Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 Is A Disaster (but we can fix it)

matduggan.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: IPv6 Is A Disaster (but we can fix it)

#71

Post by hot_gril »

JohnFen wrote: post #69
hot_gril wrote: post #68

Earlier quoted context omitted.

> If you use DHCP, then I think you can configure that. What I have in mind is to assign static IPs to all of my fixed machines anyway, and use DHCP to assign IPs to transient machines. Not sure if that's reasonable, but it's my current thinking. You probably can, but as it's often said, most security breaches are caused by misconfiguration. >There may be broken ones, but it doesn't matter so much because your ISP wo…

> You probably can, but as it's often said, most security breaches are caused by misconfiguration. Yes, but that's no different with IPv4. What it really means is that we have to learn the intricacies of IPv6 in order to use it confidently. Right now, I am nowhere near comfortable that I have sufficient understanding. That can be fixed through enough study, but is also part of the friction in adopting IPv6.

There's that friction, but also blocking traffic in v6 is more complicated per se. v4 only has one kind of address, and it's really hard to mess up NAT in a way that causes a breach. In kind of a stupid way, it's secure by default.

Guess the most likely mishap is a bad router supports upnp and has it on by default, and a bad device maps an actually used port. No PC is going to do that, it'd have to be something like a cheap knockoff security DVR.

Re: IPv6 Is A Disaster (but we can fix it)

#72

Post by JohnFen »

bauruine wrote: post #65
JohnFen wrote: post #62

Earlier quoted context omitted.

I could, sure, although if I'm going to do that, I may as well just put an IPv6 translation layer at my router level and keep everything internally at IPv4. Which I'm seriously considering doing as the path of least resistance, particularly since there are no special IPv6 features that I really want or need. But the last time I mentioned half-measures here on HN, I got dumped on pretty harshly.

I don't think that exists and I can't imagine how a IPv6 translation layer with internally IPv4 addresses should work. What exactly do you want to do?

If the internet destinations I want to reach have an IPv4 address, it's obviously very easy. It's just a kind of NAT. And everywhere I want to reach has IPv4 addresses and probably will for a long time.

If they're IPv6 and I really need to reach them anyway, then I could imagine writing a special NAT that keeps a database equating IPv4 addresses (that I make up) with real IPv6 addresses on the net and doing a NAT that way. That would be suboptimal because it would mean that I'd need to add a database entry in advance for each internet destination, of course. But it seems feasible. And I can think of a couple of ways to automate it.

But, honestly, I don't know. I'm just spitballing what the best way of handling all of this actually is. Every method I have heard or can think of has some serious downside, and I don't have sufficient expertise (and haven't spent the time) to do actual cost/benefit analyses of the various options yet.

This is all a huge time-consuming hassle, and is why I'm putting the whole thing off until I have no other option.

Re: IPv6 Is A Disaster (but we can fix it)

#73

Post by [deleted] »

hot_gril wrote: post #41
ClashTheBunny wrote: post #9

Earlier quoted context omitted.

What would you suggest they have done? I feel like excluding IPv4 folks is a large reason why IPv6 continues to fail. I feel like this is a pretty good compromise between pushing IPv6 and not being an IPv6 hermit in the IPv6 desert.

I would suggest letting v4 users keep their existing v4 addresses when going to v6.

[deleted]

Re: IPv6 Is A Disaster (but we can fix it)

#74

Post by JohnFen »

nottorp wrote: post #17
Nextgrid wrote: post #7

Earlier quoted context omitted.

I don't think it's fair to blame the technology. The problem is that the computing industry has changed. The things that IPv6 would enable (direct end-to-end connectivity) is now seen as a negative by the industry that has since pivoted on rent-seeking, walled gardens and restricting user's potential. The industry is now even legally making money on many things that would've been considered outright malware just a de…

> The problem is that the computing industry has changed. Nah, the problem is ipv6 has been designed by a commitee for a lot of enterprise-ish features so the hobbyists have taken a look and postponed setting it up internally for when they have absolutely no choice. I've asked for simple ipv6 tutorials in discussions on HN and elsewhere and whatever I got pointed at was always longer than the article we're discussing…

> I've asked for simple ipv6 tutorials

There really does seem to be a lack of good documentation about all of this. The docs that I've seen appear to be aimed at actual network engineers, or are so incomplete as to not be worthwhile.

