Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why IPv6 is so complicated

github.com

Post reply on HN
Print view View original

221–230 of 519 posts

Re: Why IPv6 is so complicated

#221

Post by Dagger2 »

general1465 wrote: post #215
Dagger2 wrote: post #184

Earlier quoted context omitted.

Even a correctly-configured NAT will let connections in from outside, and a lot of people don't understand this. Personally I'd count "your security thing doesn't actually do the thing it's supposed to do" as being pretty bad on the security scale. At least people understand firewalls.

> Even a correctly-configured NAT will let connections in from outside, and a lot of people don't understand this. Yes, that's called port forwarding and it is normal thing. You actually want that.

It will let them in without a port forward in place. The port forward just rewrites the IP on an incoming connection, nothing more.

Re: Why IPv6 is so complicated

#222

Post by Dagger2 »

rileymat2 wrote: post #218
Dagger2 wrote: post #160

Earlier quoted context omitted.

Nope, it doesn't. The security model is based on your firewalls and routing, not on NAT. NAT just gets in the way and makes it harder to understand what's going on. For example, on a normal home network, if you don't have a firewall on your router then your ISP can connect to anything on your network. Even when they don't control the router and even if you're NATing. If you didn't realize this then apparently NAT did…

Can you say more about the ISP connecting to any computer on your network? I can’t find any references to this aspect in googling the right terms and the concept is foreign to me. There are a bunch of ways to break it, or misconfigure it. But I have idea what this isp method is.

It's just normal routing. If you send packets to a router, it'll route them.

More concretely, they can run the equivalent of `ip route add 192.168.1.0/24 via ` on a machine that's connected to your WAN network, and then their machine will send packets with a dest of 192.168.1.x to your router. Your router will route them onto your LAN because that's what its own routing table says to do with them.

Anyone on your immediate upstream network can do this, not just your ISP. Also, if you use ISP-assigned GUAs then this inbound route will already exist and anyone on the Internet can connect. Applying NAT to your outbound connections will change their apparent source address, but it won't make that inbound route disappear.

Re: Why IPv6 is so complicated

#223

Post by general1465 »

Dagger2 wrote: post #221
general1465 wrote: post #215

Earlier quoted context omitted.

> Even a correctly-configured NAT will let connections in from outside, and a lot of people don't understand this. Yes, that's called port forwarding and it is normal thing. You actually want that.

It will let them in without a port forward in place. The port forward just rewrites the IP on an incoming connection, nothing more.

If you can reuse opened connection, but that will work with firewall too.

Re: Why IPv6 is so complicated

#224

Post by Dagger2 »

grandinj wrote: post #165
Dagger2 wrote: post #153

Earlier quoted context omitted.

Uh, no it didn't? Routing table size is still something of a problem, especially as v4 continues to fragment more and more, but also the main driver was insufficient IP addresses in v4 and that problem hasn't even slightly gone away.

I was there, reading the ipv6 mailing list eagerly. Address space exhaustion was a smaller problem because NAT was pretty primitive, so called carrier grade NAT was not even a thing yet. But cisco had the largest routers and their biggest was not big enough for the core router fabrics projected growth. And there was not enough demand (yet) for very large routers fir cisco to want to design and build the nevessary chi…

That might well have been a more immediately pressing issue, but they did know that v4 was going to be too small and that they still needed to work on v6.

I might be saying something obvious here, but address space exhaustion and size of the core routing table are really two sides of the same problem anyway. The way to keep the routing table size down is to give everybody a small number of big allocations instead of a big number of small allocations, but that consumes more address space since the allocations have to be rounded up to at minimum the next integer power of 2 (and really more, to accommodate growth).

Re: Why IPv6 is so complicated

#225

Post by Dagger2 »

general1465 wrote: post #223
Dagger2 wrote: post #221

Earlier quoted context omitted.

It will let them in without a port forward in place. The port forward just rewrites the IP on an incoming connection, nothing more.

If you can reuse opened connection, but that will work with firewall too.

You don't need any tricks like that. Regular new connections will work.

Re: Why IPv6 is so complicated

#226

Post by menotyou »

RiverCrochet wrote: post #220

Most of the bitching about IPv6 is from those who really, really want IP addresses to identify machines or users. IP addresses (including IPv4) were never intended to do that and it was never a good idea to put them in that position. There was a time when most devices had 1 network interface and didn't move. But that was never a guarantee. People thought it was a guarantee when your $400-in-1988-dollars Madge ISA ful…

My IPS changes my prefix once in while. I consider this a privacy feature, not a bug.

Now I find myself in a situation that my devices are not reachable anymore as when the IPv6 address changes and both DNS entries and firewall need to be updated each time when the prefix changed (In between connections break, but this might be a lesser problem)

As far as I understand the only solution which does not include some complex scripting of ip change detection and automatically updating the firewall rules is to use NAT66 and ULA. But even then I have a protocol whose most advertised feature is not to rely on NAT and puts mit fast in a situation in need to use NAT. And the privacy extension of every device or the devices using SLAC and not DHCPv6 are problematic.

