Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

641–649 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#641

Post by liscum »

marcosdumay wrote: post #575
pflanze wrote: post #558

Earlier quoted context omitted.

> > NAT punching does require cooperation of programs on the protected machines > As does listening to a port. Listening on a port is for incoming connections, exactly the kind that we're blocking with either a (stateful) firewall or NAT. Listening on a port is a declaration of a program (a server) to communicate with whichever counter party can connect to this port (until the server program decides to close the conn…

The point here is that the movement against IPv6 for security reasons is disingenuous or even outright dishonest. Those security reasons don't exist. Personally, I have never seen any argument for IPv6 based on security (except for some very fringe ones about address enumeration). But if anybody makes one to you, well, it would be disingenuous, or maybe even dishonest too. There is no security-based argument either w…

[flagged]

Re: Tell HN: IPv6-only still pretty much unusable

#642

Post by magicalhippo »

keiyakins wrote: post #616
magicalhippo wrote: post #532

Earlier quoted context omitted.

> And lastly... a lot of IT guys still don't care for IPv6 The issue I have with IPv6 is that it's so complex compared to the IPv4 I know, and still has lacking support in routers and similar. For example, I want to be sure my local devices uses my local NTP server. With IPv4 it's trivial, I just add an option to the DHCP server. With IPv6 I can't do that with RA, I have to use DHCPv6. But Android doesn't support DHC…

Why are you using IP addresses directly? That's what DNS is for. There's even mDNS for in simple home networks. (The DHCP thing is valid but that's one single android dev being an ass who can't read deciding that it imposes limitations it doesn't and ruining it for the rest of us)

> Why are you using IP addresses directly? That's what DNS is for.

Sometimes DNS is down, like when I rand pfSense and the prefix changed, so I like to have the core services in my network on easily accessible IPs.

Re: Tell HN: IPv6-only still pretty much unusable

#643

Post by preisschild »

otabdeveloper4 wrote: post #601
Dagger2 wrote: post #594

Earlier quoted context omitted.

It causes no end of problems, not just for ISPs and mobile networks but also for people running server networks and for end users like us. I suppose it can be hard to see that when you grew up with the problems and have never used a network where you didn't need to deal with them though. The world can mostly function without NAT. It's mainly only used to work around address shortages, which aren't an issue on v6, so…

No, NAT is not for network address shortages. NAT is a cruicial privacy and security feature. "No need to use NAT" is, of course, a horrible anti-feature, not a benefit of IPv6. (And, of course, in the real world the vast majority of IPv6 is rolled out with NAT anyways.)

NAT was never intended for security and privacy.

IPv6 security is like IPv4 security: Firewalls

For privacy IPv6 uses Security Extensions, which shuffles your ipv6 ip.

Re: Tell HN: IPv6-only still pretty much unusable

#644

Post by dqh »

Dagger2 wrote: post #640
dqh wrote: post #637

Earlier quoted context omitted.

I think you have missed that a IP4.4 packet would be a valid IP4 packet. The first 4 octets of the 4.4 address are where IP4 expects them to be. The router at this IP4 address needs to understand IP4.4, but routers before do not. The additional octets are smuggled within the IP4 options header.

You've basically invented 6to4. This isn't a new idea; v6 already has it.

I didn't claim it to be a new idea - I asked why we didn't do something simple like that (as the solution) instead of all the expensive complexity of trying to upgrade the entire Internet to IP6 over multiple decades.

Re: Tell HN: IPv6-only still pretty much unusable

#645

Post by BizarroLand »

unquietwiki wrote: post #586
AtlasBarfed wrote: post #517

Earlier quoted context omitted.

So the largest expansion of general availability compute (and associated addressing needs) occurs and it ignores ipv6. Re: 50% ... Your ipv6 numbers are very likely mobile, are they not? And those all CGNAT to ipv4 land? So the entire ipv6 mobile space (the biggest victory of the ipv6 war) is basically behind the #1 thing that ipv6 hate more than anything: a NAT. If you can't get ISPs to support it............ ......…

Windows Vista came out in 2007, and it explicitly had a dual-stack IPv4+IPv6 implementation. Around that same time, the BSDs were finishing up KAME, and Linux support was decently mature. That was 15 years ago. Software and OS-wise; with the exception of some features of Mikrotik routers + managed Meraki & Ubiquiti stuff just now getting onboard; the support is there. Node's using it properly now. I was able to updat…

I'm willing to bet that every ISP in America has IPV6 capabilities but the ones that have not activated it have done so out of corporate lethargy.

