Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS to start charging for IPv4 usage, but critical services don't support IPv6

old.reddit.com

Post reply on HN
Print view View original

71–80 of 245 posts

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#71

Post by lxgr »

exabrial wrote: post #55
jjjjmoney wrote: post #48

Earlier quoted context omitted.

> ok, but why? Because NAT breaks a lot of services. > Is that going to change with ipv6? Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked) > Are you _really_ just going to allow random traffic into your network? Common misconception! Even without NAT, the router can have port/traffic policies. There's just no address translation happening. There's a lot of good stuff abou…

[flagged]

VoIP.

Two peers, each behind a CG-NAT (or other symmetric NAT), depend on somebody running a relay in order to be able to communicate.

This makes it very expensive (and sometimes risky, since unrestricted relays can be used for all kinds of nefarious things too) to deploy any new VoIP service.

I'd call that "broken by NAT".

> everything works right now.

Yes, everything that works right now works right now, but that's a tautology, not proof of anything. The things that don't exist because they wouldn't work in a predominately NATted world don't work, because we live in a predominately NATted world.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#72

Post by hristov »

exabrial wrote: post #55
jjjjmoney wrote: post #48

Earlier quoted context omitted.

> ok, but why? Because NAT breaks a lot of services. > Is that going to change with ipv6? Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked) > Are you _really_ just going to allow random traffic into your network? Common misconception! Even without NAT, the router can have port/traffic policies. There's just no address translation happening. There's a lot of good stuff abou…

[flagged]

I remember having to do a lot of port forwarding to get certain things to work behind a nat. Certainly doable but beyond the competence of a non-expert.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#73

Post by adriancr »

jjjjmoney wrote: post #48
exabrial wrote: post #39

[flagged]

> ok, but why? Because NAT breaks a lot of services. > Is that going to change with ipv6? Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked) > Are you _really_ just going to allow random traffic into your network? Common misconception! Even without NAT, the router can have port/traffic policies. There's just no address translation happening. There's a lot of good stuff abou…

> Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked)

In practice someone can still configure NAT on IPv6 same as on IPv4 at least on Linux and some vendors, even if IETF resists standardizing it.

https://blogs.infoblox.com/ipv6-coe/you-thought-there-was-no...

So you might still see CGNAT if someone is determined to configure it.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#74

Post by supriyo-biswas »

exabrial wrote: post #55
jjjjmoney wrote: post #48

Earlier quoted context omitted.

> ok, but why? Because NAT breaks a lot of services. > Is that going to change with ipv6? Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked) > Are you _really_ just going to allow random traffic into your network? Common misconception! Even without NAT, the router can have port/traffic policies. There's just no address translation happening. There's a lot of good stuff abou…

[flagged]

The existence of PASV mode and STUN/TURN is because the end-to-end addressibility of the IP protocol was broken with CGNAT.

Furthermore, in populous countries like India, ISPs enforce extremely aggressive timeouts on IPv4 connections in order to keep the 5-tuples on the egress side of things manageable. Trying to make a request that takes 10 seconds to process (like a user requesting a report consisting of multiple SQL queries)? You get a connection reset.

I must also must point out the HN guidelines because you bring a combative tone to this entire conversation which is not helping it.

> Be kind. Don't be snarky. Converse curiously; don't cross-examine.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#75

Post by supriyo-biswas »

hristov wrote: post #72
exabrial wrote: post #55

Earlier quoted context omitted.

[flagged]

I remember having to do a lot of port forwarding to get certain things to work behind a nat. Certainly doable but beyond the competence of a non-expert.

And that's entirely out of your control if your ISP is doing the NATing.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#76

Post by lxgr »

dboreham wrote: post #68
exabrial wrote: post #39

[flagged]

It's not about allowing random traffic in, it's about having a unitary address space. The two are orthogonal.

They do go hand in hand, though.

Having globally unique addresses removes the need of (stateful) mapping tables, which in turn make it easier to intentionally allow traffic in.

In other words, it's quite hard to even name the traffic you want to let in if names are globally overloaded.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#77

Post by jjjjmoney »

adriancr wrote: post #73
jjjjmoney wrote: post #48

Earlier quoted context omitted.

> ok, but why? Because NAT breaks a lot of services. > Is that going to change with ipv6? Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked) > Are you _really_ just going to allow random traffic into your network? Common misconception! Even without NAT, the router can have port/traffic policies. There's just no address translation happening. There's a lot of good stuff abou…

> Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked) In practice someone can still configure NAT on IPv6 same as on IPv4 at least on Linux and some vendors, even if IETF resists standardizing it. https://blogs.infoblox.com/ipv6-coe/you-thought-there-was-no... So you might still see CGNAT if someone is determined to configure it.

Yes this is absolutely possible, but I do like that IPv6 doesn't mandate NAT.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#78

Post by jjjjmoney »

supriyo-biswas wrote: post #75
hristov wrote: post #72

Earlier quoted context omitted.

I remember having to do a lot of port forwarding to get certain things to work behind a nat. Certainly doable but beyond the competence of a non-expert.

And that's entirely out of your control if your ISP is doing the NATing.

Not even your ISP - it could be university, business, shared internet for apartments, etc.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#80

Post by LegionMammal978 »

supriyo-biswas wrote: post #74
exabrial wrote: post #55

Earlier quoted context omitted.

[flagged]

The existence of PASV mode and STUN/TURN is because the end-to-end addressibility of the IP protocol was broken with CGNAT. Furthermore, in populous countries like India, ISPs enforce extremely aggressive timeouts on IPv4 connections in order to keep the 5-tuples on the egress side of things manageable. Trying to make a request that takes 10 seconds to process (like a user requesting a report consisting of multiple S…

> The existence of PASV mode and STUN/TURN is because the end-to-end addressibility of the IP protocol was broken with CGNAT.

But isn't all that still necessary as long as the typical user isn't going to be opening their firewall on those ports to arbitrary incoming connections? That's the whole point here.

Post reply on HN