things get even worse because every outbound connection from any of your machines immediately informs the server of the IP needed to make an inbound connection to you. That's a completely unnecessary security sacrifice.)

But if you're going to run everything on one IP without proxying, you only need port forwards to do it, you don't need to run the network on some local IP range too.

Re: The world in which IPv6 was a good design (2017)

#232

Post by patmorgan23 »

JohnFen wrote: post #171
jeroenhd wrote: post #76

Earlier quoted context omitted.

> The over 99.9% of sites that still have an A record have it for a very good reason A records work on v4 and v6, so they'll probably stick around for a while. Perhaps they'll end up being concentrated around 4-to-6 forwarding NAT-as-a-service companies, but they're the fallback mechanism. I don't think anyone is advocating for dropping A all together unless you're really trying to pinch pennies. > I'd love to see so…

> Unlearning NAT NAT is certainly not a firewall, but it is a very useful router function. I still don't understand how IPv6 makes NAT a thing that isn't useful to know. I want to expose my servers to the internet through a single shared IP address, and to be able to have those servers exist on different IP addresses inside my network. How does IPv6 allow this without NAT?

"I want to expose my servers to the Internet through a single shared IP address" that's a load balancer/reverse proxy, not NAT.

Re: The world in which IPv6 was a good design (2017)

#233

Post by JohnFen »

patmorgan23 wrote: post #216
nikanj wrote: post #123

Earlier quoted context omitted.

That comes with a major assumption that switching ISPs is an option. Most people get to choose between their cable company, or a fleet of ill-trained pigeons

Actually most people (in the US) get a choice between the cable company, the LEC, and a 5g carrier, and maybe even StarLink.

I have a choice between the cable company and sorta Starlink (Starlink isn't actually available in my area yet, and is a nonstarter anyway). There are no other options available to me.

Re: The world in which IPv6 was a good design (2017)

#234

Post by JohnFen »

Dagger2 wrote: post #231
JohnFen wrote: post #171

Earlier quoted context omitted.

> Unlearning NAT NAT is certainly not a firewall, but it is a very useful router function. I still don't understand how IPv6 makes NAT a thing that isn't useful to know. I want to expose my servers to the internet through a single shared IP address, and to be able to have those servers exist on different IP addresses inside my network. How does IPv6 allow this without NAT?

By reverse proxying. Run a load balancer on a single machine and have that reverse proxy connections to their destination. But what if you insist on not using a proxy for whatever reason? When people say "NAT", they're usually talking about SNAT/MASQUERADE, i.e. NATing outbound connections. What you're asking for here is port forwards/DNAT, i.e. applying NAT to redirect an inbound connection. If you want to NAT inbou…

Thanks for this.

> I think you should just suck it up and use different hostnames for different services, because running all of your services on one IP is really bad for security since it makes it much easier to enumerate every service you're running

I really, really don't want to do this for a ton of reasons. Port scanning isn't high on my security worries, to be honest. I've been dealing with that for decades and am well-protected, so that's not a compelling reason for me.

Re: The world in which IPv6 was a good design (2017)

#235

Post by Dagger2 »

remram wrote: post #159
K2L8M11N2 wrote: post #156

Earlier quoted context omitted.

But it does, that's what ::ffff:0:0/96 is for

I can't `ping ::ffff:192.168.0.1` and have it ping my router. There is a range reserved for representing IPv4 addresses, but the stack doesn't translate.

It does translate, but it doesn't work for ping because ping bypasses most of the stack by sending raw packets. Try something like `telnet ::ffff:192.168.0.1 80`.

Re: The world in which IPv6 was a good design (2017)

#236

Post by nikanj »

patmorgan23 wrote: post #217
voyagerfan5761 wrote: post #151

Earlier quoted context omitted.

As an example, the options where I am right now (thankfully temporary) are: - $55/mo. 3 Mbps DSL - $80/mo. 300 Mbps cable (or even more expensive, faster cable) - $120/mo. 100+ Mbps (if you're lucky) Starlink - A few other heavily restricted, very expensive satellite options (e.g. HughesNet), to which the aforementioned fleet of ill-trained carrier pigeons might be preferable Only one of those is practical and (mostl…

Did you look at doing 5g home Internet? There's great coverage in lots of areas.

