Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

281–290 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#281

Post by cassianoleal »

kube-system wrote: post #207
wyager wrote: post #198

Earlier quoted context omitted.

> Or is it possible to allow access from my trusted network INTO the restricted network Yes, my home network works exactly like this. I have a vlan called "trusted" which can connect to any other vlan. One line in pf.conf. My VLANs are something like: trusted, guest, media, cameras, printer, etc. Many of these aren't allowed inbound or outbound connections (e.g. cameras and printer can only talk to things on their su…

There are mDNS repeaters that can in some cases make bonjour work across different networks. In my experience I spend more time fighting with mDNS than I do enjoying it.

I have avahi running on my router repeating mDNS across all VLANs. I can't recall the last time I had an issue with it.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#282

Post by hot_gril »

voytec wrote: post #251
hot_gril wrote: post #237

Earlier quoted context omitted.

I hope you're on the new version of everything then, not just in your area of expertise. You're expecting people to want something that's worse for them if anything, and calling them lazy isn't going to help. What would've helped is making IPv6 more user-friendly.

Not new version, but reliable version. I'm not a bleeding-edge fanatic, but I was testing IPv6 during the 6bone[1] phase while networking was not in my scope. It simply made sense to get to know the future. The person who's comment I was responding to, is in denial 20 years later because they feel comfortable with IP addresses they can remember. [1] https://en.wikipedia.org/wiki/6bone

20 years later, a lot of things still don't support IPv6, and "IP" commonly means v4 unless otherwise specified. v6 isn't the stable thing yet. Less involved users aren't concerned with much about IP other than the addresses, and v6 changes those when it didn't really have to, so this is what happens.

I think the other commenter and I would both happily adopt v6 if it gave us v4-style addresses.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#283

Post by bonsaibilly »

op00to wrote: post #256
IshKebab wrote: post #68

Earlier quoted context omitted.

In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.

Consumer NAT firewalls have uPnP enabled, right?

Sometimes. Sometimes it even works, too.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#284

Post by hot_gril »

Symbiote wrote: post #188
dheera wrote: post #185

Earlier quoted context omitted.

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9

No, it should usually look like v4, except in cases where you're using more address space and need to add more dots. NAT is here to stay, and a LAN doesn't need 128 bits of address space.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#285

Post by lmm »

thesuitonym wrote: post #125
jcalvinowens wrote: post #107

Earlier quoted context omitted.

There is no downside to everything to be globally routable. It's completely orthogonal to firewalling. What is the risk you're picturing here? I'm really curious. Features like RFC4941/8981 mean nobody can infer anything about your network from the source addresses they see making requests out if it. If you want to use link-local V6 addresses and NAT to a global one, you can do that. But IMHO that's sacrificing one o…

I'm not saying there's any downside, I'm just saying it's not the magic bullet "this is why you should use ipv6" that everyone seems to think it is. It's a complete non-issue that nobody really cares about.

People care as soon as it bites them. If I can't stream my music when I'm on my work VPN because the IPs are the same, that's a pain. If my wife and I can't game together online because we "have the same IP" that's a pain. There are all these little irritations that come from not having a global address, and they add up.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#286

Post by CaliforniaKarl »

gxt wrote: post #270
adgjlsfhk1 wrote: post #264

Earlier quoted context omitted.

what do you mean by topology? the only information leaked would be the number of computers making requests.

That is information about the topology.

It's fairly limited, without a lot of time and effort, or information from inside the network. I assume you're not acting as an AS, doing BGP, etc; and that you're just getting an IP allocation from a single ISP. In that case, you're probably getting an entire IPv6 subnet (like a /48) allocated to you. Ideally, you make the entire subnet available to your systems.

Assuming you block unsolicited packets (that is, packets not related to existing connections/streams) at your border (the connection to your ISP), then outsiders won't be able to use tools like traceroute to learn anything. All that an outsider has is an IPv6 IP, and since you're not doing BGP with anything, all they'll know to do is to send the traffic to your ISP.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#287

Post by lmm »

wankle wrote: post #245
davikr wrote: post #79

Earlier quoted context omitted.

To "avoid domination by huge centralized services", of course. What if you want to run something like a website from your own IP, but you can't because you're behind CGNAT?

I use a public VPS and Wireguard. Costs $3.50 for the VPS which has a static IP. I host on my laptop. I can take my laptop anywhere in the world there's an Internet connection and my email and web sites continue to work right from the same VPS IP because my laptop connects to the Wireguard server on my VPS when it comes up.

That $3.50 will go up and up as IPv4 addresses get scarcer.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#288

Post by josephg »

Faark wrote: post #266
adgjlsfhk1 wrote: post #264

Earlier quoted context omitted.

what do you mean by topology? the only information leaked would be the number of computers making requests.

And what computer is making what requests. Now that i think about it, this cloud be the reason why youtube started making recommendations based on stuff i just watched in private browser tabs...

I have multiple computers in the house, mostly not logged in to Google. YouTube recommendations spill between devices all the time - like, if I watch a video on one device, I’ll see the same video recommended on another. Or if my partner watches something, YouTube will recommend it to me.

They’re obviously doing recommendations based on IP address. (And this is purely over ipv4).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#290

Post by CaliforniaKarl »

drbawb wrote: post #234
petertodd wrote: post #96

Earlier quoted context omitted.

IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total globa…

EUI64 means that random space is effectively reduced to just 48-bits of real entropy, It's security through obscurity at best, i.e: not security. You shouldn't be relying on size of address space to protect you from anything. An IDS/IPS that alerts on abnormal ICMP behavior will be useful whether an attack is 1GiB of traffic in size or 1024EiB of traffic in size. (Also you don't even need automated scanning to find s…

Most systems aren't using EUI64. Within a subnet, they're using random addresses per RFC 4941. So, if I've got a /64 IPv6 allocation (which I do right now), that means I've got 64 bits of randomness to play with. Right now, my macOS system has four publicly-routable IPv6 IPs, all of which were randomly-generated, and which regularly regenerate.

I did not have to do anything to get this. My macOS system has IPv6 set to Automatic. My home ASUS router picks up the /64 allocation from my ISP, passes the info on to things on the LAN, and acts as a firewall for IPv6 (while continuing to act as a NAT for IPv4).

According to https://www.internetsociety.org/resources/deploy360/2014/pri..., this has been common for some time.

Post reply on HN