Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Customers Cannot Escape IPv4

tty.neveragain.de

Post reply on HN
Print view View original

71–80 of 316 posts

Re: AWS Customers Cannot Escape IPv4

#71

Post by throw0101b »

beoberha wrote: post #6
fulafel wrote: post #4

It seems obviously against AWS incentives to offer working v6 - all their influencing tools ("well architected" criteria, certificates) strongly herd you towards building mazes of ambigously addressed 10.x RFC1918 networks, and not internet style architectures with end-to-end addressing. In the world of their recommendations, even the concept of a "public ip address" is a red flag, and AWS even recommends (for an add…

I work in Azure, but my experience is that customers want this - and for good reason. Customers want their own private network to prevent intrusions and exfiltrations, just on machines they don’t own. Or even better, put the nice fancy batteries included PaaS services in these networks too.

> Customers want their own private network to prevent intrusions and exfiltrations, just on machines they don’t own.

If your (default) gateway from one network segment to another network segment only has one rule, default-deny, then it's not a problem. If you think that's not enough, then use IPv6 ULA (fd00::/8).

But why should the incompetence of some customers limit what all customers can do?

Re: AWS Customers Cannot Escape IPv4

#72

Post by ninkendo »

pantalaimon wrote: post #64
rad_gruchalski wrote: post #20

Earlier quoted context omitted.

I’m pretty confident that this statement is mostly true without sarcasm, and that you are in the minority.

How is managing a NAT easier than managing a firewall?

I’m one typo away from accidentally allowing IPv6 access to every machine in my network with my pf config on my home router. (I know this because I’ve done it one time, and didn’t notice for about a week.)

There is no such typo i could make with my single shared public ipv4 address because it’s just one address. Saying “allow” by accident isn’t enough, I’d have to somehow accidentally configure the particular ingress port to NAT to a particular internal machine, and even then it would only affect that machine and no other.

(Full disclosure, i actually like IPv6 and am in full favor of everything moving to it. This is in spite of the above, but i at least recognize that the above is the case.)

Re: AWS Customers Cannot Escape IPv4

#73

Post by jeroenhd »

hkt wrote: post #14

There needs to be a body of law relating to technical matters like this (and interoperability etc) that is adjacent to competition law. Some things we just need everyone to be on the same page about. It is manifestly the case that ipv6 is never going to be that, because the incentives to invest simply don't exist for companies like AWS. This distorts the market in eyeball networks and hosting - the former are under l…

The EU did have a mandate for government services to use IPv6, but the programme it was part of got replaced by another that didn't include IPv6.

The European Commission did advocate for IPv6 use, but, the EU being the EU, motivated their recommendation by complaining that law enforcement had issues tracking down people behind CGNAT, and made clear that they wanted every IP address to point to a specific person for law enforcement reasons.

So, yeah, I don't think we should let the EU deal with the specifics of network infrastructure just yet.

I think it's hard to make an economic argument for IPv6. Yes, it's obviously a superior technology, but ISPs can CGNAT for cheap, consumers can still access every server, and the €40 per year a business needs to pay for an IPv4 address isn't exactly breaking the bank either.

Perhaps the EU should force the issue, but I think countries like Lithuania ,where there is practically no IPv6 available (0.58%, according to https://stats.labs.apnic.net/ipv6-zoom, but who knows how accurate that is), will protest any mandate that will force their ISPs to buy new networking equipment.

Re: AWS Customers Cannot Escape IPv4

#74

Post by ninkendo »

huijzer wrote: post #68
mjevans wrote: post #3

It would really help if there were real ISP competition in the USA. There's only one actually broadband ISP provider where I rent, which is in the suburbs near Seattle. It's NOT a rural area by any definition, and yet Comcast is my only option. Their price and service reflect that reality...

> Comcast is my only option Maybe Starlink is another option. It has some drawbacks like reduced performance during heavy rain, but I've seen some positive reviews as well.

Starlink doesn’t have capacity for a large urban area. There’s only so many satellites available per square mile, and if you have a sizable fraction of a major city using starlink, they’d all be bottlenecked on a handful of satellites at best, even with the huge number of satellites. Starlink only makes sense for low-geographic-density deployments, where the number of customers on the same satellite is (relatively) low.

