301–310 of 511 posts
Earlier quoted context omitted.
First thing I do setting up any network is disable ipv6. It's caused issues at least once, and that's one time too many for something that doesn't benefit me in any other way.
For me, the first thing is actually enabling ipv6
There's a reason most haven't moved to ipv6. ipv6 is a solution looking for a problem. What we really need is an ipv7 that takes the best of ipv4 and ipv6 instead of trying to force ipv6 down a reluctant user group.
It’s clear to me that IPv6 won’t reach critical mass (e.g. 80% of connected devices/servers using IPv6 addresses).
I’ll just wait for a new IP with an actual transition plan.
Earlier quoted context omitted.
I get that there are people in the world with severe lack of IPv4 addresses and this is a valid reason for them to switch to IPv6. However, assuming that I and my organization have enough IPv4 addresses (without requiring any of the tricks of multiple layers of NAT), is there a sufficient reason for us to justify the effort/expense of changing what works?
_You_ might not need to deal with the tricks of NAT, but more and more, your customers _do_. For example, I'm in the US, and my mobile device has an IPv4 IP sitting behind the mobile provider's CG-NAT. My mobile device also gets IPv6. Since you only provide your site over IPv4, that means my opinion of your site is governed in part by my ISP's CG-NAT, which you do not control. If the CG-NAT is overloaded, or otherwis…
Perhaps you will diagnose the issue as caused both by the combination of your ISP flaws and my choice to be IPv4, however, the vast majority of users definitely won't, they will notice that most of the web (i.e. IPv4 web) sucks for them but doesn't suck for other ISPs and will put on the pressure on your ISP to get their stuff working to properly support the IPv4 net (or take their business to another ISP) instead of putting the pressure on IPv4 sites to switch to IPv6 or taking their business to another site.
IPv4-only still has enough critical mass (and will have for quite a few years still) to ensure that 100% of ISPs in the world have to support decent service for IPv4 only servers; IPv6-only does not yet have enough critical mass to ensure that all or even half of servers have to support decent service for IPv6-only clients - this is a quite literal chicken-and-egg problem for the motivation to switch.
Is there any risks of nodes assigning same IP if there's no central DHCP?
Firstly, normally nodes base their automatic IPv6 address on their MAC address, so there will be no conflict between these, since MAC addresses are supposed to be unique to the hardware. Otherwise, it’s a random 64-bit number (actually a few less bits, but not many). It’s very unlikely a collision will happen. And even if it does, there is a protocol (Duplicate Address Detection) to detect it, and avoid it.
Is there any risks of nodes assigning same IP if there's no central DHCP?
Unlike in IPv4, in IPv6 there is a lower risk of nodes assigning the same IPv6 address if there's no central DHCP. This is because IPv6 uses a unique interface identifier (IID) that is automatically generated by the node based on its MAC address and a random value. This makes it highly unlikely that two nodes on the same network would generate the same IID and therefore, the same IPv6 address.
And thanks to Duplicate Address Detection, before a new randomly-generated IP is used, a check is made to ensure it is not in use by someone else.
Earlier quoted context omitted.
> Since DHCPv6 is apparently frowned upon by v6 purists, and not all devices on my network support it, that leaves SLAAC. The main hold out against DHCPv6 is Android: * https://issuetracker.google.com/issues/36949085
that thread is amazing. Google's stance makes me want to deploy DHCPv6 simply to spite them. I guarantee in 10 years when some Fortune 500 company or top 20 research university IT department, who has no idea about that thread, goes live with a DHCPv6-only IPv6 stack because it's very similar to their IPv4 network, and 30,000 users can't join their Android devices to the campus wifi, this attitude will change
Earlier quoted context omitted.
> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…
How does that protect privacy of the private network? I don't want to divulge any information about internal topology.
I'm curious to know: what (attack) do you hope to protect against?
I would think that most attacks come in two fashions: the first being that you run a service of some kind and that there's some JSP/PHP/whatever exploit for a public facing service, and someone does a 'magic' PUT/GET that has the application server execute some code, which downloads a larger malware attack package. After which point the black hats start scanning from the inside.
The second being that someone clicks on a link in a phishing e-mail or executes some attachment, after which malware code starts scanning from the inside and phones home.
