Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

311–320 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#311

Post by CaliforniaKarl »

PeterisP wrote: post #303
CaliforniaKarl wrote: post #300

Earlier quoted context omitted.

_You_ might not need to deal with the tricks of NAT, but more and more, your customers _do_. For example, I'm in the US, and my mobile device has an IPv4 IP sitting behind the mobile provider's CG-NAT. My mobile device also gets IPv6. Since you only provide your site over IPv4, that means my opinion of your site is governed in part by my ISP's CG-NAT, which you do not control. If the CG-NAT is overloaded, or otherwis…

I disagree, because as of now the vast majority of top sites are IPv4-only (see e.g. http://www.delong.com/ipv6_alexa500.html for semi-fresh stats) so if someone gets bad experience on my IPv4 site, they will not assume that the problem is with my site, as that will match their overall experience with most sites on the web. Perhaps you will diagnose the issue as caused both by the combination of your ISP flaws and my…

I'm a little concerned about that site: For its test connecting to Google, besides using port 80 (instead of 443), it reports "500 Can't connect to google.com:80 (No route to host)". I just tested to Google IPv6 ports 80, and it works fine for me.

Regardless, Google's chart of IPv6 adoption (https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6...) continues to trend towards IPv6 adoption. I expect that if you looked at a chart of web site IPv6 adoption, it would also be trending upwards (though not at as steep a rate).

If that's true, then it stops being a chicken-and-egg problem, and turns in to a game of chicken: Who starts supporting IPv6 first, you or your competitors?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#312

Post by throw0101c »

mqus wrote: post #297
throw0101c wrote: post #162

Earlier quoted context omitted.

> Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). If you set up your device to spin up a new IPv6 address every hour (or even every minute), how will they track you using IPs? On macOS it's 24h, but it doesn't have to be: $ sysctl -a | grep temppltime net.inet6.ip6.temppltime: 86400

ipv4 with NAT gets you a new "adress"(meaning port) on every single new connection. I don't see IPv6 doing the same thing(it has no clue about connections)

> ipv4 with NAT gets you a new "adress"(meaning port) on every single new connection.

No one cares about tracking by port. Folks are tracking by IP(v4) address.

I know this first hand because I have my DSL router-modem auto-reboot every night (built-in Asus functionality), and I get all sorts of crazy results for ads: I'm in southern Ontario, as is my ISP, but they service folks in Quebec, and so sometimes I get Youtube ads in French since (per my IP) I'm "in" Quebec.

And given that I have IPv6, most OSes generally use that as a first preference for connectivity, and so my IPv6 address/prefix is "in" Quebec.

And this is even with cookies enabled, which should make tracking by browsing easier (esp. since I get decently-accurate recommendations based on viewing history), but yet I still get French ads because my IPv4/IPv6 address is "in" Quebec.

So I have no idea what people are talking about when they say IPv6 will make tracking easier than IPv4. With RFC 4941 it's a solved problem IMHO and no worse under dual-stack than it is under single-stack.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#313

Post by gxt »

throw0101c wrote: post #307
gxt wrote: post #258

Earlier quoted context omitted.

How does that protect privacy of the private network? I don't want to divulge any information about internal topology.

> How does that protect privacy of the private network? I don't want to divulge any information about internal topology. I'm curious to know: what (attack) do you hope to protect against? I would think that most attacks come in two fashions: the first being that you run a service of some kind and that there's some JSP/PHP/whatever exploit for a public facing service, and someone does a 'magic' PUT/GET that has the ap…

This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#314

Post by CircleSpokes »

r3trohack3r wrote: post #82
mavhc wrote: post #40

Earlier quoted context omitted.

NAT and a Firewall are two different concepts. What's wrong with a firewall that blocks everything by default, yet all your devices have a public IP?

> NAT and a Firewall are two different concepts. They are, but in practice they are muddled together and I suspect people are going to create subnets with IPv6 in the name of security. In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log ev…

>In IPv4 NAT is used to make sure your laptop isn't exposed to random script kiddies trying to scan for vulnerable services behind your router. A fun exercise is to plug a RaspberryPi up directly to a public facing IP address and log every packet it receives. Then give those scripts a few services to detect (HTTP server, SSH server, etc.) and look at how the traffic shifts from scanning for ports to scanning for vulnerabilities. Being connected directly to the public internet is a real eye opening experience.

