Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

351–360 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#351

Post by hot_gril »

b0afc375b5 wrote: post #334
hot_gril wrote: post #172

Earlier quoted context omitted.

First thing I do setting up any network is disable ipv6. It's caused issues at least once, and that's one time too many for something that doesn't benefit me in any other way.

On my linux machine, dns queries would sometimes last 5 seconds with ipv6 enabled. It made my internet surfing experience extremely frustrating. Disabling ipv6 resolved this issue. Don't really understand networks yet, but I guess it was because my isp doesn't support ipv6, but linux kept defaulting to ipv6 before trying ipv4.

Most likely your DNS (which may be the ISP default) is bad at handling ipv6 queries, solvable by switching to Cloudflare DNS or something. If you care. Probably neither of us would bother.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#352

Post by apearson »

hot_gril wrote: post #284
Symbiote wrote: post #188

Earlier quoted context omitted.

If you would like to write IPv6 addresses in the same style as IPv4, they would look something like 208.255.238.250.0.16.239.109.89.54.222.189.74.21.22.9

No, it should usually look like v4, except in cases where you're using more address space and need to add more dots. NAT is here to stay, and a LAN doesn't need 128 bits of address space.

Like fd::1? Valid ipv6 that is shorter than an ipv4 address

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#353

Post by stephen_g »

jbverschoor wrote: post #320
throw0101c wrote: post #160

Earlier quoted context omitted.

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…

Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..

In any case, your endpoints really do need to be reasonably secure in themselves - especially if the firewall isn’t yours as then you are probably sharing the network with other devices on the inside of the network that can attack you directly, and even if not, it just takes one device being compromised and somebody has full inside access to the network, with the firewall not being able to do much…

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#354

Post by trissylegs »

sp0ck wrote: post #97

My experience with IPv6. I have option to enable full dual stack with my ISP. After doing this I noticed that YT/FB/Google were significantly faster, however my kids started to complaing that some games began to have connectivity issues. Minecraft have problems to start. On a number of sites load time was noticebly longer. Switching off IPv6 as a experiment on one of kids PC solved all issues. My conslusion is that i…

A similar anecdote is I couldn't download podcasts from iHeartRadio. Either through pocket casts or thier website. Also twitter went very slow.

I think it was an ISP issue. At the time IP6 was in beta. Now it's enabled for everyone and the issues stopped happening.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#355

Post by willbudd »

mixdup wrote: post #328
somerandomqaguy wrote: post #257

I've still got some misgivings about IPv6. Biggest one for me personally is that my current ISP doesn't give stable prefix. Power outages or firmware updates requiring a router reboot thus can cause the PD to be changed and potentially break firewall rules that are sensitive to the PD. In an absolute worst case, it also means that none of your hosts can reach the internet anymore if for whatever reason they're not up…

Yeah, there are a lot of situations where NAT is actually preferable. Not everyone is going to need inbound ports, and the stability you get by having internal addresses is a feature, not a bug Tie all your network config to your IP space provided by your ISP and now suddenly it's a pain to migrate to a different ISP Or, if you want to carry your own IP space, now you have the administrative overhead of managing that…

I feel like if you want a robust ID for your machines, using DNS instead of hardcoded IP adresses is a better idea. That way you can move services from edge to cloud and vice versa with a single nameserver update, instead of having to do so on every single edge.

Or, if you want to keep things local, run a lightweight nameserver on your LAN to resolve .home or .lan domains. Much nicer to type fridge.home in your browser than 192.168.1.57 or some such.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#356

Post by Dalewyn »

xnyanta wrote: post #212
dheera wrote: post #191

Earlier quoted context omitted.

And that's the problem! Who can memorize all that? I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to…

> With IPv6 hell knows what their hex-colon monstrosities would be. You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

"Yes you would know exactly, because every hex-colon monstrosity has a predictable hex-colon monstrosity derived from its hex-colon monstrosity."

If the problem wasn't obvious, the problem is that IPv6 addresses (and also MAC addresses) are not human readable. IPv4 addresses, on the other hand, are.

IPv6 adoption might be farther along if the addresses were human readable instead of eye-rolling machinations of a small subset of people who speak strictly in hexes.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#357

Post by stephen_g »

AnonymousPlanet wrote: post #56
dale_glass wrote: post #53

Earlier quoted context omitted.

It just makes little sense. With IPv6 instead of NAT deciding that port 2000 maps to 192.168.1.3 port 22, you have a firewall that may or not choose to route to xx:yy:zz or not, and to allow an incoming connection over port 22 to that host or not. If you don't want to accept incoming connections to a given machine or network on IPv6 without NAT that's very easy to have.

Maybe people don't want to disclose the number and purposes of interior machines?

My network would look like it has dozens of machines, since everything is periodically rotating its IP randomly around the subnet, and often have multiple IP addresses at once with privacy extensions…

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#358

Post by zoredache »

magicalhippo wrote: post #179
jesterpm wrote: post #122

Earlier quoted context omitted.

RA (Router Advertisement) handles announcing the prefix for SLAAC addresses and DNS.

But not other services like NTP, so DHCPv6 is still needed.

Create a DNS name ntp.yourdomain.example.org that points at your internal ntp servers.

Configure your ntp clients to use the name, and maybe add a pool.ntp.org entry or two into your configs.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#359

Post by generallee5686 »

somerandomqaguy wrote: post #257

I've still got some misgivings about IPv6. Biggest one for me personally is that my current ISP doesn't give stable prefix. Power outages or firmware updates requiring a router reboot thus can cause the PD to be changed and potentially break firewall rules that are sensitive to the PD. In an absolute worst case, it also means that none of your hosts can reach the internet anymore if for whatever reason they're not up…

This is the same reason I don't even bother with anything more than basic ipv6 internet access on my home network. I've made some attempts with using ULA but I could never get it to work right, even after multiple attempts.

I wish there was something in the ipv6 standard that allowed referencing an ipv6 without the prefix on your local subnet (ie: :::10a1:da35:2f4d:3cfc). So you could do all your internal networking with the consistent suffix and just deal with the changing prefix the same way we do with a dynamic ipv4 addresses, dynamic DNS. I'm certain there's a reason something like this couldn't be possible but it just seems like something along these lines is missing.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#360

Post by Arnavion »

somerandomqaguy wrote: post #257

I've still got some misgivings about IPv6. Biggest one for me personally is that my current ISP doesn't give stable prefix. Power outages or firmware updates requiring a router reboot thus can cause the PD to be changed and potentially break firewall rules that are sensitive to the PD. In an absolute worst case, it also means that none of your hosts can reach the internet anymore if for whatever reason they're not up…

>Yes there are ways to mitigate (ULA, mDNS, DNS, DHCPv6, etc) but now you're introducing additional complexity that didn't exist before into the network when I keep hearing how Ipv6 is supposed to reduce complexity.

ULAs are neither "additional complexity" nor "reduced complexity" compared to IPv4 NAT - they're the exact same. Both require you to decide on a private prefix, set up DHCP / DNS / static IPs within that prefix, and set up translation for that prefix.

>Other issue I can think of off the top of my head is how to deal with an organization that would requires multi-WAN fail over or load balancing?

Exactly the same, ULAs.

Post reply on HN