Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

241–250 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#241

Post by TacticalCoder »

kazen44 wrote: post #100
ajross wrote: post #65

> You should stop thinking of NAT as a security mechanism and think of it as the emergency address exhaustion prevention that it is. I hate this attitude. This is isomporphic to saying "stop thinking of system call interfaces as a security mechanism and think of them as an address space sharing mechanism". It's not technically wrong, but it's wrong in practice. Even the most naive NAT can't misroute an inbound packet…

why would NAT not be any configuration compared to Firewall rulesets? heck, they even inventend protocols to do automatic NAT setup (UPNP) because configuring NAT by hand confuses people a lot.

Not commenting on the whole IPv6 vs IPv4 debate but simply answering your question...

There aren't enough IPv4 addresses, so any ISP using IPv4 addresses is going to give 99.999% of their customers exactly one IPv4 address. Not ten. Not two. One.

So NAT has to work. Grandma has nothing to configure because either NAT works or grandma is calling her ISP to ask why her tablet ain't working.

So when the customer gets exactly one IPv4 address, the ISP is forced to hand a router doing IPv4 NAT. They have no way around it.

While if you take an ISP handing out hundreds of billions of IPv6 addresses to each customer, well... They are not forced to hand a router which does proper firewalling.

It's not a question of whether it'd be easier for the ISP to give a correctly configured IPv6 router firewall vs handing an IPv4 correctly doing NAT.

It's that when they hand one IPv4 address, they don't have the choice. NAT must work and there's no way around it.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#242

Post by hot_gril »

dheera wrote: post #191
Symbiote wrote: post #188

Earlier quoted context omitted.

If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9

And that's the problem! Who can memorize all that? I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to…

I agree with the complaint about IPv6, but in this situation couldn't you just use nmap?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#243

Post by birdman3131 »

philjohn wrote: post #206
alyandon wrote: post #181

Earlier quoted context omitted.

I've actually run into this helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo.

At that point, would a cheap VPS not work instead?

No. Game servers usually want high clock speed.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#244

Post by saul_goodman »

"Apple has excellent IPv6 support on their devices, fully supporting automatic configuration of 464XLAT on devices with NAT64, and overall an excellent attitude to forcing IPv6 support from developers"

Other operating systems are bit of hit or miss"

My iPhone works, what's wrong with the rest of you for not doing this??!!

But in all seriousness, I think this will be a security nightmare for quite a while if there is some forced conversion to ipv6. I realize IPv6 wasn't created yesterday, but I assume it's got plenty of security holes waiting to be discovered until I see otherwise. The only way you are going to see it be used by end-users is if the various *nix distros roll out IPv4-less images. Same for Windows/etc. Otherwise you are begging for a security nightmare of epic proportions with software that is accidentally using the wrong stack by default, firewalls not filtering anything as expected, etc.

And who thinks it's a good idea to make all the things globally accessible? It's an internet of shit out there already, this would make it even worse.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#245

Post by wankle »

davikr wrote: post #79
michaelt wrote: post #62

Earlier quoted context omitted.

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

To "avoid domination by huge centralized services", of course. What if you want to run something like a website from your own IP, but you can't because you're behind CGNAT?

I use a public VPS and Wireguard. Costs $3.50 for the VPS which has a static IP. I host on my laptop. I can take my laptop anywhere in the world there's an Internet connection and my email and web sites continue to work right from the same VPS IP because my laptop connects to the Wireguard server on my VPS when it comes up.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#246

Post by audunw »

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> as if that's something that anybody wants.

Of course I do. Why would you not want the option of easily allowing a device to be globally routable if you need it to be?

I think routers should be more explicit about how you set up each new device on a private network anyway. Guest wifi can have a sane default. Private wifi could make a notification pop up on your trusted device, asking you if you want the now device to have access to the internet, and if the internet should have access to the device, and if so, which subnets/countries should be able to access it through which ports.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#247

Post by wankle »

unethical_ban wrote: post #105
michaelt wrote: post #62

Earlier quoted context omitted.

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address. The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or inco…

IPv4 cuts it everywhere. IPv6 does not do anything to save the planet. IPv6 does have privacy concerns stated by many on this page. IPv6 could be shut down tomorrow and the Internet would continue working well.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#248

Post by mixdup »

throw0101c wrote: post #164
bityard wrote: post #78

Question from a (relative) IPv6 newbie that wasn't addressed in TFA: Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device. Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is…

> Since DHCPv6 is apparently frowned upon by v6 purists, and not all devices on my network support it, that leaves SLAAC. The main hold out against DHCPv6 is Android: * https://issuetracker.google.com/issues/36949085

that thread is amazing. Google's stance makes me want to deploy DHCPv6 simply to spite them. I guarantee in 10 years when some Fortune 500 company or top 20 research university IT department, who has no idea about that thread, goes live with a DHCPv6-only IPv6 stack because it's very similar to their IPv4 network, and 30,000 users can't join their Android devices to the campus wifi, this attitude will change

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#249

Post by [deleted] »

hot_gril wrote: post #237
voytec wrote: post #189

Earlier quoted context omitted.

[flagged]

I hope you're on the new version of everything then, not just in your area of expertise. You're expecting people to want something that's worse for them if anything, and calling them lazy isn't going to help. What would've helped is making IPv6 more user-friendly.

[deleted]
Post reply on HN