7 ms·

Examining IPv6 Performance

74 points by tdurden 11y ago

baq 11y ago
slightly OT: why is HN not ipv6 yet? why isn't reddit? why pretty much anyone except google and facebook isn't?
- the_mitsuhiko 11y ago
  Because there is no benefit to running IPV6 if you have access to an IPV4 address.
  - eeZi 11y ago
    There actually is. An increasing number of ISPs is going IPv6-only with central carrier-grade NAT for IPv4. Those gateways are often overloaded, resulting in vastly better performance over IPv6.
    - daveguy 11y ago
      Except this study shows no difference in performance, but a 9x higher failure rate to establish an ipv6 connection.
      - mutemule 11y ago
        The study did a good job breaking down the different IPv6 connectivity types, but didn't discuss different IPv4 connections. GP is comparing native IPv6 to IPv4 CGNAT, but the study seems to be comparing differing forms of IPv6 to native IPv4.
    - lisivka 11y ago
      IPv6 traffic is much slower. In my case (I use Miredo client), link to Portsmouth, ServerHouse, GB is up to 30Mbit by IPv4 but no more than 1Mbit by IPv6.
      - eeZi 11y ago
        You have native IPv4 and IPv6 over a tunnel, so of course IPv6 is going to be slower. The point is that for an increasing number of users, it's the exact opposite.
  - scurvy 11y ago
    NAT v4 addresses are no fun. IPv6 addressing is a big win there. Especially in the mobile space.
    - the_mitsuhiko 11y ago
      > NAT v4 addresses are no fun. Everybody runs behind a NAT anyways, most systems work just find with multiple layers of NATs. I have been running an internal double NAT for months and the only reason I removed one layer from my onion was that back to mac fails badly with multiple layers of NATs.
      - scurvy 11y ago
        No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. As you just admitted, NAT breaks things. Double NAT and CGN breaks a lot more. What about people who have no choice or no say in whether or not their Internet is NAT'd? There are ISP's where customers don't get routed IPv4 addresses. They get RFC1918 addresses and lots of double NAT'ing occurs. It's a bad scene.
        the_mitsuhiko 11y ago
        > No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is. > As you just admitted, NAT breaks things. And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact. When I run a server I already have to assume that clients are NATed and as such I design my system to work that way. IPV6 only is a non existing part of the internet and as such not really something to optimize for. I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it.
  - scurvy 11y ago
    Facebook says that IPv6 is faster and clients stay on their site longer. https://www.youtube.com/watch?v=EfjdOc41g0s https://www.youtube.com/watch?v=EfjdOc41g0s
- rgbrenner 11y ago
  isnt reddit pretty heavily invested in aws? aws doesn't support ipv6. nor does google compute.
  - nandhp 11y ago
    reddit uses Cloudflare now, so this isn't as big of an issue as it used to be. Some relevant links: - https://www.reddit.com/r/blog/comments/2ftv08/hell_its_about_time_reddit_now_supports_fullsite/ckcoww2 https://www.reddit.com/r/blog/comments/2ftv08/hell_its_about... - https://www.reddit.com/r/ipv6/comments/3cfqrw/cloudflare_supports_ipv6_so_why_isnt_redditcom/ https://www.reddit.com/r/ipv6/comments/3cfqrw/cloudflare_sup...
  - darkr 11y ago
    ELBs are dual-stack v4/v6 by default. That's about it though for IPv6 support on AWS. Annoyingly, Route53 supports AAAA records but their nameservers are only reachable via IPv4.
    - mutemule 11y ago
      https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internet-facing-load-balancers.html https://docs.aws.amazon.com/ElasticLoadBalancing/latest/Deve... Unfortunately, only ELBs in EC2 Classic support IPv6: "Load balancers in a VPC support IPv4 addresses only."
      - justincormack 11y ago
        Oh so AWS's only bit of ipv6 support has regressed. Sigh.
- scurvy 11y ago
  Complete guess here, but their analytics, fraud, spam, etc systems are IP based and don't work well with the v6 address space yet? Cloudflare handles their front end, so it should be as easy as toggling an option in the CF admin page.
- tajen 11y ago
  Here's the other side of the story: Not a sysadmin, but I'm an independent programmer with an online app. I've set up a Debian vps at OVH with IPv6 and it was unbearably slow. I used to believe it was OVH, but the reason seems to be that most things e.g. package managers wait for the request in IPv6 (or the one to the DNS) timeout before trying IPv4. An apt-get upgrade takes hours. I guess there's some kind of configuration to improve that, but when step 0 of setting up IPv6 starts with problems, I just stick to stacks that I can manage.
  - the_mitsuhiko 11y ago
