Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 Support for EC2 Instances in Virtual Private Clouds

aws.amazon.com

Post reply on HN
Print view View original

21–30 of 114 posts

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#21

Post by openasocket »

chipperyman573 wrote: post #18
Dobbs wrote: post #11

Earlier quoted context omitted.

This honestly doesn't surprise me. Adding an infinite number of IPs is one way bot writers get around rate limits. I've done it before when I worked for a company that made a facebook/myspace/etc crawler.

Out of curiosity, why does Amazon consider it their responsibility to prevent that? I'm personally glad that they do, but bots use resources, which is good for Amazon (money in their pocket), and as far as I know Amazon doesn't have anything it wants to protect from bots (at least, anything that would be heavily limited by IP).

From a rational self-interest standpoint, bots tend to get their IP addresses blocked by whoever they're targeting. Which means the Amazon IP address space gets on threat lists and block lists. The bot owners can just generate new instances with new IP addresses, and then some legitimate customer spins up an instance and gets their address, and wind up on blocked. The bots keep going until various services decide to just block all of Amazon's space, the same way they would for Tor exit nodes or other things associated with shady activity.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#22

Post by magila »

Dobbs wrote: post #11
fidget wrote: post #10

8 IPs per instance, max :/

This honestly doesn't surprise me. Adding an infinite number of IPs is one way bot writers get around rate limits. I've done it before when I worked for a company that made a facebook/myspace/etc crawler.

Per IP rate limiting with IPv6 is a futile gesture against any attacker more sophisticated than a kid in his parent's basement. It doesn't take much effort to get a /48 while most ISPs are handing out /64s to their customers. This leaves rate limiters in a catch 22: Are all those requests coming from a given /48 a single attacker, or a bunch of Comcast users? It's impossible to tell without maintaining a table of what the "end user" allocation size is for a particular IP range, which would be a massive, never-ending task.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#23

Post by josho »

Is there a succinct developer/administrators guide to IPv6?

I recently discovered my home IP is ipv6 and have started to realize that it is more than just a larger address range. e.g. arp is replaced with ndp. While I haven't yet found a guide that has more depth than the very basics, but isn't a full on Cisco manual.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#24

Post by axyjo »

josho wrote: post #23

Is there a succinct developer/administrators guide to IPv6? I recently discovered my home IP is ipv6 and have started to realize that it is more than just a larger address range. e.g. arp is replaced with ndp. While I haven't yet found a guide that has more depth than the very basics, but isn't a full on Cisco manual.

HE's IPv6 training guide is pretty good -- https://ipv6.he.net/certification/

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#25

Post by toomuchtodo »

zonknz wrote: post #14
bjeanes wrote: post #12

Earlier quoted context omitted.

The biggest advantage I see (which is heavily coloured by the use cases I faced at Heroku on the Add-ons team) is being able to peer many VPCs without gymnastics to avoid IP range clashes and routing issues. I haven't looked at AWS' IVv6 announcement in enough detail to know if it addresses this head on, but I always looked forward to IPv6 as an avenue to making that kind of work much more straight forward.

But if the peering limit is still 50 vpcs - I guess it might help if/when inter-region peering ships

Don't plan on inter-region peering ever shipping. Easy to do in network fabric at a region, not so easy to do across regions (constrained by fiber connectivity).

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#26

Post by openasocket »

fidget wrote: post #10

8 IPs per instance, max :/

Might be a dumb question, but why would you want or need more than one IP address for an instance? It's not like more addresses will let you download/upload things faster. Maybe if you want to run multiple web servers on port 80 and give each one a different IP address, but how often do people do that, especially more than 8 times over?

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#27

Post by derefr »

openasocket wrote: post #26
fidget wrote: post #10

8 IPs per instance, max :/

Might be a dumb question, but why would you want or need more than one IP address for an instance? It's not like more addresses will let you download/upload things faster. Maybe if you want to run multiple web servers on port 80 and give each one a different IP address, but how often do people do that, especially more than 8 times over?

Picture running something like Docker on a box, where each container gets its own IPv6 address—with services on their proper ports—instead of mashing a bunch of NATed ports together under the host's IP.

Or, moreover (and this is a bit of a pipe-dream, but it's something I've been hacking on to make possible) picture running something like an Erlang node on a box, where each Erlang process gets its own IPv6 address, fully Internet-routable. This effectively makes Erlang into an SDN vswitch for ephemeral, featherweight virtual machines (which would be oddly similar to AWS's just-announced "Lambda@Edge".)

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#28

Post by kstrauser »

openasocket wrote: post #26
fidget wrote: post #10

8 IPs per instance, max :/

Might be a dumb question, but why would you want or need more than one IP address for an instance? It's not like more addresses will let you download/upload things faster. Maybe if you want to run multiple web servers on port 80 and give each one a different IP address, but how often do people do that, especially more than 8 times over?

You'd more likely want them for outbound connections. On modern OSes, the IPv6 stack periodically calculates a new IP (see https://tools.ietf.org/html/rfc4941). Think of it as a kind of one-time-use address, so remote machines can't say "hey, I got a download request from this IP last week. I should try to hack it today!"

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#29

Post by rajivm »

openasocket wrote: post #26
fidget wrote: post #10

8 IPs per instance, max :/

Might be a dumb question, but why would you want or need more than one IP address for an instance? It's not like more addresses will let you download/upload things faster. Maybe if you want to run multiple web servers on port 80 and give each one a different IP address, but how often do people do that, especially more than 8 times over?

When you're running services in containers on the machine and want to have them be directly networkable without another overlay network.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#30

Post by toomuchtodo »

chipperyman573 wrote: post #18
Dobbs wrote: post #11

Earlier quoted context omitted.

This honestly doesn't surprise me. Adding an infinite number of IPs is one way bot writers get around rate limits. I've done it before when I worked for a company that made a facebook/myspace/etc crawler.

Out of curiosity, why does Amazon consider it their responsibility to prevent that? I'm personally glad that they do, but bots use resources, which is good for Amazon (money in their pocket), and as far as I know Amazon doesn't have anything it wants to protect from bots (at least, anything that would be heavily limited by IP).

As a good netizen, you want to ensure that other providers don't blackhole your IP blocks (which they will if you allow abuse to be emitted from said IP blocks).
Post reply on HN