I spent a week without IPv4 to understand IPv6 transition mechanisms • Hacker News Board

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#501

Post by neilalexander » Thu, Mar 09, 2023, 11:19 AM UTC

dekhn wrote: post #132

sp0ck wrote: post #97

My experience with IPv6. I have option to enable full dual stack with my ISP. After doing this I noticed that YT/FB/Google were significantly faster, however my kids started to complaing that some games began to have connectivity issues. Minecraft have problems to start. On a number of sites load time was noticebly longer. Switching off IPv6 as a experiment on one of kids PC solved all issues. My conslusion is that i…

Agreed- I turned on ipV6 and even tried turning off ipv4. All I found was a bunch of new, different problems to debug that were inevitably because somebody else somewhere doesn't support ipv6, or I would have to run some sort of bridge between the two networks. Of course this is for home where I don't need a gajillion publicly-routed IPs.

This is a frustrating take which I find myself challenging again and again and again. The need for IPv6 is not just about how many IP addresses _you_ need. The need for IPv6 is a global issue for a variety of reasons, including finding addressing for all of the millions of people and billions of devices still to come online, reducing complexity for system and application developers and being able to finally shed decades of protocol design decisions that have ended up being more painful than helpful.

Everyone is always so quick to jump to how _they_ don't need IPv6. The truth is that we _all_ need it. Eventually, there will become a day when services will start to migrate to IPv6 because the cost and limitations of IPv4 addressing will become prohibitive. Then you'll no doubt care when it affects you personally.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#502

Post by snuxoll » Thu, Mar 09, 2023, 4:43 PM UTC

daper wrote: post #405

artdigital wrote: post #319

Earlier quoted context omitted.

> You have to be careful with site-to-site VPN since even your internal services like database are now globally addressable. You really need proper firewall rules / routing policies to not leak unencrypted packets over internet. Uhmm I might be wrong here, but can’t you just not assign global IPv6s then? Keep your local network on ULAs ( https://en.wikipedia.org/wiki/Unique_local_address ) for network-internal routin…

Sure, you can. But on advantage of IPv6 is you addresses are globally unique. If you ever need to connect two networks that were created independently (like different companies), unique addresses, even local are very helpful.

Sure, but ULA's within your network are still an extremely useful tool to deal with annoying problems like renumbering if you don't have PI address space (and a majority of businesses won't). It's not an ideal solution, but unless you're a large enough shop to have multi-homed BGP sessions the IANA doesn't give a shit about how much headache changing ISPs or backup connections cause and getting a new allocation causes; so ULAs fill that gap to give a non-changing, probably-unique (if you follow the proper process to generate your prefix) address space.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#503

Post by tenebrisalietum » Thu, Mar 09, 2023, 4:49 PM UTC

wankle wrote: post #247

unethical_ban wrote: post #105

Earlier quoted context omitted.

If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address. The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or inco…

IPv4 cuts it everywhere. IPv6 does not do anything to save the planet. IPv6 does have privacy concerns stated by many on this page. IPv6 could be shut down tomorrow and the Internet would continue working well.

I don't think EUI-64 being built into link-local fe80 addresses is a privacy issue. Link-local addresses don't get routed, so nothing outside of that network will see or know about them. As far as the router itself, e.g. your ISPs router, it can already gather MAC addresses if it wanted to, so IPv6 using the MAC to generate link-local addresses doesn't add or remove to that situation.

CGNAT is not the Internet working well. CGNAT makes you have to have your ISPs permission and coordination to originate outgoing traffic--imagine if you had to ask the power company for permission to operate each electrical device in your house.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#504

Post by snuxoll » Thu, Mar 09, 2023, 4:52 PM UTC

Arnavion wrote: post #360

somerandomqaguy wrote: post #257

I've still got some misgivings about IPv6. Biggest one for me personally is that my current ISP doesn't give stable prefix. Power outages or firmware updates requiring a router reboot thus can cause the PD to be changed and potentially break firewall rules that are sensitive to the PD. In an absolute worst case, it also means that none of your hosts can reach the internet anymore if for whatever reason they're not up…

>Yes there are ways to mitigate (ULA, mDNS, DNS, DHCPv6, etc) but now you're introducing additional complexity that didn't exist before into the network when I keep hearing how Ipv6 is supposed to reduce complexity. ULAs are neither "additional complexity" nor "reduced complexity" compared to IPv4 NAT - they're the exact same. Both require you to decide on a private prefix, set up DHCP / DNS / static IPs within that…

You're talking about using NPTv6 with ULA's. Remember, IPv6 is explicitly designed to allow having multiple addresses on an interface - you can have a ULA for internal connectivity and a GUA for everything else.

This is the situation I settled on for my home, because having redundant ISPs means a lot of headaches and I obviously do not qualify for a PI allocation. Every machine on the network gets a ULA address that remains stable, and to deal with ISP failover I have a script on my Mikrotik router to change advertised prefixes when the primary ISP goes down.

