Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1/3 of all access to Google is now over IPv6

google.com

Post reply on HN
Print view View original

201–210 of 237 posts

Re: More than 1/3 of all access to Google is now over IPv6

#201

Post by Bnshsysjab »

jedberg wrote: post #195
Bnshsysjab wrote: post #176

Earlier quoted context omitted.

Gmail blocks my mailserver, I recently discovered it’s the lack of ipv6 that causes it.

If your mail server is in AWS, it's not ipv6 that is the problem per se. It's that google has blocked the entire AWS address space. To be fair, you shouldn't be sending email from AWS without going through SES, which has it's own address space and has specific deals for deliverability to all the big mail recipients, like gmail and hotmail.

AWS allows you to switch mail servers to a specific address range which, as far as I know, are treated nicer than the regular address space.

Please provide citations if you’re going to speak so factually.

Re: More than 1/3 of all access to Google is now over IPv6

#202

Post by bspammer »

ed25519FUUU wrote: post #194
myself248 wrote: post #179

Just turn off ipv4 for one minute every day. Next month, increase it to 2 minutes. A minor inconvenience, but a major motivator.

Punish people that don't care and have no control over whether or not their ISP supports IPv6? IPv6 affects everyday internet users exactly 0%. It's rational for them not to care about it.

To me that's more of an argument for GP's idea. Make it rational for them to care about it. Display a big "You can't visit this website because won't let you. Here's their email:"

Obviously it's not worth it for any website that matters to actually do this, but it's fun to think about.

Re: More than 1/3 of all access to Google is now over IPv6

#203

Post by Decade »

mshroyer wrote: post #183
kokx wrote: post #82

A large part of the problem with IPv6 is that most developers and SA's don't have a lot of knowledge about it. This is why everything new is still built with IPv4 in mind, instead of thinking forward to IPv6. I think we could easily blame lack of IPv6 support at cloud providers to lack of knowledge with the developers and SA's they attract. If more developers and SA's would have access to IPv6 at home, the practical…

> Unfortunately, my ISP does not support IPv6. This severely limits experimentation with it, since all experimentation is locked behind my home network. You probably know about this already, but there are free IPv6 tunnel brokers you can use to experiment. I previously used Hurricane Electric's tunnel, back before Comcast had native IPv6 support: https://www.tunnelbroker.net/

I previously used Hurricane Electric, too, but Netflix blocked it.

A more practical challenge, Hurricane Electric is a 6in4 tunnel, not layered over TCP nor UDP. Some ISP-provided residential gateway devices (AT&T) don’t support 6in4, not even if you configure your device as a “DMZ” with a public IP address. Also, I frequently find myself in situations with IPv4 NAT and no public IPv4 addresses at all.

The only free IPv6 tunnel service that supported UDP was SixXS, which shut down in 2017.

Nowadays, AT&T supports IPv6 natively, and I went through an annoying amount of effort to bypass their gateway device and control the entire /60 instead of being limited to a /64 and being limited by their NAT. https://github.com/jaysoffian/eap_proxy

Re: More than 1/3 of all access to Google is now over IPv6

#204

Post by Decade »

walton_simons wrote: post #151
georgyo wrote: post #81

Earlier quoted context omitted.

I really think IPv6 is the future but, Devices configuring without DHCP as a network administrator is really hard. There is no longer a single method to be given an IP6 address, and with the auto methods, there is no log either. Only some clients will do dhcpv6 which means you often have two different auto configuring services on a network. Similarly, to see devices on a network I now have to use neighborhood discove…

Honestly it's reassuring to read this. I do want to understand IPv6 better and I think I am slowly getting to grips with how it all fits together, but the details regularly make me feel as though I need to throw out a lot of what I think I know about networking, and rebuild my entire mental model from the ground up.

Yes, you should throw out a lot of what you know about networking.

Port scanning _should_ be difficult in IPv6. Instead, you should be using DNS and/or multicasting.

Having multiple ways to configure IP addresses _isn’t_ a problem. Modern devices have lots of RAM. They can handle having lots of IP addresses.

Because of how difficult it is to port scan IPv6, as long as you don’t manually allocate a low-entropy address to the printer, it won’t be easy to get to it. Even better, these days you can allocate a unique local address to the printer (RFC 4193, fd00::/8) and eliminate Internet access entirely. https://tools.ietf.org/html/rfc4193

Re: More than 1/3 of all access to Google is now over IPv6

#205

Post by Decade »

MayeulC wrote: post #114

I host some services at home, mainly targeted at friends and family. Some are IPv6-only, because it's much easier to manage from my side. I whish I could add an A record for these that pointed to a reserved IP address that would inform clients the service is IPv6-only. For now, I just don't put any, and browsers just display a generic error. Since some DNS don't answer with IPv6 addresses, the browser couldn't even p…

For web services, one sad way to handle it is to proxy through Cloudflare. IPv4, IPv6, DNSSEC, TLS at the cost of selling your users out to a budding monopoly.

Re: More than 1/3 of all access to Google is now over IPv6

#206

Post by dylz »

mehrdadn wrote: post #128
dijit wrote: post #121

Earlier quoted context omitted.

