Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

431–440 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#431

Post by BlueTemplar »

bert64 wrote: post #428
BlueTemplar wrote: post #372

Earlier quoted context omitted.

What I don't understand is why governments seemingly ignore this problem ?? Look at what they did with broadcast digital TV : it was announced that it would be illegal in a couple of years to sell hardware not compatible with the new standard, then a couple of years later on illegal to sell hardware compatible with the old standard...

Some are... China, India, Israel all mandate IPv6 support from ISPs in their territory and the equipment they provide to users, as do some others. The US has mandated IPv6 support for federal contracts since 2009, although they don't get involved outside of those directly providing services to the government itself. They now have plans to go IPv6-only, and eliminate the use of legacy IP within the federal government.…

Yeah, though I've heard that Africa is being left out, once again ?

(Though the sooner we ban IPv4, the sooner they will stop using it too...)

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#432

Post by kaetemi »

sgtnoodle wrote: post #387
kaetemi wrote: post #329

Earlier quoted context omitted.

My ISP's modem doesn't do prefix delegation so I don't even get IPv6 with my own router in-between. And I need that thing in-between to at least have some control over the IPv4 LAN. No idea what security that modem provides, since there are zero controls, so no IPv6 it is.

You could still route within the /64, couldn't you? With a smaller subnet SLAAC wouldn't work, but you could DHCPv6 addresses still. There is also an RFC somewhere for sharing a single /64, intended for mobile hotspots.

No idea. I've tried every setting combination on this consumer grade D-Link router which is supposed to support IPv6. Nothing results in a functioning network. Forum posts I find from other customers of this ISP report the same behaviour on other routers. The modem gets a /56 at least, and hands out addresses from a /64 range under that I assume, the router gets a /128 from the modem, and then gives up entirely on doing anything with IPv6.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#433

Post by bert64 »

dheera wrote: post #185
superkuh wrote: post #182

>There seems to be a lack of drive (judging by forum posts) to enable IPv6 on internet services by admins, either because they don’t care to, or it’s more work to manage a public IPv4 and public IPv6 presence If you run a mailserver adding ipv6 support is far more risk to your domain's mailserver reputation than it is worth. And if you're just a human person and not a megacorp that new ipv6 address, even if it it doe…

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

You're thinking small..

In an organisation of any significant size, remembering legacy IP is much worse than v6.

Chances are you will have lots of disparate legacy blocks, some starting 1.x, some starting 80.x etc. Then you have all the RFC1918 space, and the possibility of overlapping address space in different areas of the business. Then you have to keep track of translations, so an internal address 10.1.1.1 could have an external address of 80.1.1.1 but only on port 25, if you're talking over port 443 then actually the traffic is forwarded to 192.168.1.1 instead.

IPv6 is simpler. You have a single prefix for your company, eg 2001:db8:: Then you split it out in a sensible hierarchical way, for instance 2001:db8:1:: is your facility in the US, 2001:db8:2:: is your facility in Canada etc. Beyond that you go down to VLANs and hosts as needed.

So 2001:db8:2:25::1 is a device in your toronto data center... 80.1.1.1 is where?!?!? 192.168.1.1 is where?!? and which one did you mean?!?!

Then there's no NAT, no address overlap, much simpler. 2001:db8:2:25::1 is the same device wether you're talking to it on port 1 or port 65535. Your firewall rules are simpler and more secure as a result.

Microsoft had a presentation about this, and they are a bigger organisation than most.

If you're only small then you don't care, technologies like SLAAC and MDNS exist for exactly this reason.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#434

Post by bert64 »

somerandomqaguy wrote: post #388
xnyanta wrote: post #212

Earlier quoted context omitted.

> With IPv6 hell knows what their hex-colon monstrosities would be. You would know exactly, because every IPv6-enabled interface has a link-local predictable IPv6 address derived from its MAC address.

.... ? Windows and many Linux distros by default enable the privacy extensions on the link local address; it's randomized for a period of time. This is right off a Windows 10 VM: ipconfig: Link-local IPv6 Address . . . . . : fe80::9aaf:a280:d593:db1%2 Notice that there's no ff:fe in the middle of the address? RHEL 9: [user@localhost ~]# ip addr | grep fe80 inet6 fe80::3544:fe14:5cf:5ad9/64 scope link noprefixroute Fe…

The link-local address is generated when you first enable the interface (ie when you load the drivers for your NIC), it won't change unless you manually force it to.

