Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Customers Cannot Escape IPv4

tty.neveragain.de

Post reply on HN
Print view View original

301–310 of 316 posts

Re: AWS Customers Cannot Escape IPv4

#301

Post by mschuster91 »

jeroenhd wrote: post #300
mschuster91 wrote: post #215

Earlier quoted context omitted.

> ISPs can CGNAT for cheap The problem is customers don't like CGNAT. You can't run Animal Crossing on Nintendo Switch in network mode as a host if you don't place the Switch as a catch-all in the DMZ. Wish I were joking here - especially due to the security risk involved in running something in all-ports-open on the Internet - but Nintendo doesn't seem to (want to) run STUN/TURN servers.

Nintendo's hilariously bad Switch networking guides ("to make games work, forward ports 1-65535 to your switch") are more of a Nintendo problem than a CGNAT problem. Normally I'm all for blaming CGNAT for shitty internet issues, but Nintendo is at fault this time, and ISPs should rightly tell their customers to ask Nintendo to get its shit together. Even without CGNAT, STUN/TURN is important to get peer to peer conne…

> Normally I'm all for blaming CGNAT for shitty internet issues, but Nintendo is at fault this time, and ISPs should rightly tell their customers to ask Nintendo to get its shit together. Even without CGNAT, STUN/TURN is important to get peer to peer connections working.

I agree with you, but it doesn't change reality... Nintendo doesn't give a fuck and (from hearsay) people with Nintendo Switches make up a huge proportion of service calls from customers that want CGNAT disabled and pay for a legitimate IP address.

Re: AWS Customers Cannot Escape IPv4

#302

Post by icedchai »

otabdeveloper4 wrote: post #291
icedchai wrote: post #257

Earlier quoted context omitted.

You don't need private addresses. You may need non-routable addresses, but they do not need to come from a "private" network range.

A distinction without a difference. Private addresses are those that aren't globally routable by definition.

The difference becomes apparent when you connect or combine organizations using the same private range. It's a lot simpler to route networks (not globally, privately) when the ranges are unique. There's no NATs, double NATs, and other nonsense to deal with.

Even without this, it's a lot simpler administratively. I have about 20 AWS accounts, all with their own VPCs, all using the same 10.0.0.0 block because... well.. nobody thought about this. What do I do if they need to communicate? (They probably won't, but...)

Re: AWS Customers Cannot Escape IPv4

#303

Post by kevincox »

welder wrote: post #105

I use DigitalOcean... almost all their products support IPv6. Only floating IPs are IPv4, but can work around that by not destroying droplets so the IPv6 address doesn't change.

One annoyance I have is that IPv6 is disabled on VMs (droplets) by default. So every time you upgrade your Kubernetes cluster and it recreates every node they all have no IPv6 again with no way to change this. In the end I couldn't be bothered and just stopped rebooting every node after every update.

Re: AWS Customers Cannot Escape IPv4

#304

Post by kaliqt »

pkulak wrote: post #273
jvolkman wrote: post #237

Earlier quoted context omitted.

My favorite region isolation oversight was when someone realized that the perl cron job that iterated over every border router globally and applied ACL updates 2-3x per day didn't pay attention to isolation at all, and could easily have just started blackholing the entire network one device at a time if someone configured a bad rule. The mitigation was to sort routers by hostname which began with the regional airport…

Oh wonderful. 15 minutes to get the page, put down my beer, get on my computer, sign in to everything, get 2-factored 3 times AND figure out exactly what’s happening and fix it.

Chop chop!

Re: AWS Customers Cannot Escape IPv4

#305

Post by bradknowles »

icedchai wrote: post #88
jiggawatts wrote: post #7

Earlier quoted context omitted.

Azure is copying this wholesale. I've lost track of all of the "Private Endpoints", "Private Links", "Service Endpoints", "Private Resolvers" and "Virtual WAN" products they've introduced... all to make IPv4 work at scale. Literally none of those products would be required if they had just made IPv6 work properly. Instead, they NAT IPv6, so you can't even use it to avoid the NAT forced upon you by IPv4. They also rel…

A lot of IT folks are still fearful of IPv6. I've been on calls where people disable IPv6 as a matter of "best practice." It's sad. People will gladly learn the latest flavor of the month web framework but won't take time to gain experience with a fundamental protocol.

Some current Apple products still have problems with IPv6, and the standard practice is to disable it entirely.

I continue to do that on all my personal equipment.

