Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Customers Cannot Escape IPv4

tty.neveragain.de

Post reply on HN
Print view View original

281–290 of 316 posts

Re: AWS Customers Cannot Escape IPv4

#281

Post by klysm »

apparentorder wrote: post #140
Bluecobra wrote: post #85

> There is no concept of private addresses in IPv6, which means farewell to the Managed NAT Gateway and its magnificent pricing. Maybe not in AWS, but there are Unique Local IPv6 addresses in fc00::/7 and NAT66 if you really love NAT!

Yeah, I was referring to AWS; I should have made that clear. ULA is frequently discouraged though, and NAT66, well ... just no. I just recently heard that MS apparently has built everything IPv6 on Azure around NAT. This is so weird.

It’s the most Microsoft thing possible. That way they can charge you! How else are they supposed to rent seek?

Re: AWS Customers Cannot Escape IPv4

#282

Post by klysm »

dangus wrote: post #197

The moment you have a customer with crappy legacy infrastructure who refuses to allowlist anything but static IPV4 addresses, you have to support IPV4.

This shit boggles my mind. Whitelisting static IPs as a security measure has a terrible pain / added security ratio

Re: AWS Customers Cannot Escape IPv4

#283

Post by Shadowmist »

sgjohnson wrote: post #259
vasachi wrote: post #121

Earlier quoted context omitted.

What? Private networks are defined as networks, that use private address ranges[0]. They are most certainly not AWS "rhetoric". And why are unique MAC addresses a problem? [0] https://en.wikipedia.org/wiki/Private_network

Private address ranges doesn’t make a network private. Firewall does. If I know the external, publicly addressable IP address of your router (e.g. 135.77.9.106), and no firewall whatsoever, there’s nothing at all preventing me from doing `ip route add 10.0.0.0/8 135.77.9.106`, and voila, I’d have a route to your “private” network. Using private addresses vs globally unique offers no security benefiy whatsoever.

It only takes one, but most likely all the routers in between your network and the remote private network already drop the Martian packets, and you don’t have an interface directly connected to the remote private network, so the route you have configured would not work.

Re: AWS Customers Cannot Escape IPv4

#284

Post by Aeolun »

whoknew1122 wrote: post #173
rekoil wrote: post #166

Earlier quoted context omitted.

Tell me more about these "pizza teams".

The idea is internal teams should be no bigger than what can be fed by 2 pizzas.

It’s unfortunate when you have big eaters in your team, but I suppose you can just scale up your pizza.

Pepperoni.16xlarge

Re: AWS Customers Cannot Escape IPv4

#285

Post by Aeolun »

Varriount wrote: post #102
icedchai wrote: post #88

Earlier quoted context omitted.

A lot of IT folks are still fearful of IPv6. I've been on calls where people disable IPv6 as a matter of "best practice." It's sad. People will gladly learn the latest flavor of the month web framework but won't take time to gain experience with a fundamental protocol.

Why? What's the (supposed) fear?

In the case of my corporate VPN, Teams doesn’t work with IPv6 enabled. Something on either the MS side, or the SSO one.

Re: AWS Customers Cannot Escape IPv4

#286

Post by NovemberWhiskey »

apparentorder wrote: post #269
NovemberWhiskey wrote: post #194

> almost no AWS API can be used from a VPC without public IPv4 addresses Virtually every single application at the company I work at deploys into VPCs without public IPv4 addresses - this seems like a ridiculous claim.

As mentioned in the footnote, this can be done by using PrivateLink; it costs a few bucks too, but it is the way to go if your VPC does not (or must not, for Compliance™ reasons) have internet connectivity. If your target VPC has neither PrivateLink nor public IPv4 connectivity somewhere, I'm not sure how that would work; I'd love to learn how that was built.

Yeah, sure, we use PrivateLink. In my opinion, it's clickbait to say "almost no AWS API can be used from a VPC without public IPv4 addresses" with a footnote "actually most can if you use the service that enables that".

Re: AWS Customers Cannot Escape IPv4

#287

Post by taway1237 »

SoftTalker wrote: post #174
LinuxBender wrote: post #158

Earlier quoted context omitted.

FWIW this does not have to be true for companies that do not wish to expose internal nodes. I'm not even talking about the privacy extensions . I realize that people beat the drums that one must not NAT IPv6 but it can absolutely be a NAT just like IPv4. I would actually expect in most companies that they don't even add IPv6 inside their datacenters, rather they just put a block of IPv6 addresses on some load balance…

> In the early days of IPv4 many big companies did not NAT IPv4. I was at a company that did this. Our workstations all had routable public IPv4 addresses. A lot of big universities did this and even still do this to a large degree. They got huge IPv4 allocations early and there was no scarcity.

In my current company (related to academic institution that introduced internet to my country) every office workstation has FOUR public (but firewalled of course) IPv4 addresses. And every user has an unique VPN IPv4 address on top of that.

Re: AWS Customers Cannot Escape IPv4

#288

Post by taway1237 »

icedchai wrote: post #163
mr_mitm wrote: post #127

Earlier quoted context omitted.

It's definitely "best practice" to turn off features you don't need. Who knows, maybe in five years someone will find a bad bug in the implementation of the IPv6 stack, then you'll be glad you decreased your attack surface. Not saying this is what you should do, just a common rationalization.

It's also "best practice" to learn a new, foundational technology (like IPv6) sooner than later, perhaps less than 20 years after it was first available.

I know IPv6, just don't feel the need to use it. I prefer to have one firewall and public network interface to worry about. I can't disable IPv4 yet, so the logical solution is to disable IPv6.

Re: AWS Customers Cannot Escape IPv4

#289

Post by ninkendo »

icedchai wrote: post #161
talent_deprived wrote: post #153

Earlier quoted context omitted.

The biggest issue is IPv6 is a privacy, wide open wild west, there is no privacy on IPv6. Every device's IP is literally public, on the public Internet, 24/7. All so called privacy extensions or improvements do not change the lack of privacy of IPv6 and one more thing, the address structure sucks.

IP-based "privacy" is an illusion. With IPv4, your public IP (NAT router IP address) may not change for months, years, and possibly not until your change your router/MAC address. With IPv6 privacy extensions, your address changes regularly. This seems like an improvement.

> With IPv6 privacy extensions, your address changes regularly. This seems like an improvement.

Eh… If I was a company that wanted to use IP addresses to fingerprint users, IPv4 vs IPv6+privacy extensions both seem identical to me. Multiple requests from the same IPv4 address mean “someone, perhaps more than one person, from the same household/wifi”. Whereas multiple IPv6+privacy requests from the same /64 prefix means the same thing.

ie. You just consider the first 64 bits of the IP and can assume the same amount of information you already would assume from the IPv4 address. Just ignore the trailing 64 bits because it’s expected that they’ll be randomized/shuffled even from the same client.

Re: AWS Customers Cannot Escape IPv4

#290

Post by taway1237 »

sgjohnson wrote: post #260
otabdeveloper4 wrote: post #242

Earlier quoted context omitted.

You need both firewalls and private addresses, of course. Anything else is amateur hour madness.

> private addresses Private addresses offer no security benefit whatsoever. If you have no firewall, nothing at all prevents me from doing `ip route add 10.0.0.0/8 your.routers.ip.here`

Nothing prevents you from doing that, but your martian packets have zero chance of reaching my router.
Post reply on HN