Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#171

Post by throw0101a »

jedberg wrote: post #143
rnhmjoj wrote: post #111

Earlier quoted context omitted.

But IPv4+ is incompatible, so it requires to maintain two network stacks until reasonably everything has moved over to it. You need to duplicate the configuration for DNS, routing, firewalls etc., exactly as for dual stack IPv6. I don't really see a difference.

Imagine I own a company and I already have a bunch of IP4. I upgrade my network equipment to IP4+, and then keep all my routing and firewall configs. Everything just works the same as before. Now I want to access IP4+, so I add a route entry for all the IPs above 255.255.255.255. In fact, if that entry is just "send everything to my upstream" it might already work! Now I want to add some new resources but I'm out of…

> Imagine I own a company and I already have a bunch of IP4. I upgrade my network equipment to IP4+, and then keep all my routing and firewall configs. Everything just works the same as before. Now I want to access IP4+, so I add a route entry for all the IPs above 255.255.255.255.

It does not. Because 255.255.255.255 only covers 32 bits and "IP4+" is >32 bits. You'd still have to touch every rule to to tweak the mask.

Oh, and your IP4+ idea already exists:

> Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For example, ::ffff:192.0.2.128 represents the IPv4 address 192.0.2.128. A previous format, called "IPv4-compatible IPv6 address", was ::192.0.2.128; however, this method is deprecated.[61]

* https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresse...

* https://datatracker.ietf.org/doc/html/rfc4291#section-2-5-5

You still need to upgrade bit of networking kit between the source and destination to understand "IP4+", and this (lack of) upgrading and enabling is what is hampering deployment.

What makes you think that companies would have been willing to make the effort to deploy "IP4+" any more than IPv6?

Re: Tell HN: IPv6-only still pretty much unusable

#172

Post by tjoff »

noipv6 wrote: post #139
tjoff wrote: post #78

Earlier quoted context omitted.

That is a very one-sided view of adoption. It ties directly with the rise of mobile and internet in areas that wasn't able to grab IPv4 addresses in time. Such as India. Not sure what France is doing though, maybe something right. So, from my perspective (which obviously is tied to my location) is that all computers have IPv4 (haven't heard (and I've asked) of a single consumer ISP that offers IPv6) but all mobile ph…

okay - how about a few other angles? https://stats.labs.apnic.net/ipv6/ - per-country, and within a country, per-asn eyeball statistics, collected from online ads - not just mobile! https://www.facebook.com/ipv6/?tab=ipv6_country - per-country, albeit with a mobile-heavier bias (as you hint) https://www.akamai.com/internet-station/cyber-attacks/state-... - collected from their content delivery network - tends to show…

Neat, very different results. But still looking at it from the wrong direction?

That is, ipv6 for clients. But I'm more interested in servers, because that is what would affect me if I don't have IPv4. Such as the experiences described by OP in this thread.

Re: Tell HN: IPv6-only still pretty much unusable

#174

Post by derefr »

devnullbrain wrote: post #123
gertrunde wrote: post #108

Earlier quoted context omitted.

No.... Absolutely no... NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. And how is "You have to think about which ports you want the NAT gateway to forward." any different from thinking about firewall rules? And most consumer CPE devices (i.e. 'router' etc) are perfectly capable of running a firewall, and often do. And any firewall that doesn't drop i…

>NAT is absolutely not in any way a substitute for an actual firewall, despite the side effect of 'blocking' ports. This is one of those infosec tenets that is technically true but functionally unhelpful. Like correct-horse-battery-stable debates. The claim is that IPv4 + NAT + bad firewall is better than IPv6 + bad firewall. Yes, both are insufficient and inferior to a good firewall - but how confident are you that…

What makes you think that, for critical systems, "IPv4 + NAT + bad firewall" is the default IPv4 deployment paradigm, rather than "IPV4 + bad firewall"?

Sure, big IaaS providers like AWS put you in a VPC by default. But most servers on the net are not hosted in an IaaS; they're hosted using a VPS or bare-metal hosting provider, or just coloed in a DC by their owner. And in all those cases, what that kind of deployment gets you, is a public IPv4 per VM/machine, that anyone on the Internet can march right up and talk to, where it's the responsibility of the machine itself to reject incoming packets (i.e. at the OS level with a kernel firewall.)

NAT on IPv4 is only really a default assumption for residential networks. Anywhere else, it's pretty much like the movie WarGames: even the mainframe has a phone number you can call. Staying on IPv4 isn't making anyone safe.

Re: Tell HN: IPv6-only still pretty much unusable

#175

Post by trey-jones »

The furthest I ever got was creating firewall rules for ipv6 that mostly corresponded to our ipv4 rules. These were never used, but they were tested and ready. This was around "ipv6 day" (2014? 2015?) I've thought about it on and off since then and wondered whether I should be doing more with ipv6, but haven't actually taken any action in that direction.

I wonder if there's a relatively simple solution to at least most of the OPs list, all having to do with outgoing ipv6 requests, which would be proxying such (or all) requests through another computer on the network that has both ipv4 and ipv6 interfaces. Maybe that is an oversimplification.

