Why IPv6 is so complicated • Hacker News Board

Re: Why IPv6 is so complicated

#341

Post by thayne » Sat, May 02, 2026, 7:03 PM UTC

hackthemack wrote: post #316

Plasmoid wrote: post #290

Earlier quoted context omitted.

> keeping backward operational compatibility It is not possible to be backwards compatibility with a larger address space

You are right that a 32 bit ipv4 stack can not understand a 64 bit packet format. The thing I am trying to get at is not native compatibility, it is operational compatibility via translation. I know, I know, you will probably say that is what ipv6 bridges do. But in an ipv42 type setup, you would have determnistic embedding so that every ipv4 address is represented inside the larger address space. This would allow tr…

> But in an ipv42 type setup, you would have determnistic embedding so that every ipv4 address is represented inside the larger address space

IPv6 supports that, but it ended up not getting used very much.

See https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechan...

Re: Why IPv6 is so complicated

#342

Post by thayne » Sat, May 02, 2026, 7:09 PM UTC

dreamcompiler wrote: post #336

I almost wish NAT had never been invented. It's a kludge that effectively added 16 bits to the IPv4 address space and delayed IPv6 as a result.

And it added those 16 bits in a way that causes a lot of problems

Re: Why IPv6 is so complicated

#343

Post by zadikian » Sat, May 02, 2026, 7:13 PM UTC

simoncion wrote: post #325

zadikian wrote: post #323

Earlier quoted context omitted.

The defaults determine what like 95% of users end up actually using, even if they have their own preference. Like you said, even if I wanted to use DHCP6, Android won't use it. My router also doesn't support it.

> My router also doesn't support it. I'm sorry your router sucks. If -for example- my router intermittently fucked up its IPv4 NAT and sent NATted packets into the Internet Bitbucket, it would be incorrect for me to claim that IPv4 NAT sucks or isn't supported by default. The correct claim would be that my router's NAT implementation sucks.

A router messing up IPv4 NAT would make it unusable for v4. My router still works with v6, just doesn't support an optional extension of it. (Idk if the v6 spec actually says DHCP is optional, but it de facto is because slaac isn't, likewise NAT isn't even part of v4 spec but a home router will need it.)

And it's not exactly a bad thing that most routers have only one right way to do v6 addressing. One thing that's explicitly optional in v6 is default-deny firewall, which is where those "v6 is insecure" "no you're just using it wrong" fights come from:

  REC-49: Internet gateways with IPv6 simple security capabilities MUST
   provide an easily selected configuration option that permits a
   "transparent mode" of operation that forwards all unsolicited flows
   regardless of forwarding direction, i.e., not to use the IPv6 simple
   security capabilities of the gateway.  The transparent mode of
   operation MAY be the default configuration.

You could say well the user is dumb for not changing this setting, but there's a point where you should blame the design instead of the user if it's not generating the desired outcome across many users. This also goes if you actually want the router to leave your inbound alone and let the devices do firewalling, cause your device isn't going to be reachable when you're on someone's default-deny network.

Re: Why IPv6 is so complicated

#344

Post by Veserv » Sat, May 02, 2026, 7:17 PM UTC

djha-skin wrote: post #297

Veserv wrote: post #283

Earlier quoted context omitted.

1. IPv6 does have NAT [1], NAT66. 2. NAT is totally orthogonal to IP and addressing. 3. NAT (as in transparent packet modification to rewrite addresses) is utterly idiotic. Ephemeral, anonymous address allocation with inbound filtering is smart, but transparently rewriting packets to do that is one of the dumbest possible ways prone to horrible compatibility and ossification issues as has been proven empirically. [1]…

Are you a network engineer?

I engineer and design network device drivers and network protocol stacks.

NAT is a terrible network protocol. The correct protocol would have been a DHCP extension giving you a 49-bit address where your IPv4 address constitutes a /32 with a 17-bit unique local address.

Re: Why IPv6 is so complicated

#345

Post by thayne » Sat, May 02, 2026, 7:19 PM UTC

djha-skin wrote: post #292

alfons_foobar wrote: post #289

Earlier quoted context omitted.

NAT is a crutch to circumvent the problem of "there are not enough addresses for each device". I _assume_ you are referring to a default deny inbound firewall (so that devices are not reachable from the outside), but these are very different, completely orthogonal concerns (and independent of the IP version in use).

Everyone I've talked to with this opinion are typically mobile devs thinking about cell phones. Ipv6 works great there, but NATs are often used in corporate networks for isolation and in particular obfuscation. You can't tell what's behind a NAT by inspecting traffic coming from inside it like you can with no NAT networks. Some of the networks I administrate are contractually obligated to be so isolated.

There isn't any reason you can't set up a NAT like that with ipv6.

Re: Why IPv6 is so complicated

#346

Post by simoncion » Sat, May 02, 2026, 7:20 PM UTC

ninkendo wrote: post #333

simoncion wrote: post #301

Earlier quoted context omitted.

