Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 Is A Disaster (but we can fix it)

matduggan.com

Post reply on HN
Print view View original

81–90 of 98 posts

Re: IPv6 Is A Disaster (but we can fix it)

#81

Post by bauruine »

nottorp wrote: post #80
yesco wrote: post #78

Earlier quoted context omitted.

All networking is complex. I asked the other guy this, but I'll also ask you. Please provide me the level of documentation you are looking for, but for an IPv4 network. If you have some grand tutorial that explains it as easily as you make it out to be, then I truly would love to see it, I will include it in my onboarding documentation at work. Because I understand both IPv4 and IPv6, and do not consider IPv6 the mor…

> Because I understand both IPv4 and IPv6, and do not consider IPv6 the more complex protocol by any measure. You mentioned "new hires" while i mentioned hobbyists. You're talking about a business network where people are paid to do it, I'm talking about home networks and home labs. You're basically confirming my statement that IPv6 was designed for enterprise needs?

There are millions of people using IPv6 without knowing it. The ISP has everything preconfigured and if you use a third party router it's normaly one or two options to set. And it just works like for IPv4.

Re: IPv6 Is A Disaster (but we can fix it)

#82

Post by nottorp »

bauruine wrote: post #81
nottorp wrote: post #80

Earlier quoted context omitted.

> Because I understand both IPv4 and IPv6, and do not consider IPv6 the more complex protocol by any measure. You mentioned "new hires" while i mentioned hobbyists. You're talking about a business network where people are paid to do it, I'm talking about home networks and home labs. You're basically confirming my statement that IPv6 was designed for enterprise needs?

There are millions of people using IPv6 without knowing it. The ISP has everything preconfigured and if you use a third party router it's normaly one or two options to set. And it just works like for IPv4.

I have that. Not enough at hobbyist level though.

Re: IPv6 Is A Disaster (but we can fix it)

#83

Post by bauruine »

nottorp wrote: post #82
bauruine wrote: post #81

Earlier quoted context omitted.

There are millions of people using IPv6 without knowing it. The ISP has everything preconfigured and if you use a third party router it's normaly one or two options to set. And it just works like for IPv4.

I have that. Not enough at hobbyist level though.

>Please provide me the level of documentation you are looking for, but for an IPv4 network.

Could help to get an idea what you see as "hobbyist level". Setting up IPv6 has been pretty straight forward on plain Ubuntu as a router just with replacing the dhcpd subnet configs with a radvd config, enable ipv6 forwarding in addition to ipv4 forwarding and replace the iptables NAT rule with a only forward RELATED,ESTABLISHED connections (which already is optional).

Re: IPv6 Is A Disaster (but we can fix it)

#84

Post by nottorp »

bauruine wrote: post #83
nottorp wrote: post #82

Earlier quoted context omitted.

I have that. Not enough at hobbyist level though.

>Please provide me the level of documentation you are looking for, but for an IPv4 network. Could help to get an idea what you see as "hobbyist level". Setting up IPv6 has been pretty straight forward on plain Ubuntu as a router just with replacing the dhcpd subnet configs with a radvd config, enable ipv6 forwarding in addition to ipv4 forwarding and replace the iptables NAT rule with a only forward RELATED,ESTABLISH…

Two fiber connections coming inside my home. One is a home connection with a router that sends ipv6 to any machine that asks for it (which i may not always want), the other one is a business connection that goes into an Ubuntu router that has to run pppoe.

The path of least resistance with ipv4 was to have static ips for every PC and change the default route where I cared about which connection the PC used. Also was using the dhcp from the home router.

Now ipv6 has addresses that are auto generated by the OS on boot, addresses that are forwarded from the router and are in a subnet assigned to home ISP #1, and ... whatever I'd need to assign manually?

It's still hobbyist level not enterprise level if you ask me. But it's a lot to read for a network that works just fine thank you.

Re: IPv6 Is A Disaster (but we can fix it)

#85

Post by bauruine »

nottorp wrote: post #84
bauruine wrote: post #83

Earlier quoted context omitted.

>Please provide me the level of documentation you are looking for, but for an IPv4 network. Could help to get an idea what you see as "hobbyist level". Setting up IPv6 has been pretty straight forward on plain Ubuntu as a router just with replacing the dhcpd subnet configs with a radvd config, enable ipv6 forwarding in addition to ipv4 forwarding and replace the iptables NAT rule with a only forward RELATED,ESTABLISH…

Two fiber connections coming inside my home. One is a home connection with a router that sends ipv6 to any machine that asks for it (which i may not always want), the other one is a business connection that goes into an Ubuntu router that has to run pppoe. The path of least resistance with ipv4 was to have static ips for every PC and change the default route where I cared about which connection the PC used. Also was…

This auto configuration mechanism is called stateless address autoconfiguration (SLAAC) so "Your OS disable IPv6 SLAAC" or something like that in your favorite search engine should give you the answer. After that you should be able to manually configure your address and gateway like you would for v4. If your prefix is dynamic it gets a bit ugly then you have to use link local addresses and something like NPTv6 or NAT66 on the gateway. A better alternative IMHO would be to use different VLANs for the two networks but then your switch and possibly access point have to support it.