Linux will use EUI-64 if left to its own devices, or privacy extensions if you're using something like networkmanager. This makes sense because a desktop oriented distro will typically use networkmanager while a server oriented distro will not, and having a predictable eui-64 address is usually beneficial for a server.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#435

Post by bert64 »

Dalewyn wrote: post #371
xnyanta wrote: post #366

Earlier quoted context omitted.

Adding A-F to the 0-9 existing digits in ip addresses makes them non-human readable? Give me a break. We've had something human-readable since the dawn of the internet: it's called DNS and works with both IP families.

Tell me Google DNS's IPv6 addresses without looking them up. I won't wait. Sometimes we need to deal with raw IP addresses instead of abstraction layers, and IPv6 fails hilariously because it clearly goes beyond the realm of direct human consumption. You saying a non-human readable thing is human readable if it's passed through an abstraction layer to make something human readable only reinforces the argument IPv6 is…

The way you see legacy IP addresses is also an abstraction layer, their actual form is as a 32bit integer.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#436

Post by bert64 »

SoftTalker wrote: post #260
dheera wrote: post #185

Earlier quoted context omitted.

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

Yep I’m in your camp. I have zero problems using IPv4 (and NAT when necessary), unless and until that stops working I’m staying with it.

Newspapers still work.. Why are you here at all instead of writing a letter to the editor of your local newspaper with good old pen and paper?

New technology has benefits, if you don't know what they are then you need to learn about them properly. Sticking with old technology because you fear the new is not a good plan.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#437

Post by growse »

hot_gril wrote: post #327
growse wrote: post #133

Earlier quoted context omitted.

It's not that the reluctant user group doesn't like IPv6, they don't like change .

My public IPv4 is something like 14.63.323.85, private is 192.168.1.2 (others are .3, .4, etc), DNS is 1.1.1.1. My public v6 would be like 2345:0425:2CA1:2020:1100:0567:5673:23b5, private is fc00::::903A:1C1A:E802:11E4, DNS 2606:4700:4700::1111 (don't forget those consecutive colons). It's not that I don't like change, it's that I don't like changes that make things plainly worse for me.

As someone who runs an ipv6-only network, I can't tell you what my prefix is off the top of my head because it's irrelevant.

Change is about more than just "how many numbers do I have to remember".

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#438

Post by gnramires »

soebbing wrote: post #8

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

I think NAT is a bit of an unfortunate "janky" solution of addressing protocols (giving some security and some address expansion, and sacrificing interoperability and connectivity). I think the security part should be fixed by proper firewalls and/or authentication -- in fact some kind of security mechanism should be default for home routers and such.

I think ideally we should also think of new interoperable defenses that fill the NAT gap. Perhaps each device should have an authentication key apart from its IP, which it could pass onto trusted devices like local network routers, which would only allow authenticated incoming data. Maybe even better would be a global scheme including this authentication and also more private addressed (than IP), although that would probably require a redesign of IP and might be a project for the far future.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#439

Post by hot_gril »

growse wrote: post #437
hot_gril wrote: post #327

Earlier quoted context omitted.

My public IPv4 is something like 14.63.323.85, private is 192.168.1.2 (others are .3, .4, etc), DNS is 1.1.1.1. My public v6 would be like 2345:0425:2CA1:2020:1100:0567:5673:23b5, private is fc00::::903A:1C1A:E802:11E4, DNS 2606:4700:4700::1111 (don't forget those consecutive colons). It's not that I don't like change, it's that I don't like changes that make things plainly worse for me.

As someone who runs an ipv6-only network, I can't tell you what my prefix is off the top of my head because it's irrelevant. Change is about more than just "how many numbers do I have to remember".

The numbers are the only change that's visible to me as a user.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#440

Post by sgtnoodle »

kaetemi wrote: post #432
sgtnoodle wrote: post #387

Earlier quoted context omitted.

You could still route within the /64, couldn't you? With a smaller subnet SLAAC wouldn't work, but you could DHCPv6 addresses still. There is also an RFC somewhere for sharing a single /64, intended for mobile hotspots.

No idea. I've tried every setting combination on this consumer grade D-Link router which is supposed to support IPv6. Nothing results in a functioning network. Forum posts I find from other customers of this ISP report the same behaviour on other routers. The modem gets a /56 at least, and hands out addresses from a /64 range under that I assume, the router gets a /128 from the modem, and then gives up entirely on do…

It sounds like your ISP is delegating a prefix, then? Weird, that all sounds reasonable to me. What do you mean the router gives up entirely, though? Computers in the LAN don't get an IP address? Packets go out but nothing comes back?
Post reply on HN