Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The IPv6 Transition

potaroo.net

Post reply on HN
Print view View original

411–420 of 433 posts

Re: The IPv6 Transition

#411

Post by withinboredom »

vetinari wrote: post #238
matrix2003 wrote: post #188

Earlier quoted context omitted.

Why do dynamic address allocations matter? Most IPv4 consumer WAN addresses are also dynamic. I’m asking, because I’m an advocate of having your gateway advertise a separate, stable ULA /64 in conjunction with the globally-routable dynamic /64. This gives you a stable set of addressable LAN IPs, and you can usually ignore the dynamic globally routable IPs. Granted this won’t work for everyone, but if dynamic global a…

It matters, because when the prefix changes, it changes IP addresses of every single device in your network. As you wrote, internally, you can use ULA. But you cannot open access from outside, because your firewall rules will become invalid with prefix change. With classic IPv4 NAT, your internal addresses don't change, so your port forwarding works, even if the WAN address changes. Together, with a single /64 -- whi…

A /64 is a literal ton of subnets. Not sure what you mean by that.

Re: The IPv6 Transition

#412

Post by School-Cotton »

James_K wrote: post #371
Vilian wrote: post #183

Earlier quoted context omitted.

When you want to control and censor all internet is much easier todo that only with ipv6 and not care for ipv4, not sure if that's a "step ahead"

v6 is just as easy to censor as v4. Given the popularity of Veitnamese pho noodles over there, I don't think internet censorship is as important an objective as you estimate. Have you noticed how many Chinese tourists there are around the world? Not much you can do about internet when any of them could just pick up a newspaper.

My impression is that the Chinese government doesn’t care about a few people being able to access blocked content. What they want to do is prevent large social movements from forming via the mainstream internet.

Re: The IPv6 Transition

#413

Post by School-Cotton »

tcfhgj wrote: post #267
tptacek wrote: post #212

Earlier quoted context omitted.

Just the idea of having an always-on computer anywhere in your home excludes probably more than 80% of everyone who has ever written a blog. IPv4 is not why people use hosted services.

> Just the idea of having an always-on computer anywhere in your home excludes probably more than 80% of everyone who has ever written a blog. I have yet to meet someone who turns off the router at night, although I have heard of such people. Then if you think about it, TVs, washing machines, etc. people are too lazy to turn them off, and OLED TVs even require being turned on while not being used.

He obviously meant a general-purpose PC, the type of thing you might host a blog from.

Re: The IPv6 Transition

#414

Post by pwarner »

Anycast and SNI mean someone like cloud flare only needs one IPv4 for their entire public facing service? Is that the gist? Obviously I exaggerate but I think that's their point?

Re: The IPv6 Transition

#415

Post by kbolino »

withinboredom wrote: post #411
vetinari wrote: post #238

Earlier quoted context omitted.

It matters, because when the prefix changes, it changes IP addresses of every single device in your network. As you wrote, internally, you can use ULA. But you cannot open access from outside, because your firewall rules will become invalid with prefix change. With classic IPv4 NAT, your internal addresses don't change, so your port forwarding works, even if the WAN address changes. Together, with a single /64 -- whi…

A /64 is a literal ton of subnets. Not sure what you mean by that.

SLAAC requires the bottom 64 bits to be part of the host portion of the address. A network prefix larger than /64 limits SLAAC to providing link-local addresses only, which means another mechanism needs to provide routable addresses, such as DHCPv6. That, in turn, prevents the use of privacy addresses.

Re: The IPv6 Transition

#416

Post by vetinari »

kbolino wrote: post #415
withinboredom wrote: post #411

Earlier quoted context omitted.

A /64 is a literal ton of subnets. Not sure what you mean by that.

SLAAC requires the bottom 64 bits to be part of the host portion of the address. A network prefix larger than /64 limits SLAAC to providing link-local addresses only, which means another mechanism needs to provide routable addresses, such as DHCPv6. That, in turn, prevents the use of privacy addresses.

DHCPv6 is also optional, clients do not have to support it; some do not support it intentionally. So for example, any Android device won't be up and running on SLAAC-less network.

