Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS adds an extra 5.5M IPv4 addresses

github.com

Post reply on HN
Print view View original

201–210 of 283 posts

Re: AWS adds an extra 5.5M IPv4 addresses

#201

Post by [deleted] »

niij wrote: post #160
School-Cotton wrote: post #153

Earlier quoted context omitted.

> Most internet users at home could have their IPv4 address removed and only provided an IPv6 one. > Mobile internet is commonly served only by IPv6. These aren’t true. There are still some big consumer-facing sites that are IPv4 only — notably twitter.com and amazon.com. I can definitely still access both from my mobile device.

My understanding is that there is some sort of translation taking place with 6to4, NAT64, ??? So while amazon.com may not have AAAA records/ipv6 it is still reachable by properly configured ipv6 clients with some sort of middleman to translate.

[deleted]

Re: AWS adds an extra 5.5M IPv4 addresses

#202

Post by lazide »

innocenat wrote: post #138
athrowaway3z wrote: post #132

Earlier quoted context omitted.

Yesterday i spend 2 hours trying to figure out why i couldn't ping my home router, only to find out this is probably the reason. Luckily i had created a reverse ssh tunnel on a vps before leaving.

ISP blocking ICMP might be a more probable reason than CGNAT. At least where I live.

It’s hard to tell sometimes what is going on. I just learned for instance that the cable modem provided by Comcast switched to NAT - and my router is also doing NAT - and my business firewall also does NAT. So at least 3 layers now.

If they are doing CGNAT further into the infrastructure, how would I even be able to tell at this point? I’m assuming someone would also block ICMP just so it would be less embarrassing, but who knows.

Comcast does generally seem to be moving towards IPv6 at least, which is helpful.

Re: AWS adds an extra 5.5M IPv4 addresses

#203

Post by vmception »

toxik wrote: post #124
xvilka wrote: post #117

Earlier quoted context omitted.

Some countries did exactly that, China for example. Most of the infrastructure, ISP networks, even user applications here is now IPv6 or ought to be in a few years [1]. [1] https://www.theregister.com/2021/07/26/china_single_stack_ip...

To be fair, this is exactly the type of thing you’d expect China to be good at, unilateral decision making.

Benevolent leader is the best case of government, it is just improbable and of course it is too risky for any dissenter, and the successor is never as good. So people go for inclusive forms of government, which produces average case results more often.

Re: AWS adds an extra 5.5M IPv4 addresses

#204

Post by p1mrx »

indigodaddy wrote: post #96
jgrahamc wrote: post #70

Earlier quoted context omitted.

We do default IPv6 on. https://blog.cloudflare.com/always-on-ipv6/ And the chart in that blog shows the dent we made.

This will show my lack of ipv6 knowledge but I’ll ask anyway. Say I have an endpoint service somewhere listening only on ipv6. Let’s take any sort of CDN out of the equation for simplicity. Can I use Cloudflare DNS for the service, such that anyone using ipv6 will connect directly to my service, of course— but can CF do some magic ipv4->ipv6 translation/bridge sort of thing, so that someone on ipv4-only will also be…

Cloudflare makes a website dual-stack from the user's perspective, regardless of whether the server is IPv4-only or IPv6-only.

Typically, both the A and AAAA records point to the same Cloudflare proxy, because serving IPv4 and IPv6 via different infrastructure requires a lot of care to avoid subtle brokenness.

Re: AWS adds an extra 5.5M IPv4 addresses

#205

Post by icedchai »

rafaelm wrote: post #182
icedchai wrote: post #150

Earlier quoted context omitted.

I own a /24, personally. It was registered in the early 90’s. I have it routed to my home network.

Out of curiosity, how much does it cost for you to run this? Not that I'm willing to pay $10k for my own /24, but I find this super interesting. I just installed a new FTTH ISP at home and learned the hard way what CG-NAT is, after years of having my own public IP with my previous ISP.

The /24 itself doesn’t cost me anything. I registered it before ARIN existed and it’s considered a “legacy” block. No fees cause I never signed their registration agreement.

I pay about $180/month for a “business internet” cable line. 300 megabits down, 25 up. I also “know a guy” at the ISP who made sure the routing wasn’t going to be an issue.

Re: AWS adds an extra 5.5M IPv4 addresses

#206

Post by technofiend »

wu_187 wrote: post #110
korethr wrote: post #2

low whistle I imagine they paid a pretty penny for those /12s. A thought comes to me: If IPv6 adoption continues to drag along, and AWS/Azure/GCP continue to expand their IP blocks like this, how quickly are we in danger of the cloud providers effectively being the Internet?

