I spent a week without IPv4 to understand IPv6 transition mechanisms • Hacker News Board

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#421

Post by bert64 » Tue, Mar 07, 2023, 2:28 PM UTC

buzer wrote: post #209

joshspankit wrote: post #148

Earlier quoted context omitted.

Not without being entirely broken. I think you might be bringing in uPnP, DNZ, and other such features. NAT itself is more basic.

One could argue that if e.g. FTP is not working behind the NAT then the NAT is misconfigured. NAT needs to aware of certain protocols so that it can modify the application layer data. Of course, if the protocol added workaround for NAT and NAT is modifying that application layer data then it can cause another set of issues.

IP networking was designed with separate layers, NAT breaks this by having to span multiple layers. Generally NAT gateways only support TCP/UDP, other protocols are simply not supported, which has basically stifled protocol innovation (eg look at SCTP, it has some neat features but is hardly ever used because of NAT).

It gets even worse with higher level protocols like FTP. There is such a thing as FTPS (FTP over SSL) but it's rarely used because if you encrypt the traffic then the NAT gateway can't inspect and rewrite the traffic.

The same is true of IPSEC/ESP, if you have an encrypted TCP packet encapsulated with ESP the NAT gateway can't keep track of which internal host to forward it to because it can't see the source and destination ports.

A normal router does not need to care about anything further up the stack than IP. A firewall does, but even when a firewall doesn't explicitly support a particular protocol you could write a rule allowing any traffic with a particular protocol number between specific hosts is allowed, and anything else denied.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#422

Post by bert64 » Tue, Mar 07, 2023, 2:33 PM UTC

jlokier wrote: post #199

bityard wrote: post #92

Earlier quoted context omitted.

Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941

Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order. Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy ex…

That requires someone who has the ability to monitor all your traffic - ie the government, your ISP, or a hacker who has infiltrated one of those two.

In this scenario it's a lot more work trying to map out your infrastructure than to try performing a MITM connection against some of your outbound traffic.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#423

Post by KronisLV » Tue, Mar 07, 2023, 2:35 PM UTC

throw0101c wrote: post #160

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…

> Further, because you don't have only one external IP, you don't have to futz around with non-default ports if you want multiple instances of the same service (e.g., Minecraft), because each instance can have its own IP.

This is an interesting point though personally I love how easy container technologies made exposing arbitrary ports, without trying to configure the software itself, or checking whether it even supports customizing the port.

For example, I could have 3 database instances, each using 3306, but expose them on 30000, 30001 and 30002 or whatever I want.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#424

Post by bert64 » Tue, Mar 07, 2023, 2:36 PM UTC

zamnos wrote: post #402

justeleblanc wrote: post #400

Earlier quoted context omitted.

Unless you're part of the tiny percent of people who run their own router, your ISP can just monitor what goes through your ISP-provided router.

With the home router+wifi market estimated to be USD 2070.43 million in 2022, I wouldn't say it's a tiny percentage of people, just people you know.

Most people don't buy their own router, the ISPs bulk buy thousands of routers at a time. The ISPs make up most of the market.

Many of these routers are managed by the ISP using protocols such as TR-069, several ISPs have already been found to not only manage the devices but also monitor certain data including what devices are present.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#425

Post by welterde » Tue, Mar 07, 2023, 2:37 PM UTC

arka2147483647 wrote: post #378

Whenever i read these ipv6 discussions, i cant help to think there is a huge disconnect between users and designers of ipv6: - Designers think globally routable internet is a huge achievement - Users just want to hide their devices from the hellscape that is modern internet, with all its threats These are fundamentally different approaches

Except the devices are still quite well-hidden in IPv6 due to the large address space. Good luck scanning even a single /64 behind a normal home internet connection.

Only way around that is sniffing the communication (say some cloud service that some IoT device connects to) - which would also give you enough information to send your own packets through the NAT/firewall too. Not very feasible for the average attacker and assumes that the device initiates connections in the first place. If it doesn't, good luck finding it remotely.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#426

Post by bert64 » Tue, Mar 07, 2023, 2:44 PM UTC

michaelt wrote: post #62

tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

Pushing all your traffic through a third party cloud server causes a lot of problems.

It costs that third party real money to run that server...

What happens when they decide to shut if off because they no longer want to bear the costs? Your applications are a ticking timebomb...

What about privacy? What if the operator of that server decides to fund it through selling your data?

Sending your traffic through a third party server adds latency, sometimes a LOT of latency if that server is far away. This is very bad for certain latency sensitive things (gaming, calls etc).

If you're dependent on a third party server then you're screwed if it goes down, even if your own connection is fine.

Doing away with that and going back to peer to peer is MUCH better in most cases.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#427

Post by xnyanta » Tue, Mar 07, 2023, 2:49 PM UTC

somerandomqaguy wrote: post #388

xnyanta wrote: post #212

Earlier quoted context omitted.

