Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Addresses Through 2025

potaroo.net

Post reply on HN
Print view View original

111–120 of 158 posts

Re: IP Addresses Through 2025

#111

Post by pixl97 »

1970-01-01 wrote: post #88
oasisbob wrote: post #84

Earlier quoted context omitted.

Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with. However, there are network upstarts like Jio (India) which made huge v6 investments from day one which use 464xlat for subscribers to access v4-only resources.

>Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with. That's my point; why is it still difficult? What exactly are the pain points for a fully commercialized native IPV6-only business, and why do we think it will be easier to maintain the status quo?

Because a few large companies are holdouts. Github for example. Some AWS backend stuff. Many smaller ISPs that represent a very long tail.

Most of it is not any particular difficulty for you, but because of someone else.

Re: IP Addresses Through 2025

#112

Post by dist-epoch »

RiverCrochet wrote: post #75
dist-epoch wrote: post #44

Earlier quoted context omitted.

But has the nice side-effect of working as a firewall, before traffic gets to you.

- Did you disable UPnP on your router? If not, any device behind the router can simply ask the router to open a port, typically without authentication, bypassing this "firewall" completely. - TURN and STUN trivially bypass this side-effect, and a side effect of that is a third party has to often be involved, which can be collecting data later leaked or used against you. - The monstrosity of NAT is that it's the core…

That third party involved is my ISP which will see the packets anyway, even if NAT is not used.

And the attacks you mentioned are initiated from the inside. Not what I stated, that NAT is a sort of a firewall for incoming connections.

Re: IP Addresses Through 2025

#113

Post by grishka »

simoncion wrote: post #65
grishka wrote: post #48

Earlier quoted context omitted.

How many more decades will I have to wait to have IPv6 from my ISP though?

Try switching ISPs. [0] Even Comcast provided me IPv6 service fifteen, twenty years ago. [0] Yes, I am aware that that's simply not possible for most folks. I used to be most folks, so I definitely know.

You're underestimating just how rare IPv6 is in my country. It's mostly found only in datacenters.

Re: IP Addresses Through 2025

#114

Post by megous »

dist-epoch wrote: post #44
shmerl wrote: post #36

Earlier quoted context omitted.

NAT is the monstrosity, not IPv6.

But has the nice side-effect of working as a firewall, before traffic gets to you.

You just have outbound NAT enabled, so that your internal nodes can access the internet, no mapping to any internal nodes is set from the outside and no firewall. (just NAT alone) So all packets to your router's address will terminate at the router. Right?

OK, let's say I send a packet to your router's external interface with destination IP set to internal address of one of nodes in your network.

Will it reach your internal host? Will I get a response? ;-) I hope you now appreciate how NAT is not a firewall at all.

Re: IP Addresses Through 2025

#115

Post by RiverCrochet »

cyberax wrote: post #91
RiverCrochet wrote: post #75

Earlier quoted context omitted.

- Did you disable UPnP on your router? If not, any device behind the router can simply ask the router to open a port, typically without authentication, bypassing this "firewall" completely. - TURN and STUN trivially bypass this side-effect, and a side effect of that is a third party has to often be involved, which can be collecting data later leaked or used against you. - The monstrosity of NAT is that it's the core…

I've yet to see UPnP work...

I was surprised as well as it's something I turn off on devices I control and I haven't really assumed it was a thing. But recently at a friends house I decided to install upnpc on my Linux laptop and give this a try:

| upnpc -a 192.x.x.x 8080 80 tcp

And to my surprise it just worked. This friend just upgraded to fiber and had just received a new router.

Re: IP Addresses Through 2025

#116

Post by cyberax »

radlad wrote: post #107
cyberax wrote: post #105

Earlier quoted context omitted.

This is BS. "Default deny" or "default accept" makes no practical difference with NAT. You can leave the "default accept" rule with NAT and you'll be perfectly fine except in some weird edge cases. That's because it's exploitable only if you control the next hop from the NAT router, which is typically within the ISP infrastructure. So the attacker will need to either hack your ISP or mess with your NAT router's physi…

A default deny firewall is a good idea to protect services everywhere in your network, including those which run on the router itself (e.g. many routers run a local DNS server.) Without NAT, packets are not dropped, they simply do not have their destination rewritten to another device on the network. The traffic is still destined for the router and will be processed by it. This is why routers ship with a default-deny…

Sure, a default deny is a good idea. However, it's not _critical_. If you forget to enforce it on your NAT router, you'll be fine. And if you are behind a CGNAT, it's even safer.

In IPv6 it becomes absolutely essential. If you forget to include it, your network becomes wide open. And you don't have an easy way to detect this because you need an external service to probe your network.