IPv6 is just not able to steup efficiently for where IP addresses are changing. Not with moving mobile devices, not in wifi environments with multiple access points, not with changing prefixes, not in failover scenarios.

Bottom Line: I disabled IPv6 again here without any intentions to look for complex workarounds. All outbound traffic is now IPv4 again. IPv6 is providing no benefit but causes additional problems over IPv4 due to issues with the design. I am waiting for IPv7 (or whatever will be the next successor of IPv4) will arrive.

Re: Why IPv6 is so complicated

#227

Post by Dagger2 »

b112 wrote: post #167
Dagger2 wrote: post #152

Earlier quoted context omitted.

You're at the very beginning, baby steps stage of inventing IPv6 there. You aren't the first person to come up with the idea of adding extra bits to IP addresses to make them longer. The problem isn't finding somewhere to stash the extra bits in the packet format (which is trivial; you can simply set the next-protocol field to a special value and then put the bits at the start of the payload), it's getting all softwa…

Please consider that maybe the people working on v6 weren't actually complete imbeciles and did in fact think things through. It is possible for the world to change, and for designs and plans and viewpoints 30+ years ago to be less correct today. This world is not that world. That world had massive concerns about the processing cost of NAT. That was one reason for ipv6. It also had different ideas about where the net…

None of that has anything to do with what you said in the post I replied to. "Add an extra octet to v4 addresses" has hard technical barriers to deal with if you want it to work, regardless of what the world looks like or what you're designing for.

> We now know that the "internet of things" and "having your fridge online", as well as "5G in everything so people can't firewall it off" is just insane and malign

None of this is really relevant either. IP's job is to handle the addressing used when sending data over the Internet, and it should do this job well regardless of what people end up doing with it.

> We also know that tying an IP address to a person (compared to an ISP using NAT) reduces privacy

We don't tie IP addresses to people. PI allocations might sort of count, but regular users don't get those.

Re: Why IPv6 is so complicated

#228

Post by ksec »

shibapuppie wrote: post #194
ButlerianJihad wrote: post #137

Earlier quoted context omitted.

> IPv6 supports NAT You say that, but in practice it does not. My consumer router, and every router I have configured, implicitly supports IPv4 NAT out of the box. But it will never NAT an IPv6 network. If I enable IPv6 then it operates by IPv6 rules, which means each device gets a Network ID and each Network ID gets routed directly and transparently. The router has no NAT table and no NAT settings for this protocol.…

IPv6 DOES support NAT. If you've got a car that can't go 100, that doesn't mean nobody can, or that it doesn't exist. I don't care if you can't do it, it IS supported in the spec.

That is the same argument with USB, USB support x, but 90% of USB dont implement it. In reality that is no different to not supported.

Re: Why IPv6 is so complicated

#229

Post by ksec »

>Getting IPv6 to about 50% deployment has taken more than 25 years. Any alternative or new proposal would be the same.

That is oversimplified a few things. The 50% deployment is largely Mobile Phone + Cloudflare and India. ( Not sure about China ). Outside of that things aren't that different from a high level overview.

You could have 50% deployment in less than 10 years if 6G Mobile Phone mandate the use of let say IPv8.

Re: Why IPv6 is so complicated

#230

Post by Dagger2 »

menotyou wrote: post #226
RiverCrochet wrote: post #220

Most of the bitching about IPv6 is from those who really, really want IP addresses to identify machines or users. IP addresses (including IPv4) were never intended to do that and it was never a good idea to put them in that position. There was a time when most devices had 1 network interface and didn't move. But that was never a guarantee. People thought it was a guarantee when your $400-in-1988-dollars Madge ISA ful…

My IPS changes my prefix once in while. I consider this a privacy feature, not a bug. Now I find myself in a situation that my devices are not reachable anymore as when the IPv6 address changes and both DNS entries and firewall need to be updated each time when the prefix changed (In between connections break, but this might be a lesser problem) As far as I understand the only solution which does not include some com…

Are you talking about reaching the devices from inside the network, or outside?

If inside then you don't need NAT66 and ULA, you just need ULA. Use both ULA and the ISP GUAs on the network, and do your internal connections over ULA. If outside, then NAT66+ULA doesn't help because connections from outside will still fail until you update DNS for the new prefix.

NAT66 doesn't help in either situation, so why do you think you need to use it here?

> automatically updating the firewall rules

You can probably structure your firewall rules to not rely on the prefix, e.g. by doing "connections from WAN to LAN where the address matches ::42/-64" -- you might to write it with a mask instead (::42/::ffff:ffff:ffff:ffff), which looks awful but works fine. There's no point in putting a specific prefix into the rule if you're just going to change it to match the network anyway.

Post reply on HN