Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

381–390 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#381

Post by mac-chaffee »

commandersaki wrote: post #298
mgbmtl wrote: post #38

Earlier quoted context omitted.

Here's an easy one for you: if you have a gigabit connection, most home routers can barely handle the load of NAT. That's why gamers push for IPv6. It's mentioned in the article but few people realize how inefficient NAT can be at gigabit and more. My ISP router could do max 800 mbps, which isn't so bad, but it degraded when we were multiple people using the link. With IPv6 it's much less of a problem, we can easily…

Haha bollocks. NAT adds probably at most 1 microsecond to the processing of packets. It’s state for a flow is roughly 16 bytes. The nonsense about NAT being inefficient or slow astounds me.

> The results show that rewriting the packets is quite a bit more expensive than just allowing or dropping a packet. For example, if we look at the unidirectional test with 10,000 flows, we see that we dropped from 14M pps [packets per second] to 3.2M pps, we also needed 13 cores more to do this!

https://atoonk.medium.com/linux-kernel-and-measuring-network...

Just speculating, but I believe the cost comes from all the memory operations of reading/editing/writing every packet, not from the NAT table lookup.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#383

Post by jeroenhd »

arka2147483647 wrote: post #378

Whenever i read these ipv6 discussions, i cant help to think there is a huge disconnect between users and designers of ipv6: - Designers think globally routable internet is a huge achievement - Users just want to hide their devices from the hellscape that is modern internet, with all its threats These are fundamentally different approaches

As a user, I like that my router doesn't need to alter my traffic mid transit to connect to outside networks.

With attacks like NAT slipstreaming your devices are already globally reachable in any real network anyway. That, or FTP/SIP doesn't work, because ALG exploitation can be mitigated by just disabling those protocols.

Just ask the average gamer behind CGNAT how they feel about the security NAT provides them (and what kind of NAT they need), or your average network application developer about the joys of setting up handshake servers to punch holes through NATs.

The curse that is NAT has led to ridiculous workarounds like Nintendo telling people to put their Nintendo Switch in the DMZ if multiplayer doesn't work.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#384

Post by arka2147483647 »

fulafel wrote: post #379
arka2147483647 wrote: post #378

Whenever i read these ipv6 discussions, i cant help to think there is a huge disconnect between users and designers of ipv6: - Designers think globally routable internet is a huge achievement - Users just want to hide their devices from the hellscape that is modern internet, with all its threats These are fundamentally different approaches

I'm a user and I think they are compatible requirements and support each other well. The alternative, having ambiguous addresses, makes systems hard to reason about and monitor, and add compplexity - eg when inevitably "internal" networks end up connected to each other in various kinds of reorganisations resulting in misconfigurations because nobody can tell anymore what the ambigous rule about a 10.xx address meant.…

Perhapse so, but i think psycologically, having your devices ’hide’ behind a NAT feels a lot more safe than having them out in the wild with only some firewall rules to protect them.

Secondarily, to many users both ipv6 routing and NAT are both incomprehensible. I think most home/sme IT admin people who have to maintain everything in their home/company are not in a position to learn everything about ipv6. Having a solution like NAT where you just cant connect from the outside (unless forwarded) really simplifies many things.

Many people are not in a position where they can understand networking fully.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#385

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #279
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

The article uses gaming and IPSEC as examples but not, say, ad servers and "tech" company websites or other websites desperate to collect data. Interesting coincidence. As the parent suggests, IPv6 creates more work to prevent more exfiltration. It is already difficult enough with IPv4. Could IPv6 fix a web infested with "tech" company intermediaries and return it to one where all participants can connect directly an…

Toward that end, CJDNS has been most interesting use of IPv6 I have seen to date.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#386

Post by speedgoose »

anderiv wrote: post #326
speedgoose wrote: post #157

Earlier quoted context omitted.

But you still need these mechanisms for the time being. And personally, I do like NAT. I'm not a fan of exposing my internal networks to the internet. Having everything hidden behind a single address is neat.

As has been discussed ad nauseam, getting rid of NAT does not mean all your hosts are exposed. You would still have a firewall, and managing that firewall is much more straightforward when one doesn’t have to deal with address or port translations.

