Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 is the only way forward

ankshilp.in

Post reply on HN
Print view View original

181–190 of 350 posts

Re: IPv6 is the only way forward

#181

Post by magicalhippo »

gertrunde wrote: post #176
magicalhippo wrote: post #169

Earlier quoted context omitted.

Please don't put words in my mouth. I did not say "Because pfSense, does really bad things." How pfSense works is fairly reasonable if every IPv6 deployment had been as the original designers intended, ie you have a static prefix. It's just that the way IPv6 ended up getting deployed in practice was often not aligned with that original vision. And that has been a large source of IPv6 frustration.

There's a few things here that are a bit iffy tbh! I can't see why an ISP is dynamically changing the IPv6 addressing for a client, but if that's what is going on, then v6 NPT is your friend (RFC6296 - https://datatracker.ietf.org/doc/html/rfc6296 ). But pfsense's behaviour is a bit iffy too, unless when you say 'public IP', you mean the IPv6 address being used on the pfsense facing the clients? (I'm assuming it's us…

> v6 NPT is your friend

So NAT is the one true solution after all.. /s

> unless when you say 'public IP', you mean the IPv6 address being used on the pfsense facing the clients?

Well, that's kinda the thing, pfSense seems to assume global means it's also the IP facing the local clients. I couldn't get pfSense to advertise its ULA as the DNS server for example. But if you have a static prefix, that's not a bad assumption. And a static prefix is what the IPv6 designers envisioned.

> I'm assuming it's using DHCPv6 prefix delegation, and the delegation is being changed?

ISP indeed uses DHCPv6 prefix delegation. The prefix I get can change "randomly". It always changes when my router or modem reboots, but other times too (perhaps when their equipment reboots).

I should note that after getting very frustrated with pfSense, I threw it away a few years ago and switched to OpenWRT which has worked much, much better when it comes to IPv6.

Re: IPv6 is the only way forward

#182

Post by Dagger2 »

rkagerer wrote: post #158

The main complaint I have against IPv6 is the addresses are so unwieldy. When I look at them I have the same reaction as when I look at some kind of complex scientific formula comprised of operators and symbols that are unfamiliar. It also takes extra mental effort to expand the compressed zeros and interpret what I'm viewing. Even after reading about them many times and using them in (an albeit limited) fashion, the…

Just use it. This reaction is coming from a lack of familiarity, not from it actually being hard.

Here's some roughly equivalent IP addresses:

    203.0.113.45+192.168.1.1 ↔ 2001:db8:2d4f:1::1
    203.0.113.45+192.168.1.2 ↔ 2001:db8:2d4f:1::2
    203.0.113.45+192.168.1.3 ↔ 2001:db8:2d4f:1::3
    203.0.113.45+192.168.2.1 ↔ 2001:db8:2d4f:2::1
The v6 addresses are made up of the network prefix (2001:db8:2d4f, basically an opaque string like 203.0.113.45+192.168), then the subnet ID (1, 2) and then the host ID on the network (1-3 and 1).

When you look at 2001:db8:2d4f:X::Y, it should be pretty easy to see that it's host Y on subnet X, under your prefix which is the same for your whole network. Even if it's 2001:db8:2d4f:X:YYYY:YYYY:YYYY:YYYY it's still the same thing, just with more characters.

Re: IPv6 is the only way forward

#183

Post by MaKey »

magicalhippo wrote: post #160
oconnore wrote: post #41

I don't understand why people are so negative about IPv6. I have done essentially zero home networking work and I just ran this successfully. It just works! ``` > ping6 google.com PING6(56=40+8+8 bytes) 2605:59c0:236f:3a08:7883:9d04:c26d:5fa1 --> 2607:f8b0:4005:806::200e 16 bytes from 2607:f8b0:4005:806::200e, icmp_seq=0 hlim=117 time=22.262 ms 16 bytes from 2607:f8b0:4005:806::200e, icmp_seq=1 hlim=117 time=26.124 m…

> I don't understand why people are so negative about IPv6. [...] It just works! Networking is a lot more than being able to ping a single host. As a concrete counter-example, IPv6 routinely broke for me when I was using pfSense as a router. Why? Because pfSense, with no way of disabling this behavior, published its public IP as the DNS server for internal clients. So each time I got a new prefix from my ISP, which h…

> And, if I had bothered configuring IPv6 firewall rules, those would have had to be reconfigured manually with the new prefix. I understand this is mostly fixed in pfSense recently, but this was the case for many, many years.

