Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

361–370 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#361

Post by Arnavion »

generallee5686 wrote: post #359
somerandomqaguy wrote: post #257

I've still got some misgivings about IPv6. Biggest one for me personally is that my current ISP doesn't give stable prefix. Power outages or firmware updates requiring a router reboot thus can cause the PD to be changed and potentially break firewall rules that are sensitive to the PD. In an absolute worst case, it also means that none of your hosts can reach the internet anymore if for whatever reason they're not up…

This is the same reason I don't even bother with anything more than basic ipv6 internet access on my home network. I've made some attempts with using ULA but I could never get it to work right, even after multiple attempts. I wish there was something in the ipv6 standard that allowed referencing an ipv6 without the prefix on your local subnet (ie: :::10a1:da35:2f4d:3cfc). So you could do all your internal networking…

>I wish there was something in the ipv6 standard that allowed referencing an ipv6 without the prefix on your local subnet (ie: :::10a1:da35:2f4d:3cfc).

That's what the link-local address on your interface is for.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#362

Post by viraptor »

jbverschoor wrote: post #320
throw0101c wrote: post #160

Earlier quoted context omitted.

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…

Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..

The same comment applies to ipv4. Port bindings accessible from outside by accident, misconfigured upnp, SIP-ALG with vulnerabilities, various other router issues. "What if my firewall is broken" is not a new ipv6 consideration.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#363

Post by zoredache »

martinald wrote: post #317
wolrah wrote: post #42

Earlier quoted context omitted.

> I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The same exact way you do it right now. Think of NAT as an implicit default-deny firewall rule, that's all it's doing. Basically any firewall worth using will do exactly the same thing in IPv6, deny unsolicited inb…

But how does eg a device programmatically tell the firewall to allow traffic in in this case? This is done via UPNP on ipv4 NAT. If you're going to say there isn't a way and you need to add the firewall rules manually, then this is absolutely no improvement for 99%+ of consumer users who have absolutely no chance of understanding how to configure that. Think of for example Xbox users. On ipv4 with NAT it automaticall…

Lots router have UPNP disabled or blocked, and thing still work. UPNP isn't great.

First The firewalls are stateful. Client inside your network attempts to connect to some system outside. The firewall adds an entry to the state table with client ip, destination ip, protocol, ports, and so on. If an incoming packet is received by the firewall, the state table is checked. If there is an matching entry for the ips, proto, ports, etc, then the packet is forwarded. If there is no match the packet is dropped or rejected depending on your config. So it is easy to permit packets based on the interface it was received or transmitted on.

Ports can be opened for some incoming traffic pretty much the same with as IPv4 using STUN, TURN, and so on.

Past that, you can do manual port forwards the same way you do with IPv4.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#364

Post by mgbmtl »

jonathantf2 wrote: post #205
mgbmtl wrote: post #38

Earlier quoted context omitted.

Here's an easy one for you: if you have a gigabit connection, most home routers can barely handle the load of NAT. That's why gamers push for IPv6. It's mentioned in the article but few people realize how inefficient NAT can be at gigabit and more. My ISP router could do max 800 mbps, which isn't so bad, but it degraded when we were multiple people using the link. With IPv6 it's much less of a problem, we can easily…

I have a symmetrical gig connection, ISP doesn't provide IPv6. Can route full line speed using their router, no matter if it's 1 device or 50 connected. I don't know of a single game that supports IPv6, although some consoles might?

Yep, Xbox supports IPv6.

Maybe it's a ricer thing, but I definitely see a difference and I compared my ISP's router (which didn't display CPU load), an openwrt router without hw flow offloading support (horrible), and an UDM SE.

(I don't have an Xbox, I just see posts on my local ISP's forum)

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#365

Post by commandersaki »

welterde wrote: post #318
commandersaki wrote: post #302

Earlier quoted context omitted.

Whatever the next IP is, it needs to be interoperable with the Internet aka IPv4. It’s clear to me that IPv6 won’t reach critical mass (e.g. 80% of connected devices/servers using IPv6 addresses). I’ll just wait for a new IP with an actual transition plan.

The problem is that IPv4 is not forward-compatible and therefore there cannot be a protocol that is entirely interoperable. There can only be ones that are somewhat interoperable. And IPv6 has plenty of mechanisms that make things interoperable (NAT64, embedding ipv4 addresses in ipv6, etc.).

What we need is a pure 4 network to be able to talk to a 6 network - that's what it means to be interoperable. Going 6 to 4 is obviously required or otherwise 6 would be a useless protocol to begin with. Anycast routing plus tunnelling is one way to achieve 4 to 6. But the "ngtrans" team didn't accept this a transition plan, nor did they provide an official transition plan for migrating 4 to 6. Basically 6 has been a disaster since the days of IPng and misstep is ignored because they wanted a "clean slate" architecture with a large IP space that nobody really needs.

I'm holding out for a new protocol/architecture to come along and supplant IP by recognising that it needs to be fully interoperable with 4 before it can supersede it.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#366

Post by xnyanta »

Dalewyn wrote: post #356
xnyanta wrote: post #212

Earlier quoted context omitted.

> With IPv6 hell knows what their hex-colon monstrosities would be. You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

"Yes you would know exactly, because every hex-colon monstrosity has a predictable hex-colon monstrosity derived from its hex-colon monstrosity." If the problem wasn't obvious, the problem is that IPv6 addresses (and also MAC addresses) are not human readable. IPv4 addresses, on the other hand, are. IPv6 adoption might be farther along if the addresses were human readable instead of eye-rolling machinations of a smal…

Adding A-F to the 0-9 existing digits in ip addresses makes them non-human readable? Give me a break. We've had something human-readable since the dawn of the internet: it's called DNS and works with both IP families.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#367

Post by Miiko »

apearson wrote: post #352
hot_gril wrote: post #284

Earlier quoted context omitted.

No, it should usually look like v4, except in cases where you're using more address space and need to add more dots. NAT is here to stay, and a LAN doesn't need 128 bits of address space.

Like fd::1? Valid ipv6 that is shorter than an ipv4 address

Nah, "1.1" is a valid IPv4 address (Cloudflare DNS) and it's shorter

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#368

Post by [deleted] »

throw0101c wrote: post #323
gxt wrote: post #313

Earlier quoted context omitted.

This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.

> […] that can exploit it via any other vector. And what are those vector(s)? Besides compromising a machine that is already inside per the above (which can then do scanning / lateral moves), or perhaps physically getting inside the premises (in which case a scanner can be physically installed to examine the network), what attack are you protecting against ? Can you give me a link about an attack that knowing the top…

[deleted]

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#369

Post by foepys »

throw0101c wrote: post #307
gxt wrote: post #258

Earlier quoted context omitted.

How does that protect privacy of the private network? I don't want to divulge any information about internal topology.

> How does that protect privacy of the private network? I don't want to divulge any information about internal topology. I'm curious to know: what (attack) do you hope to protect against? I would think that most attacks come in two fashions: the first being that you run a service of some kind and that there's some JSP/PHP/whatever exploit for a public facing service, and someone does a 'magic' PUT/GET that has the ap…

DNS rebinding could be one attack scenario.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#370

Post by apearson »

Miiko wrote: post #367
apearson wrote: post #352

Earlier quoted context omitted.

Like fd::1? Valid ipv6 that is shorter than an ipv4 address

Nah, "1.1" is a valid IPv4 address (Cloudflare DNS) and it's shorter

Touché, I guess I should’ve said a typical v4 address. Short hand v4 addresses aren’t as common knowledge though
Post reply on HN