Re: AWS Customers Cannot Escape IPv4

#306

Post by orangeboats »

otabdeveloper4 wrote: post #292
orangeboats wrote: post #277

Earlier quoted context omitted.

>exposing your LAN to public routing tables is madness And I don't understand why people think that. You are exposing a /64 network. That's 2^64 addresses, no one can scan your LAN if that's what you fear, nor can anyone reach your hosts if you build a stateful firewall that denies incoming connections - you know, just like NAT. But minus the packet modifications.

> no one can scan your LAN Are we really back to security by obscurity? Please don't tell me you are serious. Anyways, you can't rely on ISP's handing out sufficiently large network ranges to make your security-by-obscurity scheme work.

Are we not _already_ attempting security by obscurity at the very moment we talk about "exposing your LAN" as a supposed weakness of IPv6?

/64 is the smallest network your ISP can hand out, of course you can rely on that. Even my mobile phone is getting a /64 from my ISP.

Re: AWS Customers Cannot Escape IPv4

#307

Post by joshstrange »

icedchai wrote: post #88
jiggawatts wrote: post #7

Earlier quoted context omitted.

Azure is copying this wholesale. I've lost track of all of the "Private Endpoints", "Private Links", "Service Endpoints", "Private Resolvers" and "Virtual WAN" products they've introduced... all to make IPv4 work at scale. Literally none of those products would be required if they had just made IPv6 work properly. Instead, they NAT IPv6, so you can't even use it to avoid the NAT forced upon you by IPv4. They also rel…

A lot of IT folks are still fearful of IPv6. I've been on calls where people disable IPv6 as a matter of "best practice." It's sad. People will gladly learn the latest flavor of the month web framework but won't take time to gain experience with a fundamental protocol.

I probably fall into this bucket but I’ve seen disabling it fix very odd issue entirely too many times to write this off as just “sad”.

Learning a new framework doesn’t (often) break things for the end user in a way I can’t diagnose/reproduce. IPv6? Totally different ball of wax.

Also my ISP, a fiber gigabit provider and the best available in my region, doesn’t support IPv6. Until they, and others like them, get on board fully I don’t see customers having a snowball’s chance in hell of working cleaning with IPv6. I can only imagine how long it will take the shitty ISPs to fully support it.

Re: AWS Customers Cannot Escape IPv4

#308

Post by joshstrange »

Honestly IPv6 is a clusterfuck. From the horrible addresses (why are they impossible to memorize? Who thought that was a smart idea? At least I can wrap my brain around IPv4) to the need for specific support in literally every layer of the network stack.

If you are going to mention gateways or other methods make it work please just stop. No end-user is going to do that, or rather no appreciable amount of end users are going to do it. If your fix starts with “why don’t you just…” then please stop living in a fantasy world.

I was excited for IPv6 when it was announced, I was excited years later, I was excited a decade later, now I’m just tired of it. 2024, year of IPv6 and and the Linux desktop, ok sure. My ISP, literally the best available in my area and fairly cutting edge in every other aspect, has zero IPv6 support.

While the idea of every device having its own public IP address was attractive to a younger me, I look at it with a bit of horror now. The privacy/security aspects alone are staggering and you rarely want your device to be publicly available by default. I’m not going to exceed the 16M+ limit of 10.0.0.0/8 so I don’t see why I would ever want to use anything but IPv4 internally for my sanity. Are STUN/TURN servers fun? Is needing some central server ideal? No but the alternative (everyone can talk to everyone directly) makes my head hurt with the implications and footguns.

At the end of the day I’ve started disabling IPv6 as a matter of course. Leaving it on is a landmine I’m laying for my future self. I’ve dealt with too many issues directly myself or for clients/customers which end with “let’s try disabling IPv6, oh it’s working now?” (on my end or theirs) that I’m done. Something drastic would have the happen to get me to change that thinking and seeing how it’s been over 2 decades and major websites I use daily still don’t support IPv6 I’m not holding my breath.

Re: AWS Customers Cannot Escape IPv4

#309

Post by dharmab »

Dwedit wrote: post #172
mabbo wrote: post #104

Many years ago when I was a junior dev at Amazon, there was a massive project internally to split up every internal system into regional versions with limited gateways allowing calls between regions. The reason? We had run out of internal IPv4 addresses. The Principal PM in charge of the "regionalization" effort was asked in a Q&A "why didn't we just switch to IPv6?". Her answer was something along the lines of "The…

Out of IP addresses? Just use NAT.

Out of NAT sockets? Just use more IP addresses.
Post reply on HN