Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

201–210 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#201

Post by toast0 »

dan1234 wrote: post #85
tinus_hn wrote: post #76

Earlier quoted context omitted.

You can request free IPv6 connectivity through the Hurricane Electric tunnel broker at ipv6.he.net

Thanks, I've actually looked at that in the past, but I'm not sure what their throughput is, and I'd have to configure each device individually as the router I have can't be configured for it. I think I've still got my HE IPv6 t-shirt somewhere, from when I completed their readiness quiz so years ago! Edit: I actually decided to set up a tunnel, just to see how well it worked, and it turns out my ISP supplied router…

https://route48.org/ provides 6 in 4 tunnels and wireguard is an option. Their webpage is a mess, but more info is available behind the login, IIRC. I got part way through and then decided to just use a Hurricane Electric tunnel because HE has presence at the nearest internet exchange and it was more familiar.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#202

Post by dragoncrab »

justeleblanc wrote: post #156
ajross wrote: post #154

Earlier quoted context omitted.

I'm sorry, I don't follow. Our grandparents have working, secure NAT setups that no human being needed to configure. I've never once seen a "firewall ruleset" configured by a non-geek.

Really? I changed ISPs the other day. Got my new modem/router. You know what I did in terms of firewalls? Nothing. You know what I have? A firewall that blocks all unknown incoming connections. Does it work? Yes. Did I even have to do anything besides plug in the box? No.

Happy you.

All the 3 ISPs I dealt with in Hungary in the last 10 years provided 0 firewall capability for IPv6 in their integrated router/modem.

Once you start assigning the addresses, every compatible IoT gadget you have is reachable from the public web.

In this state, IPv6 is a pure security stepback for average residential users with 0 upside.

I can't take any comment seriously who is speaking of configuring a stateful firewall in a residential environment.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#203

Post by magicalhippo »

Arnavion wrote: post #195
magicalhippo wrote: post #179

Earlier quoted context omitted.

But not other services like NTP, so DHCPv6 is still needed.

For NTP, an alternative is letting the LAN devices connect to whatever NTP server they want to, and just NAT'ing outgoing udp/123 to your NTP server.

Well yes, but that's a suboptimal hack.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#204

Post by Arnavion »

bityard wrote: post #78

Question from a (relative) IPv6 newbie that wasn't addressed in TFA: Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device. Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is…

>Since DHCPv6 is apparently frowned upon by v6 purists, and not all devices on my network support it, that leaves SLAAC.

It's not a dichotomy between DHCPv6 and SLAAC. You can hard-coded addresses too. Since it's your homelab you presumably already know all the devices that will be connected. It's what I do.

You may not even need to hard-code the prefix everywhere. Eg with systemd-networkd you can configure the device as:

    [Network]
    IPv6AcceptRA=yes
    [IPv6AcceptRA]
    Token=static:::1:2:3:4
... which will give that interface the address $prefix::1:2:3:4 based on whatever $prefix was advertised by radvd. So the only place where you'd need to hard-code $prefix is in your DNS server.

>My question then is: is there some standard for the DNS server on the router to somehow know the v6 IPs of the hosts on the network

NDP discovery (`ip -6 neigh show`) will let you know about other IPs (and corresponding MAC addresses) on the link. It won't do anything for matching them up to DNS names.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#205

Post by jonathantf2 »

mgbmtl wrote: post #38
TekMol wrote: post #21

I still think IPv6 can be safely ignored. This articles section "here are some reasons you should start using IPv6 within your own network" seems to comfirm this. None of the 6 "reasons" speak to me.

Here's an easy one for you: if you have a gigabit connection, most home routers can barely handle the load of NAT. That's why gamers push for IPv6. It's mentioned in the article but few people realize how inefficient NAT can be at gigabit and more. My ISP router could do max 800 mbps, which isn't so bad, but it degraded when we were multiple people using the link. With IPv6 it's much less of a problem, we can easily…

I have a symmetrical gig connection, ISP doesn't provide IPv6. Can route full line speed using their router, no matter if it's 1 device or 50 connected.

I don't know of a single game that supports IPv6, although some consoles might?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#206

Post by philjohn »

alyandon wrote: post #181
throw0101c wrote: post #161

Earlier quoted context omitted.

> With IPv4, it's very hit or miss […] It's also probably impossible if you're with an ISP that does CG NAT.

I've actually run into this helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo.

At that point, would a cheap VPS not work instead?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#207

Post by kube-system »

wyager wrote: post #198
soebbing wrote: post #58

Earlier quoted context omitted.

I actually thought about that for a minute when I set up my home network a while ago, but that seems to be a pretty hard (or at least inconvenient) problem. Often I need to access a device from my local network (think: use my phone to control Wi-Fi LED Strips, Sonos speakers, etc.), which makes it impossible (I guess?) to separate these devices into their own network completely (if they aren't controlled by an online…

> Or is it possible to allow access from my trusted network INTO the restricted network Yes, my home network works exactly like this. I have a vlan called "trusted" which can connect to any other vlan. One line in pf.conf. My VLANs are something like: trusted, guest, media, cameras, printer, etc. Many of these aren't allowed inbound or outbound connections (e.g. cameras and printer can only talk to things on their su…

There are mDNS repeaters that can in some cases make bonjour work across different networks. In my experience I spend more time fighting with mDNS than I do enjoying it.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#208

Post by justeleblanc »

waych wrote: post #184
justeleblanc wrote: post #152

Earlier quoted context omitted.

What kind of observer is 1. able to listen to the entirety of your network's outside communications, 2. interested at all in it, 3. harm you only on the condition that they "map out" your internal infrastructure? This isn't a novel, the goal is not to solve intricate security non-problems.

"The network is secure" is a common fallacy.

"Those who don't know what to say quote adages" is a common saying.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#209

Post by buzer »

joshspankit wrote: post #148
justeleblanc wrote: post #114

Earlier quoted context omitted.

NAT cannot be misconfigured? Really?

Not without being entirely broken. I think you might be bringing in uPnP, DNZ, and other such features. NAT itself is more basic.

One could argue that if e.g. FTP is not working behind the NAT then the NAT is misconfigured. NAT needs to aware of certain protocols so that it can modify the application layer data.

Of course, if the protocol added workaround for NAT and NAT is modifying that application layer data then it can cause another set of issues.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#210

Post by Arnavion »

dheera wrote: post #185
superkuh wrote: post #182

>There seems to be a lack of drive (judging by forum posts) to enable IPv6 on internet services by admins, either because they don’t care to, or it’s more work to manage a public IPv4 and public IPv6 presence If you run a mailserver adding ipv6 support is far more risk to your domain's mailserver reputation than it is worth. And if you're just a human person and not a megacorp that new ipv6 address, even if it it doe…

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

https://news.ycombinator.com/item?id=26615231
Post reply on HN