Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

161–170 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#161

Post by throw0101c »

lxgr wrote: post #57
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> Everything on my network is going to go through my firewall anyway. Yes, and that's a very reasonable configuration. But UDP hole punching (very widely used for VoIP, online gaming etc.) works orders of magnitude better with IPv6 than with IPv4, since there is no address and port translation to worry about. With IPv4, it's very hit or miss, since it depends on both sides' NATs and also requires additional infrastru…

> With IPv4, it's very hit or miss […]

It's also probably impossible if you're with an ISP that does CG NAT.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#162

Post by throw0101c »

adriancr wrote: post #145
jcalvinowens wrote: post #142

Earlier quoted context omitted.

> They can infer that an address matches to a single device No they can't: the whole point of RFC4941/8981 is to prevent that. The source address for external connections is effectively randomized. All that can be inferred is that it came from your network, but even with NAT you know that anyway.

> The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would…

> Each day the address will likely change but new address is still unique to the device (otherwise how would routing work).

If you set up your device to spin up a new IPv6 address every hour (or even every minute), how will they track you using IPs?

On macOS it's 24h, but it doesn't have to be:

    $ sysctl -a | grep temppltime              
    net.inet6.ip6.temppltime: 86400

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#163

Post by adriancr »

justeleblanc wrote: post #155
adriancr wrote: post #145

Earlier quoted context omitted.

> The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would…

You literally wrote "Once device is identified all its past traffic is discernible." How is that compatible with devices changing their address every day?

you identify device each day, identity is X, daughter of Y on iPad. Once identified via data broker all its traffic is identifiable including torrents for example and porn websites, etc (say X goes to facebook with new address it now has real name)

Once identity is known for address X you know its traffic for the day, including past traffic for the day.

once address changes you do the whole identification again.

All these logs where address is identified goes to bucket X.

On addresses where you couldnt identify that day you put them in unknown bucket.

Once you have a profile of the network, you can do exclusion (Only 4 people in household, 3 active with known addresses, not X, one unknown address, you can assume its X)

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#164

Post by throw0101c »

bityard wrote: post #78

Question from a (relative) IPv6 newbie that wasn't addressed in TFA: Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device. Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is…

> Since DHCPv6 is apparently frowned upon by v6 purists, and not all devices on my network support it, that leaves SLAAC.

The main hold out against DHCPv6 is Android:

* https://issuetracker.google.com/issues/36949085

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#165

Post by adriancr »

throw0101c wrote: post #162
adriancr wrote: post #145

Earlier quoted context omitted.

> The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would…

> Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). If you set up your device to spin up a new IPv6 address every hour (or even every minute), how will they track you using IPs? On macOS it's 24h, but it doesn't have to be: $ sysctl -a | grep temppltime net.inet6.ip6.temppltime: 86400

I mean, it's the same point, single address to single node, just more often, so need to identify more often.

Minutes or less I guess would defeat tracking, but then what's the point?, it's almost equivalent to NAT it still breaks reverse connectivity? and does it actually work?

It also feels like a workaround for an oversight.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#166

Post by p1mrx »

bittermandel wrote: post #11

Is there any risks of nodes assigning same IP if there's no central DHCP?

You can generate sqrt(2^64) random suffixes before the probability of collision becomes significant. That number is in the billions for a single /64 network.

In other words, no.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#167

Post by tenebrisalietum »

tinus_hn wrote: post #86
tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

With NAT it is impossible to make a mistake that causes machines with a private address to become reachable to the internet. That is a reality that is not going anywhere, no matter if you like it or not, no matter if you think it is stupid or not.

UPnP?

Also STUN makes your private addresses reachable without you making any mistake at all.

Your comment is a good example of the NAT cargo cult mentality that is damaging to the Internet.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#168

Post by cassianoleal »

Asooka wrote: post #126
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

Also I'm not going to expect my ISP to actually give me more than one address, so if I have multiple devices at home, I will need to do NAT. Heck, back in the day they used to set TTL to 1 so the packets weren't routable at all without mangling them via iptables. Maybe that will be harder now than 20 years ago since everything connects online...

ISPs are expected to delegate a /56 or /64 prefix to customers. Some are even delegating /48s. Mine delegates a /56.

That should be enough for all your devices to randomly rotate IPs for a lifetime or a few without any NAT.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#169

Post by ectospheno »

bityard wrote: post #78

Question from a (relative) IPv6 newbie that wasn't addressed in TFA: Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device. Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is…

If I want to connect to something by name then I setup a wireguard connection with a fixed ip. The few things that don’t allow for that all use mdns anyway.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#170

Post by labcomputer »

soebbing wrote: post #58
wyager wrote: post #43

Earlier quoted context omitted.

Put internet of shit devices on their own VLAN(s). Almost all wifi APs today support multiple SSIDs with separate VLANs. Have your firewall block inbound connections to devices on that VLAN. Every OS firewall has built-in support for this. I spent a lot of time figuring out how to do all this in the most efficient way (in terms of my time and effort) during covid, and I suggest getting any arbitrary box with 2 ethern…

I actually thought about that for a minute when I set up my home network a while ago, but that seems to be a pretty hard (or at least inconvenient) problem. Often I need to access a device from my local network (think: use my phone to control Wi-Fi LED Strips, Sonos speakers, etc.), which makes it impossible (I guess?) to separate these devices into their own network completely (if they aren't controlled by an online…

Each of the VLAN is (or can be) just another network from the router’s and firewall’s perspective. So you just have to set up appropriate firewall rules to allow traffic between the networks that you want to communicate.

You could, for example, allow only TCP traffic initiated by hosts in the “normal” VLAN to hosts the IoT VLAN. So IoT stuff can’t initiate outgoing connections to any other network, and can only receive TCP connections from one network.

You can also set up an MDNS reflector on your router if your IoT devices use that (e.g. HomeKit) to send data proactively back to “normal network” hosts.

Post reply on HN