Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Every Network is 192.168.1.x

netrinos.com

Post reply on HN
Print view View original

71–80 of 123 posts

Re: When Every Network is 192.168.1.x

#71

Post by solaris2007 »

pcarroll wrote: post #50
solaris2007 wrote: post #23

> But the moment two sites share the same address range, you have an ambiguity that IP routing cannot resolve. Writing PF or nft rules to NAT these hyper-legacy subnets on the local side of the layer3 tunnel is actually super trivial, like 20 seconds of effort to reason about and write in a config manifest. Like written the article, a device on the customer site is required. At that point you might as well deploy a r…

Support for IPv6 is notoriously bad in residential modems. They can barely run IPv4. In an enterprise, you can do it properly. But here we are stuck with the junk the ISP gave out. Customers don't care. You have to work with what you've got.

[dead]

Re: When Every Network is 192.168.1.x

#72

Post by ivanjermakov »

rtkwe wrote: post #17

I recently just changed my default subnet to 10.X.Y.... rolling two random numbers to make it highly unlikely my home subnet through wireguard would conflict with the subnet where I am connecting from.

I subtly remember that 10.x.y address space is widely used by CGNATs.

Re: When Every Network is 192.168.1.x

#74

Post by bandrami »

zamadatix wrote: post #16
lxgr wrote: post #4

Earlier quoted context omitted.

IPv6 solves the addressing problem, not the reachability problem. Good luck opening ports in the stateful IPv6 firewalls in the scenarios outlined in TFA: > And that assumes a single NAT. Many sites have a security firewall behind the ISP modem, or a cellular modem in front of it. Double or triple NAT means configuring port forwarding on two or three devices in series, any of which can be reset or replaced independen…

The article's proposed solution for IPv4 is a combination of VPN+NAT. The solution in IPv6 can be just VPN, sans NAT.

It can be sans NAT, but there's no guarantee it will be, and if a remote site chooses to NAT their IPV6 you still have to support it

Re: When Every Network is 192.168.1.x

#75

Post by bandrami »

1970-01-01 wrote: post #6
lxgr wrote: post #4

Earlier quoted context omitted.

IPv6 solves the addressing problem, not the reachability problem. Good luck opening ports in the stateful IPv6 firewalls in the scenarios outlined in TFA: > And that assumes a single NAT. Many sites have a security firewall behind the ISP modem, or a cellular modem in front of it. Double or triple NAT means configuring port forwarding on two or three devices in series, any of which can be reset or replaced independen…

With IPv6 you don’t forward ports at all. The device already has a public address.

You don't have to forward ports with IPv6 but you certainly can, and that means some remote sites you have to interact with will.

Re: When Every Network is 192.168.1.x

#76

Post by tryauuum »

pcarroll wrote: post #58
1970-01-01 wrote: post #2

Why not IPv6? Pretending that it doesn't exist?? https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechan...

IPv6 is very badly supported at the low end of the market. Cheap webcams, doorbells, etc. And that not counting already old equipment... If we had a nuclear war, we could start over. But for now, we are stuck. Blame it on Cisco for inventing NAT.

man this sounds so realistic, a system administrator saying "yes! Now we can migrate to the IPv6" after the 99.9 percent of the world population is killed

Re: When Every Network is 192.168.1.x

#77

Post by greyface- »

ivanjermakov wrote: post #72
rtkwe wrote: post #17

I recently just changed my default subnet to 10.X.Y.... rolling two random numbers to make it highly unlikely my home subnet through wireguard would conflict with the subnet where I am connecting from.

I subtly remember that 10.x.y address space is widely used by CGNATs.

CGNATs should be using 100.64/10 instead of 10/8 to avoid this problem, but I don't doubt that there are significant deployments on 10/8 anyway.

Re: When Every Network is 192.168.1.x

#78

Post by mjevans »

eqvinox wrote: post #69
pcarroll wrote: post #53

Earlier quoted context omitted.

I like to think this is what we did. It's a simple Linux software stack - Linux, nftables, WireGuard, Go... But the goal was also to make it automatic and easy to use. It's not for my Mom. But you don't need a CCNP either. The trick is in the automation and not the stack itself.

The key distinction with a L3VPN setup is that the packets are unmodified from and including the IP layer upwards, they're just encapsulated/labelled/tagged (depending on your choice of distinguisher). That encapsulation/… is a stateless operation, but comes at the cost of MTU (which in your case should be a controllable factor since the inner flows don't really hit uncontrolled devices.) Depending on what you're try…

10. is /8 (24 payload bits), 172.16 is /12 (so 22) and 192.168 is /16. Very little need to spend more than 18 bits of space to map every 'usable' private IPv4 address once per customer. Probably also less than 14 bits (16k) of customers to service.

There's more addresses I didn't know about offhand but found when looking up the 'no DHCP server' autoconf IP address range (Link Local IPv4).

https://en.wikipedia.org/wiki/IPv4#Special-use_addresses

Re: When Every Network is 192.168.1.x

#79

Post by solaris2007 »

themafia wrote: post #35
lxgr wrote: post #29

Earlier quoted context omitted.

> Otherwise it makes a strong case for the continued use of "private networks" and the IPv6 ULA mechanism. Let's please not. Even without inbound reachability, hole punching is significantly easier given globally routeable addresses.

You can have /both/ a ULA and a Globally Routable address. In practice it works just fine. My internal DNS points to the ULA for internal connectivity and my hosts use their global addresses for external connectivity.

[dead]
Post reply on HN