> I think this is the biggest change with IPv6: that a machine’s IP addresses is no longer its identity, and you can’t easily predict what address will be used when connecting somewhere. Can't you unset the "Use autonomous addressing" bit and set the "Use DHCPv6 for addressing and other config" bit in your RAs, and then refuse to hand out anything other than DHCPv6 Normal Addresses? Or do OS's ignore the fact that Te…

IME nothing pays attention to when you set a flag to not do autonomous addressing. macOS and iOS don't respect it AFAICT, I don't recall what Linux does by default, but I don't remember having any success. But it's rather not really my point... best practices for IPv6 are to not do any of this, and you probably don't want to do it, because privacy addresses are an actually-important thing for privacy (so that sites c…

> IME nothing pays attention to when you set a flag to not do autonomous addressing.

When I unset the Autonomous flag, Linux does the right thing, at least on the systems I have at hand. Android does the right thing. My Playstation 5 does the right thing. I'd be shocked if Windows doesn't do the right thing. While I wouldn't be surprised to hear that Apple devices absolutely do the wrong thing -given Apple's long history with flagrantly doing the disruptively-wrong thing in regards to networking-, based on the results I'm seeing, I expect that Apple devices work just fine. I think you came to the wrong conclusions because you fucked up your test.

> ...privacy addresses are an actually-important thing for privacy (so that sites can't correlate you easily.)

As you allude to, The Web has eleventy billion ways to track you that give absolutely zero shits about your IP address. "Privacy" addresses buy the typical user of The Internet effectively zero privacy. January's deprecation of DHCPv6 "Temporary Addresses" suggests that folks who deploy this stuff believe that this feature is far less useful than proponents might think it to be. Plus, absolutely nothing prevents a DHCPv6 server from randomly generating the host part of the addresses it hands out, as well as handing out entirely new addresses for each address request. If I believed that "privacy" addresses actually provided any meaningful privacy, that's how I'd configure mine to behave for hosts that I wasn't intentionally providing fixed addresses.

Re: Why IPv6 is so complicated

#347

Post by hackthemack » Sat, May 02, 2026, 7:22 PM UTC

thayne wrote: post #341

hackthemack wrote: post #316

Earlier quoted context omitted.

You are right that a 32 bit ipv4 stack can not understand a 64 bit packet format. The thing I am trying to get at is not native compatibility, it is operational compatibility via translation. I know, I know, you will probably say that is what ipv6 bridges do. But in an ipv42 type setup, you would have determnistic embedding so that every ipv4 address is represented inside the larger address space. This would allow tr…

> But in an ipv42 type setup, you would have determnistic embedding so that every ipv4 address is represented inside the larger address space IPv6 supports that, but it ended up not getting used very much. See https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechan...

I remember reading about that a long time ago. I wonder why it never really caught on?

I think part of the problem is not so much a technical one, as a coordination issue. Who are you more likely to get on board? ISP and backbone providers. What is the path forward? Here is the recommended path forward, kind of thing.

Re: Why IPv6 is so complicated

#348

Post by zadikian » Sat, May 02, 2026, 7:22 PM UTC

Dylan16807 wrote: post #308

zadikian wrote: post #299

I disagree that it would've been just as hard anyway. The people who say "I just wanted v4 with more bits" have a point that most of these arguments completely ignore, but this one touches on it: Actually, we tried that: the "IPv4-Compatible IPv6 address" format was defined in [RFC3513] but deprecated by [RFC4291] because it turned out to be of no practical use for coexistence or transition. The practical use would'v…

Going all-in in what way? The only thing I can think of is making it easier to run your local network v6-only. But if you're translating at the router like that, you don't need any particular mappings.

I've clarified under another comment what I meant by that

Re: Why IPv6 is so complicated

#349

Post by thayne » Sat, May 02, 2026, 7:25 PM UTC

Galanwe wrote: post #276

djha-skin wrote: post #271

Article does not address the elephant: there is no ability to NAT with IPv6. Sure, absolutely, you shouldn't have to NAT, but in my datacenter, NAT is a feature, not a bug. The article specifically asks "did the ipv6 designers go mad" and then they list features I've never heard of or use to prove they didn't. Those features are not why I think they went mad. The inability to create a NAT is. For this reason, at ever…

Its not just NAT, it's also DHCP. Somehow the nerds creating IPv6 decided to not only add bytes (which is what people wanted), but also "fix" DHCP and NAT, which nobody asked for.

When ipv6 was first created DHCP and NAT were new and not widely deployed. They weren't trying to "fix" them, they solved the same problems independently.

And if you need NAT or DHCP, there isn't any reason you can't use them with ipv6. DHCP6 had been around for a long time.

Re: Why IPv6 is so complicated

#350

Post by djha-skin » Sat, May 02, 2026, 7:28 PM UTC

Veserv wrote: post #344

djha-skin wrote: post #297

Earlier quoted context omitted.

Are you a network engineer?

I engineer and design network device drivers and network protocol stacks. NAT is a terrible network protocol. The correct protocol would have been a DHCP extension giving you a 49-bit address where your IPv4 address constitutes a /32 with a 17-bit unique local address.

Fascinating. Would love to know more if you have a link.