Tell HN: IPv6-only still pretty much unusable • Hacker News Board

Re: Tell HN: IPv6-only still pretty much unusable

#131

Post by tjohns » Wed, Dec 07, 2022, 5:36 PM UTC

tjoff wrote: post #45

argulane wrote: post #28

Earlier quoted context omitted.

Everything should get its IPv6 configuration via SLAAC. DHCPv6 is only useful when you plan to provide prefix delegation for extra routers or network boot information.

So how do you do DNS then? Not sure if this is a good source but it had some history to recap, and it doesn't look pretty... https://www.reddit.com/r/networking/comments/ajb2ec/comment/... [...] To be honest because of this hot mess if you want to reliably support any possible client you'll need to do both DHCPv6 and RDNSS for DNS information. [...]

SLAAC can configure DNS automatically (via RDNSS).

Or you can run DHCPv6 just to hand out DNS settings (or anything else you want more control over), even if it's not handling addressing. But this isn't necessary for small deployments.

Personally, I've never had any problems with pure SLAAC (no DHCPv6) on my home network.

Re: Tell HN: IPv6-only still pretty much unusable

#132

Post by SamuelAdams » Wed, Dec 07, 2022, 5:36 PM UTC

bombcar wrote: post #40

arcade79 wrote: post #31

I was thinking about ipv6 the other day. I concluded in my head that adoption was just around 5-10%. Luckily I went to verify that with statistics. https://www.google.com/intl/en/ipv6/statistics.html While price of ipv4 addresses are increasing, the world has slowly been adopting ipv6. From the graph above, I'd say we cross over 50% in about 2-3 years time. At some point the "dash" to adopt ipv6 starts, and brave fol…

I'd love for some way to measure how much of my network's traffic outbound and inbound is IPv6. I assume there's some way to "count" it on the router, but Mikrotik doesn't seem to expose it directly.

PiHole is actually pretty great for this. I set up some firewall rules in OpnSense to force all devices to use PiHole as a DNS server. Then log all queries.

You can see which clients are using ipv6 and how many queries there are. I would estimate that about 60% of iPhone traffic in my household (by far the busiest devices) is ipv6. We usually use big sites though like Reddit, twitter, google, etc.

And then there’s the Rokus that don’t support ipv6 at all. Considering how cheap they were it doesn’t really surprise me.

Re: Tell HN: IPv6-only still pretty much unusable

#133

Post by lzaaz » Wed, Dec 07, 2022, 5:36 PM UTC

bombcar wrote: post #63

yusyusyus wrote: post #58

Earlier quoted context omitted.

iirc mikrotik supports netflow. that's how i account for proto balance. FWIW, owing to the nature of residential traffic, I've typically seen high (60-70% of traffic) as v6.

Yeah, if the stream platform CDNs support IPv6 (Do they? is there a site that lists it?) then the vast majority of residential traffic will be IPv6.

This is exactly why this isn't a good way to measure ipv6 adoption. For example, youtube supports ipv6; if you spend all day watching youtube, 80%+ of your traffic will be ipv6.

Re: Tell HN: IPv6-only still pretty much unusable

#134

Post by jraph » Wed, Dec 07, 2022, 5:37 PM UTC

staringback wrote: post #118

lzaaz wrote: post #113

Earlier quoted context omitted.

It is a substitute to an actual firewall because I don't need a firewall since NAT makes all of my listening ports unavailable to my WAN.

Oh you don't need a firewall then? I guess accessing a routers web interface from the WAN is a-okay

My shitty cable modem which is also a router does not expose its web interface to the world by default.

I don't understand why you'd need a firewall if

- you trust devices on your network (yes, big if, but even then: the only reachable ports of a machine from the outside are those explicitly open to the outside, most stuff listens to 127.0.0.1 anyway)

- you only configure your NAT to forward ports you would open on your firewall

Re: Tell HN: IPv6-only still pretty much unusable

#135

Post by xattt » Wed, Dec 07, 2022, 5:37 PM UTC

RijilV wrote: post #9

It's been a quarter of a century since IPv6 launch. There's some really good lessons learned here. IPv6 requires everyone, everywhere, needs to change their configuration to add IPv6 addresses and network connectivity to every node/endpoint. The madness of course is that all the underlying infrastructure software (routers, OS, standard libraries) all support IPv6. It would seem, at a large enough scale, that software…

If we take a chapter on fixing broken implementations from the USB Forum, the clear solution is to come up with an IPv6 Rev. e^76.

Re: Tell HN: IPv6-only still pretty much unusable

#136

Post by yesco » Wed, Dec 07, 2022, 5:37 PM UTC

tjoff wrote: post #109

porbelm wrote: post #94

Earlier quoted context omitted.

