Why IPv6 is so complicated • Hacker News Board

Re: Why IPv6 is so complicated

#161

Post by icedchai » Sat, Apr 18, 2026, 6:01 PM UTC

Hikikomori wrote: post #109

ExoticPearTree wrote: post #37

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forward 15 years snd the situation has improved quite dramatically. IPv6 has some quirks that make it harder to digest. - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space - privacy extensions:…

>In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Those people love their NAT. Was also designed in the early 90s before security was taken seriously.

The real problem is many "enterprises" have people who don't understand networking. NAT was a solution to IP address depletion. This is not a problem we have with IPv6.

If security is taken seriously, I'm sure they can spend a few minutes and learn how to configure a IPv6 firewall that allows no inbound connections. It's basically the simplest configuration possible.

Re: Why IPv6 is so complicated

#162

Post by icedchai » Sat, Apr 18, 2026, 6:02 PM UTC

Ekaros wrote: post #151

ExoticPearTree wrote: post #133

Earlier quoted context omitted.

> Was also designed in the early 90s before security was taken seriously. True, but since then it has transformed into “no one gets in because we have _private_ IP addresses”…

I would need to ask the follow up question. Okay so what happens when someone gets in? Say some idiot install something they should not. Or there is some vulnerability in something you allow in? Extra layers is good. But it does not mean you can forgo anything else.

Okay, so you configure a firewall. NAT is not required.

Re: Why IPv6 is so complicated

#163

Post by Dagger2 » Sat, Apr 18, 2026, 6:05 PM UTC

eqvinox wrote: post #90

wongarsu wrote: post #61

Earlier quoted context omitted.

The article describes coexistence as both dual-stack and connectivity between single-stack IPv6 and single-stack IPv4 host. And that in the autor's opinion all the complexity is in the latter, not in the dual-stack You raise a good point that we also should't take dual- stack for granted. But I think the more precise question 'why not dual-stack as the only coexistence option' also seems like a good one, and one the…

Dual-stack was the only coexistence option for a long time, until NAT64 came around. There were a whole bunch of attempts at compatibility, e.g. with "::1.1.1.1" and "::ffff:1.1.1.1" as IPv6 addresses, they just didn't go anywhere. (Well, not quite, the latter is in POSIX and in socket libraries around the planet. Doesn't leave the host though. At least it's not supposed to . I have some horror stories…) NAT64 starte…

NAT64 is a subset of a different thing that existed since 2000 though, when v6 was ~5 years old and before most OSs even had support for it.

Re: Why IPv6 is so complicated

#164

Post by orev » Sat, Apr 18, 2026, 6:07 PM UTC

smolder wrote: post #42

mort96 wrote: post #31

Earlier quoted context omitted.

It's not complicated because you understand it? Okay then

Not much more complicated than IPv4. There are more bits. The addresses are longer. It's not hard to grasp if you understand the prerequisites to understanding networking in general.

The idea that it’s just “more bits” it’s wrong, so I’m not sure your assessment is valid. Maybe at the packet level it’s just “more bits”, but at the network level a lot of processes changed. IP assignment, router discovery, etc. are different.

Re: Why IPv6 is so complicated

#165

Post by grandinj » Sat, Apr 18, 2026, 6:12 PM UTC

Dagger2 wrote: post #153

grandinj wrote: post #119

Earlier quoted context omitted.

A couple of years later ipv6 became unnecessary. A big driver for ipv6 at the time was routers not being able to manage the increasing size of the core routingtable. Then 2 years later betterhardware and routing table compression became available and ipv6 became unnecessary.

Uh, no it didn't? Routing table size is still something of a problem, especially as v4 continues to fragment more and more, but also the main driver was insufficient IP addresses in v4 and that problem hasn't even slightly gone away.

I was there, reading the ipv6 mailing list eagerly. Address space exhaustion was a smaller problem because NAT was pretty primitive, so called carrier grade NAT was not even a thing yet. But cisco had the largest routers and their biggest was not big enough for the core router fabrics projected growth. And there was not enough demand (yet) for very large routers fir cisco to want to design and build the nevessary chips. The IPv6 people thought they held all the cards and could mandate whatever they wanted.

But of course, it was s very long time ago and my memory may be inexact.

Re: Why IPv6 is so complicated

#166

Post by hkpack » Sat, Apr 18, 2026, 6:13 PM UTC

themafia wrote: post #112

hnlmorg wrote: post #53

Earlier quoted context omitted.

