Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The IPv6 Transition

potaroo.net

Post reply on HN
Print view View original

341–350 of 433 posts

Re: The IPv6 Transition

#341

Post by cyberax »

elcritch wrote: post #232
cyberax wrote: post #175

IPv6 is _still_ not at the feature parity with IPv4! I'm not kidding. For example, Android doesn't support stateful DHCPv6. And DHCPv6 doesn't have the _basic_ feature of DHCPv4: hostnames. You can't easily use it to do a quick survey of your network. Then you have that @#& (^( &!@^ that is ULA. With IPv4 we have a very useful pattern: you create an "internal" network that is stable and predictable. It's routed to th…

> dhcpv6 Just skip DHCPV6, just use SLAAC. Plus I've never seen DHCP hostnames work. Now I just ping ff02::1 multicast to see what devices are on my network. Unfortunately much software makes it a pain to use link-local addresses but they're really convenient as they normally don't change across networks. > Half of the hosts don't implement prefix withdrawal, and keep both their ULAs and the normal addresses. Congrat…

> Just skip DHCPV6, just use SLAAC. Plus I've never seen DHCP hostnames work.

Here's how a part of my IPv4 network looks in my router's control panel: https://imgur.com/a/xZDUfqw , I can easily set up permanent local IPv4 addresses for the fixed infrastructure, and I can easily see which hosts are alive.

Yes, it's not 100% perfect, but it works most of the time just fine. Even with crappy IoT devices.

Here's how it looks for IPv6 and SLAAC: https://imgur.com/a/DiUNqTC - good luck trying to make sense of it.

Re: The IPv6 Transition

#342

Post by TabTwo »

As long as you have enterprise products like zscaler, that do not support IPv6. Or switches and routers that are broken in different ways with every update. Userproperties in Active Directory that are to short to insert an IPv6 address.

Why should any enterprise company move to it? Why should any enterprise (at least) double the cost by having to support two protocols when most problems can be solved by various types of NAT?

Re: The IPv6 Transition

#343

Post by sebazzz »

TabTwo wrote: post #342

As long as you have enterprise products like zscaler, that do not support IPv6. Or switches and routers that are broken in different ways with every update. Userproperties in Active Directory that are to short to insert an IPv6 address. Why should any enterprise company move to it? Why should any enterprise (at least) double the cost by having to support two protocols when most problems can be solved by various types…

> As long as you have enterprise products like zscaler, that do not support IPv6

ZScaler is a burning piece of privacy-violating garbage that as a developer rather get rid of than have.

Nice for non-IT collegues who were previously protected by the corporate proxy server while working in the office, now work at home or other places, and are prone to scamming and visiting forbidden [by the employer] sites.

As a developer a system-wide MITM SSL-decrypting proxy server is a major pain in the ass. Every runtime of developer tools, python, Node, .NET, Docker, Linux (WSL) flavors, etc have their own way to trust root certificates, and as a web developer you do tend to touch a lot of different tools. Secondly, when you do a bit of devops, you can't even check basic things like checking if a website has the correct (valid) SSL certificate without RDP-ing to some server which doesn't have ZScaler installed.

Sorry for my rant. But I'm not allowed to disable ZScaler - but am forced to live with it.

Re: The IPv6 Transition

#344

Post by aidenn0 »

I'll admit that while I run dual-stack for the public internet, I still haven't figured out a good way to manage my LAN with ipv6.

For ipv4, I have a DHCP server on the same machine as my DNSH server, which lets me configure my network in a single place. With IPv6 I'm still not sure exactly how to configure this. It seems like if I use SLAAC for a ULA, at least some hosts will still apply RFC 4941 (or maybe 8981; I'm not sure), which makes DNS unfeasible. So I guess maybe DHCPv6 is the answer (short of manually configuring each host)?

Re: The IPv6 Transition

#345

Post by tptacek »

tucnak wrote: post #311
tptacek wrote: post #177

Earlier quoted context omitted.

They had to do with computers being directly addressable, routable, and reachable by the entire Internet, which was the default prior to widespread deployment of NAT. NAT isn't the best way to do it, but it probably is the single biggest factor in reducing the external reachability of endpoint IPs.

NAT deployment here is only tangential to the real differentiator: the firewall. I mean, you can make a case that NAT is a poor man's firewall but you should know that it's not a substitute for a security model. Zero trust is now the dominant philosophy, and it allows for firewall rules to be derived procedurally. It's a shame the likes of Microsoft only care about "zero trust" insofar their compliance checkboxes wit…

NAT was originally delivered as a security mechanism.