    The problem there is probably the DNS resolution. I like the way apple does it: they resolve AAAA and A in parallel. Whatever comes back first is being used for the connection attempt. Much better than waiting for a ~5 second timeout on AAAA before calling back to A.
    - scurvy 11y ago
      This is no longer the case. Their implementation of Happy Eyeballs now prefers IPv6 over IPv4. This is as of iOS 9 and El Capitan.
      - the_mitsuhiko 11y ago
        > This is no longer the case. Their implementation of Happy Eyeballs now prefers IPv6 over IPv4. This is as of iOS 9 and El Capitan. It prefers, but only if it gets a response within 25milliseconds. It still queries AAAA and A in parallel.
        scurvy 11y ago
        > It prefers, but only if it gets a response within 25milliseconds. It still queries AAAA and A in parallel Correct. The large technology companies that shape the world are indicating their preference and shift towards an IPv6 world, yet you still claim that you see no benefit? You don't want to be on board with them?
- SFjulie1 11y ago
  because some customers of "internet" like me in northern america have an IPv4 only access to the internet. Thanks to teksavvy that blames videotron. Customer services says: not a problem. There is a growing balkanisation between highly dense zone with the critical mass for getting a ROI in IPv6 transition and less dense zone that where equiped with a correct IPv4 backbone. Non mobile land connection is getting less and less connected to the internet, because "mobile" is the future. But mobile data plan and hardware are freakingly expensive as if there was a money divide on the internet between riches and poors. I don't want no smartphone, no mobile connection, no netflix: I just want a 1Megabyte/s clean internet with 100% internet connection. It is really the IPv6pocalypse here. Half baked technologies put on the front, while the basics (100% access, UDP not dropping too much, not too much lags) are decaying (as if equipments where not upgraded). I used to be a QIII player. Nowadays it is excessive lags, spikes everywhere on every continent. My internet sux balls big, QIII was a good reason to have internet. Now, everyone is happy with buggy crashy games that are sloooooowwww in gameplay but with a 4KHD 120fps. Why must I have internet? Because administrative tasks requires me to have it to gather and send forms. Else, I would drop it. 2.8% of mondial energy burnt...for this
daveguy 11y ago
This compares ipv6 vs ipv4 dual stacks between the same endpoints. The conclusion is that performance is equivalent but the establishment of the connection has a 9x higher failure rate for ipv6. (Edits:grammar)
theophrastus 11y ago
Not a performance issue per-se, but more an ugly unintended consequence of IPv6 issues: peer-flooding in torrent transfers. I use libtorrent to distribute my data sets and i'm seeing all the usual trackers are being flooded (DoS-like) via the vast available, in this case phony, IPv6 address space[1]. The unstated contention by agents of content owners being that bit-torrent can never do anything but wrong. Selfishly focused on their own content they're statistically not utterly wrong, but they are using the design of IPv6 to poison the well for benevolent use. [1] https://torrentfreak.com/popular-torrents-being-sabotaged-by-ipv6-peer-flood-150619/ https://torrentfreak.com/popular-torrents-being-sabotaged-by...
- voltagex_ 11y ago
  >Update: The IPv6 addresses which are used appear to be fictional. They haven’t been allocated yet and are non-routable. What kind of network are they using that lets them send forged source addresses? Also, a temporary solution in that case would be to use a blocklist of non-allocated ranges.
  - the_mitsuhiko 11y ago
    BT is UDP and you can write whatever you want into a packet.
    - voltagex_ 11y ago
      Right. Looks like I'll have to add some networking to my to-learn list. Thanks.
    - banthar 11y ago
      Are you talking about changing source address in IP header? Most ISPs will drop such packets: https://tools.ietf.org/html/rfc3013#section-4.3 https://tools.ietf.org/html/rfc3013#section-4.3
      - voltagex_ 11y ago
        That's what I thought - but it turns out that not all ISPs behave well. https://defcon.org/images/defcon-22/dc-22-presentations/Graham-McMillan-Tentler/DEFCON-22-Graham-McMillan-Tentler-Masscaning-the-Internet.pdf https://defcon.org/images/defcon-22/dc-22-presentations/Grah... but the video is also very entertaining. This is applicable to the IPv4 internet but I'm sure someone will eventually come up with a way to do it for IPv6.
jrcii 11y ago
I didn't RTFA but would point out that the performance problems I've run into with IPv6 aren't related to the specification itself but buggy implementation code from vendors, which I expect to improve with time.
- shorttime 11y ago
