Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

151–160 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#151

Post by waych »

ianburrell wrote: post #146
waych wrote: post #124

Earlier quoted context omitted.

The limit of changing addresses once every N seconds as N approaches 0 is equal to offline. With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.

Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface. More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.

This looks like NAT pushed down to the endpoint itself.

You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.

What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be a ~1200X blowup in routing overheads.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#152

Post by justeleblanc »

waych wrote: post #124
justeleblanc wrote: post #119

Earlier quoted context omitted.

Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.

The limit of changing addresses once every N seconds as N approaches 0 is equal to offline. With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.

What kind of observer is 1. able to listen to the entirety of your network's outside communications, 2. interested at all in it, 3. harm you only on the condition that they "map out" your internal infrastructure? This isn't a novel, the goal is not to solve intricate security non-problems.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#153

Post by ianburrell »

ilyt wrote: post #22
screamingninja wrote: post #16

Earlier quoted context omitted.

Increased number of available IP addresses, improved security features, simplified network management, reduced network complexity, and support for new technologies. IPv6 also provides significant performance benefits for mobile networks, IoT devices, and cloud services. The adoption of IPv6 will lead to cost savings, improved network performance, and increased scalability.

[flagged]

IPv6 being more secure used to be feature back when IPsec was cool. IPv6 has better integration with IPsec. But everyone is using TLS and other more secure VPNs these days.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#154

Post by ajross »

kazen44 wrote: post #100
ajross wrote: post #65

> You should stop thinking of NAT as a security mechanism and think of it as the emergency address exhaustion prevention that it is. I hate this attitude. This is isomporphic to saying "stop thinking of system call interfaces as a security mechanism and think of them as an address space sharing mechanism". It's not technically wrong, but it's wrong in practice. Even the most naive NAT can't misroute an inbound packet…

why would NAT not be any configuration compared to Firewall rulesets? heck, they even inventend protocols to do automatic NAT setup (UPNP) because configuring NAT by hand confuses people a lot.

I'm sorry, I don't follow. Our grandparents have working, secure NAT setups that no human being needed to configure. I've never once seen a "firewall ruleset" configured by a non-geek.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#155

Post by justeleblanc »

adriancr wrote: post #145
jcalvinowens wrote: post #142

Earlier quoted context omitted.

> They can infer that an address matches to a single device No they can't: the whole point of RFC4941/8981 is to prevent that. The source address for external connections is effectively randomized. All that can be inferred is that it came from your network, but even with NAT you know that anyway.

> The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would…

You literally wrote "Once device is identified all its past traffic is discernible." How is that compatible with devices changing their address every day?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#156

Post by justeleblanc »

ajross wrote: post #154
kazen44 wrote: post #100

Earlier quoted context omitted.

why would NAT not be any configuration compared to Firewall rulesets? heck, they even inventend protocols to do automatic NAT setup (UPNP) because configuring NAT by hand confuses people a lot.

I'm sorry, I don't follow. Our grandparents have working, secure NAT setups that no human being needed to configure. I've never once seen a "firewall ruleset" configured by a non-geek.

Really? I changed ISPs the other day. Got my new modem/router. You know what I did in terms of firewalls? Nothing. You know what I have? A firewall that blocks all unknown incoming connections. Does it work? Yes. Did I even have to do anything besides plug in the box? No.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#157

Post by speedgoose »

anderiv wrote: post #17
speedgoose wrote: post #3

Why should I spend the time and energy to deal with IPv6 when disabling it fix many issues ? The listed advantages are not worth the troubles in my experience.

It's not so much that the advantages of IPv6 are all that compelling. Rather, it's more that the mechanisms put in place to deal with a nearly-exhausted IPv4 pool (NAT, and CGNAT in particular, etc.) are not great, and any opportunity to negate the need for them ought to be pursued.

But you still need these mechanisms for the time being. And personally, I do like NAT. I'm not a fan of exposing my internal networks to the internet. Having everything hidden behind a single address is neat.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#158

Post by speedgoose »

api wrote: post #19
speedgoose wrote: post #3

Why should I spend the time and energy to deal with IPv6 when disabling it fix many issues ? The listed advantages are not worth the troubles in my experience.

I've run dual stack at home and at work for years and have had no issues. You might have issues if you have really old junk that's just broken.

My current internet provider doesn't support IPv6 so I'm good. I noticed that removing the AAAA records in the DNS configurations of my domains magically fixed a lot of weird network issues reported by the users.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#159

Post by speedgoose »

screamingninja wrote: post #32
speedgoose wrote: post #3

Why should I spend the time and energy to deal with IPv6 when disabling it fix many issues ? The listed advantages are not worth the troubles in my experience.

Increased number of available IP addresses, improved security features, simplified network management, reduced network complexity, and support for new technologies. The adoption of IPv6 will lead to cost savings, improved network performance, and increased scalability. Scalability may not matter in the typical home network, but in an enterprise environment, the cost of up-keeping the network backbone is significant.

But that's in a world where IPv4 doesn't exist. But it does, so I see an increased number of available IP addresses that many people can't access, so you must keep an IPv4 stack which makes everything more complex and more expensive.

I understand the support of new technologies but IPv6 is 27 years old.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#160

Post by throw0101c »

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable.

Globally routable ≠ globally connectible.

Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, that goes along with non-global addresses:

* https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_...

Your end-user device knows its address and the address of the other connection point, and can tell the firewall to open a rule between only those two IPs:

* https://en.wikipedia.org/wiki/Port_Control_Protocol

* http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf

Further, because you don't have only one external IP, you don't have to futz around with non-default ports if you want multiple instances of the same service (e.g., Minecraft), because each instance can have its own IP.

Further, if you want certain devices to not able to get outside: (a) give them static assignments and block them at the firewall, (b) don't give them a default route so they are subnet-local, or (c) give them site-local addresses via ULA and do not set up NTPv6 translation.

Post reply on HN