The SLAAC should not change after the host has generated it during installation / first connection, as long as you don't reinstall the OS etc. It's basically no problem. Even better: I can set my own ::/64 so personal servers at home can be ::d3ad:b33f and accessible from outside without NAT. It's beautiful. Firewall configuration is not hard either these days is it?

So I have to manually configure every device to be able to use internet? Every friends phone that wants to connect to my wifi needs manual setup? That is a problem. To which the solution is IPv4?

Why do you think this? What led you to assuming these things?

You would only need to configure any of this if you want to allow external connections, which isn't much different than setting up port forwarding with IPv4 + NAT, except with IPv6 it's less complicated.

Re: Tell HN: IPv6-only still pretty much unusable

#137

Post by vel0city » Wed, Dec 07, 2022, 5:37 PM UTC

spookthesunset wrote: post #81

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

> With IPv6 the entire network is reachable outside by default.

The entire network might be routable, but it often isn't reachable. My router had a default deny rule, so everything in my network for sure wasn't reachable by default despite having IPv6 addressing.

If anything, I like firewalling in IPv6 far better than dealing with NATs. Just imagine having multiple boxes you'd like to reach by SSH or HTTPS from the outside. With NAT, you can only run one on a standard port. With IPv6, there's no need to NAT, everything can just use one of their many public IPv6 addresses, and then I can firewall to allow traffic to each of those boxes at the standard ports.

In fact, this gets even cooler. I can then have multiple services all bound to different IP addresses and have different firewall rules related to each of those services. There's so much more possible using IPv6 that you just practically can't do in IPv4, unless you just happened to have a /8 assigned to you back in the day.

Think about this: every device in my home network gets more IP addresses assigned to it than there are IP addresses in IPv4. I can have every container on my cluster have its own publicly routable IPv6 address, every application I run could theoretically have its own address and have its own network rules applied. And then I can look at my network edge and immediately identify any and all traffic flowing through that edge.

I can't wait until IPv4 is dead and I never have to deal with NAT issues again.

Re: Tell HN: IPv6-only still pretty much unusable

#138

Post by WastingMyTime89 » Wed, Dec 07, 2022, 5:37 PM UTC

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

It's already more or less how IPv4 addresses are embedded in IPv4 (except its 128bits and they use an FFFF prefix between the 0 and the IPv4 address).

IPv6 doesn't solve anything for the sake of it. Anyone who had to debug ARP caused issue on a network knows it's complete garbage for example.

Providers who explain that they are dragging their feet because of the complexity would have said exactly the same thing even it was only IPv4++. They just don't want to invest any money in something which is working for them.

Re: Tell HN: IPv6-only still pretty much unusable

#139

Post by noipv6 » Wed, Dec 07, 2022, 5:38 PM UTC

tjoff wrote: post #78

arcade79 wrote: post #31

I was thinking about ipv6 the other day. I concluded in my head that adoption was just around 5-10%. Luckily I went to verify that with statistics. https://www.google.com/intl/en/ipv6/statistics.html While price of ipv4 addresses are increasing, the world has slowly been adopting ipv6. From the graph above, I'd say we cross over 50% in about 2-3 years time. At some point the "dash" to adopt ipv6 starts, and brave fol…

That is a very one-sided view of adoption. It ties directly with the rise of mobile and internet in areas that wasn't able to grab IPv4 addresses in time. Such as India. Not sure what France is doing though, maybe something right. So, from my perspective (which obviously is tied to my location) is that all computers have IPv4 (haven't heard (and I've asked) of a single consumer ISP that offers IPv6) but all mobile ph…

okay - how about a few other angles?

https://stats.labs.apnic.net/ipv6/ - per-country, and within a country, per-asn eyeball statistics, collected from online ads - not just mobile!

https://www.facebook.com/ipv6/?tab=ipv6_country - per-country, albeit with a mobile-heavier bias (as you hint)

https://www.akamai.com/internet-station/cyber-attacks/state-... - collected from their content delivery network - tends to show lower adoption than the other metrics

i would point out that "all mobile phones have IPv6" isn't true globally, but it is the reality in some countries, yes.

Re: Tell HN: IPv6-only still pretty much unusable

#140

Post by ehPReth » Wed, Dec 07, 2022, 5:38 PM UTC

gfaster wrote: post #74

withinboredom wrote: post #46

Earlier quoted context omitted.

It’s not that ipv4 space is exhausted, there’s plenty of it available. It’s that early on it was mismanaged to the point that people / companies were able to buy entire /8’s for basically nothing and hold them forever.

Related anecdote, my (small) school had acquired a /16 way back and so today, every single device on the network gets its own public ipv4. It was an absolute mess for security (imagine a small army of first year CS majors setting up each a Raspberry Pi) but it was kinda fun being able to experiment with servers without having to worry about NAT.

they could just firewall inbound connections and have some sort of request/interface to allow certain/all ports whilst keeping everything lovely about public v4 though, yeah?