Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Hacker News now supports IPv6

news.ycombinator.com

Post reply on HN
Print view View original

311–320 of 396 posts

Re: Tell HN: Hacker News now supports IPv6

#311

Post by tsimionescu »

geraldhh wrote: post #189
tsimionescu wrote: post #112

Earlier quoted context omitted.

I don't understand what you mean by complicating firewall rules,except maybe that you now need to use IPv6 addresses instead of IPv4 addresses in some of the rules. It's not like NAT without a firewall gave any security in 2024.

there is no nat w/o a "firewall" and yes, it will be more secure

A perfectly reasonable NAT implementation will allocate a router TCP port for an outgoing connection from a private IP, and will send ANY traffic that reaches this port to that private IP.

So, if I send traffic from 192.168.0.78:19990 to 1.1.1.1:443, the NAT may allocate TCP/29099 for this connection and forward traffic from its public IP, 3.56.54.90.

Then, if an attacker sends a SYN packet to 3.56.78.90:29099, the router will forward that packet to 192.168.0.78:19990. The machine may or may not accept that connection, but the attacker has reached it.

Now, many NAT implementions also do firewall-style tracking, and would not accept this packet unless it came from 1.1.1.1:443. But that is not required for NAT to work, and it requires extra memory per connection (storing the destination IP/port as well as the local IP/port), so I'd bet real devices exist that do this.

Re: Tell HN: Hacker News now supports IPv6

#312

Post by wvh »

I think I created my first IPv6 tunnel in 1998 or 1999. Not holding my breath. For as fast as everything technology seems to move, the basic building blocks of TCP and DNS evolve very, very slowly, if at all. I wonder if there's a genuine lack of interest all around or if there are business interests at stake to prevent people from having their own routable IP addresses and facilitate peer-to-peer networking.

Re: Tell HN: Hacker News now supports IPv6

#313

Post by ivlad »

JohnFen wrote: post #302
op00to wrote: post #298

Earlier quoted context omitted.

You’d think so, but dns magically works for me. Wish I had a better answer ha ha.

I assume it's possible to prevent machines from changing their IP address? I have a few where DNS cannot reasonably be used and I use raw IP addresses instead.

You can disable IPv6 privacy extensions. The exact process depends on the operating system you use.

Re: Tell HN: Hacker News now supports IPv6

#314

Post by ivlad »

rumdz wrote: post #36

Does ipv6 result in higher latencies? I could see larger addresses increasing latency, but then again I could also see a more efficient protocol resulting in lower net latency. I should probably read a book describing the differences.

Facebook tested it and IPv6 resulted lower latencies: https://www.internetsociety.org/blog/2015/04/facebook-news-f...

Re: Tell HN: Hacker News now supports IPv6

#315

Post by toast0 »

Y_Y wrote: post #227
sylware wrote: post #224

Earlier quoted context omitted.

IPv6 will rid us from the abomination of domestic NAT. IPv6 will, finally, enabled the real internet: all p2p protocols will start to work seamlessly. I am thinking a super simple no-dns IP (audio|video) phone protocol listening only on tcp 1 port, new bittorrent like protocol for live streaming, etc. Since IPv6 has been almost everywhere in my country for years: enjoying ssh session everywhere (ipv6 mobile internet)…

Is it possible for me, or worse, a normal person, to claim or request an ipv6 address that they can keep and use like a phone number? I'm used to dynamic allocation for residential ipv4 addresses and never bothered to beg ARIN for some or rent since from an ISP. Having an address you could keep and bring with you would be great and avoid a lot of the difficulties of DNS.

Like the siblings said, Provider independent IP assignments are available, for v4 and v6 (although to get a v4 assignment in many jurisdictions, you're going to have to go on a waitlist for a long time, or buy addresses from the previous holder). However, most ISPs will require a higher tier connection if you want to bring your own IPs, so it's not something you can usually do on a residential connection.