I would be much less stressed by all of this if I could find something good that sits between those two extremes.

A part of me, though, suspects that the reason there is no "middle ground" documentation is that it's not possible -- that IPv6 is too complex for that. Not saying that's the actual reality, but it has the whiff of it.

Re: IPv6 Is A Disaster (but we can fix it)

#75

Post by JohnFen »

hot_gril wrote: post #71
JohnFen wrote: post #69

Earlier quoted context omitted.

> You probably can, but as it's often said, most security breaches are caused by misconfiguration. Yes, but that's no different with IPv4. What it really means is that we have to learn the intricacies of IPv6 in order to use it confidently. Right now, I am nowhere near comfortable that I have sufficient understanding. That can be fixed through enough study, but is also part of the friction in adopting IPv6.

There's that friction, but also blocking traffic in v6 is more complicated per se. v4 only has one kind of address, and it's really hard to mess up NAT in a way that causes a breach. In kind of a stupid way, it's secure by default. Guess the most likely mishap is a bad router supports upnp and has it on by default, and a bad device maps an actually used port. No PC is going to do that, it'd have to be something like…

> blocking traffic in v6 is more complicated per se

I don't think that's the case. I think how you set your router/firewall rules with IPv6 is the same as with IPv4 aside from the addresses being longer.

> it's really hard to mess up NAT in a way that causes a breach

You can continue to use NAT with IPv6. I know that when I make the change, I'll still be using NAT, for convenience if nothing else.

Re: IPv6 Is A Disaster (but we can fix it)

#76

Post by WorldMaker »

bauruine wrote: post #65
JohnFen wrote: post #62

Earlier quoted context omitted.

I could, sure, although if I'm going to do that, I may as well just put an IPv6 translation layer at my router level and keep everything internally at IPv4. Which I'm seriously considering doing as the path of least resistance, particularly since there are no special IPv6 features that I really want or need. But the last time I mentioned half-measures here on HN, I got dumped on pretty harshly.

I don't think that exists and I can't imagine how a IPv6 translation layer with internally IPv4 addresses should work. What exactly do you want to do?

Some NAT46 (not to be confused with NAT64) tools and routers exist in the wild today. "Stateless" ones work by manually setting routes for chosen IPv4 addresses to IPv6 ones or treating all of IPv4 traffic as the "ultimate" semi-private IPv6 "subnet" and prepend a fixed IPv6 prefix to all IPv4 traffic (and you can do that with just about any IPv6 /64). Stateful ones act a lot like NAT44 routers and can also use "out-of-bound" protocols similar to NAT44's UPnP (but I think distinct from?) to setup routes on the fly from application requests.

Though they exist, my understanding is that the need and use cases for them is overall much weaker than NAT64 or NAT44.

Re: IPv6 Is A Disaster (but we can fix it)

#77

Post by yesco »

nottorp wrote: post #25
yesco wrote: post #19

Earlier quoted context omitted.

- https://openwrt.org/docs/guide-user/network/ipv6/configurati... - https://openwrt.org/docs/guide-user/network/routing/examples... - https://openwrt.org/docs/guide-user/network/ipv6_ipv4_transi... - https://openwrt.org/docs/guide-user/network/ipv6/ipv6_extras

Yeah right. The summary of the first page already throws around like 4-5 acronyms that each require reading a separate documentation. And that's only for configuring your router, not your local network...

Okay then please provide me the level of documentation you are looking for, but for an IPv4 network. Sounds wonderful, I'd love to share it with new hires.

Re: IPv6 Is A Disaster (but we can fix it)

#78

Post by yesco »

JohnFen wrote: post #74
nottorp wrote: post #17

Earlier quoted context omitted.

> The problem is that the computing industry has changed. Nah, the problem is ipv6 has been designed by a commitee for a lot of enterprise-ish features so the hobbyists have taken a look and postponed setting it up internally for when they have absolutely no choice. I've asked for simple ipv6 tutorials in discussions on HN and elsewhere and whatever I got pointed at was always longer than the article we're discussing…

> I've asked for simple ipv6 tutorials There really does seem to be a lack of good documentation about all of this. The docs that I've seen appear to be aimed at actual network engineers, or are so incomplete as to not be worthwhile. I would be much less stressed by all of this if I could find something good that sits between those two extremes. A part of me, though, suspects that the reason there is no "middle groun…

All networking is complex.