> With IPv6 hell knows what their hex-colon monstrosities would be. You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

.... ? Windows and many Linux distros by default enable the privacy extensions on the link local address; it's randomized for a period of time. This is right off a Windows 10 VM: ipconfig: Link-local IPv6 Address . . . . . : fe80::9aaf:a280:d593:db1%2 Notice that there's no ff:fe in the middle of the address? RHEL 9: [user@localhost ~]# ip addr | grep fe80 inet6 fe80::3544:fe14:5cf:5ad9/64 scope link noprefixroute Fe…

Well, that is unfortunate because it invalidates a lot of the benefit of the link-local address while providing "pivacy" over the local link scope... I have not encountered any equipment in the wild that does this, thankfully. The only distros I use (NixOS and VyOS) do not have this behaviour by default so this was news to me.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#428

Post by bert64 » Tue, Mar 07, 2023, 2:50 PM UTC

BlueTemplar wrote: post #372

unethical_ban wrote: post #105

Earlier quoted context omitted.

If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address. The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or inco…

What I don't understand is why governments seemingly ignore this problem ?? Look at what they did with broadcast digital TV : it was announced that it would be illegal in a couple of years to sell hardware not compatible with the new standard, then a couple of years later on illegal to sell hardware compatible with the old standard...

Some are... China, India, Israel all mandate IPv6 support from ISPs in their territory and the equipment they provide to users, as do some others.

The US has mandated IPv6 support for federal contracts since 2009, although they don't get involved outside of those directly providing services to the government itself. They now have plans to go IPv6-only, and eliminate the use of legacy IP within the federal government.

Allocation of legacy address space was always based on first come first served, so developed countries got the lions share of address space and left developing countries with scraps. This creates a severe inequality, and holds developing countries back. This is also why India and China are leading, as they have a huge disparity between their population and the number of legacy addresses available.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#429

Post by bert64 » Tue, Mar 07, 2023, 3:01 PM UTC

tinus_hn wrote: post #308

tenebrisalietum wrote: post #167

Earlier quoted context omitted.

UPnP? Also STUN makes your private addresses reachable without you making any mistake at all. Your comment is a good example of the NAT cargo cult mentality that is damaging to the Internet.

Similarly, your comment is a good example of the anti NAT cargo cult mentality that people think is smart but really isn’t. The reality is that NAT has greatly improved the security of the internet, because before NAT people were exposing everything, including services like Windows file sharing, to the internet. NAT enabled those people to use multiple devices in their home and in return prevented them from unwitting…

Slammer (and other worms) propagated heavily despite NAT. If anything NAT made it worse, because once a single internal host got infected the worm now has a predictable and well known address space to scan for other devices it can infect.

NAT created a false sense of security, while also breaking a lot of other things. It is quite easy for the defaults to be wrong, you can end up with all kinds of unexpected scenarios which make internal hosts reachable - eg outbound traffic could open up inbound traffic on the same port from any source not just the one initially communicated with, UPNP can result in ports being opened, NAT slipstream attacks are another possibility, not to mention the fact that "not routable" and "there is no route" are two different things - someone who is on an adjacent network to your wan interface (ie other customers of the same isp) can easily direct traffic to your internal address space.

What reduced external attacks was not NAT, it was improved defaults - such as windows including a software firewall which blocks inbound connections by default, and unix based systems no longer shipping with large number of services (telnet, rpc, finger etc) enabled by default.

Consumer routers with IPv6 support don't allow unsolicited inbound traffic by default. Good luck scanning an IPv6 block in any case.

Slammer and other worms scanned sequential legacy IP addresses, including the well known and predictable RFC1918 space. This method simply couldn't work with IPv6 because the address space is too large, you would be flooding out huge amounts of traffic for years on end before you happened to hit upon an active device.

IPv6 is better, not worse.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#430

Post by bert64 » Tue, Mar 07, 2023, 3:08 PM UTC

daper wrote: post #64

I've given a try to IPv6 in a company with few tens on servers in a 2 DCs, an office + additional location, 3 ISPs in total. For me the real challenge is not just different way to write an IP address or doing NAT. The challenge is that IPv6 changes a lot of unexpected things: - Our ISPs support IPv6 but routing quality is way worse than IPv4 including occasional inability to connect to some networks or greater latenc…

There's no reason you wouldn't use a VPN in exactly the same way. Just because devices have routable addresses doesn't mean they will allow connections from arbitrary sources. You can configure them to only allow connections from your IPv6 VPN pool. On the other hand using globally unique IPv6 addresses means your VPN won't conflict with the source network where users are connecting from.

SLAAC can provide DNS configuration, see RFC6106 for instance.

You can do HA in the same way with VRRP or whatever too, as you point out the built in mechanisms are generally better but you don't necessarily have to use them.

The chance of traffic leaking still exists, and does happen a lot with legacy IP too. The difference is that with v6 the traffic will be routed back to you, so you will be able to see it on your border firewalls. With legacy IP, the traffic will be dropped by the ISP or absorbed by the local network so you don't know it's happening and consequently you probably won't try to do anything about it.