  Most definitely the case with at least Windows 8. Since I upgraded to Windows 10 I haven't experienced the problem. With Windows 8, after an uncertain period of time every app (browsers, torrents, games) would stall. It would drive me nuts until I found a post that recommended disabling the IPv6 networking protocol. It seemed to work fine until Windows 10 came along and all is good. Other devices on the network using Windows 7, android OS, didn't have any connectivity issues when the Windows 8 device did, so I'm sure it had to be Windows 8.
- stock_toaster 11y ago
  There are also issues with end user rollouts. For example, comcast uses prefix delegation to give you are /60 which your router (pfsense in my case) then uses for the internet network (it carves out a /64). However, this prefix changes! As it is not a statically assigned prefix, my internal devices renumber whenever it changes, it would make it a huge pain to get a consistent mapping for my internal devices (media server, printer, etc) were I to go ipv6 only. I thought about using an additional ULA subnet (ipv6 supports multiple subnets), but apparently many vendors do not yet support RFC 6724, or support it poorly with regard to ULA addresses. As such, I get mixed results with devices trying to use the ULA address for internet egress. NAT66 (npt) is another possibility, and some people end up having to use this when they have more than one ISP (multi-wan balancing) anyway, but I haven't found a good way to update the nat target when the prefix changes yet (might try moving to openbsd and try ifstated calling a script to a pf table or something).
  - lmm 11y ago
    > For example, comcast uses prefix delegation to give you are /60 which your router (pfsense in my case) then uses for the internet network (it carves out a /64). However, this prefix changes! As it is not a statically assigned prefix, my internal devices renumber whenever it changes, it would make it a huge pain to get a consistent mapping for my internal devices (media server, printer, etc) were I to go ipv6 only. Part of the point of IPv6 is that your addresses reflect the real network topology - when your upstream changes, your addresses change. The right thing is to ensure that your router is also updating DNS for your internal devices, and use names to refer to them. You shouldn't expect anything to have a truly static IPv6 address.
edwintorok 11y ago
GeoIP routing is sometimes worse with native IPv6 than IPv4. Take gstatic.com for example which goes to a neighbouring country with IPv6 (inside same ISP, but still): $ ping -c 3 gstatic.com PING gstatic.com (82.77.159.222) 56(84) bytes of data. 64 bytes from cache.google.com (82.77.159.222): icmp_seq=1 ttl=61 time=2.11 ms 64 bytes from cache.google.com (82.77.159.222): icmp_seq=2 ttl=61 time=1.98 ms 64 bytes from cache.google.com (82.77.159.222): icmp_seq=3 ttl=61 time=1.78 ms --- gstatic.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2002ms rtt min/avg/max/mdev = 1.780/1.960/2.118/0.143 m $ ping6 -c 3 gstatic.com PING gstatic.com(bud02s22-in-x03.1e100.net) 56 data bytes 64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=1 ttl=55 time=9.85 ms 64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=2 ttl=55 time=9.67 ms 64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=3 ttl=55 time=10.5 ms --- gstatic.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 9.675/10.031/10.568/0.403 ms So I have this in /etc/gai.conf now: precedence ::ffff:0:0/96 100
- scurvy 11y ago
  The worst problem with Google's GeoIP implementation is that you really can't report problems to them in a good manner. They have this: https://support.google.com/websearch/contact/ip https://support.google.com/websearch/contact/ip but it only works for Google.com and not YouTube. I really, really wish Google would put more resources on this.
  - secure 11y ago
    I heard that you can report YouTube connection issues at https://www.reddit.com/r/youtube https://www.reddit.com/r/youtube, and YouTubers will address them. Have you tried that?
jvolkman 11y ago
I've gotta say, I was impressed with how easy the IPv6 setup was with the latest version of OpenWRT. I just recently upgraded and, with Comcast's native IPv6 support, everything just worked and all of the machines on my LAN grabbed externally-routable addresses. After poking some holes in the default firewall rules, I can connect directly from my machine at work (also IPv6 addressed) to a machine at home without any port mapping or translation. Feels nice.
onethumb 11y ago
Particularly on mobile, Facebook is seeing fairly big wins with IPv6. It's not entirely clear why, but it's happening. Here's Paul Saab's deck from earlier this year: https://www.dropbox.com/s/15xi92296lw32hu/Facebook-World-IPv6-2015.pdf?dl=0 https://www.dropbox.com/s/15xi92296lw32hu/Facebook-World-IPv...
- eeZi 11y ago
  I bet on NAT latency. No NAT must be great for push messaging, since the network is stateless and less keepalives are necessary to keep the connection open.

