Tell HN: IPv6-only still pretty much unusable • Hacker News Board

Re: Tell HN: IPv6-only still pretty much unusable

#151

Post by eppp » Wed, Dec 07, 2022, 5:42 PM UTC

tinus_hn wrote: post #92

blablabla123 wrote: post #85

Earlier quoted context omitted.

It provides a lot of improvements actually. Stating the obvious, NAT isn't needed anymore. Also with modern Firewalls rules need to be written only once. At this point I'm just surprised why it's not adopted

ISPs love NAT because it is an artificial distinction between producers and consumers, which means they can call the producers ‘pro’ of ‘enterprise’ and charge them through the nose while the consumers can’t cause trouble and just pay for download speed.

Going by my current experience of managing an ISP, the number of people that care at all about producing anything is almost zero. Out of thousands of accounts I can count on two hands the number of people that want anything outside of the standard ipv4 symmetric 1gb we offer.

Re: Tell HN: IPv6-only still pretty much unusable

#152

Post by vel0city » Wed, Dec 07, 2022, 5:42 PM UTC

lzaaz wrote: post #113

gertrunde wrote: post #108

Earlier quoted context omitted.

No.... Absolutely no... NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. And how is "You have to think about which ports you want the NAT gateway to forward." any different from thinking about firewall rules? And most consumer CPE devices (i.e. 'router' etc) are perfectly capable of running a firewall, and often do. And any firewall that doesn't drop i…

It is a substitute to an actual firewall because I don't need a firewall since NAT makes all of my listening ports unavailable to my WAN.

Depending on the NAT implementation this can be incredibly naive. Many home routers will send ANY traffic incoming on a port to the NAT'd IP address, even if the sources don't line up.

So say Alice is behind a crappy NAT and wants to talk to Bob. Alice's router opens a port on its edge, lets say 1234, and sends traffic to Bob on port 80.

Let's say Charles knows Alice's IP address. Charles starts spamming Alice's router, eventually hitting port 1234 with bad data.

Alice's router is dumb. It sees traffic on port 1234, checks its NAT table, and sees that data is supposed to go to Alice. It happily rewrites that packet and passes it along to Alice. Now Alice is getting traffic from Bob *and* Charles. Uh oh!

Many game consoles are explicitly designed around this bad, broken behavior. You'll open a port to the matchmaking server and then the matchmaking server will tell people to connect to that IP address and port combination. Crappy home routers will happily route that data through its NAT configuration to the console despite the console never explicitly opening up traffic to those other parties. This is why some game consoles will complain about closed NAT versus open NAT.

Re: Tell HN: IPv6-only still pretty much unusable

#153

Post by cloudwalk9 » Wed, Dec 07, 2022, 5:42 PM UTC

JshWright wrote: post #15

dboreham wrote: post #5

Earlier quoted context omitted.

> Most ISPs, especially on mobile, have it now or are adding it very soon. Except Charter/Spectrum in the US.

Maybe it's because we're in the former Time Warner Cable/Road Runner part of Spectrum's territory, but we've had IPv6 for years now.

I'm in original Charter territory and have v6

Re: Tell HN: IPv6-only still pretty much unusable

#154

Post by sph » Wed, Dec 07, 2022, 5:43 PM UTC

jraph wrote: post #134

staringback wrote: post #118

Earlier quoted context omitted.

Oh you don't need a firewall then? I guess accessing a routers web interface from the WAN is a-okay

My shitty cable modem which is also a router does not expose its web interface to the world by default. I don't understand why you'd need a firewall if - you trust devices on your network (yes, big if, but even then: the only reachable ports of a machine from the outside are those explicitly open to the outside, most stuff listens to 127.0.0.1 anyway) - you only configure your NAT to forward ports you would open on y…

My shitty router also firewalls incoming IPv6 connections by default, unless I manually allow them per-device, so I don't get your point.

Re: Tell HN: IPv6-only still pretty much unusable

#155

Post by allanrbo » Wed, Dec 07, 2022, 5:43 PM UTC

I believe a lot of mobile traffic to services like facebook/netflix/youtube use IPv6. That's a large percentage of internet traffic. And that allows telcos to NAT more customers onto fewer ipv4 addresses.