I asked the other guy this, but I'll also ask you. Please provide me the level of documentation you are looking for, but for an IPv4 network. If you have some grand tutorial that explains it as easily as you make it out to be, then I truly would love to see it, I will include it in my onboarding documentation at work.

Because I understand both IPv4 and IPv6, and do not consider IPv6 the more complex protocol by any measure. I suspect your "whiff" is more a bias towards what you are comfortable with, rather than a true reflection of IPv6's complexity.

Re: IPv6 Is A Disaster (but we can fix it)

#79

Post by magicalhippo »

bauruine wrote: post #48
JohnFen wrote: post #45

Earlier quoted context omitted.

> in many ways IPv6 is simpler than IPv4. It's not really about whether or not IPv6 is simpler than IPv4, though. It's about how painful moving from IPv4 to IPv6 is. And it's very painful. If the only thing that changed between the two was that the IP address space is bigger, it would reduce the pain of changing. I'm certainly not going to claim that my experience is representative of anyone except for me, but the re…

Why is it so painful for you? As someone that has been running everything dualstack for over a decade I'm seriously interested where people are struggling with it. The only pain I've ever seen is in corporate networks where all the tooling around the network management are IPv4 only but those would break even if you add a single bit to an IPv4 address.

ISP doesn't provide much in terms of support. They had a IPv6 page for some years announcing it was available for the eager ones, which has been since been taken down. Searching for IPv6 in their documentation comes up empty.

Software isn't ready or was written back in the early days before they figured out how IPv6 would actually be deployed. I had an Asus router back in the days, it had primitive and unstable IPv6 support, which just grabbed a single /64 and that was it.

I then ran pfSense for some years and it was unusable for IPv6 due to everything being geared around fixed prefix. Even if my ISP had given me a fixed prefix it would have been a pain, because I got two new cable modems in that period (one due to the previous being too old, other one due to a move), so would have gotten a new prefixes anyway and would have had to rewrite all my firewall rules. Would have been major PITA each time. No such need with IPv4.

I switched to OpenWRT some years ago and it's mostly worked since. Mostly.

Android phones in the homes don't respect my DHCPv6 settings, and it took me some time to figure out it ignored my DNS settings because I had only IPv4 configured as my local DNS server. Other boxes were fine with that, but not Android, which silently used Googles DNS instead.

Running dual stack isn't ideal either, since it can lead to inconsistencies. When some things work and some things don't, and it can be difficult to figure out why because of the non-trivial interaction between IPv4 and IPv6.

It's also painful because just about everything is different. So very little of what I know of how to configure my IPv4 network carries over. It's very much not just IPv4 with more bits. I'm old enough now that I'm not terribly excited about digging around in the IPv6 technical weeds, and I haven't found a good guide or reference I can fall back on.

Re: IPv6 Is A Disaster (but we can fix it)

#80

Post by nottorp »

yesco wrote: post #78
JohnFen wrote: post #74

Earlier quoted context omitted.

> I've asked for simple ipv6 tutorials There really does seem to be a lack of good documentation about all of this. The docs that I've seen appear to be aimed at actual network engineers, or are so incomplete as to not be worthwhile. I would be much less stressed by all of this if I could find something good that sits between those two extremes. A part of me, though, suspects that the reason there is no "middle groun…

All networking is complex. I asked the other guy this, but I'll also ask you. Please provide me the level of documentation you are looking for, but for an IPv4 network. If you have some grand tutorial that explains it as easily as you make it out to be, then I truly would love to see it, I will include it in my onboarding documentation at work. Because I understand both IPv4 and IPv6, and do not consider IPv6 the mor…

> Because I understand both IPv4 and IPv6, and do not consider IPv6 the more complex protocol by any measure.

You mentioned "new hires" while i mentioned hobbyists. You're talking about a business network where people are paid to do it, I'm talking about home networks and home labs.

You're basically confirming my statement that IPv6 was designed for enterprise needs?

Post reply on HN