Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS to start charging for IPv4 usage, but critical services don't support IPv6

old.reddit.com

Post reply on HN
Print view View original

181–190 of 245 posts

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#181

Post by redox99 »

ianlevesque wrote: post #117
redox99 wrote: post #112

Had IPv6 been a superset of IPv4, we would have switched 10 years ago. IPv4 1.2.3.4 becomes IPv6 0.0.0.0.1.2.3.4 Owning IPv6 0.0.0.0.1.2.3.4 means you also own IPv4 1.2.3.4, because addresses that begin with 4 zeroes mean they also own the equivalent IPv4 address. Owning 2.2.2.2.1.2.3.4 means you do not fully own an IPv4 address. In this case you'll have a NAT IPv4 address. If you connect to 1.2.3.4 you use the IPv4…

This comes up every time, but it doesn't make any sense. Routers, software, IT professionals, would've all been just as happy to not support IPv4.1 as they have been to not support IPv6. At this point though the inflection point has already been passed adoption-wise and AWS needs to just do the thing already.

Not at all. This would be much easier to migrate and support.

Nowadays you have two entire separate stacks, each with their own firewall rules. That's why the first thing I do is outright disable IPv6 because of the potential security issues due to misconfiguration.

The hardware and operating systems have supported IPv6 for a very long time. The problem is that it's a pain in the ass to maintain 2 stacks simultaneously, that's why adoption is so slow.

OS and hardware support is not the bottleneck.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#182

Post by bluepizza »

hot_gril wrote: post #102
bluepizza wrote: post #84

Earlier quoted context omitted.

Home router NAT "layer of security" is equivalent to closing all ports. If an IPv6 home router closes all ports by default, then the same level of security is achieved.

That's a big "if." > Randomized, temporary IPv6 public addresses are a nice feature, and mostly turned on by default I really do not want this.

> That's a big "if."

Not really. Many home routers used to assign all ports to the first device to connect to the router, and you'd need to setup NAT just for your second computer. Eventually the default settings wised up.

It is much more probable that security defaults will be much tighter today than they were when ADSL initially took off.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#183

Post by hot_gril »

JoshTriplett wrote: post #20
paulgb wrote: post #7

Earlier quoted context omitted.

Is there an alternative, though? Both Python3 and IPv6 both solve problems that would have been at least as painful to do incrementally, IMHO.

IPv6 provided some features people needed (larger addresses), made some changes born from experience (removing IP-level header checksums in favor of packet checksums like those in UDP and TCP, removing fragmentation), and then bundled in a pile of mandatory added complexity (DAD, SLAAC and router advertisements rather than DHCP, initially mandatory IPsec). If IPv6 had left out the mandatory added complexity, and just…

Yes but you've left out the biggest and most disruptive change in v6: all pre-existing v4 addresses and routing are not carried over to it. This alone makes it a conceptually separate network from ipv4.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#184

Post by gray_-_wolf »

oarsinsync wrote: post #36
gray_-_wolf wrote: post #21

Earlier quoted context omitted.

I think that if IPv6 would just be IPv4 with bigger addresses, the rollout would be much easier. Sure, you would still need new hardware, but the basic operations would still be the same as IPv4. Currently, it is far from that.

Are there recommendations that result in IPv6 looking like something more than just IPv4 with bigger addresses? Yes. Is there anything stopping you from effectively running IPv6 networks the same way as you run IPv4 networks, but with larger address pools? No. You can do NAT66, you can do DHCPv6, you can run every network as a /120 (IPv6 equivalent of a /24 - 256 addresses) if you want to as well. You can even (outsi…

Sure, I don't have to, but everything in the stack assumes I would run it in the recommended way. I gave up trying to setup my LAN to support IPv6 after I wasted more than 2 hours on convincing my router, and devices behind it, to somehow work with the /128 address I got from my ISP. Should it be technically possible? Yes, definitely. Is there any value for me in spending a lot of time on it? No, there is not, everything is reachable on IPv4 anyway.

This would not be a problem if it would be just bigger IPv4 and there still was NAT, DHCP and everything. But that is not the way you are expected to be doing IPv6...

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#185

Post by jiggawatts »

radarsat1 wrote: post #32

To be fair I have a bunch of instances with public IP addresses just so I can ssh into them easily. This situation made me look into how I'd get into these instances otherwise and indeed you can set up an appropriate endpoint and then run "aws ec2 instance-connect" to make a tunnel that gets you an ssh connection without needing the public IP, so just like that my needs for public IPs actually goes down pretty drasti…

See, you’re already acting as if you’re being selfish.

You’re not.

Having an IP per endpoint that is conveniently globally routable from any other endpoint is the entire purpose of the Internet!

It’s not some sort of greed or abuse of privilege! It’s the reason for the thing to exist!

This is like going to a shopping centre that has been growing along with the local population exponentially but refuses to buy more shopping carts. You can’t feel guilty for using a shopping cart “just” for your quick snack shopping as-if that’s a greedy move taking it away from more deserving people with “real” grocery shopping to do.

Stop thinking like this. Seriously, STOP!

You’re the victim here.

You’re the victim of Amazon’s greed and lock-in.

You’re the victim of the lack of foresight for the most predictable resource exhaustion in the history of the world.