74 points by tdurden 11y ago

baq 11y ago

slightly OT: why is HN not ipv6 yet? why isn't reddit? why pretty much anyone except google and facebook isn't?

the_mitsuhiko 11y ago
Because there is no benefit to running IPV6 if you have access to an IPV4 address.
- eeZi 11y ago
  There actually is. An increasing number of ISPs is going IPv6-only with central carrier-grade NAT for IPv4. Those gateways are often overloaded, resulting in vastly better performance over IPv6.
  - daveguy 11y ago
    Except this study shows no difference in performance, but a 9x higher failure rate to establish an ipv6 connection.
    - mutemule 11y ago
      The study did a good job breaking down the different IPv6 connectivity types, but didn't discuss different IPv4 connections. GP is comparing native IPv6 to IPv4 CGNAT, but the study seems to be comparing differing forms of IPv6 to native IPv4.
  - lisivka 11y ago
    IPv6 traffic is much slower. In my case (I use Miredo client), link to Portsmouth, ServerHouse, GB is up to 30Mbit by IPv4 but no more than 1Mbit by IPv6.
    - eeZi 11y ago
      You have native IPv4 and IPv6 over a tunnel, so of course IPv6 is going to be slower. The point is that for an increasing number of users, it's the exact opposite.
- scurvy 11y ago
  NAT v4 addresses are no fun. IPv6 addressing is a big win there. Especially in the mobile space.
  - the_mitsuhiko 11y ago
    > NAT v4 addresses are no fun. Everybody runs behind a NAT anyways, most systems work just find with multiple layers of NATs. I have been running an internal double NAT for months and the only reason I removed one layer from my onion was that back to mac fails badly with multiple layers of NATs.
    - scurvy 11y ago
      No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. As you just admitted, NAT breaks things. Double NAT and CGN breaks a lot more. What about people who have no choice or no say in whether or not their Internet is NAT'd? There are ISP's where customers don't get routed IPv4 addresses. They get RFC1918 addresses and lots of double NAT'ing occurs. It's a bad scene.
      - the_mitsuhiko 11y ago
        > No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is. > As you just admitted, NAT breaks things. And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact. When I run a server I already have to assume that clients are NATed and as such I design my system to work that way. IPV6 only is a non existing part of the internet and as such not really something to optimize for. I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it.
- scurvy 11y ago
  Facebook says that IPv6 is faster and clients stay on their site longer. https://www.youtube.com/watch?v=EfjdOc41g0s https://www.youtube.com/watch?v=EfjdOc41g0s
rgbrenner 11y ago
isnt reddit pretty heavily invested in aws? aws doesn't support ipv6. nor does google compute.
- nandhp 11y ago
  reddit uses Cloudflare now, so this isn't as big of an issue as it used to be. Some relevant links: - https://www.reddit.com/r/blog/comments/2ftv08/hell_its_about_time_reddit_now_supports_fullsite/ckcoww2 https://www.reddit.com/r/blog/comments/2ftv08/hell_its_about... - https://www.reddit.com/r/ipv6/comments/3cfqrw/cloudflare_supports_ipv6_so_why_isnt_redditcom/ https://www.reddit.com/r/ipv6/comments/3cfqrw/cloudflare_sup...
- darkr 11y ago
  ELBs are dual-stack v4/v6 by default. That's about it though for IPv6 support on AWS. Annoyingly, Route53 supports AAAA records but their nameservers are only reachable via IPv4.
  - mutemule 11y ago