Re: The IPv6 Transition

#346

Post by iam-TJ »

NelsonMinar wrote: post #337
iam-TJ wrote: post #264

Earlier quoted context omitted.

I've been using Starlink since early 2021 with IPv6 only internally. Starlink User Terminal hands out a /56 prefix (via DHCPv6) and mine has not changed in all that time so I wouldn't call it dynamic. The User Terminal issues a router advertisement (RA) and my gateway gives itself an address in that /64 via SLAAC in addition to assigning itself an address from the /56 prefix. If not using prefix delegation each host'…

Thanks for the report with success with IPv6 and Starlink. Do you make inbound connections to devices on your LAN? Do they work? Starlink recently updated their FAQ with more info on addressing: https://www.starlink.com/support/article/1192f3ef-2a17-31d9-... As for static addresses, it says "a reservation system retains the ... IPv6 prefix even when the system is off or rebooted. However, relocating the Starlink or s…

Yes, I use direct IPv6 peer-to-peer connections both outbound and inbound using the delegated prefix.

Even for a changing prefix, if operating a DNS authoritative server for a domain, any changes to the prefix can be quickly and automatically updated in both forward (AAAA) and reverse (PTR) resource records provided the TTL for those records is appropriately short, and thus allow almost seamless inbound via FQDNs. I do this with a bind9 (hidden) master locally that notifies external slave servers operated by a highly available, anycast, DNS service.

Re: The IPv6 Transition

#347

Post by Dylan16807 »

otabdeveloper4 wrote: post #317
josephg wrote: post #307

Earlier quoted context omitted.

So? Is your argument that it’s so cheap that everyone should get an IP? That would be mathematically impossible. If more people wanted an IP, the price would just rise. The same percentage of people (less than 1/3) would have one. They would just pay more. It’s like buying land in a city like SF. Demand can change the price, but the supply remains the same.

The argument is that migrating to IPv6 isn't worth anyone's time. (Except for maybe CG-NAT operators.)

The number of people behind CGNAT is huge and rising. It's collectively worth it. And really not that much effort. (If your internal business network is sufficiently entrenched you don't have to change it.)

Re: The IPv6 Transition

#348

Post by thayne »

cyberax wrote: post #333
thayne wrote: post #92

Earlier quoted context omitted.

Yep, lots of AWS apis don't work over ipv6, and many require making requests outside the VPC, so you need to have at least one ipv4 address for a NAT.

You can use NAT64, it works with all the AWS services. Although it's pretty stupid that services like ECR don't have IPv6.

NAT64 requires you to have a NAT with a public ipv4 address. Or possibly pay to use someone elses NAT.

Re: The IPv6 Transition

#349

Post by AStonesThrow »

kevvok wrote: post #236
AStonesThrow wrote: post #198

My ISP has given me a quite stable /64 network that's lasted for months and months. I am curious though: my IPv6 network begins with 2600::, which I feel is not an accident or mere coincidence. For a long time, Facebook would never "trust" my device, and I suspected it was because of the IPv6 thing. Now, "2600" is actually a hex number and doesn't mean 2600 decimal, but 2600 is an interesting prefix for a stable addr…

According to the IANA assignment list, 2600::/12 is assognrd to ARIN. https://www.iana.org/assignments/ipv6-unicast-address-assign...

Yes, that's correct -- I'm in the USA, and not in Europe or Africa. What is your point with this? ARIN has, of course, delegated my assigned IPv6 network to my ISP; you do realize that this is SOP for ARIN?

Re: The IPv6 Transition

#350

Post by WorldMaker »

growse wrote: post #291
pmarreck wrote: post #282

Earlier quoted context omitted.

The biggest design failure of IPv6 is that it was not designed to be backwards-compatible with IPv4. Technologies with established user bases need to evolve with backwards compatibility if they want to take advantage of existing network effects.

This comment shows up like clockwork. How does a device with a 32-bit-sized addressing scheme construct an IP packet to a device with an address in a 128-bit-sized addressing scheme?

I also appreciated how much the linked article is adamant that IPv6 is what you get when all you do is increase the addressing size. There were wilder alternatives discussed that broke more things or took a more progressive stance. Part of the "there's no compelling 'use case' for IPv6" is that it really doesn't do anything new or exciting, it just increased the address size, and then dealt with the consequences (including "lack of backward compatibility", that was always going to be a consequence of increasing the address size).
Post reply on HN