Re: The IPv6 Transition

#417

Post by InfamousRece »

Affric wrote: post #96
redprince wrote: post #53

Earlier quoted context omitted.

That was in fact one of the promises of IPv6: Restore the network of peers where every host is in principle a server and a client and communication between peers is unhindered unless a policy is enforced saying otherwise (on the machine, on a firewall, etc.). > having a public address is actually a security and privacy risk. Services can be turned off or a firewall instructed not to pass traffic from the internet (by…

> in Germany we have the peculiar horror of getting the IPv6 address and all delegated prefixes changed on every redial. This is oh so very German. In normal times it is massively overkill. I have to wonder if, heaven forbid, the things these sort of German things are meant to mitigate come to pass again if they will make any difference or if they are a largely symbolic act designed to demonstrate ideological opposit…

My IPv6 prefix changes several times a day with no apparent reason.

Re: The IPv6 Transition

#418

Post by orangeboats »

robocat wrote: post #398
orangeboats wrote: post #254

Earlier quoted context omitted.

Conversely, blindly categorizing all government mandation as authoritarianism sounds like a highway to all kinds of logical fallacies! Is mandating a fair market (by e.g. punishing monopolies) authoritarian? A sensible person would answer no. Similarly, mandating an Internet Protocol that doesn't require centralization (you know, NAT) and renting an address from the Big Boys (AWS etc) sounds like a perfectly sensible…

A sentence written by a pedant that doesn't help communicate. Followed by another sentence. Ending with a quote that implies a worldview that the government should use violence without any balance "it's a status quo broken by an external force".

I don't think you understand what "pedant" means.

Re: The IPv6 Transition

#419

Post by orangeboats »

otabdeveloper4 wrote: post #396
orangeboats wrote: post #255

Earlier quoted context omitted.

> Disabling it is often the quickest fix for a variety of networking issues. In a way, you disabling it now is the reason why others are disabling it later. A lot of IPv6 deployment issues are precisely caused by middleboxes/clients disabling or misconfiguring it.

Yes, and? Don't make excuses for shitty technology. The mental model of what the "future Internet" (aka the one we're using now) would look like is completely insane in IPv6.

I am saying a lot of "IPv6 issues" are not because of the protocol itself, but rather it is self-inflicted pain.

You quickly assuming IPv6 is a "shitty technology" means that you are part of the problem. Congratulations, you just proved my point.

>the one we're using now

The one we are using now is held by a bandaid. It's insane that, for me to connect to other computer, I need a middleman (STUN or other coordination services) to help me with it.

Re: The IPv6 Transition

#420

Post by BrandoElFollito »

School-Cotton wrote: post #409
BrandoElFollito wrote: post #26

Earlier quoted context omitted.

I had to reluctantly deploy ipv6 on my home network because of ISP requirements + will to use pihole. Ipv6 is hard. I had to learn quite a bit to make it work and not only I see no value, but it is significantly more difficult to use dire to the address length. I think IPv6 is a missed opportunity, it was probably designed by experts that did not take into account the population that will use it (not the one users wh…

I’m curious what your home network involves that’s more complicated than simply plugging everything in to one cheap router.

My network is not particularly complicated. It is the ISP router that manages the biber connection (FTTH). So I have to have that specific ISP provided box, which offers me some more or less crappy features (DNS, DHCP, ...).

If I want to use Pihole for DHCP (because it handles internal registration well) and DNS (because if offers filtering) I need to disable DHCP on the ISP router. But since the TV is handled through IPv6 I need to understand it to make sure that that stack is correctly implemented.

Then I have two mesh networks (tailscale and Wireguard as a backup because I manage family networks that are not available from internet) and a docker stack which has its own surprises.

I would love to put a linux box as the egress router and handle everything there (the fiber, DNS, DHCP, etc.) but it is not possible with the provider because the SFP is proprietary (sort of)).

I am really happy to have a relatively stable 1 Gbps fiber connection so I am not complaining - but doing things exactly as I would wish is not always possible.

Post reply on HN