Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

321–330 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#321

Post by hot_gril »

aidenn0 wrote: post #273
MagicMoonlight wrote: post #194

We should just make an IPv5 which takes a current address: 216.3.128.12 and makes it 0.0.0.0.216.3.128.12 So any address of the current length you just treat it as if it has zeroes in front, otherwise you use the longer length which allows for many more addresses. Problem solved.

You're leaving out what happens if an ipv4 only host gets a packet from an ipv5 host. It only knows how to respond to a 4-byte address. If you manage to solve that problem, you'll probably have invented something a lot like NAT64, which TFA talks about.

Drops the packet and the sender retries with v4. Ipv6's solution to packet fragmentation has the hosts retry too, iirc. But I'm a little rusty on this subject; would this actually work?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#322

Post by [deleted] »

ajross wrote: post #65

> You should stop thinking of NAT as a security mechanism and think of it as the emergency address exhaustion prevention that it is. I hate this attitude. This is isomporphic to saying "stop thinking of system call interfaces as a security mechanism and think of them as an address space sharing mechanism". It's not technically wrong, but it's wrong in practice. Even the most naive NAT can't misroute an inbound packet…

[deleted]

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#323

Post by throw0101c »

gxt wrote: post #313
throw0101c wrote: post #307

Earlier quoted context omitted.

> How does that protect privacy of the private network? I don't want to divulge any information about internal topology. I'm curious to know: what (attack) do you hope to protect against? I would think that most attacks come in two fashions: the first being that you run a service of some kind and that there's some JSP/PHP/whatever exploit for a public facing service, and someone does a 'magic' PUT/GET that has the ap…

This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.

> […] that can exploit it via any other vector.

And what are those vector(s)?

Besides compromising a machine that is already inside per the above (which can then do scanning / lateral moves), or perhaps physically getting inside the premises (in which case a scanner can be physically installed to examine the network), what attack are you protecting against?

Can you give me a link about an attack that knowing the topology of the network ahead of time would allow, but that not knowing would prevent?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#324

Post by [deleted] »

welterde wrote: post #318
commandersaki wrote: post #302

Earlier quoted context omitted.

Whatever the next IP is, it needs to be interoperable with the Internet aka IPv4. It’s clear to me that IPv6 won’t reach critical mass (e.g. 80% of connected devices/servers using IPv6 addresses). I’ll just wait for a new IP with an actual transition plan.

The problem is that IPv4 is not forward-compatible and therefore there cannot be a protocol that is entirely interoperable. There can only be ones that are somewhat interoperable. And IPv6 has plenty of mechanisms that make things interoperable (NAT64, embedding ipv4 addresses in ipv6, etc.).

[deleted]

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#325

Post by ghshephard »

lxgr wrote: post #57
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> Everything on my network is going to go through my firewall anyway. Yes, and that's a very reasonable configuration. But UDP hole punching (very widely used for VoIP, online gaming etc.) works orders of magnitude better with IPv6 than with IPv4, since there is no address and port translation to worry about. With IPv4, it's very hit or miss, since it depends on both sides' NATs and also requires additional infrastru…

IPv6 Networks have Prefix Translation - but that's pretty mechanistic and not prone to the types of failures you see with PAT on IPv4.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#326

Post by anderiv »

speedgoose wrote: post #157
anderiv wrote: post #17

Earlier quoted context omitted.

It's not so much that the advantages of IPv6 are all that compelling. Rather, it's more that the mechanisms put in place to deal with a nearly-exhausted IPv4 pool (NAT, and CGNAT in particular, etc.) are not great, and any opportunity to negate the need for them ought to be pursued.

But you still need these mechanisms for the time being. And personally, I do like NAT. I'm not a fan of exposing my internal networks to the internet. Having everything hidden behind a single address is neat.

As has been discussed ad nauseam, getting rid of NAT does not mean all your hosts are exposed. You would still have a firewall, and managing that firewall is much more straightforward when one doesn’t have to deal with address or port translations.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#327

Post by hot_gril »

growse wrote: post #133
orcajerk wrote: post #131

There's a reason most haven't moved to ipv6. ipv6 is a solution looking for a problem. What we really need is an ipv7 that takes the best of ipv4 and ipv6 instead of trying to force ipv6 down a reluctant user group.

It's not that the reluctant user group doesn't like IPv6, they don't like change .

My public IPv4 is something like 14.63.323.85, private is 192.168.1.2 (others are .3, .4, etc), DNS is 1.1.1.1.

My public v6 would be like 2345:0425:2CA1:2020:1100:0567:5673:23b5, private is fc00::::903A:1C1A:E802:11E4, DNS 2606:4700:4700::1111 (don't forget those consecutive colons).

It's not that I don't like change, it's that I don't like changes that make things plainly worse for me.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#328

Post by mixdup »

somerandomqaguy wrote: post #257

I've still got some misgivings about IPv6. Biggest one for me personally is that my current ISP doesn't give stable prefix. Power outages or firmware updates requiring a router reboot thus can cause the PD to be changed and potentially break firewall rules that are sensitive to the PD. In an absolute worst case, it also means that none of your hosts can reach the internet anymore if for whatever reason they're not up…

Yeah, there are a lot of situations where NAT is actually preferable. Not everyone is going to need inbound ports, and the stability you get by having internal addresses is a feature, not a bug

Tie all your network config to your IP space provided by your ISP and now suddenly it's a pain to migrate to a different ISP

Or, if you want to carry your own IP space, now you have the administrative overhead of managing that (and, now you have to go with higher-end business internet service that may be more than you need, just to support bringing your own IPs)

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#329

Post by kaetemi »

throw0101c wrote: post #160
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…

My ISP's modem doesn't do prefix delegation so I don't even get IPv6 with my own router in-between. And I need that thing in-between to at least have some control over the IPv4 LAN. No idea what security that modem provides, since there are zero controls, so no IPv6 it is.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#330

Post by hot_gril »

jaywalk wrote: post #174
TekMol wrote: post #46

Earlier quoted context omitted.

I don't even know what type of connection I have. I only know the speed is way more than I need. fast.com says 50 "Mbps". Whatever that is.

You aren't qualified to speak on this topic. Sorry.

If NAT were an HN comment
Post reply on HN