Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

101–110 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#101

Post by justeleblanc »

groestl wrote: post #67
vel0city wrote: post #26

Earlier quoted context omitted.

> what would be the best way forward to keep it that way in a IPv6-only future? Firewalls. You configure what traffic should be allowed from who to who. Default deny incoming traffic, and its the same behavior as when you had a NAT. Something having a routable IP address doesn't mean it needs to receive all traffic addressed to it.

My ISP does not allow BYOM (bring your own modem) and assigns me a /64 net, so I have a hard time running an (ipv6) router behind it that would do the firewalling.. I guess I'm stuck with ipv4 for the time being...

Does your ISP's router not have a firewall?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#102

Post by [deleted] »

michaelt wrote: post #62
tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

[deleted]

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#103

Post by throwaway742 »

soebbing wrote: post #58
wyager wrote: post #43

Earlier quoted context omitted.

Put internet of shit devices on their own VLAN(s). Almost all wifi APs today support multiple SSIDs with separate VLANs. Have your firewall block inbound connections to devices on that VLAN. Every OS firewall has built-in support for this. I spent a lot of time figuring out how to do all this in the most efficient way (in terms of my time and effort) during covid, and I suggest getting any arbitrary box with 2 ethern…

I actually thought about that for a minute when I set up my home network a while ago, but that seems to be a pretty hard (or at least inconvenient) problem. Often I need to access a device from my local network (think: use my phone to control Wi-Fi LED Strips, Sonos speakers, etc.), which makes it impossible (I guess?) to separate these devices into their own network completely (if they aren't controlled by an online…

>Or is it possible to allow access from my trusted network INTO the restricted network, but not the other way around?

Yes

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#104

Post by temp2022account »

AnonymousPlanet wrote: post #56
dale_glass wrote: post #53

Earlier quoted context omitted.

It just makes little sense. With IPv6 instead of NAT deciding that port 2000 maps to 192.168.1.3 port 22, you have a firewall that may or not choose to route to xx:yy:zz or not, and to allow an incoming connection over port 22 to that host or not. If you don't want to accept incoming connections to a given machine or network on IPv6 without NAT that's very easy to have.

Maybe people don't want to disclose the number and purposes of interior machines?

To be fair that info is already available w/ port sequence analysis, the same machine will pick from the same set of ephemeral ports for outgoing connections. I'd say the time for vanity privacy arguments is over, I'm all-in for team globally routable addresses w/ firewalls just saying "yes" or "no" to connections instead of routers guessing at port mappings.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#105

Post by unethical_ban »

michaelt wrote: post #62
tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address.

The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or incompetence of device manufacturers, primarily, holding us back. (and incompetence around IPv6 in general - I talked to a network guy at a large company recently and they were deploying /58s. WHY?!)

The benefits of IPv6 may not be just for you - it's for the planet, it's for the developing nations, it's for the future where IPv4 does not cut it. It's bigger than your home network.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#106

Post by jacob019 »

justeleblanc wrote: post #90
bityard wrote: post #78

Question from a (relative) IPv6 newbie that wasn't addressed in TFA: Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device. Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is…

It's not usual for your router to create A or AAAA records for the hosts connected to it. Look into Multicast DNS.

Maybe not, but it's super convenient and well supported by isc-dhcp-server/bind9. I do it on all my networks.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#107

Post by jcalvinowens »

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

There is no downside to everything to be globally routable. It's completely orthogonal to firewalling.

What is the risk you're picturing here? I'm really curious. Features like RFC4941/8981 mean nobody can infer anything about your network from the source addresses they see making requests out if it.

If you want to use link-local V6 addresses and NAT to a global one, you can do that. But IMHO that's sacrificing one of the greatest advantages of IPv6 for no tangible benefit.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#108

Post by unethical_ban »

tinus_hn wrote: post #86
tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

With NAT it is impossible to make a mistake that causes machines with a private address to become reachable to the internet. That is a reality that is not going anywhere, no matter if you like it or not, no matter if you think it is stupid or not.

Every home router could be built with a default deny inbound for traffic, with big flashing lights saying "do not override this".

IPv6 has private addressing and a form of NAT as well, were it to be the will of router mfg'ers and network admins. No need to stay on a legacy protocol.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#109

Post by aaronax »

groestl wrote: post #67
vel0city wrote: post #26

Earlier quoted context omitted.

> what would be the best way forward to keep it that way in a IPv6-only future? Firewalls. You configure what traffic should be allowed from who to who. Default deny incoming traffic, and its the same behavior as when you had a NAT. Something having a routable IP address doesn't mean it needs to receive all traffic addressed to it.

My ISP does not allow BYOM (bring your own modem) and assigns me a /64 net, so I have a hard time running an (ipv6) router behind it that would do the firewalling.. I guess I'm stuck with ipv4 for the time being...

A firewall can be run "in-line" and not have IP addresses on the interfaces. On a Palo Alto firewall this would be a "virtual wire", and "transparent firewall" or "bridging firewall" would be other common terms.

Examples: https://docs.opnsense.org/manual/how-tos/transparent_bridge.... https://docs.netgate.com/pfsense/en/latest/bridges/index.htm... https://www.fortinet.com/resources/cyberglossary/transparent...

Post reply on HN