Why would you have to reconfigure your firewall rules when you're getting a new IPv6 prefix?

Re: IPv6 is the only way forward

#184

Post by juliangmp »

general1465 wrote: post #109
dogleash wrote: post #28

Earlier quoted context omitted.

Yup. People learn parts of v4 through osmosis because it's the default. Then when networking topics come up, it's easier to keep going with stuff that looks familiar rather than un-learning assumptions. Why bother with the weird other thing that's not even mandatory?

Because IPv4 is logical and makes sense. First thing which IPv6 came up with? No NATs everything will have a public address. It turned out that this was hare brained idea so let's just cover it up with firewall. However misconfigured firewall means that everything is open... IPv6 has been designed by people who were unable to think further than what is going to be tomorrow for a lunch.

Are you really complaining about the fact that we need to deploy firewalls?

Re: IPv6 is the only way forward

#185

Post by Dagger2 »

themafia wrote: post #37
diath wrote: post #14

Earlier quoted context omitted.

ISPs providing IPv6 connectivity out of the box does not equal software and internal devices doing the same.

You can route internal IPv4 networks over IPv6. There are several mapping strategies so this can even be transparent at your v6 gateway.

But note this only gives you access to v4 addresses, not to v6 ones. You do need v6 internally too.

Re: IPv6 is the only way forward

#186

Post by magicalhippo »

MaKey wrote: post #183
magicalhippo wrote: post #160

Earlier quoted context omitted.

> I don't understand why people are so negative about IPv6. [...] It just works! Networking is a lot more than being able to ping a single host. As a concrete counter-example, IPv6 routinely broke for me when I was using pfSense as a router. Why? Because pfSense, with no way of disabling this behavior, published its public IP as the DNS server for internal clients. So each time I got a new prefix from my ISP, which h…

> And, if I had bothered configuring IPv6 firewall rules, those would have had to be reconfigured manually with the new prefix. I understand this is mostly fixed in pfSense recently, but this was the case for many, many years. Why would you have to reconfigure your firewall rules when you're getting a new IPv6 prefix?

> Why would you have to reconfigure your firewall rules when you're getting a new IPv6 prefix?

Because the IP address of the target changes when you get a new prefix.

There's some discussion in this[1] old pfSense ticket.

With IPv4 you typically do address translation (NAT) and so the internal target address is not tied to the global address.

[1]: https://redmine.pfsense.org/issues/6626

Re: IPv6 is the only way forward

#187

Post by everdrive »

Here comes the flood of IPv6 evangelists who thinks everyone is confused about NAT and firewalls. I don't know where they get their talking points, but they descend onto these threads with their sanctimony. "Oh, you must be confused about how NAT works, allow me to educate you." It's very tiresome.

Re: IPv6 is the only way forward

#188

Post by Bender »

orangeboats wrote: post #179
Bender wrote: post #175

Earlier quoted context omitted.

You have to be really special I am very special, mama said so. I stand by what I said. Get countries to do what I said and DHCP will take care of the rest. CGNAT can be binned once people do what I said.

DHCP? For country-level IP allocation? Yeah, your mama was not wrong - you indeed are a special one. Now, let's bring you to a nearby playground...

DHCP? For country-level IP allocation?

No, that would darn silly. For ISP allocation like all normal ISP's.

Gosh golly friend.

Post reply on HN