Live data from Hacker News

IPv6 Support for EC2 Instances in Virtual Private Clouds

aws.amazon.com

91–100 of 114 posts

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#91
post #55

Earlier quoted context omitted.

Because there are many other factors in choosing a hosting provider (price, performance, features, security, scalability, etc). It seems a bit weird that all of these would be less important to someone than IPv6. Though I guess I can imagine that for some businesses it could be hugely important. Was just wondering what OPs business was that it became an overriding priority.

Rolling out an IPv4 only stack right now is debt. IPv6 has finally hit the point where there's no longer an if portion to the question, but rather a when. Every server rolled out in an IPv4 only setup, every service built, etc, is one more potentially service-interrupting area that will have to be changed when port your stack to IPv6. If you're young and small, starting as IPv6 native means that the next few years yo…

[deleted]

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#92
post #2

Finally! It's been a major deficiency in AWS. Can't wait to see this roll out to us-west-2.

I'm kinda sick of all the AWS posts on here, but I'm trying to be fair since some of them are really interesting. This is one of those that's more of a "about damn time," features that'd I'd care about if I already didn't go with Digital Ocean/Linode instead just because of IPv6 support.

Great! Lots of people on Hacker News use AWS because places like Linode and DO don't actually have all the services and scale their work requires. Believe me, we agree that this announcement is several years overdue. I think most engineers who work in AWS would also agree. But when you get to their scale, it's hard to make big changes like this in a safe way. The fact that it rolled out in a brand-new region (us-east-2 only for now) is good evidence that they are being very very careful with this rollout.

And as mentioned, the reason there are so many AWS posts this week is because they save up all their announcements for the conference going on right now. I sorta wish they'd spread the stuff out more, myself, but these are mostly HN-front-page quality announcements. It's just a year's worth of work dumped all in two days.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#93
post #35

Earlier quoted context omitted.

Just curious but why is IPv6 support such a priority for you that it would be the deciding factor in your choice of hosting provider?

A few months ago Apple made it a requirement for all new iOS apps and app updates to support IPv6 only networking. If the app backend is not also available from a network where IPv4 is completely blocked, the app is rejected. At the same time, AWS does not let new accounts to create EC2 instances outside of VPC, and only provided IPv6 support in the non-VPC classic stack (only available to old AWS accounts that signe…

The requirement is only to work in networks with NAT64. That means your app can not hardcode IPv4 addresses and not rely on IPv4 only APIs, it has to work if any of its backend services are only visible through an IPv6 address from a NAT64 gateway and it receives that address from a DNS64 service. The backend service itself does not have to have IPv6 connectivity.

https://developer.apple.com/library/content/documentation/Ne...

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#94
post #55

Earlier quoted context omitted.

Because there are many other factors in choosing a hosting provider (price, performance, features, security, scalability, etc). It seems a bit weird that all of these would be less important to someone than IPv6. Though I guess I can imagine that for some businesses it could be hugely important. Was just wondering what OPs business was that it became an overriding priority.

Rolling out an IPv4 only stack right now is debt. IPv6 has finally hit the point where there's no longer an if portion to the question, but rather a when. Every server rolled out in an IPv4 only setup, every service built, etc, is one more potentially service-interrupting area that will have to be changed when port your stack to IPv6. If you're young and small, starting as IPv6 native means that the next few years yo…

That's reasonable, but I think you significantly underestimate how long it will take before these sorts of conversions will become necessary. IPv6 is 20 years old. These things take decades not years.

In addition, I think you overestimate the difficulty of conversion. Most backend servers run on 10.x.x.x networks and that doesn't need to change. You just need a proxy in front of them that can speak IPv6. Installing a new proxy does not sound like a hard job. It sounds trivial.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#95
post #35

Earlier quoted context omitted.

Just curious but why is IPv6 support such a priority for you that it would be the deciding factor in your choice of hosting provider?

We needed IPv6 support five years ago. IPv6 is so vital because without it, we'll see the cost of public IPs skyrocket. I'm surprised it hasn't considering two of the places I worked for in the past few years had trouble purchasing IPs for some of their larger data centre offerings. It's sorta like the network neutrality argument, except you're talking about limits on who can offer services to everyone vs those with…

What product are you building where you can avoid needing public IPv4 addresses considering that the vast majority of the people on the internet still use IPv4? It seems like you'll still need both for many years.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#96
post #35

Earlier quoted context omitted.

Just curious but why is IPv6 support such a priority for you that it would be the deciding factor in your choice of hosting provider?

Our entire application back end is written in IPv6 only. We don't have an IPv4 version of our product. Until IPv6 was offered, no way for us to host our application on AWS.

Why did you choose to write your backend application using IPv6 APIs only instead of higher abstraction network libraries that support both v4 and v6?

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#97
post #81

I’m not an AWS user, so the “Virtual Private Cloud” caveat confuses me. If I just click an EC2 instance, will that be in a “Virtual Private Cloud” or not? Also, are these IPv6 addresses publically reachable or not?

If you're not an AWS user yet then any EC2 instance you create (if you ever decide to become an AWS user) will be in a Virtual Private Cloud, either one you create yourself or the default VPC associated with your account.

