Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why IPv6 is so complicated

github.com

Post reply on HN
Print view View original

131–140 of 519 posts

Re: Why IPv6 is so complicated

#131

Post by miyuru »

ggm wrote: post #7

India on around 80% in the apnic labs active measurement of end users. https://stats.labs.apnic.net/ipv6/in They report nearly a billion users, predominantly in mobile. So, "only" 750 to 800 million users. Think about that: 3x the population of the USA using it most of the time, in one economy. Here's the rankings: https://stats.labs.apnic.net/ipv6/XA?o=cINw30x1r1 This is a different measure to Google's. They measure…

if you want population measurements, there is a APNIC page for that too.

https://stats.labs.apnic.net/v6pop

Fair warning, this page is not optimized and takes a lot of resources to render.

Re: Why IPv6 is so complicated

#132

Post by ExoticPearTree »

9dev wrote: post #114
hnlmorg wrote: post #110

Earlier quoted context omitted.

> and that's fairly easy to reason about for me But we aren’t talking about someone technical glancing at their home routers firewall. We are talking about explaining a network topology to enterprise teams like change management, CISO, etc in large infrastructure environments. That’s a whole different problem and half the time the people signing off that change either aren’t familiar with the infrastructure (which me…

> But we aren’t talking about someone technical glancing at their home routers firewall. Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort. For network admins in commercial settings, this is even less of an excuse. IPv6, the protocol, is fairly well documented and understandable if you put in the wor…

> Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort.

People at home don’t care about protocols. If the WiFi works and the TV plays Netflix or Hulu or whatever, the protocol can be anything.

Last time I “cared” was when I changed the DHCP network to not overlap with the VPN. And that was a long time ago.

Re: Why IPv6 is so complicated

#133

Post by ExoticPearTree »

Hikikomori wrote: post #109
ExoticPearTree wrote: post #37

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forward 15 years snd the situation has improved quite dramatically. IPv6 has some quirks that make it harder to digest. - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space - privacy extensions:…

>In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Those people love their NAT. Was also designed in the early 90s before security was taken seriously.

> Was also designed in the early 90s before security was taken seriously.

True, but since then it has transformed into “no one gets in because we have _private_ IP addresses”…

Re: Why IPv6 is so complicated

#134

Post by ExoticPearTree »

icedchai wrote: post #121
jjav wrote: post #113

Earlier quoted context omitted.

> In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Topic drift, but for younger people who didn't live it, that's how it used to be! For most of the 90s my workstation in the office (at several employers) was directly on the Internet. There were no firewalls, no filtering of any kind. I ran my email server on my desktop worksta…

Same! I even had my home network on a public /24.

The good ol’ days. Same. Had a public IP on my computer, could SSH into it to read my mail.

Re: Why IPv6 is so complicated

#135

Post by 9dev »

ExoticPearTree wrote: post #132
9dev wrote: post #114

Earlier quoted context omitted.

> But we aren’t talking about someone technical glancing at their home routers firewall. Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort. For network admins in commercial settings, this is even less of an excuse. IPv6, the protocol, is fairly well documented and understandable if you put in the wor…

> Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort. People at home don’t care about protocols. If the WiFi works and the TV plays Netflix or Hulu or whatever, the protocol can be anything. Last time I “cared” was when I changed the DHCP network to not overlap with the VPN. And that was a long time a…

That would be my take as well, but feel free to read some of the sibling comments here, eager to bikeshed over the IPs of their equipment.

Re: Why IPv6 is so complicated

#136

Post by commandersaki »

muppetman wrote: post #11

This annoys me, especially the last “It takes at least 25 years” rhetoric. It didn’t take 25 years for SSL. SSH. Gzip encoding on HTTP pages. QUIC. Web to replace NNTP. GPRS/HSDPA/3G/4G/5G They all rolled out just fine and were pretty backwards and forwards compatible with each other. The whole SLAAC/DHCPv6/RA thing is a total clusterfuck. I’m sure there’s many reasons that’s the case but my god. What does your ISP s…

Yeah the at least 25 years thing is a cop out. The IPng committee specifically chose the protocol that didn't have a transition plan, and today still doesn't have a transition plan.

I expect we're going to plateau with adoption for a long while now. 50% adoption is meaningless if it doesn't tangibly make a dent in the IPv4 exhaustion problem.

Re: Why IPv6 is so complicated

#137

Post by ButlerianJihad »

gucci-on-fleek wrote: post #58
hnlmorg wrote: post #53

Earlier quoted context omitted.

