Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enabling IPv6 support for IPv4-only apps on Linux

blog.apnic.net

Post reply on HN
Print view View original

141–150 of 199 posts

Re: Enabling IPv6 support for IPv4-only apps on Linux

#141

Post by p1mrx »

WirelessGigabit wrote: post #107
ninkendo wrote: post #81

Coming from the Apple ecosystem, this is solved on macOS/iOS by a native implementation of 464XLAT on the device (particularly the CLAT relay part.) If you have a working NAT64/DNS64 setup, macOS can make a AAAA (ipv6 DNS) request to ipv4only.arpa, and observe the form the result comes back as, in order to learn the IPv6 prefix used for IPv4 compatibility on the network (eg. 64:ff9b::/96), and if it's not given an IP…

The largest problem with this is that that this IPv6 router lives outside of your devices. It lives somewhere at the ISPs infrastructure. And this causes a massive headache when it comes to systems that track you based on your IPv4 address. For example there are applications that track you by your IP address. And if you want to opt-out they refuse because the IPv4 address you give them is owned by T-Mobile. Also, it…

The problems you describe apply to CGNAT in general, which is unavoidable in a world with more humans than IPv4 addresses.

Our best hope to avoid CGNAT is more/better IPv6 support.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#142

Post by nelgaard »

simiones wrote: post #58

Instead of doing something like `export A="64:ff9b::"` and then using `ssh $A1.3.3.7`, it's apparently much easier to install a new software package and do `export LD_PRELOAD=/the/new/package` and hope it doesn't break anything...

the easiest would be to add to ~/.ssh/config:

host *.*.*.*

hostname 64:ff9:%h

(without the empty line)

Also work with scp, rsync,

Re: Enabling IPv6 support for IPv4-only apps on Linux

#143

Post by lazide »

hatch_q wrote: post #127
lazide wrote: post #119

Earlier quoted context omitted.

Every firewall I’ve dealt with since forever has default deny on inbound traffic, state full allow for outbound connections. Regardless of NAT or not, and regardless of how cheap it is.

Name one vendor? I can name you 3 that don't. Zyxel, Ubiquiti, Mikrotik. Also anything wrt based (eg. dd-wrt). In fact one of the warnings on dd-wrt official IPv6 tutorial: """ Keep in mind it can be dangerous to enable IPv6 without also having a firewall on each client that handles IPv6 packets, or having ip6tables on your router to filter incoming connections. ip6tables is NOT included by default with DD-WRT, which…

Hmm, I think you’re right! Apologies! And now off to check my firewall rules!

Re: Enabling IPv6 support for IPv4-only apps on Linux

#144

Post by mmis1000 »

josephcsible wrote: post #102
finaard wrote: post #53

Would be interesting to know which applications actually have problems with v6 - the example with directly using a v4 IP is more a user error, not an application issue. I pretty much stopped submitting patches enabling v6 functionality to various projects back in 2005 as everything I cared about was working at that point. (Side note, I was just trying to search a few of those - but seems that period pretty much doesn…

Docker's support for IPv6 is really poor. Basics are still gated behind the "experimental" flag, and there are bugs that have been open for years preventing very common configurations from working.

It don't even support dynamically assigned ipv6 address. And ipv6 prefix need to be hardcoded into config. And even worse , ipv6 address(not suffix) is bounded directly to the container at creation time. If your ipv6 prefix changed for whatever reason.(laptop is a thing since 20 years ago, you know) Best you can do is scrap the container and make a new one. I would say keep it experimental at current status is a good decision. It's simply not usable currently.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#146

Post by Dylan16807 »

keep_reading wrote: post #101
VoodooJuJu wrote: post #97

Earlier quoted context omitted.

IPv6 is an insult.

- we never got the integrated IPSEC - enough addresses for everyone on the planet, but we can't freely give out permanent static allocations to everyone because it would explode the routing tables - so we never got our permanent roaming addresses we were promised - NAT66 exists - IPv6 was (still is?) a moving target for implementors It's worse than an insult

"It only has some of the benefits over IPv4" is not worse than an insult.

Best practices changing applies to IPv4 too.

NAT exists but you don't need it and even if you do use it you don't have to track connections.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#147

Post by anticensor »

heartjudytenuta wrote: post #138
giancarlostoro wrote: post #91

Earlier quoted context omitted.

I'm of the opinion that IPv6 is old enough that the fact we have not hopped to it yet means its not happening anytime soon. I wanted it back in 2008 when I first learned about it, and I know its older than that (90s iirc) so its either going to come one day "abruptly" by force and break half the internet, or people will do hacks to maintain IPv4 as is. I think the only way IPv6 will ever become mainstream is if eithe…

China has mandated moving to single-stack IPv6 by the end of the decade. It is not well publicized. It turns out when you have a government that can tell you "move to IPv6 or we'll have your legs broken and your family thrown in prison" it's a bit easier to get things moving.

More like "move to IPv6 or you will be disconnected from the internet completely".

Re: Enabling IPv6 support for IPv4-only apps on Linux

#148

Post by hot_gril »

VoodooJuJu wrote: post #97
kuon wrote: post #86

Discord hardcodes ipv4 addresses and will not work for webrtc calls in DNS64 setup. In 2023 I consider it an insult to the internet as a whole.

IPv6 is an insult.

IPv6 to me is an example of "not letting a good crisis go to waste." The real problem was running out of addresses, but the solution got lots of less necessary changes bundled into it, rather than just adding more address space.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#149

Post by tsimionescu »

p1mrx wrote: post #125
tsimionescu wrote: post #122

Earlier quoted context omitted.

Regardless of the /64 limit, I expect DHCPv6 will win out in the consumer side (with ISPs giving customers pre-configured wifi routers with DHCPv6 already configured). SLAAC is both very complicated, and its privacy extensions are anyway not something ISPs have been friendly to even if it weren't such an extra hassle.

> and its privacy extensions are anyway not something ISPs have been friendly to That is an argument for forcing ISPs to support SLAAC, so it's difficult to bill a customer based on the number of devices in their home. ISP-friendly often means user-hostile. If ISPs can deploy device-counting DHCPv6, then router manufacturers will respond with IPv6 NAT, and then the IPv6 landscape will be as shitty as IPv4.

Device counting has always been possible with IPv4 routers, and yet I don't know of a single ISP which does this.

To be clear, I'm talking of ISP-provided (usually wifi) routers, which at least in my country are extremely common. Those could receive an IPv6 prefix and do DHCPv6 inside your own network.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#150

Post by andrewaylett »

hatch_q wrote: post #127
lazide wrote: post #119

Earlier quoted context omitted.

Every firewall I’ve dealt with since forever has default deny on inbound traffic, state full allow for outbound connections. Regardless of NAT or not, and regardless of how cheap it is.

Name one vendor? I can name you 3 that don't. Zyxel, Ubiquiti, Mikrotik. Also anything wrt based (eg. dd-wrt). In fact one of the warnings on dd-wrt official IPv6 tutorial: """ Keep in mind it can be dangerous to enable IPv6 without also having a firewall on each client that handles IPv6 packets, or having ip6tables on your router to filter incoming connections. ip6tables is NOT included by default with DD-WRT, which…

Ubiquiti do -- and it's very nice to be able to punch holes in it when I do want to let HTTPS traffic in to specific addresses, rather than need to try to shoehorn everything onto a single IPv4 address.

IPv6 support is sufficiently widespread that pretty much the only place I can't access IPv6-only services from is the office :P.

Post reply on HN