Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Going IPv6 Only [pdf]

pc.nanog.org

Post reply on HN
Print view View original

101–110 of 112 posts

Re: Going IPv6 Only [pdf]

#101

Post by repolfx »

singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

Bear in mind privacy advocates also tend to like decentralised systems, but p2p networks benefit from IPv6 a lot.

We can't have it both ways. Either we have flat connectivity and a global address space like IPv6 and have static IPs, or we have to host all services in the cloud. I'd rather have static IPs.

Re: Going IPv6 Only [pdf]

#102

Post by repolfx »

okket wrote: post #35
phicoh wrote: post #11

It is weird to call this 'IPv6 Only'. Connectivity to the IPv4 internet is still provided. It is just that to talk IPv4 you have to go through a couple of complex translation steps.

It is IPv6 only with a fallback connection to the legacy IPv4 protocol with little to no chance of a reverse connection. Sadly, too much content is still stuck in this rapidly ageing world. Bandaid after bandaid won't help in the long term. Do we really want a one way connection world? If not, adapt IPv6. By default IPv6 CPE gear blocks incoming connections, which is good. Firewall rules can be changed, if needed. Yo…

Well, are there any mobile ISPs that let you accept inbound connections?

Carrier firewalls kill mobile p2p networks even though mobile+p2p are made for each other: it'd be amazing to be able to build decentralised services running on swarms of phones, but the lack of stable device-to-device connectivity except via massive Google and Apple datacenters is a killer problem :(

Re: Going IPv6 Only [pdf]

#104

Post by devereaux »

pilif wrote: post #49
devereaux wrote: post #5

On my home network, all my device have IPv6. Unfortunately, it not native IPv6: the AT&T LTE device I use for my home internet doesn't support IPv6. (Why LTE? It's a long story- I frequently travel, and I take my connection with me. Comcast doesn't make much sense. LTE latency and bandwidth are good enough) Anyway, whenever I get a server, I make sure IPv6 is supported. No IPv6, no business from me -- even for a VPS.…

> I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. Exposing an sshd to the public internet seems very risky. IPv6 or not. Even with v6 in your LAN, you probably still want the firewall to drop all incoming connections and then use some kind of VPN or bastion host to get inside

My raspberry pi, home weather station, and test VMs are not THAT sensitive :)

Besides, with temporary IPv6, I don't think I have much to fear.

Re: Going IPv6 Only [pdf]

#105

Post by azernik »

Fnoord wrote: post #55
azernik wrote: post #43

Earlier quoted context omitted.

464XLAT is simpler because it gets to piggyback off of other infrastructure that is already in place for forward-compatibility, namely NAT64 and DNS64. Not sure how much of this background you need, but since Wikipedia doesn't explain it well: as an ISP, you want your IPv6-only customers to be able to access the IPv4 internet. So you represent the entire IPv4 internet as an IPv6 prefix (generally ::ffff:0:0:0/96) and…

Would 464XLAT allow you to connect to e.g. Emby over IPv4, SSH port forwarding over IPv4, and BitTorrent to work (where majority of clients use IPv4) where it doesn't with DS-Lite/CGN?

Not sure about BT (there's still a NAT involved, but maybe the more conventional NAT64 allows the usual hole punching techniques to work?) or Emby (no idea what that is). I have no idea why SSH port forwarding wouldn't work with DS- Lite or 464XLAT, since from the network infrastructure's perspective it's a pretty conventional server-client connection.

Re: Going IPv6 Only [pdf]

#106

Post by Fnoord »

azernik wrote: post #105
Fnoord wrote: post #55

Earlier quoted context omitted.

Would 464XLAT allow you to connect to e.g. Emby over IPv4, SSH port forwarding over IPv4, and BitTorrent to work (where majority of clients use IPv4) where it doesn't with DS-Lite/CGN?

Not sure about BT (there's still a NAT involved, but maybe the more conventional NAT64 allows the usual hole punching techniques to work?) or Emby (no idea what that is). I have no idea why SSH port forwarding wouldn't work with DS- Lite or 464XLAT, since from the network infrastructure's perspective it's a pretty conventional server-client connection.

Didn't work for me with DS-Lite/CGN because I couldn't port forward since I didn't have authorization for that on my ISP's CGN server. Outward IPv4 worked perfectly fine, but inward did not. If your client speaks IPv4 only (which is rather common; e.g. my smartphone with 4G has this), it won't be able to talk to your IPv6 who has IPv4 behind CGN. What would work is a port forwarding server. A server which accepts IPv4 connection on a certain port and forward it to the server which accepts IPv6. However, this has several advantages: these services are not free (and rightfully so), and the user is relying on a third party.

Re: Going IPv6 Only [pdf]

#107

Post by azernik »

Fnoord wrote: post #106
azernik wrote: post #105

Earlier quoted context omitted.