Exhausted NAT state tables is excessively common, evictions happen silently and the assertion that a reboot is required is for other reasons which I think are likely unrelated. Professionally I run one (two, actually) of those annoying 'always online video games' and state drops in low quality routers is the most common cause of VOIP drop. It seems like most router firmware has some kind of intelligent sensing softwa…

Thanks for sharing. While I have a hard time grasping your usage (why in the world are 3 devices opening 1.6 connections every second?), it's not really relevant as your own data shows state tables don't get exhausted, right? Your table only has 152 entries, which is quite a far cry from exhausting its 403,000 slots.

This is fairly normal and common, especially if you browse without aggressive ad blocking.

I routinely see a single ad impression make over 20-50 connections outbound, and repeatedly close and reopen or randomly open new ones for various reasons, the most common being some form of "anti ad fraud" tracking that repeatedly polls to get an average or median latency, new connections and requests firing on every mouse move, etc.

Would also be entirely unsurprised if phones that had free mobile games and equivalent were polling and sending stuff like location data every minute.

Re: More than 1/3 of all access to Google is now over IPv6

#207

Post by jedberg »

Bnshsysjab wrote: post #201
jedberg wrote: post #195

Earlier quoted context omitted.

If your mail server is in AWS, it's not ipv6 that is the problem per se. It's that google has blocked the entire AWS address space. To be fair, you shouldn't be sending email from AWS without going through SES, which has it's own address space and has specific deals for deliverability to all the big mail recipients, like gmail and hotmail.

AWS allows you to switch mail servers to a specific address range which, as far as I know, are treated nicer than the regular address space. Please provide citations if you’re going to speak so factually.

> Please provide citations if you’re going to speak so factually.

That's fair. I don't really have handy citations. I just know this stuff from working in email deliverability for a long time. I guess you can choose to believe me or not.

Re: More than 1/3 of all access to Google is now over IPv6

#208

Post by mehrdadn »

dijit wrote: post #133
mehrdadn wrote: post #132

Earlier quoted context omitted.

You're talking about the state-mismatch rate being nonzero, right? I take it as a given that that represents the router dropping states? And you're assuming that must be due to NAT slot exhaustion? If that's what you're saying, it clearly doesn't square with the 152 slots being in use currently (nor does it make sense to me otherwise, given everything I explained above). So either the states are being dropped due to…

Routers, especially cheap ones, are often equipped with weak CPUs because they aren’t designed to handle heavy processing loads. It’s not like you’re calculating physics or processing 3D animation directly on your router, right? But network address translation _can_ be a processing-heavy task. Every single packet that leaves the private network needs to be translated, and every single packet that comes in from the pu…

I'm sorry but I still don't get how any of this implies NAT table exhaustion. A few hundred entries is literally 3 orders of magnitude away from a few hundred thousand entries. I don't see the problem.

Re: More than 1/3 of all access to Google is now over IPv6

#209

Post by gvjddbnvdrbv »

Decade wrote: post #204
walton_simons wrote: post #151

Earlier quoted context omitted.

Honestly it's reassuring to read this. I do want to understand IPv6 better and I think I am slowly getting to grips with how it all fits together, but the details regularly make me feel as though I need to throw out a lot of what I think I know about networking, and rebuild my entire mental model from the ground up.

Yes, you should throw out a lot of what you know about networking. Port scanning _should_ be difficult in IPv6. Instead, you should be using DNS and/or multicasting. Having multiple ways to configure IP addresses _isn’t_ a problem. Modern devices have lots of RAM. They can handle having lots of IP addresses. Because of how difficult it is to port scan IPv6, as long as you don’t manually allocate a low-entropy address…

> Even better, these days you can allocate a unique local address to the printer (RFC 4193, fd00::/8) and eliminate Internet access entirely.

I.e. essentially what we already had with IPv4.

> Because of how difficult it is to port scan IPv6, as long as you don’t manually allocate a low-entropy address to the printer, it won’t be easy to get to it.

Security provided by 'the attackers get bored'....

Re: More than 1/3 of all access to Google is now over IPv6

#210

Post by dungdang »

Dagger2 wrote: post #152
dijit wrote: post #130

Earlier quoted context omitted.

NAT doesn't do much if anything for security at all, as soon as there's an outbound connection the internet has a port mapping back to your host. https://www.f5.com/services/resources/white-papers/the-myth-... .

You don't even need an outbound connection. If your router receives a packet with a dest IP set to one of your LAN machines, it'll be routed to that LAN machine. NAT does nothing to stop that, and thus does nothing for (this aspect of) security.

of course it does nothing to stop it, because you start your scenario after the stop has been made. you don't know the ip of the lan machine. the public machine receiving it's outbound packet doesn't either.

but here's your simple test for the home of why nat helps with security.

take a winxp machine. connect it to your lan. come back tomorrow. it's not infected.

now connect it to the wan and wait about 2 minutes. you have several viruses.

then, go back here, and tell us how despite nat protecting you from viruses, it does not.

then we'll all laugh.

you lock your door. but a guy can pick the lock. so why do you lock it?

in the real world, nat adds security. wep for wifi is enough security for your home lan. and dvd encryption works for preventing copying. just like your house key. by reducing the attack surface by 99%.

but i know i won't convince you, so stay with your opinion. but apply it also to vaccines.

Post reply on HN