Anyway, ipv4 definitely has a problem, and something is going to have to be done eventually.

Edit regarding World IPv6 day. I must be thinking of June 6, 2012: "This time, it's for real."

Re: Tell HN: IPv6-only still pretty much unusable

#176

Post by sp332 »

tjoff wrote: post #78
arcade79 wrote: post #31

I was thinking about ipv6 the other day. I concluded in my head that adoption was just around 5-10%. Luckily I went to verify that with statistics. https://www.google.com/intl/en/ipv6/statistics.html While price of ipv4 addresses are increasing, the world has slowly been adopting ipv6. From the graph above, I'd say we cross over 50% in about 2-3 years time. At some point the "dash" to adopt ipv6 starts, and brave fol…

That is a very one-sided view of adoption. It ties directly with the rise of mobile and internet in areas that wasn't able to grab IPv4 addresses in time. Such as India. Not sure what France is doing though, maybe something right. So, from my perspective (which obviously is tied to my location) is that all computers have IPv4 (haven't heard (and I've asked) of a single consumer ISP that offers IPv6) but all mobile ph…

Comcast added IPv6 ages ago. Time Warner and AT&T (FTTH, not just mobile internet) support it now as well.

Re: Tell HN: IPv6-only still pretty much unusable

#177

Post by throw0101a »

patrakov wrote: post #149
blablabla123 wrote: post #85

Earlier quoted context omitted.

It provides a lot of improvements actually. Stating the obvious, NAT isn't needed anymore. Also with modern Firewalls rules need to be written only once. At this point I'm just surprised why it's not adopted

> NAT isn't needed anymore. False. The most obvious case is multi-homing (for redundancy, fail-over, and policy-routing reasons) without an AS available and thus without BGP. In other words, a typical case when a user has a fiber connection and LTE as a backup. Then it is the router who should pick the correct source address, according to the link which is up. Another reason is to deal with dynamic addressing from th…

>> * NAT isn't needed anymore.*

> False.

"IPv6 Multihoming without Network Address Translation"

   Network Address and Port Translation (NAPT) works well for conserving
   global addresses and addressing multihoming requirements because an
   IPv4 NAPT router implements three functions: source address
   selection, next-hop resolution, and (optionally) DNS resolution.  For
   IPv6 hosts, one approach could be the use of IPv6-to-IPv6 Network
   Prefix Translation (NPTv6).  However, NAT and NPTv6 should be
   avoided, if at all possible, to permit transparent end-to-end
   connectivity.  In this document, we analyze the use cases of
   multihoming.  We also describe functional requirements and possible
   solutions for multihoming without the use of NAT in IPv6 for hosts
   and small IPv6 networks that would otherwise be unable to meet
   minimum IPv6-allocation criteria.  We conclude that DHCPv6-based
   solutions are suitable to solve the multihoming issues described in
   this document, but NPTv6 may be required as an intermediate solution.
* https://datatracker.ietf.org/doc/html/rfc7157

Re: Tell HN: IPv6-only still pretty much unusable

#178

Post by cj »

yesco wrote: post #122
justin_oaks wrote: post #14

Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more complicated than IPv4, but maybe that's just because I'm just not familiar with it. Are there any good resources on setting up IPv6 support from first principles? I still get confused as to the "right" way to set up internal networks for IPv6, especially when DHC…

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…

I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network.

Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets?

There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in ipv4 world, you know that server is truly unreachable via public internet)

Re: Tell HN: IPv6-only still pretty much unusable

#179

Post by tjoff »

yesco wrote: post #136
tjoff wrote: post #109

Earlier quoted context omitted.

So I have to manually configure every device to be able to use internet? Every friends phone that wants to connect to my wifi needs manual setup? That is a problem. To which the solution is IPv4?

Why do you think this? What led you to assuming these things? You would only need to configure any of this if you want to allow external connections, which isn't much different than setting up port forwarding with IPv4 + NAT, except with IPv6 it's less complicated.

Literally the post I answered.

Fact: SLAAC does not do DNS. So, my question then is: how do you do DNS?

Answer: "The SLAAC should not change after the host has generated it during installation / first connection, as long as you don't reinstall the OS etc."

Since SLAAC does not do DNS that answer implies that you'd enter it during connection/installation to complete the config.

Re: Tell HN: IPv6-only still pretty much unusable

#180

Post by notdonspaulding »

_8j50 wrote: post #141

My take is that they should have used alphanumeric addressing. You could have addresses like company:office:laptop and it shouldn't have reinvented arp and dhcp or added more complex routing like anycast or link local. It tried to solve too many problems at once.

How would alphanumeric addressing help anything?

You currently have an address hierarchy like :::. That hierarchy is conveniently conveyed in a single 128 bit number. With an alphanumeric address, 128 bits of ASCII would get you `company:office:l` and your net/subnet/host would require more CPU horsepower to compute.

Post reply on HN