The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with enterprise is that 80% of the work is explaining to other people, usually non-technical or pseudo-technical decision makers, why your design is safe. I really do think IPv6 missed a tr…

It's just one firewall rule at the border to block all inbound traffic to a subnet or a range unless related to an outbound connection. Now you have identical security to a NAT. The huge win is you can forget about port forwarding and later just open the ports you need to the hosts you need or even the whole host if required.

Is it really identical when the receiving party can now identify every workstation at your internal network and track them separately?

For example, any website can now not only log that the traffic originated from org A, but specifically from org A, workstation N.

I wonder, is privacy implication is not important enough for people to worry about this?

Re: Why IPv6 is so complicated

#167

Post by b112 » Sat, Apr 18, 2026, 6:26 PM UTC

Dagger2 wrote: post #152

b112 wrote: post #148

Earlier quoted context omitted.

There are lots of legacy things in tcp/ip headers. One of them can be for the extra octlet. When ipv4 legacy flies around, that oclet will be null or 0. The entire internet could route just fine, especially if you put the extra octlet at the end. 1.1.1.1 gets an extra 1.1.1.1.newoctlet. So every existing IP gets a bonus 255 new IPs, and for now, routing of those is hardlocked to that IP, and it works with all legacy…

You're at the very beginning, baby steps stage of inventing IPv6 there. You aren't the first person to come up with the idea of adding extra bits to IP addresses to make them longer. The problem isn't finding somewhere to stash the extra bits in the packet format (which is trivial; you can simply set the next-protocol field to a special value and then put the bits at the start of the payload), it's getting all softwa…

Please consider that maybe the people working on v6 weren't actually complete imbeciles and did in fact think things through.

It is possible for the world to change, and for designs and plans and viewpoints 30+ years ago to be less correct today.

This world is not that world. That world had massive concerns about the processing cost of NAT. That was one reason for ipv6. It also had different ideas about where the net would go. We now know that the "internet of things" and "having your fridge online", as well as "5G in everything so people can't firewall it off" is just insane and malign.

We also know that tying an IP address to a person (compared to an ISP using NAT) reduces privacy. That devious and devilish actors abound.

Even though they thought these things might be neat, many of them aren't.

Re: Why IPv6 is so complicated

#168

Post by montag » Sat, Apr 18, 2026, 7:50 PM UTC

My problem with IPv6 is that I can't double click 2001:db8::1428:57ab to select the entire address. It's a silly complaint but representative of real ergonomic issues.

Re: Why IPv6 is so complicated

#169

Post by nobody9999 » Sat, Apr 18, 2026, 7:50 PM UTC

9dev wrote: post #27

nslsm wrote: post #21

Earlier quoted context omitted.

So, like ipv4, but you lose the protection and privacy afforded by the NAT?

IPv4 requires a DHCP server. It requires assigning a range of addresses that's usually fairly small, and requires manual configuration as soon as you need more than 254 devices on a network. The range must never conflict with any VPN you use. And there's more. Compare to IPv6: Nothing. All of these just go away. And concerning the NAT: That's just another word for firewall, which you still have in your router, which…

>IPv4 requires a DHCP server.

Windows[0]: Static IP configuration is as simple as typing an IP address into the pretty dialog box. No DHCP required.

Linux[1]: # ip addr will set a static IP address

>It requires assigning a range of addresses that's usually fairly small, and requires manual configuration as soon as you need more than 254 devices on a network.

Is 65,536 (172.16.0.0/16) or 16 million addresses (10.0.0.0/8) "fairly small"? Are DHCP servers unable to parse networks that "big"?

>Compare to IPv6: Nothing. All of these just go away.

They most certainly do. But they're not "problems" with RFC1918 addressing and aren't "problems" at all with IPv4.

There are many issues with IPv4 and the sooner it dies, the better. But the ones you mention aren't issues at all.

If you're going to dunk on IPv4, then dunk on it for the actual reasons it needs to go, not made up "problems."

Re: Why IPv6 is so complicated

#170

Post by Dagger2 » Sat, Apr 18, 2026, 8:09 PM UTC

hkpack wrote: post #166

themafia wrote: post #112

Earlier quoted context omitted.

It's just one firewall rule at the border to block all inbound traffic to a subnet or a range unless related to an outbound connection. Now you have identical security to a NAT. The huge win is you can forget about port forwarding and later just open the ports you need to the hosts you need or even the whole host if required.

Is it really identical when the receiving party can now identify every workstation at your internal network and track them separately? For example, any website can now not only log that the traffic originated from org A, but specifically from org A, workstation N. I wonder, is privacy implication is not important enough for people to worry about this?

At this point, the people who would be worried about this ought to know that temporary addresses are a thing, and that they prevent workstation N from having a single fixed IP for its outbound connections that it could be identified with.