> NAT is not a firewall. It is address translation. It will not drop packets.

Yes, it is a firewall because it enables the address space isolation.

Re: IP Addresses Through 2025

#117

Post by Aloisius »

1970-01-01 wrote: post #38

I'm interested in any new successful startups going full IPV6 from the beginning. Once we cross that bridge, where your internal IPV4 knowledge is equivalent to token ring knowledge, there's nothing else to watch.

While definitely not a startup, the National Archives made https://clintonwhitehouse1.archives.gov/ and https://clintonwhitehouse2.archives.gov/ IPv6-only.

While I don't think a couple administration's website archives are enough to drive adoption, one could imagine there might be some government resources that might.

Sadly browsers don't seem to warn users that they couldn't connect because of the lack of IPv6 (and doing so would be difficult for IPv6-only DNS servers), so it just looks like a regular connection failure.

Re: IP Addresses Through 2025

#118

Post by dlcarrier »

ianburrell wrote: post #54
dlcarrier wrote: post #41

Earlier quoted context omitted.

As someone with a background in electronics who doesn't manage any internet-connected equipment but has multiple embedded devices connected to a WAN, I'm glad that IPv4 still seems to have a bit of life left in it. When IPv6 was developed, over 30 years ago, connecting everything to the internet seemed like a great idea. I know that IPv6 can be made secure, but I don't have the background or research time to learn ho…

IPv6 is just as secure as IPv4. NAT usually combines address translation with a stateful firewall. I remember when they were separate things. IPv6 has the stateful firewall, all the same security but without the mess of address translation. Also, if you have devices connected to WAN, then they are insecure because they are not NATed.

Oops, I meant to say LAN, not WAN.

Re: IP Addresses Through 2025

#119

Post by dlcarrier »

simoncion wrote: post #63
dlcarrier wrote: post #41

Earlier quoted context omitted.

As someone with a background in electronics who doesn't manage any internet-connected equipment but has multiple embedded devices connected to a WAN, I'm glad that IPv4 still seems to have a bit of life left in it. When IPv6 was developed, over 30 years ago, connecting everything to the internet seemed like a great idea. I know that IPv6 can be made secure, but I don't have the background or research time to learn ho…

> I know that IPv6 can be made secure, but I don't have the background or research time to learn how to do so, and the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy that makes it impossible to accidentally directly connect anything to the internet. To get the "unsolicted traffic is rejected or dropped" behavior of the typical IPv4 NAT, forward inbound traffic that…

Yeah, that's the kind of stuff that I know how it works from a network protocol standpoint, but have no clue how to configure on any given system, let alone verify I configured it correctly. I installed DD-WRT on my router, hoping it would be easier to set up. The user interface was much easier to navigate, but the labels of the settings were so sparse that I couldn't tell what anything was referring to, even knowing the terminology for the the lower layers of network protocols. I wouldn't be surprised if I never get around to working on it in my lifetime, as long as I can play around with electronics projects.

Regarding Android OS, I'm not convinced it isn't a toy OS. I feel like they threw in the Linux kernel, but didn't bother including most of the useful features, and pat themselves on the back whenever they add one back. It took almost a decade before they figured out that you could install fonts without reinstalling the operating system. If they ever discover DKMS, we can stop throwing our phones away every few years, and have some actually useful hardware. Then again, it took Apple two years to add copy and paste to a phone, so maybe it's an industry-wide problem. If I could buy a modern Jornada 700 series running Linux or BSD, I'd never need to pick up an Android or iOS device again.

Re: IP Addresses Through 2025

#120

Post by SchemaLoad »

JulianHart wrote: post #73
Fiveplus wrote: post #17

The collapse in IPv4 transfer prices is what caught my eye here, dropping from a ~$55 peak in 2021 to a mean of $22 in early 2026 (figure 12). This validates my hypothesis that the run-up in 2020–2022 was an artificial scarcity bubble driven largely by hyperscalers. AWS was right up there stockpiling before they shifted their pricing model. Once AWS introduced the hourly charge for public IPv4 addresses (effectively…

The CGNAT point is underrated. Carriers have zero incentive to move away from it - thousands of users per public IP, no transition cost. The interesting downstream effect is on IP reputation systems. Traditional detection assumed 1 IP = 1 user. CGNAT breaks that entirely - platforms can't aggressively filter mobile carrier IPs without blocking legitimate customers by the thousands. Makes sense the IPv4 price dropped…

I wonder if all these new tools that punch through CGNAT like tailscale will end up breaking it when they force these NAT boxes to maintain tons of long lived connections.

With the uptake in smart home and internet connected CCTV by consumers, things could dramatically shift.

Post reply on HN