Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Addresses Through 2025

potaroo.net

Post reply on HN
Print view View original

81–90 of 158 posts

Re: IP Addresses Through 2025

#81

Post by MaKey »

simoncion wrote: post #68
ianburrell wrote: post #56

Earlier quoted context omitted.

IPv6 routers use a stateful firewall just like NAT includes. Just without the problems of NAT.

As a bonus, because most (nearly all?) SOHO IPv6 routers are Linux under the hood, they are also capable of IPv6 NAT.

I doubt that most consumer routers expose this functionality. IPv6 NAT is rarely needed and should be avoided. Interestingly enough I stumbled upon a use case today. No IPv6 connectivity at my office but at my dad's house. Since a WireGuard tunnel is layer 3 I can't use router advertisements and the prefix is dynamic, so private IPv6 addresses and NAT66 it is. It was an exercise out of curiosity though, route64.org works much better for IPv6 connectivity.

Re: IP Addresses Through 2025

#82

Post by oasisbob »

themafia wrote: post #71
simoncion wrote: post #63

Earlier quoted context omitted.

> I know that IPv6 can be made secure, but I don't have the background or research time to learn how to do so, and the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy that makes it impossible to accidentally directly connect anything to the internet. To get the "unsolicted traffic is rejected or dropped" behavior of the typical IPv4 NAT, forward inbound traffic that…

I don't think you even need a stateful firewall. If it's an IoT device that's not meant to provide services to the internet then it seems to me you can just drop all non local subnet originated traffic and get most of the security you would expect with NAT.

If you want to drop all non-local subnet originated traffic, you need to keep state. Otherwise, how can you tell which side originated the flow?

Even that is only a partial solution - UPNP hole punching exploits holes in this logic to allow peer-to-peer traffic into a network which otherwise has a default-deny ACL.

Re: IP Addresses Through 2025

#83

Post by immibis »

dlcarrier wrote: post #41
Fiveplus wrote: post #17

The collapse in IPv4 transfer prices is what caught my eye here, dropping from a ~$55 peak in 2021 to a mean of $22 in early 2026 (figure 12). This validates my hypothesis that the run-up in 2020–2022 was an artificial scarcity bubble driven largely by hyperscalers. AWS was right up there stockpiling before they shifted their pricing model. Once AWS introduced the hourly charge for public IPv4 addresses (effectively…

As someone with a background in electronics who doesn't manage any internet-connected equipment but has multiple embedded devices connected to a WAN, I'm glad that IPv4 still seems to have a bit of life left in it. When IPv6 was developed, over 30 years ago, connecting everything to the internet seemed like a great idea. I know that IPv6 can be made secure, but I don't have the background or research time to learn ho…

For some background why IoT products will stop being insecure: if you sell one in the EU, you're liable for all the damage your botnet causes.

Luckily, common EU home routers have firewalls, even for IPv6. And it's so much easier to punch holes on purpose! Instead of messing with port forwarding and internal and external IP addresses, you can just say "this device is a server, please allow traffic on port 80 and 443, thank you"

Re: IP Addresses Through 2025

#84

Post by oasisbob »

1970-01-01 wrote: post #38

I'm interested in any new successful startups going full IPV6 from the beginning. Once we cross that bridge, where your internal IPV4 knowledge is equivalent to token ring knowledge, there's nothing else to watch.

Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with.

However, there are network upstarts like Jio (India) which made huge v6 investments from day one which use 464xlat for subscribers to access v4-only resources.

Re: IP Addresses Through 2025

#85

Post by patmorgan23 »

ianburrell wrote: post #55
dunder_cat wrote: post #47

Earlier quoted context omitted.

In the US, I really want the FCC to mandate that an ISP provides IPv6 connectivity in order to meet the criteria to be considered broadband (and access the subsidies related to that). Don't even care if the functionality is off by default / you have to call and agree the routing may be sub-optimal, whatever. I currently use HE tunnels but on top of additional latency, the HE Cogent peering dispute still makes it diff…

There should be rule that ISP with CGNAT must offer IPv6 as an alternative. The US doesn't use CGNAT as much as other countries, but would help people stuck behind crappy CGNAT.

Yeah I this is the bigger issue. CG-NATs break things, you shouldn't be able to sell a pooled IP CG-NAT only service as broadband connection. Looking at you MetroNet

Re: IP Addresses Through 2025

#86

Post by newsoftheday »

knollimar wrote: post #49
newsoftheday wrote: post #39

Earlier quoted context omitted.

When AWS rolled out plans to start charging for IPv4 addresses: https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address... "As you may know, IPv4 addresses are an increasingly scarce resource and the cost to acquire a single public IPv4 address has risen more than 300% over the past 5 years. This change reflects our own costs and is also intended to encourage you to be a bit more frugal with your use of public I…

What disgusted you about it? I'm out of the loop

It was clearly a corporate money grab, not an altruistic motion as they made it sound.

Re: IP Addresses Through 2025

#87

Post by immibis »

oasisbob wrote: post #84
1970-01-01 wrote: post #38

I'm interested in any new successful startups going full IPV6 from the beginning. Once we cross that bridge, where your internal IPV4 knowledge is equivalent to token ring knowledge, there's nothing else to watch.

Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with. However, there are network upstarts like Jio (India) which made huge v6 investments from day one which use 464xlat for subscribers to access v4-only resources.

Also every mobile phone network ever (with a handful of exceptions) is IPv6-only, with a slow translation layer to reach v4 sites. Your app or website literally runs faster if you use IPv6.

Re: IP Addresses Through 2025

#88

Post by 1970-01-01 »

oasisbob wrote: post #84
1970-01-01 wrote: post #38

I'm interested in any new successful startups going full IPV6 from the beginning. Once we cross that bridge, where your internal IPV4 knowledge is equivalent to token ring knowledge, there's nothing else to watch.

Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with. However, there are network upstarts like Jio (India) which made huge v6 investments from day one which use 464xlat for subscribers to access v4-only resources.

>Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with.

That's my point; why is it still difficult? What exactly are the pain points for a fully commercialized native IPV6-only business, and why do we think it will be easier to maintain the status quo?

Re: IP Addresses Through 2025

#89

Post by cyberax »

radlad wrote: post #46
dlcarrier wrote: post #41

Earlier quoted context omitted.

As someone with a background in electronics who doesn't manage any internet-connected equipment but has multiple embedded devices connected to a WAN, I'm glad that IPv4 still seems to have a bit of life left in it. When IPv6 was developed, over 30 years ago, connecting everything to the internet seemed like a great idea. I know that IPv6 can be made secure, but I don't have the background or research time to learn ho…

> the NAT-by-default of IPv4 IPv4 is not NAT-by-default. The reality of the world we live in today is that most home networks have a NAT, because you need multiple devices behind a single IP. That said, I agree: it's quite unknowable how many services I've turned on on local machines with the expectation that a router firewall sat between me and potential clients. But that doesn't go away with IPv6 - the NAT does, th…

> NAT is not the firewall.

NAT _is_ a firewall. And a much safer one than IPv6 firewalls, because NAT will fail safe if misconfigured.

Re: IP Addresses Through 2025

#90

Post by huslage »

jdsully wrote: post #52
knollimar wrote: post #49

Earlier quoted context omitted.

What disgusted you about it? I'm out of the loop

They hadn't bothered to add ipv6 support to most of their services and the ones that did have it usually were only dual stack - still requiring an ipv4 address.

They didn't require you to have a public IPv4 address. Just an IPv4 address.
Post reply on HN