    https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internet-facing-load-balancers.html https://docs.aws.amazon.com/ElasticLoadBalancing/latest/Deve... Unfortunately, only ELBs in EC2 Classic support IPv6: "Load balancers in a VPC support IPv4 addresses only."
    - justincormack 11y ago
      Oh so AWS's only bit of ipv6 support has regressed. Sigh.
scurvy 11y ago
Complete guess here, but their analytics, fraud, spam, etc systems are IP based and don't work well with the v6 address space yet? Cloudflare handles their front end, so it should be as easy as toggling an option in the CF admin page.
tajen 11y ago
Here's the other side of the story: Not a sysadmin, but I'm an independent programmer with an online app. I've set up a Debian vps at OVH with IPv6 and it was unbearably slow. I used to believe it was OVH, but the reason seems to be that most things e.g. package managers wait for the request in IPv6 (or the one to the DNS) timeout before trying IPv4. An apt-get upgrade takes hours. I guess there's some kind of configuration to improve that, but when step 0 of setting up IPv6 starts with problems, I just stick to stacks that I can manage.
- the_mitsuhiko 11y ago
  The problem there is probably the DNS resolution. I like the way apple does it: they resolve AAAA and A in parallel. Whatever comes back first is being used for the connection attempt. Much better than waiting for a ~5 second timeout on AAAA before calling back to A.
  - scurvy 11y ago
    This is no longer the case. Their implementation of Happy Eyeballs now prefers IPv6 over IPv4. This is as of iOS 9 and El Capitan.
    - the_mitsuhiko 11y ago
      > This is no longer the case. Their implementation of Happy Eyeballs now prefers IPv6 over IPv4. This is as of iOS 9 and El Capitan. It prefers, but only if it gets a response within 25milliseconds. It still queries AAAA and A in parallel.
      - scurvy 11y ago
        > It prefers, but only if it gets a response within 25milliseconds. It still queries AAAA and A in parallel Correct. The large technology companies that shape the world are indicating their preference and shift towards an IPv6 world, yet you still claim that you see no benefit? You don't want to be on board with them?
SFjulie1 11y ago
because some customers of "internet" like me in northern america have an IPv4 only access to the internet. Thanks to teksavvy that blames videotron. Customer services says: not a problem. There is a growing balkanisation between highly dense zone with the critical mass for getting a ROI in IPv6 transition and less dense zone that where equiped with a correct IPv4 backbone. Non mobile land connection is getting less and less connected to the internet, because "mobile" is the future. But mobile data plan and hardware are freakingly expensive as if there was a money divide on the internet between riches and poors. I don't want no smartphone, no mobile connection, no netflix: I just want a 1Megabyte/s clean internet with 100% internet connection. It is really the IPv6pocalypse here. Half baked technologies put on the front, while the basics (100% access, UDP not dropping too much, not too much lags) are decaying (as if equipments where not upgraded). I used to be a QIII player. Nowadays it is excessive lags, spikes everywhere on every continent. My internet sux balls big, QIII was a good reason to have internet. Now, everyone is happy with buggy crashy games that are sloooooowwww in gameplay but with a 4KHD 120fps. Why must I have internet? Because administrative tasks requires me to have it to gather and send forms. Else, I would drop it. 2.8% of mondial energy burnt...for this