Took more work than my v4 NAT setup, and I hope more network vendors build-in support for the WAN failover bit in particular because every consumer/prosumer kit I've used does absolutely nothing for v6 traffic (I literally could not have done it without Mikrotik scripting or rolling my own router because no off-the-shelf distro like opnsense/m0n0wall/etc have support for this).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#505

Post by dmm » Fri, Mar 10, 2023, 9:34 PM UTC

jacob019 wrote: post #345

dmm wrote: post #218

Earlier quoted context omitted.

It's important to distinguish between stateful and stateless DHCPv6. stateless DHCPv6 is fine. It's just a way for nodes to get dns/ntp/etc. Nodes still select their addresses with SLAAC. Stateful DHCPv6 is the bad one. It assigns hosts specific addresses. > the router essentially always knows the MAC address, IP address and hostname of each device. You can still have this with ipv6 addresses. They easiest way is to…

SLAAC can advertise the DNS server. Why would you call stateful DHCP bad?

> SLAAC can advertise the DNS server.

RFC6106 ? You're right that works. I was just trying to communicate the unobjectionable nature of stateless DHCPv6.

Stateful DHCPv6 is bad because it undermines the concept of hosts selecting their own addresses as needed for privacy, tethering, etc.

The decade old Android issue where Google refuses to implement stateful DCHPv6 provides some good background: https://issuetracker.google.com/issues/36949085#comment53

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#506

Post by hot_gril » Tue, Mar 14, 2023, 8:56 PM UTC

ArchOversight wrote: post #30

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

That's what a firewall is for, NAT does nothing here.

NAT does nothing? The NAT setup is the reason incoming connections don't reach devices on the LAN. I get that you can phrase this as NAT actually being the thing forwarding the packets, and on a home ipv4 router without NAT the incoming packets would just go nowhere, but everyone is talking about the realistic options of NAT vs device having own public IP addr.

I get that an ipv6 router can have a firewall with good defaults blocking incoming connections, emulating that aspect of a NAT.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#507

Post by hot_gril » Tue, Mar 14, 2023, 9:01 PM UTC

aflag wrote: post #275

audunw wrote: post #246

Earlier quoted context omitted.

> as if that's something that anybody wants. Of course I do. Why would you not want the option of easily allowing a device to be globally routable if you need it to be? I think routers should be more explicit about how you set up each new device on a private network anyway. Guest wifi can have a sane default. Private wifi could make a notification pop up on your trusted device, asking you if you want the now device t…

Most people don’t need it, so that’s why they don’t want it. OP didn’t say people object to it, just that it’s not something most people cares about.

It's fairly common to want P2P connections, even if the users aren't aware of it. A lot of online games rely on NAT traversal, sometimes automatically picking a host based on whoever's NAT it can get past. I don't remember the details, but even the Nintendo Switch cares about NAT.

A lot of would-be P2P applications end up using a relay server to get around that restriction, which adds significant cost and latency. Sure it's a well-established workaround by now, but it'd be nice not to rely on it.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#508

Post by hot_gril » Tue, Mar 14, 2023, 9:06 PM UTC

JohnFen wrote: post #474

cassianoleal wrote: post #274

Earlier quoted context omitted.

Sure they exist, but should you expect your ISP to be shitty? Sounds like a terrible deal for you.

In large swaths of the US, you don't have a choice about what ISP you have available. If you happen to have a shitty one (and most aren't great), there's nothing you can really do about it.

The bad ones won't even give you IPv6 to begin with, haha. Not that I want it anyway.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#509

Post by hot_gril » Tue, Mar 14, 2023, 9:14 PM UTC

drbawb wrote: post #234

petertodd wrote: post #96

Earlier quoted context omitted.

IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total globa…

EUI64 means that random space is effectively reduced to just 48-bits of real entropy, It's security through obscurity at best, i.e: not security. You shouldn't be relying on size of address space to protect you from anything. An IDS/IPS that alerts on abnormal ICMP behavior will be useful whether an attack is 1GiB of traffic in size or 1024EiB of traffic in size. (Also you don't even need automated scanning to find s…

I don't see what's wrong with the outside knowing your local IP addresses. But I absolutely wouldn't want EUI64 encoding my device vendors in the addrs.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#510

Post by hot_gril » Tue, Mar 14, 2023, 9:20 PM UTC

wolrah wrote: post #149

lxgr wrote: post #140

Earlier quoted context omitted.

Unconfigured/not activated firewalls usually fail reachable; without explicit port forwarding or exposed hosts, NATs fail unreachable.

> Unconfigured/not activated firewalls usually fail reachable Local firewalls on devices, maybe, but network firewalls generally are default-deny on untrusted interfaces, and between 0 and 1 interfaces are trusted by default. Back in 2007 Apple's Airport Extreme Base Station shipped with a firmware that defaulted to allowing all IPv6 traffic, which was quickly pointed out in the tech media and fixed in a patch a few…

It takes effort to make NAT that bad. Something jank like UPnP has to map the port, and even that requires action on the device's part. I don't quite understand your SIP example; how does the router know which IP is the phone's?

Bad IPv6 is as simple as not having a firewall or default-allowing it like AirPort did. If Apple can make that mistake, a lot of random manufacturers can too. I can see the whole NATless firewall setup but wouldn't use it for a very long time, to let things settle.