I've worked in the cloud hosting industry for a decade and a half. The entire time, we were warned about the IPv4 shortage and how we needed to switch to IPv6 soon(tm). Well, things haven't changed. Everyone is dragging their feet on IPv6 adoption from hosting providers, ISPs, hardware manufacturers, and software developers. I predicted this years ago and always said that it would require a government mandate to move…

I just don't get it. We already have regular hygiene programs to remediate legacy stuff - remove weak encryption methods, scan for CVEs and patch old versions, etc. IPV6 isn't any harder to use than IPV4 except for storing a larger IP address. Really, there's no excuse and that goes double for anyone using a modern stack instead of legacy.

Re: AWS adds an extra 5.5M IPv4 addresses

#207

Post by dekhn »

wu_187 wrote: post #110
korethr wrote: post #2

low whistle I imagine they paid a pretty penny for those /12s. A thought comes to me: If IPv6 adoption continues to drag along, and AWS/Azure/GCP continue to expand their IP blocks like this, how quickly are we in danger of the cloud providers effectively being the Internet?

I've worked in the cloud hosting industry for a decade and a half. The entire time, we were warned about the IPv4 shortage and how we needed to switch to IPv6 soon(tm). Well, things haven't changed. Everyone is dragging their feet on IPv6 adoption from hosting providers, ISPs, hardware manufacturers, and software developers. I predicted this years ago and always said that it would require a government mandate to move…

I spent some time trying to upgrade my home network to primarily-IPv6 (mainly so I could more easily address internal computers from the outside). I was pretty unimpressed with the results; I expect to have to run dual stack for the foreseeable future.

Re: AWS adds an extra 5.5M IPv4 addresses

#208

Post by IcePic »

korethr wrote: post #2

low whistle I imagine they paid a pretty penny for those /12s. A thought comes to me: If IPv6 adoption continues to drag along, and AWS/Azure/GCP continue to expand their IP blocks like this, how quickly are we in danger of the cloud providers effectively being the Internet?

Of course that is how it will end. Noone thinks that this is a bad idea, to only allow customers of those three to host a service, because that is the current mindset. When they own all the v4 ips, we will have no choice but to hot on their infra or not host at all.

At that time, someone might think that IPv6 with all its faults might have been a good idea after all, but then it will be too late, since "v4 seems to work, all clients behind 2-3-4 layers of NAT, everything tunneled in HTTP/4.5 on a single port outwards to your VPS/VPN".

Not being able to host a game on your home computer, not being able to start a service unless GCP/Azure/AWS allows you to will be the end of the internet as we used to know it. Extra fun for anyone not being american enough to want to be a customer of the big three.

Re: AWS adds an extra 5.5M IPv4 addresses

#209

Post by t0mas88 »

kazen44 wrote: post #175
t0mas88 wrote: post #77

Earlier quoted context omitted.

"We don't have the ability to determine a specific subscriber based on the information provided" and close the request.

this is not how most of these laws works. As an ISP, you are required to have this bookkeeping, and are audited for it in (most) countries. Usually, the law has specific procedures about how this information is requested, what responsibilities are with which party, and how long the response time should be for suchs a request. When starting (or already being an ISP). You already know what kind of system you need to bu…

In my European country the law very specifically tells ISPs what to record. It doesn't require them to produce any conclusions or other data, so if you ask for a subscriber name without enough details (port and destination in this example) the response I gave is totally legal. I have in fact seen that kind of thing happen and compliance departments tend to favor exactly this, do what the letter of the law said, not a byte more unless a court orders them. The risk otherwise is that you're illegally violating the privacy of a customer just to please some law enforcement agency.

As a follow-up the agency, with the right court order, could get all the raw connection records and try to figure it out themselves. But if you don't know the exact time and (source IP, port, destination IP, port) combination you're not going to figure it out in a network with large scale NAT.

Re: AWS adds an extra 5.5M IPv4 addresses

#210

Post by innocenat »

lazide wrote: post #202
innocenat wrote: post #138

Earlier quoted context omitted.

ISP blocking ICMP might be a more probable reason than CGNAT. At least where I live.

It’s hard to tell sometimes what is going on. I just learned for instance that the cable modem provided by Comcast switched to NAT - and my router is also doing NAT - and my business firewall also does NAT. So at least 3 layers now. If they are doing CGNAT further into the infrastructure, how would I even be able to tell at this point? I’m assuming someone would also block ICMP just so it would be less embarrassing,…

> If they are doing CGNAT further into the infrastructure, how would I even be able to tell at this point?

Check the IP on your WAN interface of your modem? I mean, that's how I have always been checking for CGNAT.

Post reply on HN