The bosses aren't yelling, "TURN ON IPV6 AND MAKE IT WORK" so the peons have no reason to flip the switches. The bosses have no reason to push for IPV6 as it will increase support costs and add work hours but it will not increase income or improve profits.

We need a mandate from the FCC that says that any ISP that has accepted federal funds to build or deploy internet access systems must turn on IPV6 to the consumer or face penalties. Short of that, it's not going to happen.

Re: Tell HN: IPv6-only still pretty much unusable

#646

Post by Dagger2 »

dqh wrote: post #644
Dagger2 wrote: post #640

Earlier quoted context omitted.

You've basically invented 6to4. This isn't a new idea; v6 already has it.

I didn't claim it to be a new idea - I asked why we didn't do something simple like that (as the solution) instead of all the expensive complexity of trying to upgrade the entire Internet to IP6 over multiple decades.

That was my point: we did. It turns out people prefer to deploy v6 natively.

(Also, I don't think it's fair to call it simple. Many of the things we've done to deploy v6 are things which need to be done to deploy any IP protocol with bigger addresses than v4. If you count those things against v6 while ignoring them for any alternative, you aren't doing a fair comparison.)

Re: Tell HN: IPv6-only still pretty much unusable

#647

Post by nonlogical »

zajio1am wrote: post #498
vel0city wrote: post #152

Earlier quoted context omitted.

Depending on the NAT implementation this can be incredibly naive. Many home routers will send ANY traffic incoming on a port to the NAT'd IP address, even if the sources don't line up. So say Alice is behind a crappy NAT and wants to talk to Bob. Alice's router opens a port on its edge, lets say 1234, and sends traffic to Bob on port 80. Let's say Charles knows Alice's IP address. Charles starts spamming Alice's rout…

> Alice's router is dumb. It sees traffic on port 1234, checks its NAT table, and sees that data is supposed to go to Alice. While in principle that is possible, in practice almost all home routers are based on Linux, and Linux netfilter NAT implementation distinguish connections based on port and IP, not just port, so this would not work.

I think you would enjoy this article from Tailscale: https://tailscale.com/blog/how-nat-traversal-works/

The poke a hole to outside world to a random server, log the port allocated to you by your router and have someone else use this to connect to you is the basis of STUN protocol.

Re: Tell HN: IPv6-only still pretty much unusable

#648

Post by Dagger2 »

pflanze wrote: post #604
Dagger2 wrote: post #578

Earlier quoted context omitted.

> I have always understood NAT's protection to be limited to prohibiting incoming connections It doesn't actually do this. NAT rewrites the source address of outbound connections. Inbound connections aren't outbound connections so it does nothing to them, which means it doesn't prohibit them. That is why you don't need NAT for security: it doesn't give any in the first place.

> which means it doesn't prohibit them OK. I want to dig down into this. Let's say I have a router `R`, which I'm running NAT and optionally other iptables rules on. I've got a client machine `C` sitting in a private network "behind" `R`. `R` is connected to the internet via a gateway `G`. `A` is some machine out there owned by an attacker. There's a vulnerable TCP service running on `C` listening on *:1313. A | inte…

That's basically it. In that network, G can connect to C just fine. You need the firewall rule to block inbound connections, because NAT just does nothing to them.

I don't have any good learning resources for this stuff, sorry. I mostly picked it all up by running it on my home network and Googling for stuff when I hit something I didn't get.

Re: Tell HN: IPv6-only still pretty much unusable

#649

Post by Lockal »

commandersaki wrote: post #628

It's unlikely that IPv6 will be deployed widely for a few reasons. First, many companies and organizations have already invested heavily in IPv4 infrastructure, so it would be costly and time-consuming for them to switch to IPv6. Additionally, IPv4 and IPv6 are not interoperable, which means that devices using one protocol cannot communicate with devices using the other. Finally, there are still a large number of ava…

Please, no ChatGPT in the comment section.
Post reply on HN