Re: AWS Customers Cannot Escape IPv4

#75

Post by pantalaimon »

jeroenhd wrote: post #73
hkt wrote: post #14

There needs to be a body of law relating to technical matters like this (and interoperability etc) that is adjacent to competition law. Some things we just need everyone to be on the same page about. It is manifestly the case that ipv6 is never going to be that, because the incentives to invest simply don't exist for companies like AWS. This distorts the market in eyeball networks and hosting - the former are under l…

The EU did have a mandate for government services to use IPv6, but the programme it was part of got replaced by another that didn't include IPv6. The European Commission did advocate for IPv6 use, but, the EU being the EU, motivated their recommendation by complaining that law enforcement had issues tracking down people behind CGNAT, and made clear that they wanted every IP address to point to a specific person for l…

Is there any networking equipment that was sold in the last 10 years that does not support IPv6?

Re: AWS Customers Cannot Escape IPv4

#76

Post by cameronh90 »

fulafel wrote: post #4

It seems obviously against AWS incentives to offer working v6 - all their influencing tools ("well architected" criteria, certificates) strongly herd you towards building mazes of ambigously addressed 10.x RFC1918 networks, and not internet style architectures with end-to-end addressing. In the world of their recommendations, even the concept of a "public ip address" is a red flag, and AWS even recommends (for an add…

It's not just AWS. Microsoft, security auditors, penetration testers, cyber insurance companies, etc. also largely insist on not having publicly addressable endpoints.

I don't understand why, but until some large tech company starts pushing for end to end addressability as best practice, I have no choice but to follow the conventional wisdom to avoid throwing up red flags.

Re: AWS Customers Cannot Escape IPv4

#77

Post by jeroenhd »

pantalaimon wrote: post #75
jeroenhd wrote: post #73

Earlier quoted context omitted.

The EU did have a mandate for government services to use IPv6, but the programme it was part of got replaced by another that didn't include IPv6. The European Commission did advocate for IPv6 use, but, the EU being the EU, motivated their recommendation by complaining that law enforcement had issues tracking down people behind CGNAT, and made clear that they wanted every IP address to point to a specific person for l…

Is there any networking equipment that was sold in the last 10 years that does not support IPv6?

I don't have a complete overview of the industry, but there were at least one or two Ubiquity gateways that didn't support hardware accelerated IPv6 routing. I also read about a lineup of Microtik switches that got updates to enable IPv6 hardware offloading this year.

Perhaps the enterprise side of networking is better about this stuff, but I doubt it if my experiences with other enterprise products is anything to go by.

The packets routed by these devices will end up at their destination, but at very low speeds.

Re: AWS Customers Cannot Escape IPv4

#78

Post by kennu »

Worst for me is CloudFront not supporting IPv6 for custom origins. If you happen to run a lot of separate Fargate containers as origins, you have to enable public IPv4 addresses for them, and that will soon double the price of small confainers. Amazon needs to make their infrastructure actually support IPv6 before starting to charge extra for legacy IPv4 usage.

Re: AWS Customers Cannot Escape IPv4

#79

Post by dopylitty »

donor20 wrote: post #8

IPv6 is such a massive headache it’s kind of mind boggling. I used to be super enthused - but it is absolutely less useful and more annoying than it’s worth.

I've been listening to a very good IPv6 related podcast with knowledgeable hosts (IPv6 Buzz) and all it's done is convince me that IPv6 is a poorly thought out mistake.

Every other episode seems to be about a different new RFC that's replacing another RFC because the original ended up having a bunch of holes and edge cases. That's somewhat understandable for a new protocol but the protocol have been around for almost 30 years and is just so overly complex that it's rife with these situations.

As an example the most recent such episode was on rfc6724[0] which describes these convoluted algorithms systems are supposed to follow to determine which of their many assigned IPv6 addresses to use for a particular connection and also which of many possible destination addresses to use. Just reading the introduction makes your eyes water with how overly complex and prone to nasty failure cases (what if the source address isn't what you expect and somehow the connection routes around your firewall?) the whole situation they've created is.

0: https://datatracker.ietf.org/doc/html/rfc6724

Re: AWS Customers Cannot Escape IPv4

#80

Post by supertrope »

thaumasiotes wrote: post #15
jiggawatts wrote: post #7

Earlier quoted context omitted.

Azure is copying this wholesale. I've lost track of all of the "Private Endpoints", "Private Links", "Service Endpoints", "Private Resolvers" and "Virtual WAN" products they've introduced... all to make IPv4 work at scale. Literally none of those products would be required if they had just made IPv6 work properly. Instead, they NAT IPv6, so you can't even use it to avoid the NAT forced upon you by IPv4. They also rel…

Comcast at some point stopped letting you administrate your own router. You can log in to it, but port forwarding is no longer available through the administration interface. If you want port forwarding, they recommend that you do... something. It's not clear what; what you can find on the internet is mostly just people complaining that they insisted to customer support that they needed port forwarding, customer supp…

One cannot unplug the Comcast issued router, power cycle the modem, and plug in a customer owned router?
Post reply on HN