Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

391–400 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#391

Post by noipv6 »

Dalewyn wrote: post #371
xnyanta wrote: post #366

Earlier quoted context omitted.

Adding A-F to the 0-9 existing digits in ip addresses makes them non-human readable? Give me a break. We've had something human-readable since the dawn of the internet: it's called DNS and works with both IP families.

Tell me Google DNS's IPv6 addresses without looking them up. I won't wait. Sometimes we need to deal with raw IP addresses instead of abstraction layers, and IPv6 fails hilariously because it clearly goes beyond the realm of direct human consumption. You saying a non-human readable thing is human readable if it's passed through an abstraction layer to make something human readable only reinforces the argument IPv6 is…

[dead]

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#392

Post by jeroenhd »

martinald wrote: post #317
wolrah wrote: post #42

Earlier quoted context omitted.

> I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The same exact way you do it right now. Think of NAT as an implicit default-deny firewall rule, that's all it's doing. Basically any firewall worth using will do exactly the same thing in IPv6, deny unsolicited inb…

But how does eg a device programmatically tell the firewall to allow traffic in in this case? This is done via UPNP on ipv4 NAT. If you're going to say there isn't a way and you need to add the firewall rules manually, then this is absolutely no improvement for 99%+ of consumer users who have absolutely no chance of understanding how to configure that. Think of for example Xbox users. On ipv4 with NAT it automaticall…

Every guide I see tells you to disable Upnp (or IGD, the part of UPNP that lets you open ports), for good reason. It's a protocol that just disables the security you thought you had before.

The reason Xboxes need port forwarding in the first place is that IPv4 relies on NAT. The unreliability and unpredictability of NAT means remote devices won't know what ports to talk to or if those ports will even be mapped to the right device. IPv6 removes that problem all together! It alleviates the need for 99% of the port forwarding cases that UPNP provides, assuming you've manually enabled it in the first place.

If port forwards are really necessary for Xboxes to work, then IPv6 brings another advantage: you can run multiple Xboxes behind the same IPv4 address. That IPv4 address can be your home connection, or it can be a thousand people behind CGNAT. In countries where CGNAT is the norm (India comes to mind) you can't possibly expect UPNP to be a requirement for Xbox to work!

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#393

Post by J-Kuhn »

jeroenhd wrote: post #389

My experience with IPv6 is that routing generally goes faster and the network breaks down less. The statelessness of it all just makes it work. The fight between your average video game and NAT has caused me so many problems over the years (including port forwards to receive traffic because whatever NAT punching mechanism the game used didn't work). Running dual stack does cause some weird debugging ("why can't my la…

I agree, IPv4 has its problems. That is why we transition to IPv6.

Dual Stack doesn't "solve" anything. You still run IPv4. With all the downsides, especially every machine will still need an (RFC 1918) IPv4 address.

(Microsoft is running out of their internal 10.0.0.0/8: https://www.arin.net/blog/2019/04/03/microsoft-works-toward-...)

The goal of the IPv6 transition is to disable IPv4. NAT64+DNS64 or 464XLAT allows us to disable IPv4 on devices before the entire internet is ready.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#394

Post by jbverschoor »

stephen_g wrote: post #353
jbverschoor wrote: post #320

Earlier quoted context omitted.

Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..

In any case, your endpoints really do need to be reasonably secure in themselves - especially if the firewall isn’t yours as then you are probably sharing the network with other devices on the inside of the network that can attack you directly, and even if not, it just takes one device being compromised and somebody has full inside access to the network, with the firewall not being able to do much…

Good luck with your home automation, printer, and tv

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#395

Post by jbverschoor »

viraptor wrote: post #362
jbverschoor wrote: post #320

Earlier quoted context omitted.

Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..

The same comment applies to ipv4. Port bindings accessible from outside by accident, misconfigured upnp, SIP-ALG with vulnerabilities, various other router issues. "What if my firewall is broken" is not a new ipv6 consideration.

It’s not, but the “beauty” of NAT is that you have an extra line of defense because of its limitations. Port bindings and upnp are far less impactful and less common.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#396

Post by jiggawatts »

barkingcat wrote: post #190
jiggawatts wrote: post #175

Earlier quoted context omitted.

Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. The “I don’t care if they track my household but it’s critical that Daddy’s activity not get disambiguated from my dealing daughter” is just not a valid reason to abandon the benefits of IPv6. Please stop with this line of argument. If you’re really desperate to ensure that the ads shown to your daughter are…

wait ... when you say nobody bothers ... that's a high bar. Most likely a ton of adtech companies are just drooling to use (or already are using) this type of correlation even if browsers leak more info.

https://xkcd.com/538/

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#397

Post by jiggawatts »

flangola7 wrote: post #214
jiggawatts wrote: post #175

Earlier quoted context omitted.

Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. The “I don’t care if they track my household but it’s critical that Daddy’s activity not get disambiguated from my dealing daughter” is just not a valid reason to abandon the benefits of IPv6. Please stop with this line of argument. If you’re really desperate to ensure that the ads shown to your daughter are…

> Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. If I told my security information officer "We don't protect against foreseeable threat X because we assume no one will bother to try X" she would not be very happy with me. When a valid data concern has been expressed and described, putting your head in the sand is the incorrect response. I want IPv4 to die…

https://xkcd.com/538/

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#398

Post by viraptor »

jbverschoor wrote: post #395
viraptor wrote: post #362

Earlier quoted context omitted.

The same comment applies to ipv4. Port bindings accessible from outside by accident, misconfigured upnp, SIP-ALG with vulnerabilities, various other router issues. "What if my firewall is broken" is not a new ipv6 consideration.

It’s not, but the “beauty” of NAT is that you have an extra line of defense because of its limitations. Port bindings and upnp are far less impactful and less common.

I'm not talking about preconfigured port mapping. I'm taking about bindings as in entries in NAT. That happens on every outbound connection and has stateful processing. We're still finding issues with it, like the relatively recent NAT Slipstream vulnerability.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#399

Post by otabdeveloper4 »

jcalvinowens wrote: post #107
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

There is no downside to everything to be globally routable. It's completely orthogonal to firewalling. What is the risk you're picturing here? I'm really curious. Features like RFC4941/8981 mean nobody can infer anything about your network from the source addresses they see making requests out if it. If you want to use link-local V6 addresses and NAT to a global one, you can do that. But IMHO that's sacrificing one o…

> There is no downside to everything to be globally routable.

Yes there is. I sure as fuck don't want random people from the Internet to know how many devices and what kind populate my home LAN.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#400

Post by justeleblanc »

Spivak wrote: post #261
justeleblanc wrote: post #152

Earlier quoted context omitted.

What kind of observer is 1. able to listen to the entirety of your network's outside communications, 2. interested at all in it, 3. harm you only on the condition that they "map out" your internal infrastructure? This isn't a novel, the goal is not to solve intricate security non-problems.

Your ISP, "mapping your network" means being able to take data that was previously an amalgam of a household and reliably split it into the individual members and devices for better targeting.

Unless you're part of the tiny percent of people who run their own router, your ISP can just monitor what goes through your ISP-provided router.
Post reply on HN