The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with enterprise is that 80% of the work is explaining to other people, usually non-technical or pseudo-technical decision makers, why your design is safe. I really do think IPv6 missed a tr…

> The nice thing about NAT [...] I really do think IPv6 missed a trick by not offering that IPv6 supports NAT [0], and nearly all routers make it easy to enable. The primary differences compared to IPv4 is that no-NAT is the default, and that it's more heavily discouraged, but it still works just as well as it does with IPv4. [0]: In the same way that IPv4 "supports" NAT, meaning that the protocol doesn't officially…

> IPv6 supports NAT

You say that, but in practice it does not.

My consumer router, and every router I have configured, implicitly supports IPv4 NAT out of the box. But it will never NAT an IPv6 network. If I enable IPv6 then it operates by IPv6 rules, which means each device gets a Network ID and each Network ID gets routed directly and transparently. The router has no NAT table and no NAT settings for this protocol.

So if NAT is “supported” whatever that means, it simply isn’t possible for most end-users.

Re: Why IPv6 is so complicated

#138

Post by gucci-on-fleek »

ButlerianJihad wrote: post #137
gucci-on-fleek wrote: post #58

Earlier quoted context omitted.

> The nice thing about NAT [...] I really do think IPv6 missed a trick by not offering that IPv6 supports NAT [0], and nearly all routers make it easy to enable. The primary differences compared to IPv4 is that no-NAT is the default, and that it's more heavily discouraged, but it still works just as well as it does with IPv4. [0]: In the same way that IPv4 "supports" NAT, meaning that the protocol doesn't officially…

> IPv6 supports NAT You say that, but in practice it does not. My consumer router, and every router I have configured, implicitly supports IPv4 NAT out of the box. But it will never NAT an IPv6 network. If I enable IPv6 then it operates by IPv6 rules, which means each device gets a Network ID and each Network ID gets routed directly and transparently. The router has no NAT table and no NAT settings for this protocol.…

Consumer routers don't support lots of useful stuff though, so them not supporting NAT66 isn't very surprising. Enthusiasts are likely to use OpenWRT or nftables, both of which support NAT66 [0], and quickly Googling some random enterprise routers shows that they all support NAT66 too [1] [2] [3].

This isn't enabled by default because it's usually a bad idea, but it's certainly possible if you really want. (It's discouraged because NAT in general is a bad idea, but it's no worse with IPv6 than with IPv4; the only difference being that IPv4 effectively requires NAT.)

[0]: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6

[1]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat...

[2]: https://www.animmouse.com/p/how-to-nat-ipv6-in-mikrotik/

[3]: https://www.juniper.net/documentation/us/en/software/junos/i...

Re: Why IPv6 is so complicated

#139

Post by estimator7292 »

threiw wrote: post #102
john01dav wrote: post #89

Earlier quoted context omitted.

This attitude is widespread enough to hold the world back by forcing everyone who interacts with the public Internet to support ipv4 (some technology), "for free". So, either way, we're forcing one of them. So, we might as well lean towards supporting the one that isn't hard capped at 4 billion addresses in a world with at least 2x as many devices. Have you ever tried to deal with NAT punchthrough? That's way more di…

> Have you ever tried to deal with NAT punchthrough? That's way more difficult to fix than having to properly configure your server. Yes I did, and I no longer support that either. For my setups it is local private ipv4 networks all the way now! How tailscale or other VPN deals with that is not my problem! If two nodes are on different networks, they should not be allowed to talk to each other anyway. Seems like secu…

You are so very incredibly wrong about absolutely everything here.

Re: Why IPv6 is so complicated

#140

Post by silb »

XorNot wrote: post #55
9dev wrote: post #34

Earlier quoted context omitted.

There are no more acronyms. SLAAC means automatic client configuration. That's the only one you need. > give up control of your home network. What does that even mean? What do you gain by deciding your Apple TV should be at 192.168.0.3? With IPv6, you can just `ping appletv` and it works fine. What more "control" do you need?

I mean generally I want fixed IPs on my local network for robustness. With IPv6 I actually want it more and it becomes possible since we can just use the MAC address as an IP address. I have IPv6 service at my ISP right now but I'm hesitant to turn it on on my local network because it does make my firewalling concerns much more critical.

> I mean generally I want fixed IPs on my local network for robustness.

With IPv6 you can assign fixed unique local addresses in addition to dynamic public addresses from your ISP.

Post reply on HN