3 ms·

It's not just about number of addresses. It's also about preventing conflicts. Let's say my company uses 10.0.0.0/16. Now let's say I set up a VPN. Half my use

by api 11y ago

It's not just about number of addresses. It's also about preventing conflicts. Let's say my company uses 10.0.0.0/16. Now let's say I set up a VPN. Half my users will be on local networks that are also 10.0.x.x. Fail. Even worse, let's say my company has two locations and both use 10.0.0.x and now we want to link them on a common network using a VPN or virtual Ethernet bridge. Have fun renumbering one of these two sites, or setting up abominations like internal two-way SNAT/DNAT. The reason IPv6's address space is so huge is to allow relatively stateless assignment of addresses with extremely low probability of conflicts. An IPv6 address is basically a UUID. That's going to make lots of things easier and eliminate the need for a huge number of nasty hacks.

developer1 11y ago
"An IPv6 address is basically a UUID." This is the reason why I can't believe we're not all on IPv6 yet. You would think that the online advertising industry would have done everything in their power to push IPv6, at any cost. 90%+ of people on IPv6 will literally have a unique identifier FOR LIFE on every device they own. Marketers can now pinpoint down not just to an IP address that identifies a single NAT interface, but each individual device. I hope that operating systems and/or routers will provide the option to rotate each IPv6 address on a routine basis. It would also be nice if ISPs would rotate the block that is handed out to each customer, but this is unlikely to happen. Every phone, every tablet, every PC, every thermostat, every door lock, every fridge... uniquely identifiable from the day it is hooked up to a network. :(
- jlgaddis 11y ago
  Related: "Why the FBI wants IPv6: It's better [than CGN] for tracking criminals" [0]. [0]: http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-track-ipv4-with-nat.aspx?m=2 http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-tr...
- mjcl 11y ago
  Good news, privacy addressing (ex. RFC 4941) exists and is enabled by default on OS X (10.7+) and Windows 7. Privacy addressing rotates the host section of the IP address by default once a day, leaving IPv6 host detection similar to IPv4+NAT. It seems like Linux may be a mixed bag (by distro) w/r/t it being enabled as default. I could definitely see cheap embedded devices based on a current Linux distro not bothering to change defaults to enable it.
- jlgaddis 11y ago
  > I hope that operating systems and/or routers will provide the option to rotate each IPv6 address on a routine basis. This is an issue when using SLAAC, yes, but a workaround ("Privacy Extensions") were developed years ago; cf. RFC4941 [0]. You can also assign static addresses or use DHCPv6 -- on your own networks, at least; you obviously can't control how your ISP decides to issue addresses. [0]: https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941
- api 11y ago
  There are already so many ways to fingerprint a browser, it's really not something they need.
llama052 11y ago
So two way SNAT/DNAT is nastier than using a public IP block that you don't own? Pretty bad practice if you ask me. At the very most you should use a block that you own. Also I've never had any issues setting up IPSEC VPNs or Tunnels with two way NAT, if you have your configuration setup correctly.
rbritton 11y ago
This was actually tech support call #1 at a hotel I worked at previously. We were only able to fully resolve it by using an obscure section of the 172.16.0.0/12 range -- almost all companies use the other two private ranges.
- peckrob 11y ago
  >. We were only able to fully resolve it by using an obscure section of the 172.16.0.0/12 range. This is exactly why I use 172.16.104.0/21 as my home network range. Almost no one else does so it makes things really easy when I VPN home from a hotel somewhere.
  - gonzo 11y ago
    you are... not alone.
  - jlgaddis 11y ago
    Unfortunately, I've been in more than one hotel (or other location with open/public access to the network) where the implementers decided to just use either the whole 10/8 network, a /16 (or more!) out of the 172.16/12 network, or the whole 192.168/16 network in one big, flat network. That can be a real PITA and annoys me to no end.

by api 11y ago

developer1 11y ago

"An IPv6 address is basically a UUID." This is the reason why I can't believe we're not all on IPv6 yet. You would think that the online advertising industry would have done everything in their power to push IPv6, at any cost. 90%+ of people on IPv6 will literally have a unique identifier FOR LIFE on every device they own. Marketers can now pinpoint down not just to an IP address that identifies a single NAT interface, but each individual device. I hope that operating systems and/or routers will provide the option to rotate each IPv6 address on a routine basis. It would also be nice if ISPs would rotate the block that is handed out to each customer, but this is unlikely to happen. Every phone, every tablet, every PC, every thermostat, every door lock, every fridge... uniquely identifiable from the day it is hooked up to a network. :(

jlgaddis 11y ago
Related: "Why the FBI wants IPv6: It's better [than CGN] for tracking criminals" [0]. [0]: http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-track-ipv4-with-nat.aspx?m=2 http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-tr...
mjcl 11y ago
Good news, privacy addressing (ex. RFC 4941) exists and is enabled by default on OS X (10.7+) and Windows 7. Privacy addressing rotates the host section of the IP address by default once a day, leaving IPv6 host detection similar to IPv4+NAT. It seems like Linux may be a mixed bag (by distro) w/r/t it being enabled as default. I could definitely see cheap embedded devices based on a current Linux distro not bothering to change defaults to enable it.
jlgaddis 11y ago
> I hope that operating systems and/or routers will provide the option to rotate each IPv6 address on a routine basis. This is an issue when using SLAAC, yes, but a workaround ("Privacy Extensions") were developed years ago; cf. RFC4941 [0]. You can also assign static addresses or use DHCPv6 -- on your own networks, at least; you obviously can't control how your ISP decides to issue addresses. [0]: https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941
api 11y ago
There are already so many ways to fingerprint a browser, it's really not something they need.

llama052 11y ago

So two way SNAT/DNAT is nastier than using a public IP block that you don't own? Pretty bad practice if you ask me. At the very most you should use a block that you own. Also I've never had any issues setting up IPSEC VPNs or Tunnels with two way NAT, if you have your configuration setup correctly.

rbritton 11y ago

This was actually tech support call #1 at a hotel I worked at previously. We were only able to fully resolve it by using an obscure section of the 172.16.0.0/12 range -- almost all companies use the other two private ranges.

peckrob 11y ago
>. We were only able to fully resolve it by using an obscure section of the 172.16.0.0/12 range. This is exactly why I use 172.16.104.0/21 as my home network range. Almost no one else does so it makes things really easy when I VPN home from a hotel somewhere.
- gonzo 11y ago
  you are... not alone.
- jlgaddis 11y ago
  Unfortunately, I've been in more than one hotel (or other location with open/public access to the network) where the implementers decided to just use either the whole 10/8 network, a /16 (or more!) out of the 172.16/12 network, or the whole 192.168/16 network in one big, flat network. That can be a real PITA and annoys me to no end.