At least in Canada 5g comes with $50-for-15GB levels of data cap pricing

Re: The world in which IPv6 was a good design (2017)

#237

Post by jeroenhd »

VoodooJuJu wrote: post #103
jeroenhd wrote: post #66

IPv6's biggest problem remains not that it's badly designed (at least not nowadays, there were problems but they were solved ten years ago) but that millions of network engineers never bothered to look deeper into IPv6 than "I don't get it, this feels off". You can't make a backwards compatible "IPv4 with more bits" like people dream of. L2 routers and middleboxes would still need to be replaced, software would still…

The user/customer is always right. If the people who would use IPv6 don't like it and don't want it, if they think it's bad, then it's bad. When forest rangers observe hikers repeatedly deviating from the official trail at certain spots, the ranger understands this to mean the trail is wrong, and he re-designs it to accommodate the hikers. The forest ranger is able to do this because he understands what the trail is…

> Many engineers seriously lack empathy for end-users, which results in the engineer creating inadequate products/services that don't meet the user's real needs.

Ain't that the truth. Modern operating systems are getting worse by the year.

That said, IPv6 has been significantly altered. SLAAC was fixed with two RFCs, one a decade IPv6 was designed, and another in 2015 for fixing oversights in duplicate address detection. DHCPv6 got updated with all kinds of options and it was already late to the party. RDDNS got added in 2007 and updated with more options in 2017. IPv6 Privacy Extensions got added when people brought up the privacy issues with SLAAC. People set up their own weird 4-to-6 translation mechanisms so various standards were introduced to cover any use case you may need.

IPv6 as it was originally designed is practically unusuable today. The trails have since been adjusted and the hungry mountains lions are gone. The hikers don't even notice the difference from their old paths.

However, park management decided that hikers should never go down the new and improved trail because they heard a story from their friend once that someone got lost there fifteen years ago, and some of them have lost the map to the start of the trail.

Re: The world in which IPv6 was a good design (2017)

#238

Post by Dagger2 »

FuriouslyAdrift wrote: post #194
rnhmjoj wrote: post #191

Earlier quoted context omitted.

You can if you have NAT64: $ ping 64:ff9b::1.1.1.1 PING 64:ff9b::1.1.1.1(one.one.one.one (64:ff9b::101:101)) 56 data bytes 64 bytes from one.one.one.one (64:ff9b::101:101): icmp_seq=1 ttl=54 time=10.4 ms 64 bytes from one.one.one.one (64:ff9b::101:101): icmp_seq=2 ttl=54 time=10.0 ms

And then we are back to NAT...

Yes. What were you expecting? There's no way for a v4-only device to reply to a packet from a v6 source address otherwise. The source address has to be mapped to an address the v4-only device understands, and then mapped back again for the reply packets.

How else could this work?

Re: The world in which IPv6 was a good design (2017)

#239

Post by kccqzy »

backendanon wrote: post #136
meragrin_ wrote: post #110

Earlier quoted context omitted.

> This is a good thing, at least right now, as it makes scammers/spammers/hackers/ddosers lives more expensive to acquire fresh addresses. This can only exist when a shortage exists. No it is not. More and more people share addresses so more people would be affected and it would just move the problem elsewhere.

I can guarantee you no one shares my server's IPv4.

And this is privilege and entitlement.

You know that if everyone in the world wants to have a dedicated, unshared IPv4, it is mathematically impossible. Bragging about it is showing your privilege and sense of entitlement. What makes you special that you deserve a dedicated IPv4?

Re: The world in which IPv6 was a good design (2017)

#240

Post by gwbas1c »

I've always seen "The Internet" as a network of networks.

I interpreted the article as inferring that "every device should only speak internet, and we shouldn't have non-internet hacks to allow devices to connect to the internet."

But, if we interpret the internet as a network built on top of other networks, it negates the thesis (as I interpret it) of the article. It also locks us into networking, as understood in the late 1990s, and designed into IPv6.

IMO: It seems like IPv6 suffers from second system syndrome. The authors lost sight of the purpose "network built on top of other networks" and tried to add lots of features for the "other networks" that really aren't needed.

Maybe it's time for IPv7? Really, all we need is IPv4 + larger address space. I'd even argue that NAT is a good thing (security feature,) because allowing devices on a private network to automatically open ports on the public internet is insecure.

Post reply on HN