Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#211

Post by crest »

spookthesunset wrote: post #81
redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward. With IPv6 the entire network is reachable outside by default. Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. R…

> It’s the firewall rules that always creep me out. The nice thing about NAT is open ports on your internal network are hidden to the outside world by default. You have to think about which ports you want the NAT gateway to forward.

Have you never had more than a handful of IPv4 addresses? IPv6 works the same in this regard as a router IPv4 network e.g. universities, large/old enterprises etc. NAT started as a workaround to make the available public address space last longer.

The address (and port) translation wasn't intended as a security feature on its own. These days lots of protocols automatically deal with NAT and mostly manage to establish bidirectional communication over UDP or TCP through NATs. I rather deal with stateful firewalls and public IPv6 addresses end to end instead of gluing the segments of flows between IPv4 translators back together.

Re: Tell HN: IPv6-only still pretty much unusable

#212

Post by IcePic »

withinboredom wrote: post #46
UI_at_80x24 wrote: post #37

And this is where government regulation would have helped. It's a shame nobody listened to me back in the 90's: (it's a joke. I'm a nobody, there is nobody listening.) All cell-phones should have been ipv6 from the get-go. Now if we could just go back in time and warn everybody about IPv4 address space being exhausted. And maybe the climate too while we are at it. Seriously though, cell-phone adoption would make that…

It’s not that ipv4 space is exhausted, there’s plenty of it available. It’s that early on it was mismanaged to the point that people / companies were able to buy entire /8’s for basically nothing and hold them forever.

Given the top rate* for handing out ipv4 some 10 years ago, every such "wasted" /8 would give you days to weeks before being used up again. What do you intend to do when those 2 weeks are up?

*) https://en.wikipedia.org/wiki/IPv4_address_exhaustion#/media...

Re: Tell HN: IPv6-only still pretty much unusable

#213

Post by jedberg »

jeroenhd wrote: post #208
jedberg wrote: post #192

Earlier quoted context omitted.

> You'd still have to touch every rule to to tweak the mask. No you wouldn't. 0.0.0.0.1.0.0.0/40 and 1.0.0.0/8 are the same thing. If the rule says 1.0.0.0/8 then the router converts it to 0.0.0.0.1.0.0.0/40. If you happen to have 1/8 as your rule, then an easy fix is to say ip4+ translates shorthand rules at ipv4 if the mask is under /32. > What makes you think that companies would have been willing to make the effo…

> No you wouldn't. 0.0.0.0.1.0.0.0/40 and 1.0.0.0/8 are the same thing. I don't see why the CIDR would make a direct difference. Whether it's converting 1.0.0.0/8 to 0.0.0.0.1.0.0.0/40 or 2002:c000:0204::1.0.0.0/96 doesn't seem to matter to me. The only difference I can think of is local networks (10/8, 192.168/16, 172.16/12) but your suggestion would fail in the same way. Several compatibility systems for IPv6 exist…

> If your business network is managed by "hey, this feature exists, let's see what happens if we turn it on" then your network admin needs to be more professional.

I think this is why you don't understand how IP4+ would be easier. 99% of companies make their "IT guy" manage the network. They aren't network professionals. They are mostly desktop professionals who also get forced to manage the network and firewall. Same with most schools -- they can't afford to hire network professionals. Sometimes they get lucky and someone is excited about learning networking, but that's not true in most cases.

If they already have a bunch of IPv4 rules that some contractor wrote once, and they have a vague understand of how those rules work and why, they don't want to learn a new scheme or run 6to4 or anything else. They just want it to work by copying the old config and then maybe if they have time they can explore the new features of their new equipment.

Re: Tell HN: IPv6-only still pretty much unusable

#215

Post by jeroenhd »

maximaximal wrote: post #188

We are IPv6-only on our institute-internal CPU compute cluster based on slurm. Only the head node has an IPv4 address, so that it can be reached from IPv4 only clients (sadly, there are still quite a lot). All nodes inside the cluster talk over IPv6. And all other computers with IPv6 access use that to communicate to the head node. We are transitioning to IPv6-only for internal services and try to avoid using IPv4 ad…

> Sadly, our local ISP is still IPv4-only, meaning we cannot even access our IPv6 hosts while at home, so we need to fall-back to IPv4 quite a lot.

