I can trivially remember a bunch of ipv4 addressed, and recognize them at a glance (”oh that’s just our office vpn endpoint, that traffic is benign”). No hope of that with ipv6.
Tell HN: IPv6-only still pretty much unusable
271–280 of 649 posts
Re: Tell HN: IPv6-only still pretty much unusable
#272Earlier quoted context omitted.
> And regarding compatibility, with ipv4+ if you have a 0.0.0.0.x.x.x.x ip address you would be able to talk to both ipv4+ aware and legacy ipv4 devices natively without any tunneling (because you also own the legacy, non quad 0 ip address). This exists: > Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For…
Mayne RFC exists, but it os not used in teal world anywhere. In all servers, I configure IPv4 and IPv6 separately. Network setup is separate. DHCP daemons are separate. Firewall rules are separate. Network monitoring is separate. I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me.
Ok. How do you increase address space without breaking the protocol? IPv4 just doesn't have the space in the header. Something like "v4+" can't happen for this reason.
You could argue that pervasive use of NAT beginning in the late 90's was "v4+". It bought us decades of Internet growth, at the expense of true end-to-end connectivity.
Re: Tell HN: IPv6-only still pretty much unusable
#273Earlier quoted context omitted.
Any router running a poor NAT implementation (aka most of them) essentially has a built in firewall bypass for the right attacker. A naive NAT implementation can allow an attacker to bypass the firewall.
Curious, could you expand on this?
I gave an example just a few comments above this. Alice never wanted Charles' traffic, the firewall should not have let it through. But because the NAT is dumb, and the firewall rules are often tied to the NAT on these crappy home routers, it's allowed. So now because Alice wanted to talk to Bob, she opened a port to the world that she never wanted opened as wide.
Re: Tell HN: IPv6-only still pretty much unusable
#274IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…
> And regarding compatibility, with ipv4+ if you have a 0.0.0.0.x.x.x.x ip address you would be able to talk to both ipv4+ aware and legacy ipv4 devices natively without any tunneling (because you also own the legacy, non quad 0 ip address). This exists: > Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For…
> What makes you think that companies would have been willing to make the effort to deploy "IPv4+" any more than IPv6?
Way less resistance from tech teams. Ultimately companies are made of people, and ipv6 is partly a failure because working with it requires a wholly new skillset
Re: Tell HN: IPv6-only still pretty much unusable
#275I disabled IPv6 on my home network completely because it interferes with my use of my Raspberry Pi as a DNS blocker. I was never able to get DNS working properly, which, apparently, is intentional with regards to the IPv6 protocol. Meh.
It's not supposed to. My pihole blocks IPv6 just fine, whether it's being reached from an IPv4 or an IPv6 address. IPv6 has very little to do with DNS.
Re: Tell HN: IPv6-only still pretty much unusable
#276Earlier quoted context omitted.
That’s what I ended up doing, but it’s a major turn-off to learn this by trial and error, after setup scripts fail with seemingly unrelated messages.
Yeah, if any Hetzner reps are reading this thread, it would be great to put up a support page talking about NAT64, and link to it from the dashboard when creating IPv6-only instances.
And if any Github reps are reading this thread, put together a presence on IPv6. If Google can do it, so can Microsoft.
Re: Tell HN: IPv6-only still pretty much unusable
#277IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…
One of the ideas of ipv6 was to reduce routing tables, those tables that backbone providers have to keep in memory and look up for incoming traffic. With ipv4's fragmented allocation scheme, these routing tables are huge. With ipv6, even huge companies like amazon only have a couple of global allocations. A "ipv4 with more octets" scheme would have kept that fragmentation around. That being said, Amazon currently has…
I'm not up to date, but when I knew about this stuff the cost of memory for routing tables was only a tiny, tiny fraction of the cost of a network. Most of the cost is burying and maintaining fiber.
So unless something big has changed, it seems like a terrible choice to twist the whole system into uselessness to try to save a small amount of RAM cost.
Re: Tell HN: IPv6-only still pretty much unusable
#278Earlier quoted context omitted.
> If your business network is managed by "hey, this feature exists, let's see what happens if we turn it on" then your network admin needs to be more professional. I think this is why you don't understand how IP4+ would be easier. 99% of companies make their "IT guy" manage the network. They aren't network professionals. They are mostly desktop professionals who also get forced to manage the network and firewall. Sam…
If it's just "The IT guy", then IPv6 will work out of the box for outgoing traffic and will block all incoming traffic. This is why almost half of the USA is using IPv6 right now, it's just turned on by default. Hosting stuff is harder, but it's also that different. Theoretically, you can NAT IPv6 traffic to an IPv4 server inside your network no problem, but it's a pain and nobody really needs it anyway, so it's not…
I think you're missing the point. You're a network engineer and know what you are doing. Most people aren't.
IP4+ would be easier because it's more incremental and less change than IPv6.
Yes, there exists solutions to all the problems that IP4+ would solve, but the point is backwards compatibility and incremental change is always easier than doing something new.
Re: Tell HN: IPv6-only still pretty much unusable
#279Earlier quoted context omitted.
Let's not forget about the idea that ISPs would distribute a /56 range to residential users. You could split it in /64 ranges according to your requirements and everything would work fine. There is only one "minor" issue: all major ISPs in my country ( Brazil ) only provide a single /64. You can't get another /64 unless you upgrade to a very expensive business plan. That makes IPv6 not only useless but also a huge se…
RouterOS v7 supports DHCPv6 prefix delegation. You can request a delegated /64 per downstream interface and announce itself as router using these prefixes. You can still use your MikroTik device as router, stateful firewall, proxy. You don't have to mess with smaller than /64 allocations on links unless your provider forces a broken CPE on you that doesn't support DHCPv6 prefix delegation. Have you actually seen any…
Fritz!OS also does, it's used by many consumer routers in Germany.
There is of course also OpenWRT.
Re: Tell HN: IPv6-only still pretty much unusable
#280IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…
One of the ideas of ipv6 was to reduce routing tables, those tables that backbone providers have to keep in memory and look up for incoming traffic. With ipv4's fragmented allocation scheme, these routing tables are huge. With ipv6, even huge companies like amazon only have a couple of global allocations. A "ipv4 with more octets" scheme would have kept that fragmentation around. That being said, Amazon currently has…
> where your local address is horribly long, for the sake of global uniqueness, which is something that most people don't really need
Apart from debugging where you can copy-paste anyway, does it matter? I've got a few services on the local network and over zerotier that all talk IPv6. In the last 3 years or so I've never used an ipv6 address directly. There's enough DNS and discovery protocols that I never needed to.