Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

181–190 of 198 posts

Re: New patches allow building Linux IPv6-only

#181

Post by hulitu »

rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

> I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux

Use the source, Luke. Why not start with yourself ?

Re: New patches allow building Linux IPv6-only

#182

Post by craftkiller »

icedchai wrote: post #153
craftkiller wrote: post #76

Earlier quoted context omitted.

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. Do you ever connect your laptop to any network other than your home network? For example, public wifi hotspots, hotel wifi, tech conferences, etc? If so, you need to be running a firewall _on your laptop_ anyway because your router is no longer there…

Most public wifi has client isolation enabled for this reason. Firewall or not, you can't communicate with other clients.

Only if they're set up properly, which is quite the gamble. I was recently in a hotel and I listed all the chromecast devices throughout the entire hotel. I could see what everyone was watching and if I was a lesser person I could have controlled their TVs or changed what they were watching.

Re: New patches allow building Linux IPv6-only

#183

Post by zadikian »

lxgr wrote: post #179
zadikian wrote: post #137

Earlier quoted context omitted.

upnp should not exist. Any new router default disables it, as it should be.

Care to elaborate? Non-sophisticated users don't deserve IP reachability?

I used to have it enabled long ago. It's insecure. Random cheap devices will open up ports with upnp without the user noticing. It doesn't work that well either, cause hosts will conflict on ports. P2P applications have better ways to establish connectivity.

Re: New patches allow building Linux IPv6-only

#184

Post by zadikian »

knorker wrote: post #38
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

So run fc00::/7 addresses with IPv6 NAT. That addresses all of your concerns, and you have that option.

That would be fine if it were default. My router doesn't even have that option.

Re: New patches allow building Linux IPv6-only

#186

Post by icedchai »

craftkiller wrote: post #182
icedchai wrote: post #153

Earlier quoted context omitted.

Most public wifi has client isolation enabled for this reason. Firewall or not, you can't communicate with other clients.

Only if they're set up properly, which is quite the gamble. I was recently in a hotel and I listed all the chromecast devices throughout the entire hotel. I could see what everyone was watching and if I was a lesser person I could have controlled their TVs or changed what they were watching.

What about device like those Chromecasts which don't even have firewalls? The only real solution would be to bring your own hardware firewall / access point and connect it as a client off the hotel wifi. Who is really going to do that?

Re: New patches allow building Linux IPv6-only

#187

Post by iso1631 »

knorker wrote: post #175
iso1631 wrote: post #174

Earlier quoted context omitted.

I don't have CG Nat, I choose a proper ISP. Opening a hole in my ipv6 firewall or forwarding a port in in my ipv4 firewall is effectively the same thing, I define the policy (allow traffic arriving on $address on tcp/1234 to this server on vlan 12) and it goes live. Away from home, like I am at the moment, I vpn all my traffic back home, to work, or to a mullvad endpoint. Neither the hotel wifi nor tethering off my p…

I'm not sure where that long story is supposed to convey. Cool story, bro. > Sounds like ipv6 is a good solution for people who choose ISPs with CGNat. I mean… this is just "not even wrong". > Is it just CGNat on poor ISPs? I already said no to this. Look, like I said, you appear to be unaware of so much about everything about the Internet, running an ISP, running a service provider, corporate networks, ISP-customer…

I don't directly deal with public peering, I leave that to my colleagues, my only practical BGP knowlege is on private ASes.

Your shitty ISP doesn't give you an ipv4 access, that's fine. ipv4 address blocks cost $20 an address and are cheaper today in real terms than in 2016, and have been coming down in nominal terms for years.

ipv6 makes sense at a global scale, it still makes no sense for many individuals with a good ISP, mainly because of how it was implemented, too much stuff still relies on ipv4. If you have to also run ipv4 then why run ipv6.