Have you perhaps looked into using tunnels to fix this? he.net can add IPv6 support to any routable IPv4 address that can respond to ICMP. If you need to stick to your internal ULA, something like NPTv6 can translate the /48 subnet HE provides to your own /48 subnet transparently.

Requires some setting up, but so does maintaining VPNs.

Re: Tell HN: IPv6-only still pretty much unusable

#216

Post by noipv6 »

manfre wrote: post #10
xlmnxp wrote: post #3

Hetzner should provide free CGNAT IPv4 Addresses (IPv4 Gateway) for IPv6-Only VMs

Communal ipv4 is very problematic for certain services due to bad neighbors causing it to be blacklisted.

this sounds like a valid argument for deploying ipv6 wherever you can, tbqh

cgnat is only going to get MORE common, globally

Re: Tell HN: IPv6-only still pretty much unusable

#217

Post by jeroenhd »

bombcar wrote: post #34

Setting a website to be available over IPv6 is relatively easy, yet we see: ;; QUESTION SECTION: ;news.ycombinator.com. IN AAAA Why? Because it's not quite as simple as making Apache respond over IPv6; any website of any size has various protections in place to prevent DDoS, spam, etc, and those tools are almost universally basic and at the root is the "ban by IPv4 address". Without that tooling supporting IPv6, it r…

> Why? Because it's not quite as simple as making Apache respond over IPv6; any website of any size has various protections in place to prevent DDoS, spam, etc, and those tools are almost universally basic and at the root is the "ban by IPv4 address". Without that tooling supporting IPv6, it remains a side note not worth supporting.

The consensus I've seen is to treat IPv6 /56s or /48s (depending on preferred strictness) as an IPv4 address. From there, it's quite simple to port the security mechanisms.

Of course the chicken/egg problem comes back, because many of these "solutions" don't support IPv6 because nobody asked them to support IPv6 because they don't use IPv6 because their solutions don't support IPv6.

As for HN, good question. Adding a simple line to your DNS server or hosts file to make HN resolve on IPv6 is enough to get it to work.

Edit: emailed dang, it's on the roadmap!

Re: Tell HN: IPv6-only still pretty much unusable

#218

Post by tinus_hn »

eppp wrote: post #151
tinus_hn wrote: post #92

Earlier quoted context omitted.

ISPs love NAT because it is an artificial distinction between producers and consumers, which means they can call the producers ‘pro’ of ‘enterprise’ and charge them through the nose while the consumers can’t cause trouble and just pay for download speed.

Going by my current experience of managing an ISP, the number of people that care at all about producing anything is almost zero. Out of thousands of accounts I can count on two hands the number of people that want anything outside of the standard ipv4 symmetric 1gb we offer.

Perhaps the don’t say they care about producing content but surely they care about accepting (voip) phone calls, being able to torrent twice as fast (because they would be able to connect to twice as much peers) and they’d also like all these services that just don’t exist anymore because too many people are behind NATs they can’t control.

The popularity of uPnP for automatic port forwarding should be a clue, anything that uses that is blocked by cgnat.

Re: Tell HN: IPv6-only still pretty much unusable

#219

Post by crest »

fernandomm wrote: post #191
redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

Let's not forget about the idea that ISPs would distribute a /56 range to residential users. You could split it in /64 ranges according to your requirements and everything would work fine. There is only one "minor" issue: all major ISPs in my country ( Brazil ) only provide a single /64. You can't get another /64 unless you upgrade to a very expensive business plan. That makes IPv6 not only useless but also a huge se…

RouterOS v7 supports DHCPv6 prefix delegation. You can request a delegated /64 per downstream interface and announce itself as router using these prefixes. You can still use your MikroTik device as router, stateful firewall, proxy. You don't have to mess with smaller than /64 allocations on links unless your provider forces a broken CPE on you that doesn't support DHCPv6 prefix delegation.

Have you actually seen any large scale deployments of CPEs without an active IPv6 firewall blocking incoming connections by default?

Re: Tell HN: IPv6-only still pretty much unusable

#220

Post by jeroenhd »

lzaaz wrote: post #169
mort96 wrote: post #112

Earlier quoted context omitted.

Your comment has no useful information.

Put this in your /etc/hosts file and it should work (I don't know if it does as I don't have ipv6) 2a06:98c1:3120::5 news.ycombinator.com

Can confirm, works like a charm!
Post reply on HN