Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#121

Post by 2000UltraDeluxe »

dboreham wrote: post #5
api wrote: post #4

The biggest problem remains cloud and CDN companies with poor to nonexistent IPv6 support. Most ISPs, especially on mobile, have it now or are adding it very soon. I've wondered whether some might be dragging their feet because they see an advantage in IP address scarcity to sell cloud gateways, CDNs, and other middle box type services. But the most likely explanation remains that not enough customers are asking for…

> Most ISPs, especially on mobile, have it now or are adding it very soon. Except Charter/Spectrum in the US.

Telia in Finland refuses to enable IPv6 for mobile. I'm sure there's no lack of providers doing the same.

Re: Tell HN: IPv6-only still pretty much unusable

#122

Post by yesco »

justin_oaks wrote: post #14

Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more complicated than IPv4, but maybe that's just because I'm just not familiar with it. Are there any good resources on setting up IPv6 support from first principles? I still get confused as to the "right" way to set up internal networks for IPv6, especially when DHC…

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to.

The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6.

The key things to remember when working with IPv6 are:

- IPv6 is very unidirectional, it's not a giant one way waterfall like IPv4/NAT

- Routers don't assign addresses, they advertise "prefixes", usually multiple

- Routers will usually have a prefix for: Internet, WAN, Link-Local (last one being advertised only to nodes directly connected to it)

- Nodes use prefixes to auto-generate an address

- Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same

- Usually nodes can easily communicate back and forth across multiple local routers with little configuration or hierarchy

- Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy

- Even if every node has an external address now, you can still configure your firewall to ensure they are isolated from external connections (which is usually the default anyway). You don't need NAT to securely isolate things.

- Once you get the hang of it you will realize how easy it makes everything and despair that support for it sucks and everyone makes it harder than they need to

Finally for learning resources I honestly recommend just reading the RFCs, I personally learned this way and believe they provide the most direct understanding of the rational behind everything.

Re: Tell HN: IPv6-only still pretty much unusable

#123

Post by devnullbrain »

gertrunde wrote: post #108
spookthesunset wrote: post #81

Earlier quoted context omitted.

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

No.... Absolutely no... NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. And how is "You have to think about which ports you want the NAT gateway to forward." any different from thinking about firewall rules? And most consumer CPE devices (i.e. 'router' etc) are perfectly capable of running a firewall, and often do. And any firewall that doesn't drop i…

>NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports.

This is one of those infosec tenets that is technically true but functionally unhelpful. Like correct-horse-battery-stable debates.

The claim is that IPv4 + NAT + bad firewall is better than IPv6 + bad firewall.

Yes, both are insufficient and inferior to a good firewall - but how confident are you that you never interact with a bad firewall?

Re: Tell HN: IPv6-only still pretty much unusable

#124

Post by ehPReth »

gertrunde wrote: post #108
spookthesunset wrote: post #81

Earlier quoted context omitted.

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

No.... Absolutely no... NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. And how is "You have to think about which ports you want the NAT gateway to forward." any different from thinking about firewall rules? And most consumer CPE devices (i.e. 'router' etc) are perfectly capable of running a firewall, and often do. And any firewall that doesn't drop i…

Who's the monster that created NAT for IPv6 D:

Re: Tell HN: IPv6-only still pretty much unusable

#125

Post by noipv6 »

howinteresting wrote: post #100
Dagger2 wrote: post #70

Earlier quoted context omitted.

I'm not sure it was ever relevant. All it does is describe the problem, which was already well-known at the time by the people working on v6. It doesn't give a fix for it. It doesn't give a fix because no fix is possible. Because the problem comes from the design of v4, not from v6. For some reason djb wasn't able to get his head around that, and people have been pointing to that damn page as if it's some big gotcha…

I mean, v6 is still mostly a failure, so (rightly or not) the situation is going to be blamed on the people that have been pushing v6. That's just the cost of trying to push the entire world towards a new standard. (I know that v6 has been a success within datacenters and such.)

by what definition would you call ipv6 "mostly a failure"? 30-40% global eyeball network (to the end user) adoption after ~10 years of active deployment, against very vocal opposition seems commendable enough to me.

Re: Tell HN: IPv6-only still pretty much unusable

#126

Post by staringback »

tjoff wrote: post #45
argulane wrote: post #28

Earlier quoted context omitted.

Everything should get its IPv6 configuration via SLAAC. DHCPv6 is only useful when you plan to provide prefix delegation for extra routers or network boot information.

So how do you do DNS then? Not sure if this is a good source but it had some history to recap, and it doesn't look pretty... https://www.reddit.com/r/networking/comments/ajb2ec/comment/... [...] To be honest because of this hot mess if you want to reliably support any possible client you'll need to do both DHCPv6 and RDNSS for DNS information. [...]

IPv6 router advertisement.

Re: Tell HN: IPv6-only still pretty much unusable

#127

Post by counttheforks »

Sesse__ wrote: post #93
Tempest1981 wrote: post #25

Earlier quoted context omitted.

Pricing, fyi: https://docs.hetzner.com/general/others/ipv4-pricing/ Around €19.00 setup per IP.

That's not insane, that's pretty cheap. If you buy IPv4 addresses in bulk (e.g. an entire /18 or so), they're ~$40 a piece these days. When you buy cloud services from AWS or GCE, you're still paying for those IPv4 addresses, it's just baked into the price. Hetzner makes paying for it optional, which makes it so much more visible.

It is an insane price for renting an IP address. It's not like you get to keep the IP address when you move elsewhere.

Re: Tell HN: IPv6-only still pretty much unusable

#128

Post by justsomehnguy »

spookthesunset wrote: post #81
redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

> With IPv6 the entire network is reachable outside by default

Only, and only, if you configured your router that way.

In both cases, it's absolutely the same:

    IPv4 -> allowed NAT ports -> NAT network -> Everything else is dropped/denied
    
    IPv4 -> allowed ports -> directly routed IPv4 network -> Everything else is dropped/denied
    
    IPv6 -> allowed ports -> directly routed IPv6 network -> Everything else is dropped/denied
See?

Of course if you are on someone's else network (typical for hosting when you aren't provided with your own v6 subnet, instead you have a bunch of addresses) then you should configure firewall on each your machine... which is what you need to do anyway?

Re: Tell HN: IPv6-only still pretty much unusable

#129

Post by cramjabsyn »

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

I feel the same way.

Clearly ipv6 is very flawed and by now the community should consider it a failure and work on a viable replacement.

We need an internet protocol that is backwards compatible with ipv4 and does not require deploying and maintaining entirely parallel networks, interfaces, firewalls, routing, etc.

If ipv6 actually was viable, the internet would have cut over. Instead we’re on a path to support ipv4 and ipv6 in parallel essentially forever.

Re: Tell HN: IPv6-only still pretty much unusable

#130

Post by terom »

Tempest1981 wrote: post #25
KomoD wrote: post #18

> Our Hosting provider, Hetzner, has recently started charging for public IPv4 addresses Well actually, they were charging for IPv4 addresses for a while, but just changed pricing... to outrageous pricing. The setup fees are actually insane! And yeah IPv6-only is quite a terrible experience, I tried out a few days ago. I suggest just using nat64.net if you want to access IPv4 sites over IPv6. One quite funny thing, I…

Pricing, fyi: https://docs.hetzner.com/general/others/ipv4-pricing/ Around €19.00 setup per IP.

My guess would be that you need to let used IPv4 addresses age out for a while before you can reassign them to a new customer, and they need to reduce churn - and avoid people intentionally burning IPv4 addresses by rotating through new, clean addresses.
Post reply on HN