Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

211–220 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#211

Post by philjohn »

wyager wrote: post #43
soebbing wrote: post #8

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

Put internet of shit devices on their own VLAN(s). Almost all wifi APs today support multiple SSIDs with separate VLANs. Have your firewall block inbound connections to devices on that VLAN. Every OS firewall has built-in support for this. I spent a lot of time figuring out how to do all this in the most efficient way (in terms of my time and effort) during covid, and I suggest getting any arbitrary box with 2 ethern…

I go one further - the IoT VLAN (Sonos, Philips Hue, wifi controlled light strips, TV's) is hard segmented from my "trusted" VLAN (except for some specific holes punched so things like SSDP and streaming from a media server work).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#212

Post by xnyanta »

dheera wrote: post #191
Symbiote wrote: post #188

Earlier quoted context omitted.

If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9

And that's the problem! Who can memorize all that? I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to…

> With IPv6 hell knows what their hex-colon monstrosities would be.

You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#213

Post by jlokier »

screamingninja wrote: post #138
everdrive wrote: post #87

Earlier quoted context omitted.

>simplified network management I keep hearing this, but it doesn’t seem more simple to me. My ISP won’t reserve me a /48, so I can’t control the management ips of devices on my network. The solution is apparently to set up dynamic dns, which I have no interest in doing.

Just split that /64 into smaller /80 subnets. If I were your ISP, I would be upset too. The apparent issue here is that you're falling back to what's familiar- static IP addressing. How about mDNS?

You can't use a smaller subnet than /64 for devices that use SLAAC for address allocation.

(Unless you're putting them behind an IPv6 NAT, so thry can have their oen private /64).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#214

Post by flangola7 »

jiggawatts wrote: post #175
adriancr wrote: post #163

Earlier quoted context omitted.

you identify device each day, identity is X, daughter of Y on iPad. Once identified via data broker all its traffic is identifiable including torrents for example and porn websites, etc (say X goes to facebook with new address it now has real name) Once identity is known for address X you know its traffic for the day, including past traffic for the day. once address changes you do the whole identification again. All…

Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. The “I don’t care if they track my household but it’s critical that Daddy’s activity not get disambiguated from my dealing daughter” is just not a valid reason to abandon the benefits of IPv6. Please stop with this line of argument. If you’re really desperate to ensure that the ads shown to your daughter are…

> Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway.

If I told my security information officer "We don't protect against foreseeable threat X because we assume no one will bother to try X" she would not be very happy with me.

When a valid data concern has been expressed and described, putting your head in the sand is the incorrect response. I want IPv4 to die as much as the next person but at a minimum organizations such as hospitals and government installations will not accept that sort of outside visibility into their network.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#215

Post by rahkiin »

dheera wrote: post #191
Symbiote wrote: post #188

Earlier quoted context omitted.

If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9

And that's the problem! Who can memorize all that? I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to…

Seems like a complicated solution to a problem that does not exist. You cannot turn on lights at all without a working network? If your router crashes your whole house is stuck? Seems like there is a bigger issue than the IPv6 protocol

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#216

Post by xnyanta »

adriancr wrote: post #52
soebbing wrote: post #8

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

Although I'm going to get comments saying this is wrong... What I did was: - IPv6 DHPC - private address range within: fc00::/7 - IPv6 NAT, same as for IPv4. - Firewall. Why: - digital ocean only allowed ~16 IPv6 addresses. - I wanted a local IPv6 network exiting through digital ocean. - I see no reason to give public route-able addresses to each device in my home (allows remote websites to determine who is calling i…

Digital Ocean has horrible IPv6 support, I would just move to another provider. Most VPS providers will, at the very least, provide you with a /64.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#217

Post by Arnavion »

IshKebab wrote: post #68
ArchOversight wrote: post #30

Earlier quoted context omitted.

That's what a firewall is for, NAT does nothing here.

In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.

The amount of firewall config I have to write to let an incoming connection cross from WAN to LAN is the same regardless of whether it goes to a NAT'd IPv4 address or to an IPv6 address.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#218

Post by dmm »

bityard wrote: post #78

Question from a (relative) IPv6 newbie that wasn't addressed in TFA: Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device. Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is…

It's important to distinguish between stateful and stateless DHCPv6. stateless DHCPv6 is fine. It's just a way for nodes to get dns/ntp/etc. Nodes still select their addresses with SLAAC.

Stateful DHCPv6 is the bad one. It assigns hosts specific addresses.

> the router essentially always knows the MAC address, IP address and hostname of each device.

You can still have this with ipv6 addresses. They easiest way is to use eui64, the original ipv6 addressing scheme where the address is calculated from the subnet + the MAC address of the interface. That way server VMs get deterministic addresses. If you use network-manager you can configure eui64 with the "add-gen-mode=eui64" setting.

In my homelab, I have a few server VMs that use eui64 addressing whereas the end user devices use privacy addresses randomly selected from the subnet.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#219

Post by skywhopper »

From my POV, IPv6 overshot and tried to solve too many non-problems while addressing the only real issue with IPv4, the address space. That fact alone explains the relentless failure to adopt IPv6, because it’s not just a matter of adopting IPv6. Nearly every assumption about networking changes, all the tooling is different, and the risks and concerns are all changed. There was an easier path to follow, but we missed that chance 20 years ago, and now we’re likely stuck with a dual stack mess for the rest of our careers.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#220

Post by dheera »

xnyanta wrote: post #212
dheera wrote: post #191

Earlier quoted context omitted.

And that's the problem! Who can memorize all that? I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to…

> With IPv6 hell knows what their hex-colon monstrosities would be. You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

And so now I have to stick stickers on every light bulb with a huge address on it and then get up on a chair several times per bulb while I transfer chunks of its address from the sticker to my terminal?

The reality is with IPv4 I can memorize all of the IPv4 addresses of every light bulb, every robot, every thermostat, every plant watering device in my residence, and I can hammer out CURL commands to control everything almost from muscle memory in the event of a DNS hijacking.

Post reply on HN