But my internal network structure will still be exposed.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#387

Post by sgtnoodle »

kaetemi wrote: post #329
throw0101c wrote: post #160

Earlier quoted context omitted.

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…

My ISP's modem doesn't do prefix delegation so I don't even get IPv6 with my own router in-between. And I need that thing in-between to at least have some control over the IPv4 LAN. No idea what security that modem provides, since there are zero controls, so no IPv6 it is.

You could still route within the /64, couldn't you? With a smaller subnet SLAAC wouldn't work, but you could DHCPv6 addresses still. There is also an RFC somewhere for sharing a single /64, intended for mobile hotspots.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#388

Post by somerandomqaguy »

xnyanta wrote: post #212
dheera wrote: post #191

Earlier quoted context omitted.

And that's the problem! Who can memorize all that? I mean look, a few days ago Comcast had an outage and I plugged my phone into my USB port to tether it for internet access. It hijacked my DNS entirely, and I couldn't turn on my damn lights or change my thermostat which were on my LAN. Thankfully I know their LAN IPv4 addresses from memory, 10.10.10.x and 10.10.10.y, and I was able to issue CURL commands directly to…

> With IPv6 hell knows what their hex-colon monstrosities would be. You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

.... ?

Windows and many Linux distros by default enable the privacy extensions on the link local address; it's randomized for a period of time. This is right off a Windows 10 VM:

ipconfig:

  Link-local IPv6 Address . . . . . : fe80::9aaf:a280:d593:db1%2
Notice that there's no ff:fe in the middle of the address?

RHEL 9:

  [user@localhost ~]# ip addr | grep fe80
    inet6 fe80::3544:fe14:5cf:5ad9/64 scope link noprefixroute
Fedora Core 35:

  [user@fedora ~]$ ip addr | grep fe80
    inet6 fe80::7752:d2c6:82c3:482c/64 scope link noprefixroute
Ubuntu 22.04:

  user@ubuntu:~# ip addr | grep fe80
    inet6 fe80::5ffe:c565:9de2:58f8/64 scope link noprefixroute
I don't have a Debian right on hand but IIRC they do the same thing. Alpine uses EUI64 I think though.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#389

Post by jeroenhd »

My experience with IPv6 is that routing generally goes faster and the network breaks down less. The statelessness of it all just makes it work.

The fight between your average video game and NAT has caused me so many problems over the years (including port forwards to receive traffic because whatever NAT punching mechanism the game used didn't work).

Running dual stack does cause some weird debugging ("why can't my laptop connect to github while everything else works? Oh, DHCP broke") but that's mostly because of problems with the IPv4 part of the network.

I think going IPv6 only isn't the way, not yet anyway. DS-Lite seems to be working fine as a replacement, though: CGNAT for IPv4 and normal IPv6 for real connectivity. Full fat dual stacks would be better, but realistically I don't think that's going to be brought to the masses.

For hosting stuff, not having to remember what SSH port maps to which server in my home lab is a nice addition. Being able to directly reach LXC containers is also quite useful, as is using separate addresses for individual hosted services.

I don't know why everyone here has such terrible ISPs. Unstable IPv6 prefixes, broken routing, weird custom allocations, your ISPs all seem so cursed! No wonder people are so mad at IPv6, your ISPs are sabotaging your internet.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#390

Post by [deleted] »

Arnavion wrote: post #360
somerandomqaguy wrote: post #257

I've still got some misgivings about IPv6. Biggest one for me personally is that my current ISP doesn't give stable prefix. Power outages or firmware updates requiring a router reboot thus can cause the PD to be changed and potentially break firewall rules that are sensitive to the PD. In an absolute worst case, it also means that none of your hosts can reach the internet anymore if for whatever reason they're not up…

>Yes there are ways to mitigate (ULA, mDNS, DNS, DHCPv6, etc) but now you're introducing additional complexity that didn't exist before into the network when I keep hearing how Ipv6 is supposed to reduce complexity. ULAs are neither "additional complexity" nor "reduced complexity" compared to IPv4 NAT - they're the exact same. Both require you to decide on a private prefix, set up DHCP / DNS / static IPs within that…

[deleted]
Post reply on HN