daveguy 11y ago

This compares ipv6 vs ipv4 dual stacks between the same endpoints. The conclusion is that performance is equivalent but the establishment of the connection has a 9x higher failure rate for ipv6. (Edits:grammar)

theophrastus 11y ago

Not a performance issue per-se, but more an ugly unintended consequence of IPv6 issues: peer-flooding in torrent transfers. I use libtorrent to distribute my data sets and i'm seeing all the usual trackers are being flooded (DoS-like) via the vast available, in this case phony, IPv6 address space[1]. The unstated contention by agents of content owners being that bit-torrent can never do anything but wrong. Selfishly focused on their own content they're statistically not utterly wrong, but they are using the design of IPv6 to poison the well for benevolent use. [1] https://torrentfreak.com/popular-torrents-being-sabotaged-by-ipv6-peer-flood-150619/ https://torrentfreak.com/popular-torrents-being-sabotaged-by...

voltagex_ 11y ago
>Update: The IPv6 addresses which are used appear to be fictional. They haven’t been allocated yet and are non-routable. What kind of network are they using that lets them send forged source addresses? Also, a temporary solution in that case would be to use a blocklist of non-allocated ranges.
- the_mitsuhiko 11y ago
  BT is UDP and you can write whatever you want into a packet.
  - voltagex_ 11y ago
    Right. Looks like I'll have to add some networking to my to-learn list. Thanks.
  - banthar 11y ago
    Are you talking about changing source address in IP header? Most ISPs will drop such packets: https://tools.ietf.org/html/rfc3013#section-4.3 https://tools.ietf.org/html/rfc3013#section-4.3
    - voltagex_ 11y ago
      That's what I thought - but it turns out that not all ISPs behave well. https://defcon.org/images/defcon-22/dc-22-presentations/Graham-McMillan-Tentler/DEFCON-22-Graham-McMillan-Tentler-Masscaning-the-Internet.pdf https://defcon.org/images/defcon-22/dc-22-presentations/Grah... but the video is also very entertaining. This is applicable to the IPv4 internet but I'm sure someone will eventually come up with a way to do it for IPv6.

jrcii 11y ago

I didn't RTFA but would point out that the performance problems I've run into with IPv6 aren't related to the specification itself but buggy implementation code from vendors, which I expect to improve with time.