Re: Tell HN: IPv6-only still pretty much unusable

#156

Post by AnIdiotOnTheNet » Wed, Dec 07, 2022, 5:45 PM UTC

JshWright wrote: post #15

dboreham wrote: post #5

Earlier quoted context omitted.

> Most ISPs, especially on mobile, have it now or are adding it very soon. Except Charter/Spectrum in the US.

Maybe it's because we're in the former Time Warner Cable/Road Runner part of Spectrum's territory, but we've had IPv6 for years now.

Sure, as long as you're ok with having a constantly changing prefix. At least that's how it is for home connections and it nullifies nearly all the benefits of v6.

Re: Tell HN: IPv6-only still pretty much unusable

#157

Post by est31 » Wed, Dec 07, 2022, 5:45 PM UTC

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

One of the ideas of ipv6 was to reduce routing tables, those tables that backbone providers have to keep in memory and look up for incoming traffic. With ipv4's fragmented allocation scheme, these routing tables are huge. With ipv6, even huge companies like amazon only have a couple of global allocations. A "ipv4 with more octets" scheme would have kept that fragmentation around.

That being said, Amazon currently has 2880 ipv4 allocations and 946 ipv6 allocations... not much gained I guess? :p https://asnlookup.com/asn/AS16509/

Also, there are definitely some horrible ipv6 warts, like that the only standard for local ipv6 addresses forces you to adopt a scheme where your local address is horribly long, for the sake of global uniqueness, which is something that most people don't really need.

Re: Tell HN: IPv6-only still pretty much unusable

#158

Post by rhacker » Wed, Dec 07, 2022, 5:45 PM UTC

myself248 wrote: post #114

I propose a real simple solution: Major providers pledge to take this seriously. They toss a rule in their routers that just drops all ipv4, for 1 minute, starting at noon UTC. At 12:01 UTC, revert the change and ipv4 works again. Do this every day. The following week, up it to 2 minutes. The incentive will happen.

While I think this would effectively move the needle, as soon as they announce that this is going to happen, I am guessing heart monitors, ankle brace companies (people in home jail) and a slew of weird other use cases will pop up as major problems and the effort will fail.

Re: Tell HN: IPv6-only still pretty much unusable

#159

Post by jraph » Wed, Dec 07, 2022, 5:45 PM UTC

staringback wrote: post #144

jraph wrote: post #134

Earlier quoted context omitted.

My shitty cable modem which is also a router does not expose its web interface to the world by default. I don't understand why you'd need a firewall if - you trust devices on your network (yes, big if, but even then: the only reachable ports of a machine from the outside are those explicitly open to the outside, most stuff listens to 127.0.0.1 anyway) - you only configure your NAT to forward ports you would open on y…

Quoted post unavailable.

What's with the attacks??

I make sure what I build supports IPv6 (and I'll use tunnels if it's what it takes) but I can't make the only cable ISP available at my place support IPv6. I wish it did. I wish I didn't have to use its garbage hardware.

Re: Tell HN: IPv6-only still pretty much unusable

#160

Post by neilalexander » Wed, Dec 07, 2022, 5:47 PM UTC

cramjabsyn wrote: post #129

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

I feel the same way. Clearly ipv6 is very flawed and by now the community should consider it a failure and work on a viable replacement. We need an internet protocol that is backwards compatible with ipv4 and does not require deploying and maintaining entirely parallel networks, interfaces, firewalls, routing, etc. If ipv6 actually was viable, the internet would have cut over. Instead we’re on a path to support ipv4…

There is no “backwards compatible with IPv4”. If you have to modify the existing packet headers, you no longer have backward compatibility. If you change anything involving how a flow is identified (like the source/address destinations and ports) then you have broken backward compatibility. Firewalls need to understand new address formats, routers need to understand new address formats, end systems need to understand new address formats, BGP needs to be extended to support new address formats.

IPv6 is perfectly viable and it is in many ways cleaner than IPv4 is. It’s just that transition is expensive and apathy is easy.