Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

191–200 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#191

Post by dheera »

Symbiote wrote: post #188
dheera wrote: post #185

Earlier quoted context omitted.

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9

And that's the problem! Who can memorize all that?

I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to their local, non-cloud APIs to manipulate them. With IPv6 hell knows what their hex-colon monstrosities would be.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#192

Post by dheera »

voytec wrote: post #189
dheera wrote: post #185

Earlier quoted context omitted.

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

[flagged]

> are why the world is not moving forward

I'm not an IT admin, but I disagree the world is not moving forward.

If I need to use IPv6, I would switch. But the reality is people are able to still build rocket ships, electric cars, and large language models with IPv4. The world is moving forward just fine.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#193

Post by cornholio »

orcajerk wrote: post #131

There's a reason most haven't moved to ipv6. ipv6 is a solution looking for a problem. What we really need is an ipv7 that takes the best of ipv4 and ipv6 instead of trying to force ipv6 down a reluctant user group.

You can't have the best features of the two - in the sense of interoperability - because they are different on a fundamental level: it's impossible for IPv4 nodes to talk to IPv6 nodes without understanding the much larger address space.

There were proposals back in the day (early 90s) for IPng (IP Next Gen, as IPv6 was called back then) to be a hierarchical routing algorithm, that could have kept backwards compatibility with IPv4 and transparently allow seamless operation and routing of IPng islands over IPv4 infrastructure, taking full advantage of the address space expansion.

Think of a sort of CGNAT that instead of stateful hacking with port numbers and the like, would have dedicated fields in the IPv4.x packet, allowing the gateway to statelesly route between the two domains (public IPv4 internet and internal 10.x.x.x network), while maintaining end-to-end connectivity.

Alas, the ITEF guys really wanted a clean slate design and willfully ignored the economic problem, that IPv6 is only useful when everybody upgrades, and as a consequence nobody upgrades. It's probably one of the most costly failures in the history of computing, along with the NULL pointer, 640kB and the likes.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#194

Post by MagicMoonlight »

We should just make an IPv5 which takes a current address: 216.3.128.12 and makes it 0.0.0.0.216.3.128.12

So any address of the current length you just treat it as if it has zeroes in front, otherwise you use the longer length which allows for many more addresses. Problem solved.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#195

Post by Arnavion »

magicalhippo wrote: post #179
jesterpm wrote: post #122

Earlier quoted context omitted.

RA (Router Advertisement) handles announcing the prefix for SLAAC addresses and DNS.

But not other services like NTP, so DHCPv6 is still needed.

For NTP, an alternative is letting the LAN devices connect to whatever NTP server they want to, and just NAT'ing outgoing udp/123 to your NTP server.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#196

Post by kazen44 »

jcalvinowens wrote: post #150
thesuitonym wrote: post #125

Earlier quoted context omitted.

I'm not saying there's any downside, I'm just saying it's not the magic bullet "this is why you should use ipv6" that everyone seems to think it is. It's a complete non-issue that nobody really cares about.

> It's a complete non-issue that nobody really cares about. Huh. IMHO it's the single most desirable feature, and the only reason I care about it at all. If you're approaching this from the home networking point of view, than I suppose I agree: even the most complex home network is just too simple for anything like this to matter much. As the network gets bigger, that sweet sweet global routability starts to make a l…

Also, IPV6 has far more scalable systems for dynamic address allocation compared to IPv4.

SLAAC scales really, really well, and is fairly stateless compared to DHCPv4 or V6.

Also, slaac allows one to easily change the global prefix of a vm/host if it lives on another layer 3 network.

A good example of this:

you have two seperate datacenter networks based on an EVPN-VXLAN solution, and you do no want to stretch layer 2 across both datacenters because stretching layer 2 is a terrible, terrible idea[0].

Before IPv6, moving VM;s across datacenters which have different public ip space was a major pain for two reasons:

- IPV4 has no concept of using multiple addresses per interface without it having unexpected bahaviour on a host. - address management at scale is a major PITA because DHCP is not scalable.

How to solve this with IPv6? It's fairly easy:

- Use slaac + prefix delegation of your globally unique address space (which is different per Datacenter). - Use a different (site local) address to reach the VM for management purposes. Because this address is not globally routable, you are sure it will never leak into the greater internet and be reachable from the outside world. - If you are using anycast, you can easily announce this prefix to upstream BGP neighbours because you can use BGP Neighbour Autodiscovery[1].

Trying to do this with Ipv4 will result in a mess of administration, not to mention have to do some clever technical hacks to make it work on some operating systems.

With IPv6 solving these issues becomes quite manageable.

[0] https://blog.ipspace.net/2021/06/stretched-vlan-define-probl... [1] https://www.juniper.net/documentation/us/en/software/junos/b...

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#197

Post by kazen44 »

waych wrote: post #151
ianburrell wrote: post #146

Earlier quoted context omitted.

Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface. More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.

This looks like NAT pushed down to the endpoint itself. You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME. What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be…

> You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.

They have not?

The global routing table size for ipv6 at max is a /32 (if i remember correctly) every customer gets a /56 prefix to use in their network, so the routing table entry would still be the same, no matter how many addresses you use to cycle through in your /64.

ARP caches do not exist in IPv6, and Neighbour discovery does not have the same "cache" mechanism as ARP does, it uses an entirely different mechanism for neighbour discovery. (which is also far more lightweight considering it is using multicast, compared to the broadcast of ARP).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#198

Post by wyager »

soebbing wrote: post #58
wyager wrote: post #43

Earlier quoted context omitted.

Put internet of shit devices on their own VLAN(s). Almost all wifi APs today support multiple SSIDs with separate VLANs. Have your firewall block inbound connections to devices on that VLAN. Every OS firewall has built-in support for this. I spent a lot of time figuring out how to do all this in the most efficient way (in terms of my time and effort) during covid, and I suggest getting any arbitrary box with 2 ethern…

I actually thought about that for a minute when I set up my home network a while ago, but that seems to be a pretty hard (or at least inconvenient) problem. Often I need to access a device from my local network (think: use my phone to control Wi-Fi LED Strips, Sonos speakers, etc.), which makes it impossible (I guess?) to separate these devices into their own network completely (if they aren't controlled by an online…

> Or is it possible to allow access from my trusted network INTO the restricted network

Yes, my home network works exactly like this. I have a vlan called "trusted" which can connect to any other vlan. One line in pf.conf.

My VLANs are something like: trusted, guest, media, cameras, printer, etc.

Many of these aren't allowed inbound or outbound connections (e.g. cameras and printer can only talk to things on their subnet).

Only downside is that stuff that works off broadcast packets (like bonjour) does not work across subnets.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#199

Post by jlokier »

bityard wrote: post #92
waych wrote: post #81

Earlier quoted context omitted.

Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.

Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941

Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order.

Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT

(If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.)

That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#200

Post by kazen44 »

tinus_hn wrote: post #86
tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

With NAT it is impossible to make a mistake that causes machines with a private address to become reachable to the internet. That is a reality that is not going anywhere, no matter if you like it or not, no matter if you think it is stupid or not.

With Ipv6 this is even easier.

You simply do not host services you do want public on your global unicast address but use a private/site local address instead.

Post reply on HN