shorttime 11y ago
Most definitely the case with at least Windows 8. Since I upgraded to Windows 10 I haven't experienced the problem. With Windows 8, after an uncertain period of time every app (browsers, torrents, games) would stall. It would drive me nuts until I found a post that recommended disabling the IPv6 networking protocol. It seemed to work fine until Windows 10 came along and all is good. Other devices on the network using Windows 7, android OS, didn't have any connectivity issues when the Windows 8 device did, so I'm sure it had to be Windows 8.
stock_toaster 11y ago
There are also issues with end user rollouts. For example, comcast uses prefix delegation to give you are /60 which your router (pfsense in my case) then uses for the internet network (it carves out a /64). However, this prefix changes! As it is not a statically assigned prefix, my internal devices renumber whenever it changes, it would make it a huge pain to get a consistent mapping for my internal devices (media server, printer, etc) were I to go ipv6 only. I thought about using an additional ULA subnet (ipv6 supports multiple subnets), but apparently many vendors do not yet support RFC 6724, or support it poorly with regard to ULA addresses. As such, I get mixed results with devices trying to use the ULA address for internet egress. NAT66 (npt) is another possibility, and some people end up having to use this when they have more than one ISP (multi-wan balancing) anyway, but I haven't found a good way to update the nat target when the prefix changes yet (might try moving to openbsd and try ifstated calling a script to a pf table or something).
- lmm 11y ago
  > For example, comcast uses prefix delegation to give you are /60 which your router (pfsense in my case) then uses for the internet network (it carves out a /64). However, this prefix changes! As it is not a statically assigned prefix, my internal devices renumber whenever it changes, it would make it a huge pain to get a consistent mapping for my internal devices (media server, printer, etc) were I to go ipv6 only. Part of the point of IPv6 is that your addresses reflect the real network topology - when your upstream changes, your addresses change. The right thing is to ensure that your router is also updating DNS for your internal devices, and use names to refer to them. You shouldn't expect anything to have a truly static IPv6 address.

edwintorok 11y ago

GeoIP routing is sometimes worse with native IPv6 than IPv4. Take gstatic.com for example which goes to a neighbouring country with IPv6 (inside same ISP, but still): $ ping -c 3 gstatic.com PING gstatic.com (82.77.159.222) 56(84) bytes of data. 64 bytes from cache.google.com (82.77.159.222): icmp_seq=1 ttl=61 time=2.11 ms 64 bytes from cache.google.com (82.77.159.222): icmp_seq=2 ttl=61 time=1.98 ms 64 bytes from cache.google.com (82.77.159.222): icmp_seq=3 ttl=61 time=1.78 ms --- gstatic.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2002ms rtt min/avg/max/mdev = 1.780/1.960/2.118/0.143 m $ ping6 -c 3 gstatic.com PING gstatic.com(bud02s22-in-x03.1e100.net) 56 data bytes 64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=1 ttl=55 time=9.85 ms 64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=2 ttl=55 time=9.67 ms 64 bytes from bud02s22-in-x03.1e100.net: icmp_seq=3 ttl=55 time=10.5 ms --- gstatic.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 9.675/10.031/10.568/0.403 ms So I have this in /etc/gai.conf now: precedence ::ffff:0:0/96 100

scurvy 11y ago
The worst problem with Google's GeoIP implementation is that you really can't report problems to them in a good manner. They have this: https://support.google.com/websearch/contact/ip https://support.google.com/websearch/contact/ip but it only works for Google.com and not YouTube. I really, really wish Google would put more resources on this.
- secure 11y ago
  I heard that you can report YouTube connection issues at https://www.reddit.com/r/youtube https://www.reddit.com/r/youtube, and YouTubers will address them. Have you tried that?

jvolkman 11y ago

I've gotta say, I was impressed with how easy the IPv6 setup was with the latest version of OpenWRT. I just recently upgraded and, with Comcast's native IPv6 support, everything just worked and all of the machines on my LAN grabbed externally-routable addresses. After poking some holes in the default firewall rules, I can connect directly from my machine at work (also IPv6 addressed) to a machine at home without any port mapping or translation. Feels nice.

onethumb 11y ago

Particularly on mobile, Facebook is seeing fairly big wins with IPv6. It's not entirely clear why, but it's happening. Here's Paul Saab's deck from earlier this year: https://www.dropbox.com/s/15xi92296lw32hu/Facebook-World-IPv6-2015.pdf?dl=0 https://www.dropbox.com/s/15xi92296lw32hu/Facebook-World-IPv...

eeZi 11y ago
I bet on NAT latency. No NAT must be great for push messaging, since the network is stateless and less keepalives are necessary to keep the connection open.