Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What drives IPv6 deployment?

potaroo.net

Post reply on HN
Print view View original

91–100 of 100 posts

Re: What drives IPv6 deployment?

#91

Post by mirimir »

pilif wrote: post #67
mirimir wrote: post #12

Earlier quoted context omitted.

Yes, I've never been comfortable with the device specificity of IPv6. Sure, temporary non-local addresses are now the norm. And they're usually not MAC-based. But still, I'd rather have IPv4 with NAT. Also, there's the issue that many VPN services don't yet route IPv6, and so IPv6 connections can bypass the VPN connection.

> Yes, I've never been comfortable with the device specificity of IPv6 these days it's really not much different from IPv4: During the lifetime of a connection, the prefix stays the same, so that's equivalent to the IPv4 address before that. The actual machine address rotates very often, so there's no real value in using this for identifying unique devices. If you want to profile specific devices, you're much better…

But isn't NAT deprecated for IPv6?

Re: What drives IPv6 deployment?

#92

Post by Dagger2 »

privateSFacct wrote: post #43
thomseddon wrote: post #14

We're an ISP, most of our customers are businesses. Of those, around 50% opt for a pre-configured LAN (i.e. we do NAT and usually CGNAT too). For the rest we provide a static IP address, so we'll allocate a /30 (block of 4), and they get a single usable address which they will assign to their own manged router/firewall. For the majority of our customers "networking" is either handled as overflow for their in/out IT r…

I made a major push to try to get IPv6 running at a small business. In the end, despite the ISP at the business supplying IPv6, and getting some client side IPv6 going with OTHER ISPS (a pain) it fell over because. 1) Things like the VPN client software didn't get routes right when client side network was IPv6 oriented so VPN connections broke - a no go. 2) We had to continue to offer ipv4, as folks in the field were…

> I don't get why they couldn't have kept a simpler / more familiar framework with ipv6 as an option, even if less ideal. Ie, DHCP vs autoconfig stuff

That's a statement made with 20 years of hindsight behind it. But if you had an extra 5 or so years of hindsight then it'd make more sense.

DHCP only predates IPv6 by two years (October 1993 on RFC 1531, vs December 1995 on RFC 1883). AppleTalk and Novell NetWare were still fairly common around that time. You're looking at DHCP as if it's ubiquitous, which indeed it is now, but it certainly wasn't while v6 was being developed and wouldn't be until a good few years afterwards.

In fact, router advertisements were defined in RFC 1256 in 1991, so they have two years of seniority on DHCP -- although I suppose you could make an argument that DHCP is a standardized set of BOOTP extensions, and that BOOTP has been around for longer.

Re: What drives IPv6 deployment?

#93

Post by kiallmacinnes »

Uh7seidu wrote: post #52
krupan wrote: post #40

Earlier quoted context omitted.

I agree with the statement that NAT provides no privacy benefits, but there are security benefits to NAT. As Robert Graham says, "NAT is a firewall. It's the most common firewall. It's the best firewall." https://blog.erratasec.com/2017/01/nat-is-firewall.html

Any IPv6-capable CPE I have seen also has an IPv6 firewall that blocks incoming connections without the downsides of NATs.

I have seen some that don't. Back in early days of residential ISPs to offer IPv6. But, that's a thing of the past - and the same mistakes happened on the early IPv4 routers when dialup was disappearing, and DSL/Cable was kicking off.

Having IPv6 will be exactly as secure as IPv4+NAT by default on any CPE. And, just as with NAT+v4, it's possible to open your machines to the world if you have no idea what you're doing.

(This is actually pretty common for gamers who set the "DMZ host" router feature to aim at their desktop and flick off the firewall!)

Re: What drives IPv6 deployment?

#94

Post by cmroanirgo »

pilif wrote: post #58
privateSFacct wrote: post #43

Earlier quoted context omitted.

I made a major push to try to get IPv6 running at a small business. In the end, despite the ISP at the business supplying IPv6, and getting some client side IPv6 going with OTHER ISPS (a pain) it fell over because. 1) Things like the VPN client software didn't get routes right when client side network was IPv6 oriented so VPN connections broke - a no go. 2) We had to continue to offer ipv4, as folks in the field were…

>Too much of pain to figure out who is right and if/how ipv6 changed ICMP then let me make this easy for you: ICMP has become a vital part of the inner workings of an IPv6 network. You will break all kinds of functionality by dropping ICMPv6 packets. If you are concerned, then drop ICMP echo requests and replies, but absolutely do not drop any other ICMP packets or you'll be one of those people that turn off ipv6 "be…

> ICMP has become a vital part of the inner workings of an IPv6 network. You will break all kinds of functionality by dropping ICMPv6 packets.

You've just neatly described my experience (and naivety), because I've always dropped ICMP and wondered why ipv6 never worked. In all of the articles I've read on getting ipv6 to work, this had never been explained.

Re: What drives IPv6 deployment?

