Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enabling IPv6 support for IPv4-only apps on Linux

blog.apnic.net

Post reply on HN
Print view View original

191–199 of 199 posts

Re: Enabling IPv6 support for IPv4-only apps on Linux

#191

Post by Dagger2 »

hot_gril wrote: post #183
Dagger2 wrote: post #182

Earlier quoted context omitted.

Not necessarily. What enforces that? You can't rely on your attackers to kindly not send traffic to IPs you don't want them to.

The routers. My ISP can't route dst=192.168.1.2 to anywhere, and even if someone managed to splice the packet in between my router and the ISP, my router won't take that dst. That address doesn't exist on the WAN.

No, the routers don't enforce that, and your ISP can route packets with a destination IP of 192.168.1.2, or anything else they like, to you just fine.

Your router will happily "take" that destination IP. The only reason it won't is because of a firewall, not because of NAT.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#192

Post by Dagger2 »

hot_gril wrote: post #185
Macha wrote: post #181

Earlier quoted context omitted.

::ffff: is a perfectly valid V6 address. The problem is not the user facing representation but all the software and hardware implementations, including in middleboxes in between client and server. 128 is no different to 33 bits, or 32 bits plus extension header in that regard.

It's valid but not routable in practice. The Internet collectively didn't choose to map existing IPv4 addresses into v6 or keep the routing unified, that's the problem. It should've been that 1.1.1.1 on v4 now owns 1.1.1.1/32 on v6, so going all-v6 doesn't mean cutting yourself off from v4 hosts. Once v6 was well-adopted, they could start using the longer addresses. Instead, we got two totally separate networks.

We did map existing v4 addresses into v6. They're not two totally separate networks at all.

But the limitations of v4 and of existing v4 devices limit the ways that can work. Reinventing stuff and calling it "4.1" won't change that. You'll still face all of the same limitations.

> They'd focus on getting everyone onto the v6 protocol first, then open up the new addresses for use. That's the transition period that never happened.

That's basically the transition period that _is_ happening, except we aren't delaying the "open up the new addresses" stage -- the new addresses are usable straight away for anything you've migrated.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#193

Post by nerdyadventurer »

Not directly related, Recently I was looking at Hetzner cloud and noticed IPv6 only server instances are cheaper, can I use such service to serve my back-end while front-end is hosted on CF pages? I think IPv4 only hardware are rare these days, Am I wrong? (BTW sorry for my dumb questions)

Re: Enabling IPv6 support for IPv4-only apps on Linux

#194

Post by hot_gril »

WorldMaker wrote: post #184
hot_gril wrote: post #180

Earlier quoted context omitted.

Enough things are v4-only that I can't go all-v6 at home, and that's predicated on my home ISP giving a v6 address, which hasn't been a given. V6 does seem intended to replace v4, otherwise I don't see the point; it's preferable to run one stack rather than two, and v4 is the easier choice still.

Why would the point of v6 be to entirely replace v4? That's such an impossible to accomplish goal even if v6 was the most perfect protocol to ever exist and even if you didn't believe that by that point v4 was embedded in so much hardware as to be physically impossible to replace without incredible amounts of hardware recycling problems, including some dangerous deep sea diving and missions to space. Even in your own…

The authors of IPv6 intended to replace v4 with it, according to https://web.archive.org/web/20190129005124/http://www.ipv6.o...

Presumably the next several billion devices want to talk to the current ones. There will always be old devices left behind on old protocols, same as how old versions of SSL get rejected everywhere, and they can deal with it via compatibility layers like 4-to-6 NAT.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#195

Post by hot_gril »

icedchai wrote: post #187
hot_gril wrote: post #177

Earlier quoted context omitted.

Right, it only converts to v4 if both src and dst are 32-bit, which is fine in v4.1 too. Everyone can adopt v4.1 hardware/software without even thinking about it but hold off on using >32-bit addrs until they feel like enough peers are on v4.1. Yes it's only a one-way compatibility, but that's way better than v6 which is incompatible both ways, creating gridlock. If you really want extra compatibility, idk if this is…

I think you underestimate the complexity of deploying a new protocol like that. Also, you know NAT64 exists, right? You can have a v6 only network connecting to v4 hosts. Is that not enough compatibility if you don't want dual stack hosts?

I can't tell you the man-hours, but I can tell you it'd be easier than ipv6. And yes I'm aware that you can give a "v6 only network" a v4 address, which means you're still on ipv4.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#196

Post by hot_gril »

Dagger2 wrote: post #191
hot_gril wrote: post #183

Earlier quoted context omitted.

The routers. My ISP can't route dst=192.168.1.2 to anywhere, and even if someone managed to splice the packet in between my router and the ISP, my router won't take that dst. That address doesn't exist on the WAN.

No, the routers don't enforce that, and your ISP can route packets with a destination IP of 192.168.1.2, or anything else they like, to you just fine. Your router will happily "take" that destination IP. The only reason it won't is because of a firewall, not because of NAT.

Ok, my PC's address is 192.168.1.3 and I have UDP port 9000 open, please send me a packet.

Re: Enabling IPv6 support for IPv4-only apps on Linux

#197

Post by hot_gril »

hot_gril wrote: post #195
icedchai wrote: post #187

Earlier quoted context omitted.

I think you underestimate the complexity of deploying a new protocol like that. Also, you know NAT64 exists, right? You can have a v6 only network connecting to v4 hosts. Is that not enough compatibility if you don't want dual stack hosts?

I can't tell you the man-hours, but I can tell you it'd be easier than ipv6. And yes I'm aware that you can give a "v6 only network" a v4 address, which means you're still on ipv4.

(ipv4.1 could also be implemented using the ipv6 header, btw)

Re: Enabling IPv6 support for IPv4-only apps on Linux

#198

Post by Dagger2 »

hot_gril wrote: post #196
Dagger2 wrote: post #191

Earlier quoted context omitted.

No, the routers don't enforce that, and your ISP can route packets with a destination IP of 192.168.1.2, or anything else they like, to you just fine. Your router will happily "take" that destination IP. The only reason it won't is because of a firewall, not because of NAT.

Ok, my PC's address is 192.168.1.3 and I have UDP port 9000 open, please send me a packet.

Okay, but since that's RFC1918 you'll need to give me access to your immediate upstream network in order to send the packet to your router. How do you want to do that?

Re: Enabling IPv6 support for IPv4-only apps on Linux

#199

Post by Dagger2 »

nerdyadventurer wrote: post #193

Not directly related, Recently I was looking at Hetzner cloud and noticed IPv6 only server instances are cheaper, can I use such service to serve my back-end while front-end is hosted on CF pages? I think IPv4 only hardware are rare these days, Am I wrong? (BTW sorry for my dumb questions)

CF is capable of reverse proxying onto a v6-only backend server. I'm not very enthused by how much of the Internet is hosted behind Cloudflare, but they're certainly convenient for this exact use-case.
Post reply on HN