(A third being an insider attack, who presumably know about internal topology.)
What attack are you thinking to protect against by hiding subnet and VLAN topology?
Earlier quoted context omitted.
With NAT it is impossible to make a mistake that causes machines with a private address to become reachable to the internet. That is a reality that is not going anywhere, no matter if you like it or not, no matter if you think it is stupid or not.
UPnP? Also STUN makes your private addresses reachable without you making any mistake at all. Your comment is a good example of the NAT cargo cult mentality that is damaging to the Internet.
The reality is that NAT has greatly improved the security of the internet, because before NAT people were exposing everything, including services like Windows file sharing, to the internet. NAT enabled those people to use multiple devices in their home and in return prevented them from unwittingly hosting things to the internet, which causes them to be hacked and turned into bots that harass the rest of the internet. Yes that still happens but not at the scale it happened before everyone was behind a NAT perimeter. If you want to see what could happen look up the SQL Slammer worm and imagine what could have happened if such a worm would have targeted a service more common than SQL Server.
It’s really nice to be able to host things on a consumer connection but it requires thought and management that most consumers just can’t and won’t care to provide and the damage they can cause is not only to themselves but to the rest of the internet as well. This capability really is better off by default.
And all those handwavy ‘workarounds’ for the ‘cargo cult mentality’, you typically can’t tell everyone on your network how to manage their computer to ‘just have their services listen on the local address’ and you can’t ‘just change the defaults of all routers’. But NAT makes it impossible for the default to be wrong and that is its great advantage.
Sure NAT has a lot of disadvantages and breaks the original idea of the internet with every host equally able to host services. But just as Postel’s law just doesn’t work out, every host being able to host services doesn’t work out. Because the internet is not a playground full of friendly colleagues and hasn’t been for a long time. It’s a war zone that requires strong, watertight defenses by default. And if you’re smart and careful enough to safely host a service to the internet, surely you can manage to forward a port.
I have built a couple of dual stack Kubernetes clusters already and they work much better to be honest. Most of the problems are solved and especially for node-based-ranges it works really well. Even in ipv6 only mode calico will manage amazingly and so do my OpenWRT routers. HOWEVER, My ISP regularly messes up with its ipv6 routing (deutsche Telekom (so as big as it can get for me) and if that's not the problem, the…
I got so fed up with IPv6 being either straight up unavailable or being deployed in a botched fashion by residential ISPs in my area in the last 10+ years that I picked up an ASN and a /44 last year. I advertise it from a VM on Vultr in a datacenter close to home and the experience is just amazing. I also got fed up with people discriminating against Hurricane Electric's tunnel broker (streaming services, etc) so now…
- What was involved with picking up the ASN and the IPv6 block of addresses (process, bureaucracy, initial and ongoing costs)?
- What networking plumbing is involved in being able to have homelab resources advertised to the internet?
I'm not an expert in this area, but I'd very much welcome the hard work that comes with reproducing such a setup. Thanks.
Earlier quoted context omitted.
And what computer is making what requests. Now that i think about it, this cloud be the reason why youtube started making recommendations based on stuff i just watched in private browser tabs...
I have multiple computers in the house, mostly not logged in to Google. YouTube recommendations spill between devices all the time - like, if I watch a video on one device, I’ll see the same video recommended on another. Or if my partner watches something, YouTube will recommend it to me. They’re obviously doing recommendations based on IP address. (And this is purely over ipv4).
I have IPv6 at home and connect to Youtube over IPv6 (that's generally the default behaviour on macOS and many other OSes). I reboot my DSL modem-router every night and get a new IPv4 address and new IPv6 prefix every day.
Now: I live in Ontario, and my ISP is based in Ontario, but they serve clients in Quebec. Every so often, when surfing Youtube, I get served ads in French because according to my (IPv6) address I am "in" Quebec.
And, while I am not logged into any Google service, I do not block cookies. So even with cookies, Youtube seems to be fairly dumb about serving ads correctly just based on IP addresses (or at least IPv6 addresses and/or IPv6 prefixes), since cookies don't seem to be useful.
So I'm not quite sure about what people are talking about when they say "IPv6 tracking" if even Google/Youtube can't get their act together.