I have no services I use that are ipv6 only

I have services that are ipv4 only, so I have to run a 6:4 nat

I want a stateful firewall because it's not 1999

I want to handoff to multiple consumer ISPs, using PBR, not running BGP, so I need to use NAT66 (changing IPs isn't good enough, I want to round-robin based on various rules, send traffic to dropbox via one ISP, send udp via another, etc)

I have software which doesn't work on ipv6 on a client, so I have to run CLAT on the device

But not all my local devices can run CLAT, I thus have to run dual stack to use ipv6 successfully.

Thus as I'm running ipv4 anyway, and running NAT, there is no benefit over running ipv4 only. IPV6 adds more things to go wrong (NAT64/DNS64), but offers no benefits.

Even without the ipv6 client requirement I still need to run both NAT64 and NAT66. I have an ipv6 only network at home which I put phones on. It works, but there's no benefit other than keeping awareness of ipv6.

Now sure, the reason that ipv4 addresses are cheap is because other people are moving to ipv6 (especially mobile), and relying on 464 gateways, with 46 in their CPE and 64 on the ISP level. That's great.

But that doesn't change the equation for someone with a choice of ISPs, as they can choose an ISP which provides them with static ipv4 addresses.

Re: New patches allow building Linux IPv6-only

#188

Post by traderj0e »

Dagger2 wrote: post #169
traderj0e wrote: post #154

Earlier quoted context omitted.

Another way to do ipv6 without government intervention is to make it 1. actually what people want, just v4 with more bits 2. have a reasonable migration path from v4. They made something overcomplicated that disregards all existing users, and now they act like this was the only possible way to avoid address exhaustion and it's everyone's obligation to switch. Even if the govt successfully forced v6, it'd be a downgra…

v6 mostly is just v4 with more bits, and it has a reasonable migration path from v4 too. I don't think a more reasonable migration path is even possible given the constraints of v4. About the only thing new in v6 that's not already in v4 is SLAAC, which isn't very complicated. Routing works the same, the addresses work the same, DNS, TCP, firewalling etc all work the same. If anything they removed complexity by dropp…

The biggest thing is all the v4 addresses are no longer valid in v6. They had a choice and went with making a separate parallel network with new routes. This means DNS DHCP etc work similarly but are completely different, and the separation between DNS v4 and v6 of course is never clear in any router UI, network config file, etc. And the routes themselves are different.

SLAAC itself isn't complicated, but it means introducing multiple kinds of addresses, which is complicated. Privacy addresses were the latest thing. The history of this has left the defaults in a wacky state, like I got a new router and idk what to expect if I enable v6 on it. Even disabled v6 on my laptop cause idk what it'll do when I join someone else's network. Default should've just been DHCP+NAT from the start, not a loaded gun aimed at foot.

And SLAAC means random addresses that are human-unreadable. "Just use DNS" but nah, nobody will do that.

Re: New patches allow building Linux IPv6-only

#189

Post by zadikian »

guntars wrote: post #165
zadikian wrote: post #139

Earlier quoted context omitted.

I never have to debug why my dhcp server isn't handing out ipv4 addresses or deal with conflicts, but if I did, it'd break mdns too. mdns is an extra moving part to deal with.

By debugging I mean just checking if you have not blocked broadcast packets at the firewall or some similar misconfiguration. I doubt it’s actual bugs when it doesn’t work. On your second point, it’s actually more resilient than DHCP because it works with IPv6 too.

Idk, just checked my LAN-connected Mac's arp tables now and none of the hostnames are there, even after I ping the multicast. Haven't messed with any settings.

Re: New patches allow building Linux IPv6-only

#190

Post by zadikian »

vel0city wrote: post #160
zadikian wrote: post #139

Earlier quoted context omitted.

I never have to debug why my dhcp server isn't handing out ipv4 addresses or deal with conflicts, but if I did, it'd break mdns too. mdns is an extra moving part to deal with.

I've had numerous issues with dhcp servers over the years and clients not understanding their responses. Acting like they never have issues is just burying your head in the sand. mDNS often works just fine on most common OSes, if you don't explicitly block them.

Default home router out of the box is not going to have DHCP issues. Custom config or bigger network, sure, I've dealt with it too.
Post reply on HN