The processes involved wouldn't really scale if normal people were going to do it either, but if it's something you care deeply about and are willing to spend the time on, it is possible.

As another poster said, you can get a tunnel from Hurricane Electric, or some other tunnel brokers, and that works too, although it's not as flexible --- HE tunnels are not geographically flexible, you pick where your tunnel is assigned, and those addresses will always be routed through that location. If you move far away, you'll likely want to setup a new tunnel in a new location for performance reasons.

Re: Tell HN: Hacker News now supports IPv6

#316

Post by bert64 »

ale42 wrote: post #150
scheme271 wrote: post #60

Earlier quoted context omitted.

Some systems like android don't support anything but SLAAC

IMHO it means that they are not fully IPv6 compliant. Corporate networks often have DHCPv6 rather than just SLAAC.

They are fully compliant, SLAAC is part of the standard whereas DHCPv6 is an optional extra.

DHCPv6 also does not work without RA. DHCPv6 just assigns an address, a routable prefix, dns servers etc, it does not assign a subnet or any routes, you need route advertisements for that.

Re: Tell HN: Hacker News now supports IPv6

#317

Post by tsimionescu »

outofmyshed wrote: post #123
tsimionescu wrote: post #109

Earlier quoted context omitted.

The IPv4 price is still tiny, and you anyway have to pay for it since going IPv6-only is not viable for a service in 2024 still. It's not going to significantly move the needle towards IPv6. And the price hikes will also be tiny.

Well, my employer’s AWS bill is in the region of $20m/year and the additional IPv4 tax is on track for adding an additional $250k to that for no benefit at all.

Well, 1.25% is quite tiny. And I'd bet you're not moving to IPv6 anyway, at least not entirely, since a good amount of people are probably accessing your services over IPv4-only connections.

Re: Tell HN: Hacker News now supports IPv6

#319

Post by Dagger2 »

mike_d wrote: post #134
Plasmoid wrote: post #107

Earlier quoted context omitted.

Another person who does not understand IPv4. IPv4 isn't a text based protocol where IP addresses are parsed like DNS. It's a binary protocol where addresses are recorded in binary and adding more address space WOULD BE A BREAKING CHANGE.

Not at all. We could have taken one of the unassigned /8's at the time and allocated it to v6 transitional addressing (the failure to address 4->6 reachability is IMO why v6 failed). For the sake of this example lets use 53.0.0.0/8. All new addresses start with 00110101 followed by the first three bytes of the new v6 prefix. The prefix acts as a flag that indicates it is a new address and routers read an additional 5…

Your scheme already exists, although instead of using the first octet of the IP address it uses a 41 in the protocol field, so it doesn't need to eat an entire /8. Routers can see the 41 as a flag and then read the v6 address from the beginning of the packet payload.

You haven't managed to suggest anything that v6 doesn't already do, or anything that would solve any of the problems v6 has when doing it. I'm not sure you even noticed the problems, yet you think you can throw stones at the v6 people, who not only noticed the problems but had to solve them too?

Re: Tell HN: Hacker News now supports IPv6

#320

Post by soneil »

JohnFen wrote: post #302
op00to wrote: post #298

Earlier quoted context omitted.

You’d think so, but dns magically works for me. Wish I had a better answer ha ha.

I assume it's possible to prevent machines from changing their IP address? I have a few where DNS cannot reasonably be used and I use raw IP addresses instead.

IPv6 not just allowing, but expecting multiple scoped addresses relieves this quite nicely.

The most common setup for this is that you have a static link-local address, and a static global address. And listening processes should listen to these static addresses.

Then you have a temporary global address, and outbound connections should use the youngest temporary global address (because temporary addresses don't disappear when they age out, they disappear when they age out AND no existing connection is still using them).

The net effect is that the address you leave in example.com's httpd logs is a temporary address that has no listening processes. And the address you use in dns, mdns, when connecting intentionally, etc is a static address.

Post reply on HN