251–260 of 433 posts
Earlier quoted context omitted.
With how trivial generating new addresses in IPv6 is, it'd be cool to have a host block all incoming traffic on its own and have each service that deserves to be reached over the listen on an address unique to the service.
> have each service that deserves to be reached over the listen on an address unique to the service It’s already a thing. These unique per-service addresses are called “ports” in IP protocol.
Earlier quoted context omitted.
Whilst I agree with you, I rather depressingly suspect a lot of people equate NAT with “security”.
Security - not really, but to be honest CG-NAT is kind of nice for privacy. I don't have to worry about leaking a (by default) permanent identifier. Once/if I go full ipv6, I'll probably start using a VPN full time.
The range check should be in the form of "isIPInRange(ip, cidr)", e.g. isIPInRange("192.168.0.255", "192.168.0.0/24").
It is trivial for IPv4, but not so trivial for IPv6.
If you are wondering why I am not asking LLM this, that is because when (at the time) I did attempt, it failed spectacularly, plus hey, it is HN, someone may find it useful and the more eyes the better anyways (to spot bugs, issues, what have you).
Earlier quoted context omitted.
Agreeing on a common standard is not authoritarianism.
You said "government-mandated" - do you think your words matter? That doesn't sound like agreement. Agreement is how we have arrived at the imperfect solution we have now... Agreement between various technical and non-technical parties.
Similarly, mandating an Internet Protocol that doesn't require centralization (you know, NAT) and renting an address from the Big Boys (AWS etc) sounds like a perfectly sensible decision to me.
> Agreement is how we have arrived at the imperfect solution we have now...
I disagree. What we have now is not an explicit agreement, it's a status quo which can be broken by an external force.
For my entire life, the networking nerds have been shaming us for not using IPv6. Back when I had a NeoPet in middle school, IPv6 was was "just around the corner." I'm now raising my own children and still listening to the same IPv6 talking points. Every company I've ever worked for has completely disabled IPv6 on the corporate network. My own ISP still doesn't offer it. Disabling it is often the quickest fix for a v…
In a way, you disabling it now is the reason why others are disabling it later. A lot of IPv6 deployment issues are precisely caused by middleboxes/clients disabling or misconfiguring it.
Earlier quoted context omitted.
Whilst I agree with you, I rather depressingly suspect a lot of people equate NAT with “security”.
Security - not really, but to be honest CG-NAT is kind of nice for privacy. I don't have to worry about leaking a (by default) permanent identifier. Once/if I go full ipv6, I'll probably start using a VPN full time.
Earlier quoted context omitted.
IPv4 prices peaked during the Covid pandemic, presumably because of sudden high demand. Amazon took this as an opportunity to increase prices. Now IPv4 prices are returning to pre-Covid long-term trends. But of course Amazon won't reflect that in their pricing table.
> Amazon took this as an opportunity to increase prices. IPv4 prices peaked in early 2022; AWS started charging for public IPv4 in 2024 (announced in 2023): * https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address... If they had increased prices in 2022 (or at least announced in 2022), then I could see some kind of correlation, but give it was 1.5-2 years after, I doubt there is a connection.
I have fully implemented IPv6 in my home network. I have even implemented an IPv6-Only network. It fully works, including accessing IPv4 only websites like github.com via DNS64 and NAT64 at my router. The only practically useful thing about my IPv6 enabled network is that I can run globally routable services on my lan, without NAT port mapping. Of course, only if the client is also IPv6. Other than this one use case,…
IPv6 was not created for you, but it benefits you. NAT is computationally expensive and it does have a real impact for large organizations with thousands and tens of thousands of devices. Such as large universities or you know ISPs.
I have fully implemented IPv6 in my home network. I have even implemented an IPv6-Only network. It fully works, including accessing IPv4 only websites like github.com via DNS64 and NAT64 at my router. The only practically useful thing about my IPv6 enabled network is that I can run globally routable services on my lan, without NAT port mapping. Of course, only if the client is also IPv6. Other than this one use case,…
Can it be that IPv4 price now leveled off because big players are getting ready to switch to IPv6 any time and not buying up anything that is available? If GooG/FB/Amazon force IPv6 how long will it take for ISPs to switch? I think in one week where some people cannot reach GooG/FB and any ISP that was dragging his feet has implemented IPv6 by the end of the week. I expect IPv6 adoption will blow up any time now as p…
Earlier quoted context omitted.
It matters, because when the prefix changes, it changes IP addresses of every single device in your network. As you wrote, internally, you can use ULA. But you cannot open access from outside, because your firewall rules will become invalid with prefix change. With classic IPv4 NAT, your internal addresses don't change, so your port forwarding works, even if the WAN address changes. Together, with a single /64 -- whi…
I don’t know what router you use, but openwrt lets you set firewall rules that only match the last 64 bits. This should solve your problem, provided you configure your router to hand out static IPv6 leases to devices.
I'm using Mikrotik, which doesn't allow prefix-less addresses in firewall, but allows you to put hostnames into your rules (so it will ask DNS what the address is and once the ttl expires, it will ask again).
On some CPEs (I don't remember which), it allowed to enter mac addresses, so the forwarding would always work for specific device, with any GUA address.
But we have to remember, that all these solution are optional and brand-specific; there's a wide range of devices that do not have anything to solve this problem.