Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 traffic crosses the 50% mark

google.com

Post reply on HN
Print view View original

631–640 of 643 posts

Re: IPv6 traffic crosses the 50% mark

#631

Post by azernik »

tptacek wrote: post #630
azernik wrote: post #477

Earlier quoted context omitted.

> providers don't have an easy way to correlate addresses Yes, they do. It's called DNSSEC.

Leaving aside that you applied the word "easy" to DNSSEC, how do you mean? How does DNSSEC solve the problem being discussed?

It was a somewhat flippant (given that GitHub doesn't implement DNSSEC either) dig at the idea of using hand-entered/hand-updated IP addresses for access control, rather than having the access control system look addresses up in the system designed to securely attest owner/ip mappings.

Re: IPv6 traffic crosses the 50% mark

#632

Post by tptacek »

azernik wrote: post #631
tptacek wrote: post #630

Earlier quoted context omitted.

Leaving aside that you applied the word "easy" to DNSSEC, how do you mean? How does DNSSEC solve the problem being discussed?

It was a somewhat flippant (given that GitHub doesn't implement DNSSEC either ) dig at the idea of using hand-entered/hand-updated IP addresses for access control, rather than having the access control system look addresses up in the system designed to securely attest owner/ip mappings.

(Almost nobody signs zones.) How is that any easier than just having an https:// URL from which you pull an (arbitrarily-formatted) list of IP addresses to block? Is the idea that you'd otherwise be able to do real-time DNS lookups on incoming IP addresses?

Re: IPv6 traffic crosses the 50% mark

#633

Post by Dagger2 »

dlcarrier wrote: post #521
mgulick wrote: post #295

I get an IPv6 address from my ISP (a /56 I believe), but I wish there was some good information on how to update my OpenWRT VLAN configuration, routing, and firewall rules to be able to support native IPv6 on my devices. Would love to be able to have direct IPv6 connections to the internet from my devices, but I want to make sure I can do it safely.

Yeah, I'm in the same boat. I like the idea of being able to remotely connect to anything on my network, but I know just enough about networking to be dangerous, and don't trust my self to set it up securely, so I have IPv6 disabled on my router. With IPv4, it's physically impossible to mess up the firewall and NAT settings enough to make local devices public.

It's honestly not that hard. Tell your router to reject new inbound connections from the WAN interface, and you're done.

You have to do the exact same thing to make sure inbound connections aren't possible on v4 (even with NAT in the picture), so you might well have already done this or got it from the default ruleset. Plus it's trivial to test, by attempting to connect from another network.

Re: IPv6 traffic crosses the 50% mark

#634

Post by Dagger2 »

GoblinSlayer wrote: post #604
Dagger2 wrote: post #587

Earlier quoted context omitted.

I'm not sure if I'm misreading you, but a /48 would never be an entire country's v6 allocation. If we're talking home networks, you can reliably expect a /48 to a) not be announced in BGP itself, and b) cover one to a few hundred users of one ISP. (The containing /32 or similar will be announced.) A business might structure its network so that one of its /48s corresponds to a country, but in that case the /48 would b…

Reputation unit is /64 block, so if you want to see a 100 people ISP as one reputation unit, it should get a /64 block. But AFAIK today in practice reputation unit is a country.

Country would be far too coarse to be useful. I suspect it's more likely to be at the AS level, or /32 or somewhere around there.

I have a /48. The amount of "we have detected unusual activity from your network" messages I get from sites, when I'm reasonably sure the only activity coming from my network is my usual activity on those sites, suggests that they're using something bigger than /48.

Re: IPv6 traffic crosses the 50% mark

#636

Post by azernik »

tptacek wrote: post #632
azernik wrote: post #631

Earlier quoted context omitted.

It was a somewhat flippant (given that GitHub doesn't implement DNSSEC either ) dig at the idea of using hand-entered/hand-updated IP addresses for access control, rather than having the access control system look addresses up in the system designed to securely attest owner/ip mappings.

(Almost nobody signs zones.) How is that any easier than just having an https:// URL from which you pull an (arbitrarily-formatted) list of IP addresses to block? Is the idea that you'd otherwise be able to do real-time DNS lookups on incoming IP addresses?

Yes - delay SYNs until an authenticated reverse lookup confirmed the IP was owned by a trusted domain. With caching to reduce common-case latency, which would otherwise be intolerable.

Re: IPv6 traffic crosses the 50% mark

#637

Post by ok123456 »

boredatoms wrote: post #615
ok123456 wrote: post #501

Earlier quoted context omitted.

I set up NAT66 recently with DHCPv6. The IPv4 and IPv6 addresses are practically the same, except IPv6 has a prefix and a double colon as the last separator. This really should be how SOHO routers do IPv6 out of the box. Most people don't want 1:1 addressing for their entire home or office.

Q on your setup Are you using ULA prefix for the nat66/dhcp6, are you also allowing GUA address assignment via slaac? Im wondering how it works out with source-selection

Yes, so each device has two IPv6 and one IPv4 address.

Re: IPv6 traffic crosses the 50% mark

#638

Post by tptacek »

azernik wrote: post #636
tptacek wrote: post #632

Earlier quoted context omitted.

(Almost nobody signs zones.) How is that any easier than just having an https:// URL from which you pull an (arbitrarily-formatted) list of IP addresses to block? Is the idea that you'd otherwise be able to do real-time DNS lookups on incoming IP addresses?

Yes - delay SYNs until an authenticated reverse lookup confirmed the IP was owned by a trusted domain. With caching to reduce common-case latency, which would otherwise be intolerable.

Does this system exist somewhere?

Re: IPv6 traffic crosses the 50% mark

#639

Post by azernik »

tptacek wrote: post #638
azernik wrote: post #636

Earlier quoted context omitted.

Yes - delay SYNs until an authenticated reverse lookup confirmed the IP was owned by a trusted domain. With caching to reduce common-case latency, which would otherwise be intolerable.

Does this system exist somewhere?

Absolutely not

Re: IPv6 traffic crosses the 50% mark

#640

Post by tonymet »

sschueller wrote: post #34
rtdq wrote: post #13

And still, in the year of our lord 2026, GitHub does not support IPv6. https://github.com/orgs/community/discussions/10539

Just found this little site. https://isgithubipv6.web.app/ Maybe we shouldn't even measure percentage adoption and instead just if github has finally adopted..

nice!
Post reply on HN