Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS to start charging for IPv4 usage, but critical services don't support IPv6

old.reddit.com

Post reply on HN
Print view View original

241–245 of 245 posts

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#241

Post by hot_gril »

orangeboats wrote: post #240
hot_gril wrote: post #239

Earlier quoted context omitted.

> If you increase your address space by any number of bits, your routing table must necessarily increase its size. So you're talking about the second thing I mentioned. Supporting N users requires storing at least Nlog(N) bits of addresses in total. Going to /40 doesn't seem like a big enough increase to require redoing all the routes. And even if it is, an ISP could even roll out v4.1 sticking with /32s for now, kee…

>And this is what I said in my original comment, ipv6 has extra goals (like removing NAT day 1). Extra goals? Removing NAT? Come on now... Don't act like NAT was invented along with the Internet itself, you know it wasn't. And again, never ever conflate NAT with private networks. NAT is a packet-modifying technique that is closely associated with stateful firewalls, but it still ain't firewall. If you want private ne…

Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. And even if it wasn't their original purpose, NATs are used as firewalls. Functionally they're similar except NATs also rewrite addresses, which is actually a nice feature too. There's some reassurance in having such a clear default-deny behavior, with local IPs that aren't globally unique to begin with.

What's the big problem with NAT existing anyway, especially when you're free to ditch it on your own network? Maybe because the main point of getting rid of NAT in v6 is to allow any device to claim a public IP on default networks, for p2p applications. NAT's default behavior would get in the way of that. So it seems like ipv6 is about pushing default-allow behaviors onto network operators. Again this is pretty separate from the address space crisis.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#242

Post by orangeboats »

hot_gril wrote: post #241
orangeboats wrote: post #240

Earlier quoted context omitted.

>And this is what I said in my original comment, ipv6 has extra goals (like removing NAT day 1). Extra goals? Removing NAT? Come on now... Don't act like NAT was invented along with the Internet itself, you know it wasn't. And again, never ever conflate NAT with private networks. NAT is a packet-modifying technique that is closely associated with stateful firewalls, but it still ain't firewall. If you want private ne…

Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. And even if it wasn't their original purpose, NATs are used as firewalls. Functionally they're similar except NATs also rewrite addresses, which is actually a nice feature too. There's some reassurance in having such a clear default-deny behavior, with local IPs that aren't globally unique to begin with. What's th…

>Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now.

Don't forget the context: we were talking about "removing NAT as an extra goal of IPv6," not "does it matter when was NAT invented".

So here I am reiterating my point again: It was never an extra goal, considering that IPv6 was designed in an era when NAT never predominated the internet.

>What's the big problem with NAT existing anyway,

Oooh no biggie other than breaking all sorts of P2P communication? It's so bad that we have to implement literal hacks like TURN and STUN on top of the hack that is NAT itself.

Or maybe we can talk about how it broke all sorts of protocols so badly that we to this day need application-level gateways[1] to help those protocols transverse NAT?

Or let's have some time to talk about how inefficient NAT is. You should know it requires computing power to track each connection flow and to maintain a state table for those flows.

>So it seems like ipv6 is about pushing default-allow behaviors onto network operators. Again this is pretty separate from the address space crisis.

What are you talking about? Default-allow and default-deny are both firewall rules. Even NAT (the "full-cone" or "endpoint-independent" ones) is prone to this, if a port is open everyone can connect to you through the IP:port.

I would say removal of NAT and addressing space is closely intertwined, but alas you seem to have pretty amateurish understanding of it.

Also, just in case you bring up your IPv4.1 again: all address space enlarging efforts will inevitably face incompatibility issues.

[1]: https://en.wikipedia.org/wiki/Application-level_gateway

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#243

Post by Dagger2 »

hot_gril wrote: post #226
Dagger2 wrote: post #218

Earlier quoted context omitted.

> Even if I turn off v4.0, I'm still reachable at the same address on v4.1. This is not the case with v6. That's the problem. That's not the problem. Being reachable "at the same address on v4.1" (or v6) does not mean that v4 hosts can reach you. In order for v4 hosts to reach you, you have to be doing v4, because v4 hosts will be sending you v4 packets. If you've turned off v4 then that won't work. It'll work if you…

As far as I can tell, nearly every system has an ipv6 stack included, but they are often choosing not to enable it. So ipv6's adoption problem is no longer related to a lack of capabilities on hosts. Do you agree with that? Let's say every ipv6 stack we have today were instead playing by "ipv4.1"'s rules, meaning same addresses and routing as v4 (and possibly the same packet format as v6). Nobody is taking advantage…

How is that not what we're already doing? Almost everyone with a v6 stack still has the exact same v4 address they had before, using the exact same routing as v4. Old DNS entries are still valid, NAT's still common.

The only difference seems to be that some people are already making use of the bigger address space, rather than waiting. And that's surely a good thing? If you told everybody to wait until absolutely everything supported it, you'd be waiting forever, and you'd be giving up the benefits of having a larger address space available the entire time... and you don't have a way to force people to wait anyway, so that idea wouldn't even implementable in the first place.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#244

Post by hot_gril »

orangeboats wrote: post #242
hot_gril wrote: post #241

Earlier quoted context omitted.

Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. And even if it wasn't their original purpose, NATs are used as firewalls. Functionally they're similar except NATs also rewrite addresses, which is actually a nice feature too. There's some reassurance in having such a clear default-deny behavior, with local IPs that aren't globally unique to begin with. What's th…

>Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. Don't forget the context: we were talking about "removing NAT as an extra goal of IPv6," not "does it matter when was NAT invented". So here I am reiterating my point again: It was never an extra goal, considering that IPv6 was designed in an era when NAT never predominated the internet. >What's the big problem w…

IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening ports. You ok with that?

I keep hearing this have your cake and eat it too kind of argument. "It supports P2P" and "just default-deny if you're worried about security" do not mix. We get one or the other as the assumed default. IPv4 + NAT is the default-deny. IPv6 seems to be about default-allow even if that's not inherent to it.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#245

Post by orangeboats »

hot_gril wrote: post #244
orangeboats wrote: post #242

Earlier quoted context omitted.

>Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. Don't forget the context: we were talking about "removing NAT as an extra goal of IPv6," not "does it matter when was NAT invented". So here I am reiterating my point again: It was never an extra goal, considering that IPv6 was designed in an era when NAT never predominated the internet. >What's the big problem w…

IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening ports. You ok with that? I keep hearing this have your cake and eat it too kind of argument. "It supports P2P" and "just default-deny if you're worried about security" do not mix. We get one or the other as the assumed default. IPv4 + NAT is the default-deny. IPv6…

>IPv6 with default-deny firewalls in most places would break P2P communication too.

That's why you have the PCP protocol to help you setup a hole in your firewall, you default-deny until some host in your network says "I can handle port 12345". If your router doesn't support that, in the worst case scenario you can fallback to manually setting up firewall entries much like NAT.

Sure, PCP works in NAT cases too, but not always - especially in double-NAT or CGNAT scenarios. And we already know how prevalent CGNAT is, don't we? I don't know where do you live in, but here all ISPs have deployed CGNAT.

By the way that's one of the disadvantages of having NAT, you are forced into a centralized architecture where the central node in the ISP (the CGNAT device) decides what kind of niceties you could get.

IPv6, the ISP only carries traffic around and it does not meddle with layer 4 activities.

Post reply on HN