You’re the victim of a problem that has had a solution for two decades that is now included for free(!) in every network device being made but is being turned off by lazy administrators that can’t be bothered averting slow-moving catastrophies.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#186

Post by devit »

paulgb wrote: post #7
ryandvm wrote: post #3

IPv6 and Python3 are case studies in how not to roll out a new version unless you're cool with multi-decade upgrade windows.

Is there an alternative, though? Both Python3 and IPv6 both solve problems that would have been at least as painful to do incrementally, IMHO.

A much simpler and compatible solution would be to assign a single IPv4 address per AS and then use IP options to pass additional address bits to identify the specific host within the AS.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#187

Post by hot_gril »

icehawk wrote: post #162
hot_gril wrote: post #126

Earlier quoted context omitted.

Yes, and every router has to do it properly by default, which so far they haven't really been. NAT is a lot harder to do wrong, cause the local IPs aren't even addressible.

Its not harder to do wrong, its just less noticeable when done wrong, it's been a security consideration since NAT was created, and a persistent issue since then: https://datatracker.ietf.org/doc/html/rfc2993#page-22 https://threatpost.com/remote-attackers-internal-network-dev... https://www.anvilsecure.com/blog/dhcp-games-with-smart-route...

It's defense in depth. I don't understand if and how this exploit allows an attacker to hit port 80 on my PC for instance, but either way it looks like a pretty sophisticated attack only discovered in 2021, and I still don't see panic over it.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#188

Post by snuxoll »

hot_gril wrote: post #177
bigstrat2003 wrote: post #167

Earlier quoted context omitted.

> NAT is a more desirable form of security than a firewall for most users... I don't agree with this. First, most users don't know or care about security. So neither is more desirable for them. But also, on its merits NAT isn't more desirable. It provides zero security that is not provided by a simple default deny inbound rule on a firewall. And on top of that, it introduces additional complexity that even a non-tech…

It's not shoehorned, though. Corporate and home users find it convenient. It's very hard to screw up, unlike v6 firewalls which often have bad defaults or possibly don't work as intended. Especially when one of the other goals of ipv6 is to enable p2p applications, which might lead to permissive defaults. My home router has one public IP and many private IPs. No matter how crappy my router is, it's impossible to addr…

> My home router has one public IP and many private IPs. No matter how crappy my router is, it's impossible to address private IPs from the outside except on the random mapped ports.

Only because your router also has a properly configured stateful firewall for ipv4 as part of its NAT implementation. I have a Mikrotik CCR2004 at home, I can enable SNAT without appropriate firewall rules and have any other customer of my ISP on the same subnet send packets towards the WAN interface of my router and have it happily forward them onto my internal network.

NAT is implemented using a stateful firewall, but the mere presence of it does not mean the firewall is configured to reject unestablished connections from outside. IPv6 just exposes such poor configurations more readily.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#189

Post by throw0101b »

hot_gril wrote: post #177
bigstrat2003 wrote: post #167

Earlier quoted context omitted.

> NAT is a more desirable form of security than a firewall for most users... I don't agree with this. First, most users don't know or care about security. So neither is more desirable for them. But also, on its merits NAT isn't more desirable. It provides zero security that is not provided by a simple default deny inbound rule on a firewall. And on top of that, it introduces additional complexity that even a non-tech…

It's not shoehorned, though. Corporate and home users find it convenient. It's very hard to screw up, unlike v6 firewalls which often have bad defaults or possibly don't work as intended. Especially when one of the other goals of ipv6 is to enable p2p applications, which might lead to permissive defaults. My home router has one public IP and many private IPs. No matter how crappy my router is, it's impossible to addr…

> It's very hard to screw up, unlike v6 firewalls which often have bad defaults or possibly don't work as intended.

???

Firewalls generally have inside and outside: default-deny any new connections from the outside and you're done. This is how all CPE gears ships out of the box.

> Especially when one of the other goals of ipv6 is to enable p2p applications, which might lead to permissive defaults.

For this you need hole punching, with on CPE gear is done with UPnP and/or PCP, the exact same protocols that are used with IPv4 NAT. (But of course applications also have to futz around with TURN/ICE/STUN if there's NAT.)

> No matter how crappy my router is, it's impossible to address private IPs from the outside except on the random mapped ports.

When I was still with a residential ISP that did IPv6 this was the exact same with all of my home devices behind my ten+ year old Asus.

Further, because you only have one public IPv4 address, someone can scan just that address to see which ports are forwarded. People regularly scan the entire IPv4 address space: 2^32 addresses is not a difficult task.

With IPv6, they'd have to know the IPv6 address of your service that you had opened to the public. If you hadn't advertised the address publicly, an Internet rando is not going to find it: good luck remotely scanning a single /64 (never mind a /60 or /56 that many ISPs hand out).

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#190

Post by fanf2 »

wmf wrote: post #141
hughesjj wrote: post #115

Earlier quoted context omitted.

> IP addresses were intended to be a public good. Were they though? The first few blocks auctioned off all went to large tech institutions

The Internet was designed by hippies and IP addresses weren't auctioned in the old days; they were given for free. When IPv4 runout was in sight the hippies argued loudly that addresses should be rationed instead of sold.

It might be right to call Jon Postel a hippie, but Vint Cerf sports a three piece suit. The Internet was designed by DARPA contractors and university grad students, so it’s a bit of a weird mix.
Post reply on HN