Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

101–110 of 198 posts

Re: New patches allow building Linux IPv6-only

#101

Post by bombcar »

kingstnap wrote: post #46
jeroenhd wrote: post #20

Earlier quoted context omitted.

Odido is the cheapest ISP for a reason. They refuse to implement anything that isn't strictly required. Perhaps implementing an Odido tax might actually make Odido care enough to throw the switch on IPv6. They bought 2a02:4240::/32, they just refuse to make use of it.

> They refuse to implement anything strictly required This describes a lot of businesses ngl. Bell in Canada is one huge head scratcher. They are one of the largest ISPs here and I can even buy 8 gig internet to my house if I want but they don't support IPv6.

Apparently (according to techs) a lot of ISPs are like that - they said they have everything up and running and even tested to turn on IPv6 but they haven't received the go-ahead.

He mentioned this because marking my connection as a "business" one without changing anything else would allow it to get IPv6 (a /64, bah).

Re: New patches allow building Linux IPv6-only

#102

Post by bombcar »

craftkiller wrote: post #78
bombcar wrote: post #48

Earlier quoted context omitted.

IPv6 can "leak" MAC addresses of connected devices "behind the firewall" if you don't have the privacy extensions / random addresses in use. There are a number of footguns for privacy with IPv6 that you need to know enough to avoid.

Privacy extensions are enabled by default on OSX, windows, android, and iOS: https://ipv6.net/guide/mastering-ipv6-a-complete-guide-chapt... On Linux, I think the defaults are left up to the distros so there is a chance of a privacy footgun there. Hopefully most distros follow the example set by Apple and Microsoft (a sentence I never thought I would write...)

They are now - I'm not sure when they implemented them but I know Windows at least would do some really stupid stuff very early on.

Re: New patches allow building Linux IPv6-only

#103

Post by electronsoup »

jrm4 wrote: post #77
craftkiller wrote: post #70

Earlier quoted context omitted.

You can't correlate the number of addresses with the number of devices because IPv6 temporary addresses exist. If you enable temporary addresses, your computer will periodically randomly generate a new address and switch to it. https://www.rfc-editor.org/rfc/rfc8981.html

[flagged]

and most OS do enable it by default

Re: New patches allow building Linux IPv6-only

#104

Post by iamnothere »

craftkiller wrote: post #76
iamnothere wrote: post #47

Earlier quoted context omitted.

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. Do you ever connect your laptop to any network other than your home network? For example, public wifi hotspots, hotel wifi, tech conferences, etc? If so, you need to be running a firewall _on your laptop_ anyway because your router is no longer there…

Not every device can run its own firewall. IoT devices, NVR systems, etc should be cordoned off from the internet but typically cannot run their own firewall.

Re: New patches allow building Linux IPv6-only

#105

Post by iamnothere »

wredcoll wrote: post #80
iamnothere wrote: post #66

Earlier quoted context omitted.

As someone who has done this while tired, it’s a lot easier to accidentally open extra ports to a publicly routable IP (or overbroad range of IPs) than it is to accidentally enable port forwarding or DMZ.

You could accidentally swap ips to one that had a port forward, some applications can ask routers to forward, etc etc. I donmt know how exactly we'd measure the various potential issues but they seem incredibly minor compared to the sheer amount of breakage created by widespread nat.

I don’t have any problems with NAT on my network.

Re: New patches allow building Linux IPv6-only

#106

Post by blueflow »

everdrive wrote: post #12
rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

> I like NAT

I'm in favor of having society overrule you. NAT is a horrible kludge and not okay. Never was.

Re: New patches allow building Linux IPv6-only

#107

Post by MisterTea »

degamad wrote: post #86
iamnothere wrote: post #69

Earlier quoted context omitted.

Right, but if you’re messing around as a naive learner it’s easy to accidentally disable that or completely open up an IP or range due to a bad rule. It’s a lot harder to accidentally enable port forwarding on a NAT.

> It’s a lot harder to accidentally enable port forwarding on a NAT. It's probably less than three clicks on most home router web UIs.

But you have to specify not only the exposed port but also the destination address and port which is not easy to do accidentally.

edit: typo

Re: New patches allow building Linux IPv6-only

#108

Post by iso1631 »

Sanzig wrote: post #37
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

My ISP doesn't rotate my /48

However if I change my ISP I get a new one, and that means a renumbering.

Re: New patches allow building Linux IPv6-only

#109

Post by iso1631 »

iamnothere wrote: post #104
craftkiller wrote: post #76

Earlier quoted context omitted.

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. Do you ever connect your laptop to any network other than your home network? For example, public wifi hotspots, hotel wifi, tech conferences, etc? If so, you need to be running a firewall _on your laptop_ anyway because your router is no longer there…

Not every device can run its own firewall. IoT devices, NVR systems, etc should be cordoned off from the internet but typically cannot run their own firewall.

Sure, but they sit on an iot vlan where your firewall prevents access except specificly allowed services

Re: New patches allow building Linux IPv6-only

#110

Post by iso1631 »

knorker wrote: post #38
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

So run fc00::/7 addresses with IPv6 NAT. That addresses all of your concerns, and you have that option.

Sure you can do that

So what's the point in ipv6?

Post reply on HN