Despite the article title, IPv6 is not the complication. The problem is that IPv4 is incumbent and IPv6 has to live along side of it. It doesn’t matter how it’s done, the dual stack nature of expanding the addressing system will always exist.
Why IPv6 is so complicated
371–380 of 519 posts
Re: Why IPv6 is so complicated
#372This is the only topic that tempts me to create a throwaway account. (I have not given in) None of the IPv6 proponents are willing to acknowledge that IPv6 is a pain.
All of them seem to have gone to some secret seminar somewhere where they receive their talking points:
- Everyone who dislikes IPv6 doesn't know how NAT works and thinks it's the same as a firewall.
- There's absolutely no downside whatsoever to being publicly addressable. (also this is a good time to reiterate that NO ONE understands that NAT is not a firewall)
- 128 bit addresses are exactly as convenient and memorable as as 32-bit addresses.
- The entire internet would be hosting home servers if not for the evils of NAT.
Re: Why IPv6 is so complicated
#373Article does not address the elephant: there is no ability to NAT with IPv6. Sure, absolutely, you shouldn't have to NAT, but in my datacenter, NAT is a feature, not a bug. The article specifically asks "did the ipv6 designers go mad" and then they list features I've never heard of or use to prove they didn't. Those features are not why I think they went mad. The inability to create a NAT is. For this reason, at ever…
but why do you want NAT? to hide whats in the datacentre?
I mean thats what reverse proxies are for, if you're that worried.
NAT doesn't give you anything useful, apart from the veneer of security. Sure it feels like your safe because there isnt a direct routable link between host A and the outside world, but thats not actually true.
If you want that, then you need firewalls and reverse proxies, even in IPv4.
Re: Why IPv6 is so complicated
#374Article does not address the elephant: there is no ability to NAT with IPv6. Sure, absolutely, you shouldn't have to NAT, but in my datacenter, NAT is a feature, not a bug. The article specifically asks "did the ipv6 designers go mad" and then they list features I've never heard of or use to prove they didn't. Those features are not why I think they went mad. The inability to create a NAT is. For this reason, at ever…
What exactly do you need NAT for with IPv6? Presumably, if you are operating an actual datacenter, you have a /48 or more.
NAT for IPv4 is a workaround for the scarcity of publicly routed addresses, nothing more. It bought us decades.
NAT for IPv6 does exist, but it's more often done with network prefix translation. If you want "security", you set up a firewall.
Re: Why IPv6 is so complicated
#375Earlier quoted context omitted.
> I administrate are contractually obligated to be so isolated Yeah, I've seen those contracts. They just reference a SeCuRiTy doc that's 20+ years old, and has never been re-evaluated. Things are secure because they follow the doc, not because they have actually evaluated the reasonable attack space. I've fighting customers for years on their ideas of proper TLS usage and it's always the same thing. They've got a se…
Ah-yup. The equivalent in my world is contracts that insist we make our employees rotate their passwords every 2 months or whatever, which was a popular (but still dumb) idea 20 years ago and is strongly recommended against today.
Yep. I get real tired of adding a month and year to the same base password every time I need to rotate it.
Re: Why IPv6 is so complicated
#376Article does not address the elephant: there is no ability to NAT with IPv6. Sure, absolutely, you shouldn't have to NAT, but in my datacenter, NAT is a feature, not a bug. The article specifically asks "did the ipv6 designers go mad" and then they list features I've never heard of or use to prove they didn't. Those features are not why I think they went mad. The inability to create a NAT is. For this reason, at ever…
I am reading about ipv6 nat. I guess it's possible but discouraged? This contention point confuses me. I consistently get downvoted for this opinion, and I've seen contrarian voices online, but I have yet to meet an actual datacenter network admin who disagrees with me.
I am one, also disagree with you. Ipv6 nat is possible. I dont find nat particularly useful inside a network and dont use it unless strictly required to solve a problem like shared internet access or overlapping IP addresses. Isolation is best handled with separate physical networks, vlan or firewalls.
Re: Why IPv6 is so complicated
#377I installed a new bare metal server from a european cloud provider this week. Both my clean Debian and the rescue system couldn’t reach internet through IPv6 despite getting an address through DHCP. I immediately permanently disabled IPV6. I usually do that pretty late in my installation scripts anyway. I understand the perfect solution didn’t exist and still doesn’t exist, but it’s frustrating. I wish IPv6 could wor…
You could have spent a bit of time on debugging the issue. This would have been a great learning opportunity.
It's supposed to Just Work on clean and rescue systems. Otherwise, it's a regression with respect to v4. The fact that it doesn't work is evidence that someone has been doing something wrong. The user at the receiving end of this clusterfuck is not that someone.
Re: Why IPv6 is so complicated
#378Earlier quoted context omitted.
> Its not just NAT, it's also DHCP. I'm not sure what you mean by "fix" DHCP and NAT, but FYI: RFC 3315 was published in 2003 . As far as NAT goes, it looks like iptables added IPv6 support to the MASQUERADE, SNAT, and DNAT targets in kernel version 3.7, released in 2012. IDK when other OSs added such support.
> I'm not sure what you mean by "fix" DHCP SLAAC was part of IPv6 since the original RFC, its a horribly over engineered stateless replacement of DHCP. Nobody asked for that.
> Nobody asked for that.
I mean thats not true. SLAAC is great for public/untrusted networks where you just let the clients figure that shit out.
the only thing thats a bummer is not being able to map DNS records to addresses, which is kinda the point, for privacy.
Re: Why IPv6 is so complicated
#379This is the only topic that tempts me to create a throwaway account. (I have not given in) None of the IPv6 proponents are willing to acknowledge that IPv6 is a pain. All of them seem to have gone to some secret seminar somewhere where they receive their talking points: - Everyone who dislikes IPv6 doesn't know how NAT works and thinks it's the same as a firewall. - There's absolutely no downside whatsoever to being…
You forgot important thing: There will always be some security guy yelling that leaking your internal IP structure is bad.
There will also be another clown that does IP whitelisting as security measure and refuses to just whitelist single /64|/24 network "because it is too wide" (I literally had this conversation last week with one of the clients)
> - The entire internet would be hosting home servers if not for the evils of NAT.
ISPs will find a way to fuck up
Re: Why IPv6 is so complicated
#380I installed a new bare metal server from a european cloud provider this week. Both my clean Debian and the rescue system couldn’t reach internet through IPv6 despite getting an address through DHCP. I immediately permanently disabled IPV6. I usually do that pretty late in my installation scripts anyway. I understand the perfect solution didn’t exist and still doesn’t exist, but it’s frustrating. I wish IPv6 could wor…
You could have spent a bit of time on debugging the issue. This would have been a great learning opportunity.
I agree, but debugging IPv6 issues is pretty far down on the list of things I want to learn.