Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

71–80 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#71

Post by AnIdiotOnTheNet »

mgbmtl wrote: post #38
TekMol wrote: post #21

I still think IPv6 can be safely ignored. This articles section "here are some reasons you should start using IPv6 within your own network" seems to comfirm this. None of the 6 "reasons" speak to me.

Here's an easy one for you: if you have a gigabit connection, most home routers can barely handle the load of NAT. That's why gamers push for IPv6. It's mentioned in the article but few people realize how inefficient NAT can be at gigabit and more. My ISP router could do max 800 mbps, which isn't so bad, but it degraded when we were multiple people using the link. With IPv6 it's much less of a problem, we can easily…

> if you have a gigabit connection

Rare in the US. Hell, we don't even have a 1Gb connection at work.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#72

Post by dan1234 »

I'd love to embrace ipv6, but my ISP's official line, for as long as I can remember, is 'planning it, details to come'.

I don't expect them to move forward on it until significant sites become ipv6 only as they've admitted that they have more than enough ipv4 addresses for their subscriber base, so there's very little incentive for them to do anything atm.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#73

Post by everdrive »

vlan0 wrote: post #41
czbond wrote: post #4

Great idea. Now a question for the group. What are the non-network team business benefits to IPv6 over v4? That is what drives adoption.

OPEX and CAPEX costs are significantly reduced with native IPv6 vs large NAT deployments. Adding layers to stretch IPv4 = complexity/gear. Gear/complexity = higher costs. And if you're already moving away from perimeter defense, to more identity based zero-trust, the move to IPv6 makes much sense.

People are doing “zero trust” about as well as they’re doing agile. The concept may be real, but businesses’ implantations are not.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#74

Post by silon42 »

AnonymousPlanet wrote: post #56
dale_glass wrote: post #53

Earlier quoted context omitted.

It just makes little sense. With IPv6 instead of NAT deciding that port 2000 maps to 192.168.1.3 port 22, you have a firewall that may or not choose to route to xx:yy:zz or not, and to allow an incoming connection over port 22 to that host or not. If you don't want to accept incoming connections to a given machine or network on IPv6 without NAT that's very easy to have.

Maybe people don't want to disclose the number and purposes of interior machines?

Yeah, I had an idea to have an IP for each container (which means almost every "containerized" application soon, possibly even every browser window).

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#75

Post by adriancr »

Xelynega wrote: post #70
adriancr wrote: post #52

Earlier quoted context omitted.

Although I'm going to get comments saying this is wrong... What I did was: - IPv6 DHPC - private address range within: fc00::/7 - IPv6 NAT, same as for IPv4. - Firewall. Why: - digital ocean only allowed ~16 IPv6 addresses. - I wanted a local IPv6 network exiting through digital ocean. - I see no reason to give public route-able addresses to each device in my home (allows remote websites to determine who is calling i…

Why would your firewall allow your ipv6 IoT devices to receive inbound connections from the internet? Whats the difference between "ipv6 Nat" and a firewall when theres not likely to be any address overlap.

> Why would your firewall allow your ipv6 IoT devices to receive inbound connections from the internet?

It does not, problem is with outbound connections.

> Whats the difference between "ipv6 Nat" and a firewall when theres not likely to be any address overlap.

Outbound connections can be profiled by remote websites.

With NAT (Well... Port-address-translation to be fair, so single outgoing address), traffic can't as easily be profiled.

Imagine ISPs/Ad providers having easier time identifying you, your spouse, your kids, etc. (and device, and so on just by observing addresses)

With initial SLAAC it is even nicer as MAC address is included in the address... Can look up device much easier just cross reference manufacturer database...

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#76

Post by tinus_hn »

dan1234 wrote: post #72

I'd love to embrace ipv6, but my ISP's official line, for as long as I can remember, is 'planning it, details to come'. I don't expect them to move forward on it until significant sites become ipv6 only as they've admitted that they have more than enough ipv4 addresses for their subscriber base, so there's very little incentive for them to do anything atm.

You can request free IPv6 connectivity through the Hurricane Electric tunnel broker at ipv6.he.net

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#77

Post by candiddevmike »

nrabulinski wrote: post #66
candiddevmike wrote: post #59

Earlier quoted context omitted.

The problem I have had with this setup is allowing inbound traffic to things that need it becomes tricky. Some devices don't support DHCPv6 like Android) and some firewalls don't let you do suffix matching. With a dynamic block via PD, the rules to allow inbound traffic to say an Xbox become quite complicated.

You can still have a firewall on the router level, just as you do with IPv4. You shouldn’t allow any external traffic by default anyway and NAT shouldn’t be a security measure.

I know, I'm saying that when you want to embrace global routable addresses for outbound AND inbound, it's hard with Prefix Delegation and spotty DHCPv6 support.

ISPs should be forced to let customers get IPv6 prefix reservations. Yes, PD doesn't change for most, but I'd rather not use PD at all.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#78

Post by bityard »

Question from a (relative) IPv6 newbie that wasn't addressed in TFA:

Let's say I have a very small home lab. I have a handful of hosts that get their IP addresses via DHCP from my router. In the router, DHCP and DNS are tightly coupled such that the router essentially always knows the MAC address, IP address and hostname of each device.

Now I want to run IPv6 on this network as a first-class citizen. Since DHCPv6 is apparently frowned upon by v6 purists, and not all devices on my network support it, that leaves SLAAC. My understanding of SLAAC is that each node essentially picks its own globally unique IP instead of asking a router for the IP. My question then is: is there some standard for the DNS server on the router to somehow know the v6 IPs of the hosts on the network so that it can automatically create the right A records?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#79

Post by davikr »

michaelt wrote: post #62
tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

To "avoid domination by huge centralized services", of course. What if you want to run something like a website from your own IP, but you can't because you're behind CGNAT?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#80

Post by tenebrisalietum »

michaelt wrote: post #62
tenebrisalietum wrote: post #39

Earlier quoted context omitted.

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of…

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

Another reason is that NAT is making IPv4 live longer than it should, making IPv4 addresses more expensive. Maybe you don't want to host cloud services from your home, but if IPv4 addresses start costing millions of dollars (I know blocks of them can go for that much--if we're already there do you want to go further?), that drives up the cost for anyone using the Internet even if you are super okay with CG-NAT (which you shouldn't be).

IPv6 will fix that.

Post reply on HN