Not sure about BT (there's still a NAT involved, but maybe the more conventional NAT64 allows the usual hole punching techniques to work?) or Emby (no idea what that is). I have no idea why SSH port forwarding wouldn't work with DS- Lite or 464XLAT, since from the network infrastructure's perspective it's a pretty conventional server-client connection.

Didn't work for me with DS-Lite/CGN because I couldn't port forward since I didn't have authorization for that on my ISP's CGN server. Outward IPv4 worked perfectly fine, but inward did not. If your client speaks IPv4 only (which is rather common; e.g. my smartphone with 4G has this), it won't be able to talk to your IPv6 who has IPv4 behind CGN. What would work is a port forwarding server. A server which accepts IPv…

BitTorrent should work fine, because it has mechanisms for punching UDP holes in NATs (by agreeing on a port combination with a coordination server and having each side send a dummy UDP packet to install the mappings). The one caveat is that, for correct determination of the NATted IP address, the coordination server needs to be IPv4-only.

Not sure what's going on with SSH forwarding.

Re: Going IPv6 Only [pdf]

#108

Post by Symbiote »

tialaramex wrote: post #91
pilif wrote: post #49

Earlier quoted context omitted.

> I can always ssh to any of my machines (or the VMs) from anywhere. It's just simpler. Exposing an sshd to the public internet seems very risky. IPv6 or not. Even with v6 in your LAN, you probably still want the firewall to drop all incoming connections and then use some kind of VPN or bastion host to get inside

If you just choose a completely arbitrary IPv6 address in your subnet for the server, random bad guys won't find it. This feels unintuitive, after all my IPv4 SSH servers have people banging on them 24/7, but that's orders of magnitude for you, bad guys who can try one host per second every second of every day, for a lifetime, can explore all of the actively deployed unicast IPv4 space. But those same bad guys will d…

Statistics since 1 June:

An SSH server on port 22, home broadband connection: 212k failed IPv4 login attempts, zero failed IPv6 login attempts.

An SSH server on port 22, university connection: 269k failed IPv4 login attempts, zero on IPv6.

> If you just choose a completely arbitrary IPv6 address in your subnet for the server, random bad guys won't find it.

So that is true, but it also seems they won't even bother looking. My computer is as obvious as I can make it, it's listening on 2001:xxxx:xxx0::1/44, and still has had no attempts. Nothing on port 80 either.

And of course, there's nothing to prevent having several IPs on one machine, each for a different service. A DNS name for a web server then isn't revealing a possible SSH server.

Re: Going IPv6 Only [pdf]

#109

Post by Fnoord »

azernik wrote: post #107
Fnoord wrote: post #106

Earlier quoted context omitted.

Didn't work for me with DS-Lite/CGN because I couldn't port forward since I didn't have authorization for that on my ISP's CGN server. Outward IPv4 worked perfectly fine, but inward did not. If your client speaks IPv4 only (which is rather common; e.g. my smartphone with 4G has this), it won't be able to talk to your IPv6 who has IPv4 behind CGN. What would work is a port forwarding server. A server which accepts IPv…

BitTorrent should work fine, because it has mechanisms for punching UDP holes in NATs (by agreeing on a port combination with a coordination server and having each side send a dummy UDP packet to install the mappings). The one caveat is that, for correct determination of the NATted IP address, the coordination server needs to be IPv4-only. Not sure what's going on with SSH forwarding.

Won't work if they don't have correct port forwarding enabled (which a lot of BitTorrent clients suffer from). FTP passive also doesn't work IIRC. SSH port forwarding uses TCP. Say you're listening on your IPv6 address. Well, if your client is IPv4 only you won't be able to connect. Unless you use one of those 4 to 6 services I mentioned.

Re: Going IPv6 Only [pdf]

#110

Post by azernik »

Fnoord wrote: post #109
azernik wrote: post #107

Earlier quoted context omitted.

BitTorrent should work fine, because it has mechanisms for punching UDP holes in NATs (by agreeing on a port combination with a coordination server and having each side send a dummy UDP packet to install the mappings). The one caveat is that, for correct determination of the NATted IP address, the coordination server needs to be IPv4-only. Not sure what's going on with SSH forwarding.

Won't work if they don't have correct port forwarding enabled (which a lot of BitTorrent clients suffer from). FTP passive also doesn't work IIRC. SSH port forwarding uses TCP. Say you're listening on your IPv6 address. Well, if your client is IPv4 only you won't be able to connect. Unless you use one of those 4 to 6 services I mentioned.

Ah. I thought you meant SSH port forwarding where the client is on IPv6.

Yeah, if the service has an IPv6 address only it's not going to be able to accept connections from an IPv4 client.

Post reply on HN