Re: IPv6 Is A Disaster (but we can fix it)

#86

Post by nottorp »

bauruine wrote: post #85
nottorp wrote: post #84

Earlier quoted context omitted.

Two fiber connections coming inside my home. One is a home connection with a router that sends ipv6 to any machine that asks for it (which i may not always want), the other one is a business connection that goes into an Ubuntu router that has to run pppoe. The path of least resistance with ipv4 was to have static ips for every PC and change the default route where I cared about which connection the PC used. Also was…

This auto configuration mechanism is called stateless address autoconfiguration (SLAAC) so "Your OS disable IPv6 SLAAC" or something like that in your favorite search engine should give you the answer. After that you should be able to manually configure your address and gateway like you would for v4. If your prefix is dynamic it gets a bit ugly then you have to use link local addresses and something like NPTv6 or NAT…

> If your prefix is dynamic it gets a bit ugly then you have to use link local addresses and something like NPTv6 or NAT66 on the gateway.

The home connection is probably dynamic. I asked them about paying extra for a fixed IP and they said they're all out. They meant IPv4 of course but that doesn't mean i get fixed IPv6 now.

> A better alternative IMHO would be to use different VLANs for the two networks but then your switch and possibly access point have to support it.

... and it might be fun getting the internal machines to talk to each other? I ssh around all the time.

Re: IPv6 Is A Disaster (but we can fix it)

#87

Post by zamadatix »

JohnFen wrote: post #27
zamadatix wrote: post #13

Earlier quoted context omitted.

The nice thing about NAT64 is you only NAT when you're talking to a v4 only client, otherwise you still have pure v6. This leaves no hacks to remove for a pure IPv6 experience it just means you can have single stacked IPv6 devices instead of needing to dual stack or wait for the entire rest of the world to also configure IPv6 too. I.e. it allows you to push IPv4 to your internet edge only in a way that doesn't downgr…

When the day comes that I have to shift to IPv6, I think I still want to NAT, though. I could be (and probably am) misunderstanding things, but I don't see how I can eliminate my need for it. What I want it for is so that I can have services exposed through my domain name, but operated on different internal servers.

It's not uncommon to load-balance or NAT over fe80:: link-local addresses for internal service delivery for your use case. Some services are nicer, allowing DNS SRV records or the like, but many require the middle-man.

Some ask "why bother with IPv6 if I'm still going to do that then?" and generally the two key advantages are the fe80:: address co-exists with the unique public address of each box so you don't need outbound masquerade NAT pools and the fe80:: address space is enormous+interface specific so you don't have to worry about unique internal space or conflicts with other networks. Or, if you have a static IPv6 assignment in a more "proper" hosted deployment instead of a dynamic home deployment, you can of course just do stateless NAT to the public addresses without worrying about IP scarcity.

Re: IPv6 Is A Disaster (but we can fix it)

#88

Post by zamadatix »

WorldMaker wrote: post #37
JohnFen wrote: post #27

Earlier quoted context omitted.

When the day comes that I have to shift to IPv6, I think I still want to NAT, though. I could be (and probably am) misunderstanding things, but I don't see how I can eliminate my need for it. What I want it for is so that I can have services exposed through my domain name, but operated on different internal servers.

At that point you just use a much simpler reverse proxy, I think? NATs have to be stateful to operate, but in IPv6 you can do a lot with simpler stateless reverse proxies.

NATs in this inbound scenario are most often stateless 1:1 static mappings of the port.

Re: IPv6 Is A Disaster (but we can fix it)

#89

Post by unethical_ban »

hot_gril wrote: post #60
unethical_ban wrote: post #59

Earlier quoted context omitted.

NAT is a bandage over a crippling of proper network behavior. You trust your port forwarding isn't illicitly opening itself, no? Then you can trust a default deny inbound policy on IPv6.

My port forwarding would have to actively try to allow traffic to my host. It doesn't even know where to forward to. And like it or not, NAT has momentum. Getting rid of NAT would be a big migration in of itself.

NAT66 exists, it just isn't a necessity in IPv6. There are also private IPv6 networks.

They are called Unique Local Addresses (ULA) and are in the range fd00::/8.

Which itself is so much better than RFC 1918 addresses. If you need private, non-Internet routable addresses, then you generate a random one. In the event two private networks need to communicate over VPN, for example, there is no clash.

Re: IPv6 Is A Disaster (but we can fix it)

#90

Post by aidenn0 »

I think if every hosting company that charges for ipv4 addresses offered complementary (or at least much cheaper) NAT64, then paying for an ipv4 would be only needed for ingress traffic, and ipv4 addresses could be dropped for most VMs.
Post reply on HN