That isn't really feasible with IPV6 though is it? The smallest IPV6 subnet is 18,446,744,073,709,551,616 addresses, so even if you setup a Pi fully open to the world with default passwords the chance of someone scanning it is basically zero. That type of scanning only works because the IPV4 range is so small (& you can efficiently ignore large parts of it like the US DOD space, private addresses, etc).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#315

Post by School-Cotton »

PeterisP wrote: post #303
CaliforniaKarl wrote: post #300

Earlier quoted context omitted.

_You_ might not need to deal with the tricks of NAT, but more and more, your customers _do_. For example, I'm in the US, and my mobile device has an IPv4 IP sitting behind the mobile provider's CG-NAT. My mobile device also gets IPv6. Since you only provide your site over IPv4, that means my opinion of your site is governed in part by my ISP's CG-NAT, which you do not control. If the CG-NAT is overloaded, or otherwis…

I disagree, because as of now the vast majority of top sites are IPv4-only (see e.g. http://www.delong.com/ipv6_alexa500.html for semi-fresh stats) so if someone gets bad experience on my IPv4 site, they will not assume that the problem is with my site, as that will match their overall experience with most sites on the web. Perhaps you will diagnose the issue as caused both by the combination of your ISP flaws and my…

That site's data-collection method must be misconfigured somehow. Google, Facebook, and Instagram are certainly all reachable via IPv6.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#316

Post by CircleSpokes »

wankle wrote: post #247
unethical_ban wrote: post #105

Earlier quoted context omitted.

If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address. The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or inco…

IPv4 cuts it everywhere. IPv6 does not do anything to save the planet. IPv6 does have privacy concerns stated by many on this page. IPv6 could be shut down tomorrow and the Internet would continue working well.

No it wouldn't. Basically all mobile networks would break and have to do even more layers of NAT to meet demand.

> IPv6 does not do anything to save the planet.

The world doesn't have enough IPV4 addresses. It literally solves the problem. It is crazy to me so many people here are arguing for multileveled NAT instead of the obvious solution we have had for 20 years.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#317

Post by martinald »

wolrah wrote: post #42
soebbing wrote: post #8

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

> I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The same exact way you do it right now. Think of NAT as an implicit default-deny firewall rule, that's all it's doing. Basically any firewall worth using will do exactly the same thing in IPv6, deny unsolicited inb…

But how does eg a device programmatically tell the firewall to allow traffic in in this case? This is done via UPNP on ipv4 NAT.

If you're going to say there isn't a way and you need to add the firewall rules manually, then this is absolutely no improvement for 99%+ of consumer users who have absolutely no chance of understanding how to configure that.

Think of for example Xbox users. On ipv4 with NAT it automatically configures it for serving games using upnp. If you had ipv6 only with a default deny rule and no upnp equivalent then the Xbox cannot open itself up to incoming connections. It's actually a downgrade in terms of "P2P" connectivity from NAT.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#318

Post by welterde »

commandersaki wrote: post #302
orcajerk wrote: post #131

There's a reason most haven't moved to ipv6. ipv6 is a solution looking for a problem. What we really need is an ipv7 that takes the best of ipv4 and ipv6 instead of trying to force ipv6 down a reluctant user group.

Whatever the next IP is, it needs to be interoperable with the Internet aka IPv4. It’s clear to me that IPv6 won’t reach critical mass (e.g. 80% of connected devices/servers using IPv6 addresses). I’ll just wait for a new IP with an actual transition plan.

The problem is that IPv4 is not forward-compatible and therefore there cannot be a protocol that is entirely interoperable. There can only be ones that are somewhat interoperable. And IPv6 has plenty of mechanisms that make things interoperable (NAT64, embedding ipv4 addresses in ipv6, etc.).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#319

Post by artdigital »

daper wrote: post #64

I've given a try to IPv6 in a company with few tens on servers in a 2 DCs, an office + additional location, 3 ISPs in total. For me the real challenge is not just different way to write an IP address or doing NAT. The challenge is that IPv6 changes a lot of unexpected things: - Our ISPs support IPv6 but routing quality is way worse than IPv4 including occasional inability to connect to some networks or greater latenc…

> You have to be careful with site-to-site VPN since even your internal services like database are now globally addressable. You really need proper firewall rules / routing policies to not leak unencrypted packets over internet.

Uhmm I might be wrong here, but can’t you just not assign global IPv6s then? Keep your local network on ULAs (https://en.wikipedia.org/wiki/Unique_local_address) for network-internal routing

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#320

Post by jbverschoor »

throw0101c wrote: post #160
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…

Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..
Post reply on HN