Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

61–70 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#61

Post by layer8 »

mgbmtl wrote: post #38
TekMol wrote: post #21

I still think IPv6 can be safely ignored. This articles section "here are some reasons you should start using IPv6 within your own network" seems to comfirm this. None of the 6 "reasons" speak to me.

Here's an easy one for you: if you have a gigabit connection, most home routers can barely handle the load of NAT. That's why gamers push for IPv6. It's mentioned in the article but few people realize how inefficient NAT can be at gigabit and more. My ISP router could do max 800 mbps, which isn't so bad, but it degraded when we were multiple people using the link. With IPv6 it's much less of a problem, we can easily…

> if you have a gigabit connection

Yeah, not anywhere close. In ten years I’ll have one maybe.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#62

Post by michaelt »

tenebrisalietum wrote: post #39
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

Presumably what thesuitonym means is:

Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website.

There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else?

The main benefit of IPv6 is providing routable addresses for home users, thus avoiding CGNAT.

But zealous firewalling and the rise of mobile devices mean these days almost everything is sent over HTTPS to a cloud server. I haven't had software ask me to open a port on my router in a decade or more. Even games and video conferencing software know they have to work out-of-the-box on networks where the user can't adjust the NAT.

So who's going to benefit from all this hassle - the 0.1% of users who are hosting websites from home?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#63

Post by cesarb »

api wrote: post #9
czbond wrote: post #4

Great idea. Now a question for the group. What are the non-network team business benefits to IPv6 over v4? That is what drives adoption.

IPv4 is now stretched to the point that you often end up requiring multiple layers of NAT, such as carrier-grade NAT plus endpoint NAT. That reduces the reliability of pretty much all protocols and makes any protocol doing peer to peer communication really hard or even impossible to run. The latter includes tons of games, video chat, peer to peer VPNs, decentralized social networks, and so on. These problems will onl…

> If every human being tends to have a computer and a phone that means there's at least 20X more devices than IPs.

You know, that used to be only "if every human being tends to have a computer", since phones didn't have an IP address. Now it's "a computer and a phone". A few years down the line, you'll have "a computer and a phone and a watch", then "a computer and a phone and a watch and a standalone VR headset", and so on.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#64

Post by daper »

I've given a try to IPv6 in a company with few tens on servers in a 2 DCs, an office + additional location, 3 ISPs in total. For me the real challenge is not just different way to write an IP address or doing NAT. The challenge is that IPv6 changes a lot of unexpected things:

- Our ISPs support IPv6 but routing quality is way worse than IPv4 including occasional inability to connect to some networks or greater latency than IPv4. I had to create tickets with such issues understood that most probably they just don't have IPv6 BGP sessions to all their upstream providers they connect.

- How the VPN (an employee / road warrior setup) should be configured since from the routing perspective you don't need a VPN to connect from your home to the office? Assuming both have proper IPv6 connection and all devices in the office and your laptop have a globally addressable IP address. Employee can have IPv4 or dual stack at his home, where is dual stack in the office. Very confusing. Looks like Fortigate also don't have an idea and decided to not support such case.

- You have to be careful with site-to-site VPN since even your internal services like database are now globally addressable. You really need proper firewall rules / routing policies to not leak unencrypted packets over internet.

- SLAAC is cool but doesn't provide DNS configuration. (there is RFC8106 but is it supported by all OSes?). You need DHCPv6 for that. You have to choose: use only DHCPv6 or SLAAC + DHCPv6 or just relay on the vast that DNS will be proviedd by DHCP IPv4 in a dual stack setup.

- The way of providing high availability gateway address in a network is different. You need router advertisement where you can provide priorities. That actually is much better than any other VIP mechanisms (no issue with MAC table updates, etc.) but you need to know that.

- OSPF works a bit differently. For example: there is no authentication in router communication in OSPF itself, you are supposed to use IPSec.

The list is longer unfortunately...

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#65

Post by ajross »

> You should stop thinking of NAT as a security mechanism and think of it as the emergency address exhaustion prevention that it is.

I hate this attitude. This is isomporphic to saying "stop thinking of system call interfaces as a security mechanism and think of them as an address space sharing mechanism". It's not technically wrong, but it's wrong in practice.

Even the most naive NAT can't misroute an inbound packet. If you have an internal host and it doesn't talk to anything outside the firewall, then no one else can reach it. They have no name for it, the packets won't go. You get this even if you don't understand how it works. You get this even if the router has no idea about the host.

Give everything a unique address and now the router needs to know who is safe and who isn't. That's a decision point that requires configuration by human beings, and human beings get stuff wrong.

No, NAT is your friend. Use NAT. Use it even if you're an IPv6 nut.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#66

Post by nrabulinski »

candiddevmike wrote: post #59
vel0city wrote: post #26

Earlier quoted context omitted.

> what would be the best way forward to keep it that way in a IPv6-only future? Firewalls. You configure what traffic should be allowed from who to who. Default deny incoming traffic, and its the same behavior as when you had a NAT. Something having a routable IP address doesn't mean it needs to receive all traffic addressed to it.

The problem I have had with this setup is allowing inbound traffic to things that need it becomes tricky. Some devices don't support DHCPv6 like Android) and some firewalls don't let you do suffix matching. With a dynamic block via PD, the rules to allow inbound traffic to say an Xbox become quite complicated.

You can still have a firewall on the router level, just as you do with IPv4. You shouldn’t allow any external traffic by default anyway and NAT shouldn’t be a security measure.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#67

Post by groestl »

vel0city wrote: post #26
soebbing wrote: post #8

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

> what would be the best way forward to keep it that way in a IPv6-only future? Firewalls. You configure what traffic should be allowed from who to who. Default deny incoming traffic, and its the same behavior as when you had a NAT. Something having a routable IP address doesn't mean it needs to receive all traffic addressed to it.

My ISP does not allow BYOM (bring your own modem) and assigns me a /64 net, so I have a hard time running an (ipv6) router behind it that would do the firewalling.. I guess I'm stuck with ipv4 for the time being...

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#68

Post by IshKebab »

ArchOversight wrote: post #30
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

That's what a firewall is for, NAT does nothing here.

In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#69

Post by dilyevsky »

czbond wrote: post #4

Great idea. Now a question for the group. What are the non-network team business benefits to IPv6 over v4? That is what drives adoption.

The benefit for the business is their eng team isn’t bogged down by working around ipv4 network cruft on big networks. On small ones it probably doesn’t matter yeah

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#70

Post by Xelynega »

adriancr wrote: post #52
soebbing wrote: post #8

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

Although I'm going to get comments saying this is wrong... What I did was: - IPv6 DHPC - private address range within: fc00::/7 - IPv6 NAT, same as for IPv4. - Firewall. Why: - digital ocean only allowed ~16 IPv6 addresses. - I wanted a local IPv6 network exiting through digital ocean. - I see no reason to give public route-able addresses to each device in my home (allows remote websites to determine who is calling i…

Why would your firewall allow your ipv6 IoT devices to receive inbound connections from the internet? Whats the difference between "ipv6 Nat" and a firewall when theres not likely to be any address overlap.
Post reply on HN