Only older accounts (from before december 2013) have the ability to create EC2 instances that aren't in a VPC.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#98

Earlier quoted context omitted.

I'm kinda sick of all the AWS posts on here, but I'm trying to be fair since some of them are really interesting. This is one of those that's more of a "about damn time," features that'd I'd care about if I already didn't go with Digital Ocean/Linode instead just because of IPv6 support.

Great! Lots of people on Hacker News use AWS because places like Linode and DO don't actually have all the services and scale their work requires. Believe me, we agree that this announcement is several years overdue. I think most engineers who work in AWS would also agree. But when you get to their scale, it's hard to make big changes like this in a safe way. The fact that it rolled out in a brand-new region (us-east…

>But when you get to their scale, it's hard to make big changes like this in a safe way

Which only makes it more baffling that AWS still doesn't support IPv6 everywhere.

IPv6 is 8 years older than AWS. AWS is a decade old. Given that the inevitability of IPv6 is long known and that it's well known that as a rule changes get more difficult the bigger you get, I would have expected Amazon to start IPv6 deployment much earlier, back when AWS was much smaller.

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#99
post #58

Earlier quoted context omitted.

But even if my desktop does IPV6.. I am still going to firewall it. Seems like not a "benefit" to throw up my device directly on the internet.

Of course you'll keep your firewall. NAT != Firewall Your firewall may start with a simple "deny all incoming SYN packets" rule, but IPv6 gives you the option to open up holes in the firewall to any device or devices on your LAN (port forwarding only works once per port through a NAT). The real benefits probably don't exist yet. There are entire categories of network software that have remained unknown and unexplored…

> Your firewall may start with a simple "deny all incoming SYN packets" rule, but IPv6 gives you the option to open up holes in the firewall to any device or devices on your LAN (port forwarding only works once per port through a NAT).

But see.. I can already do that with IPv4 and Nat. Oh I want to run a ftp server on my backend? Open up port 8000 on my firewall and forward to port 21 on my FTP server.

I find it weird I am making this argument, as I am normally progressive. I push Python3 over Python2, because it is the way of the future. Even though it causes me pain sometime. For some reason, I just do not see the (for me personally) reason to care about ipv6.

Clearly the more backbones that support it, the better. It at least gives us the OPTION to use it later. Not totally sure what good it will do still though ;)

Re: IPv6 Support for EC2 Instances in Virtual Private Clouds

#100
post #58

Earlier quoted context omitted.

Of course you'll keep your firewall. NAT != Firewall Your firewall may start with a simple "deny all incoming SYN packets" rule, but IPv6 gives you the option to open up holes in the firewall to any device or devices on your LAN (port forwarding only works once per port through a NAT). The real benefits probably don't exist yet. There are entire categories of network software that have remained unknown and unexplored…

> Your firewall may start with a simple "deny all incoming SYN packets" rule, but IPv6 gives you the option to open up holes in the firewall to any device or devices on your LAN (port forwarding only works once per port through a NAT). But see.. I can already do that with IPv4 and Nat. Oh I want to run a ftp server on my backend? Open up port 8000 on my firewall and forward to port 21 on my FTP server. I find it weir…

> Oh I want to run a ftp server on my backend? Open up port 8000 on my firewall and forward to port 21 on my FTP server

funny you mention FTP where that is distinctly not true as the application level protocol encodes IP addresses and ports to either (depending on PASV mode) peer to open for the data transfer.

If your server is behind a NAT and the user is using passive mode, it'll tell the client to connect to some internal ip address, so unless the NAT router does deep packet inspection and alters your packet on the go, that won't fly.

Conversely, if you disable passive mode, a NATed client would have the same issue because in that case it would tell the server to connect to some internal IP on the client's side which too won't fly.

Same issue for all other protocols that have IP addresses in their payload. There are very few of them these days for precisely this reason, many early media streaming and VoIP protocols were doing this too.

Also somewhat related: Port forwarding from one public address only gives you the ability to forward to one specific server. What if you want to run two different HTTP servers on your backend? What if you want to run different SMTP servers on your backend.

Now you're again down to needing packet-contents inspection or you need multiple public IPs in the first place plus a more complicated NAT table. With v6, all you need is to open a few ports.

And these were the technical issues.

There's also a political issue: As v4 addresses get more and more scarce, so increases the control entities with addresses get to have over what services they do and to not allow on the network.

Do we want to live in a place where no new service gets to participate in the internet? Where the next Netflix can't launch because none of the providers want to have yet another service competing against their own content business?

In order for the internet to continue to grow, we need an abundance of addresses and the only way to get that is to have wide-spread v6 support. And in order to get there, every single bit counts: Every service that can offer v6 should. Every provider that can offer v6 should. Only this way we can avoid one big cause for a very much locked down internet in the hands of the providers and the old guard.

v6 plays a very important role for both technical and political reasons to the point where we really need to fight the "v4 works fine for me" attitude. Having a v4 address to run a service on is a privilege. Don't argue from a privileged position based on lazyness.

Post reply on HN