#95

Post by pilif »

mirimir wrote: post #91
pilif wrote: post #67

Earlier quoted context omitted.

> Yes, I've never been comfortable with the device specificity of IPv6 these days it's really not much different from IPv4: During the lifetime of a connection, the prefix stays the same, so that's equivalent to the IPv4 address before that. The actual machine address rotates very often, so there's no real value in using this for identifying unique devices. If you want to profile specific devices, you're much better…

But isn't NAT deprecated for IPv6?

You don’t need to nat for privacy. That was my point. If your machine uses a different outgoing address for every connection, it’s as well masked as if all your machines used the same address.

The only thing that stays static across connections is the provider assigned prefix and that’s equivalent to your dynamic ipv4 address.

Re: What drives IPv6 deployment?

#96

Post by dfox »

lukeqsee wrote: post #37
vetinari wrote: post #29

Earlier quoted context omitted.

> Tunnels are garbage. You should either switch ISPs, or complain and wait. While the HE tunnel is somewhat limited (does it peak at 50 Mbps?), I find it's implementation way better than some ISPs that provide native IPv6. HEnet at least provides more than single /64, and does not force a specific, limited router on you.

> does it peak at 50 Mbps? I'm not certain about speed, but I did experience quite high latency during peak local traffic times (which went away when disabling IPv6).

In my experience that depends on what is the v4 path between you and HE's PoP and how good is you v4 ISP in regards to peering agreements. In most places where I used HE tunnels the latency through the tunnel was actually better for vast majority of sites I care about (which is simply effect of HE having global network and huge amount of peering partners).

Re: What drives IPv6 deployment?

#97

Post by dfox »

Uh7seidu wrote: post #80
toast0 wrote: post #78

Earlier quoted context omitted.

Most of the IPv6 CPE I've used also has the 'feature' where it's almost impossible to allow incoming connections on IPv6 if you want to :(

Newer devices might support the Port Control Protocol, so applications can ask for the port to be forwarded on ipv4 and allowed in the firewall for ipv6

Which does not solve the common case when you want to pass unfiltered ingress trafic to few specific hosts and have the default reject unknown ingress behavior for all other LAN hosts. Just give me the ability to set my own firewall rules when I need to instead of drop-all/drop-ingress/accept-all combo-box with confusing label.

Re: What drives IPv6 deployment?

#98

Post by snvzz »

PugCPC wrote: post #74

The following may sound like out-of-the-blue. To expedite the discussion, however, allow me to state that it has been in reviews at the highest levels of responsible organizations without receiving a shot yet. So, please enjoy the information. The IPv4 address shortage issues have been resolved. We came upon a scheme that can expand each public IPv4 address by 256M (Million) fold without affecting the current Interne…

>local internet

>sub-internets

Not on my Internet.

IPv6 is the only way going forward.

EzIP would be damaging to IPv6 adoption, and shouldn't be given the time of day.

Re: What drives IPv6 deployment?

#99

Post by PugCPC »

snvzz wrote: post #98
PugCPC wrote: post #74

The following may sound like out-of-the-blue. To expedite the discussion, however, allow me to state that it has been in reviews at the highest levels of responsible organizations without receiving a shot yet. So, please enjoy the information. The IPv4 address shortage issues have been resolved. We came upon a scheme that can expand each public IPv4 address by 256M (Million) fold without affecting the current Interne…

>local internet >sub-internets Not on my Internet. IPv6 is the only way going forward. EzIP would be damaging to IPv6 adoption, and shouldn't be given the time of day.

Hi, snvzz:

0) You sound quite narrow minded.

1) The Internet is for everyone, not yours.

2) Like it or not, the "local Internet" / "sub-Internet" configuration enabled by EzIP can be deployed by anyone where there is the need. Each will appear like a simple IoT to the overall Internet. This is most likely why the high level people have not tried shoot at it yet.

3) "EzIP would be damaging to IPv6 adoption ...": What is so noble about IPv6? Frequently, Internet people proudly state that "three years is too long for Internet product cycles". Here we are, the IPv6 has been in development more than two decades, and in deployment near ten years. Hasn't it had its fair time to "experiment" the "idea from scratch"? Why are you so protective of it?

Abe (2018-09-11 23:28)

Re: What drives IPv6 deployment?

#100

Post by tenebrisalietum »

tormeh wrote: post #88
tenebrisalietum wrote: post #73

Earlier quoted context omitted.

> and this statement makes me sad and angry Your MAC and/or IP address should not identify you, and never should have been used as an identifier. It's the identity of a communication endpoint. If the OSI model is about making the core of the network stupid and fast, which has proven benefits of scalability and/or extensibility, then identity/authentication is not the network layer's job and never was. If a protocol a…

We need some kind of DNS-style federated service that can map the identity (MAC address?) of a non-stationary device to its IP address.

There's an elaborate protocol framework that does this for cellular data, I don't know much about it.

There is also SCTP.

Post reply on HN