5 ms·

Why implement NAT for IPv6 at all?

by api 11y ago

nandhp 11y ago
Possibly because the other popular approach -- bridging the VM's emulated Ethernet card to one of the host's network adapters -- doesn't always work or isn't always supported. (Last I checked, bridging was unsupported by my wireless driver, though this was several years ago.)
- glandium 11y ago
  It's IPv6, they could just route it.
  - justincormack 11y ago
    The expectation would be for ipv6 routing that you have more than a /64 assigned, but many setups just share a /64 between all devices. You need to allocate yourself a /60 say so you can allocate a /64 per VM to route.
    - fulafel 11y ago
      You can do ND proxy then.
maccam94 11y ago
Yeah, I thought NAT did not exist with IPv6: https://youtu.be/v26BAlfWBm8 https://youtu.be/v26BAlfWBm8
- DanielDent 11y ago
  NAT can actually still be pretty useful in IPv6. But in IPv6 it's also realistic to do prefix translation, so that while there is NAT, it doesn't foreclose on the possibility of end-to-end communication. Multihoming, site renumbering, and a few other issues are areas where work still needs to be done. Prefix translation is a current workable answer to some of those problems.
- api 11y ago
  Learning there was such a thing as IPv6 NAT wasn't quite as depressing as learning about a forgotten historical genocide, but close.
rachelbythebay 11y ago
I wish I didn't have to use it. Bridging the Linux VM means it escapes from the Mac-level VPN which I need to get actual work done. I'd have to tunnel in from both systems and would probably set off some alarms for being in two places at once. Ugh. And yeah, as mentioned elsewhere, bridging onto a wireless situation is even worse.
- DanielDent 11y ago
  People are going to have to wrap their head around the brave new v6 world. I get "logged in from a new IP address!" alerts with a service I use almost every time I log in, even though my IPv6 prefix hasn't changed. Deciding it's a completely new IP just because something changed in the last 64 bits is probably a bad idea in a v6 world. Devices being multi-homed is intended to be standard practice. My iPhone regularly has multiple IPv6 addresses, with different reachability characteristics for different addresses. There's an address used by my carrier for voice, there are addresses I locally administer, there are addresses from a stable prefix I use, addresses from dynamic prefixes provided by my upstreams, ... The v6 world is a world where many devices have many addresses and addresses do not all have the same scope. Application developers are going to need to get used to this new normal. An application I manage has ~40% of users accessing it over IPv6, most of which would have a degraded experience if we didn't offer v6 connectivity. IPv6 is here, it's here to stay, and applications are going to need to understand the new world they live in.
  - mirimir 11y ago
    Yes. And it's not just multiple IPv6. I don't know iOS, but Windows, OS X and Debian all use only "privacy-friendly" (RFC 4941) IPv6 with remote devices. And they change frequently. That gets to be a pain when you're pushing static routes. NAT was so easy.
    - DanielDent 11y ago
      I'm not sure I understand what your use case is for pushing static routes & would be interested to understand what you mean. I've been trying a few different approaches to routing. Putting link-local addresses in routing tables has worked well in some deployments. Debian & OS X use MAC based addresses in addition to their privacy addresses. https://www.danieldent.com/blog/remote-ipv6-device-fingerprinting/ https://www.danieldent.com/blog/remote-ipv6-device-fingerpri...
callesgg 11y ago
Because of wifi?

Why implement NAT for IPv6 at all?

by api 11y ago

Why implement NAT for IPv6 at all?

Possibly because the other popular approach -- bridging the VM's emulated Ethernet card to one of the host's network adapters -- doesn't always work or isn't always supported. (Last I checked, bridging was unsupported by my wireless driver, though this was several years ago.)

glandium 11y ago
It's IPv6, they could just route it.
- justincormack 11y ago
  The expectation would be for ipv6 routing that you have more than a /64 assigned, but many setups just share a /64 between all devices. You need to allocate yourself a /60 say so you can allocate a /64 per VM to route.
  - fulafel 11y ago
    You can do ND proxy then.

maccam94 11y ago

Yeah, I thought NAT did not exist with IPv6: https://youtu.be/v26BAlfWBm8 https://youtu.be/v26BAlfWBm8

DanielDent 11y ago
NAT can actually still be pretty useful in IPv6. But in IPv6 it's also realistic to do prefix translation, so that while there is NAT, it doesn't foreclose on the possibility of end-to-end communication. Multihoming, site renumbering, and a few other issues are areas where work still needs to be done. Prefix translation is a current workable answer to some of those problems.
api 11y ago
Learning there was such a thing as IPv6 NAT wasn't quite as depressing as learning about a forgotten historical genocide, but close.

rachelbythebay 11y ago

I wish I didn't have to use it. Bridging the Linux VM means it escapes from the Mac-level VPN which I need to get actual work done. I'd have to tunnel in from both systems and would probably set off some alarms for being in two places at once. Ugh. And yeah, as mentioned elsewhere, bridging onto a wireless situation is even worse.

DanielDent 11y ago
People are going to have to wrap their head around the brave new v6 world. I get "logged in from a new IP address!" alerts with a service I use almost every time I log in, even though my IPv6 prefix hasn't changed. Deciding it's a completely new IP just because something changed in the last 64 bits is probably a bad idea in a v6 world. Devices being multi-homed is intended to be standard practice. My iPhone regularly has multiple IPv6 addresses, with different reachability characteristics for different addresses. There's an address used by my carrier for voice, there are addresses I locally administer, there are addresses from a stable prefix I use, addresses from dynamic prefixes provided by my upstreams, ... The v6 world is a world where many devices have many addresses and addresses do not all have the same scope. Application developers are going to need to get used to this new normal. An application I manage has ~40% of users accessing it over IPv6, most of which would have a degraded experience if we didn't offer v6 connectivity. IPv6 is here, it's here to stay, and applications are going to need to understand the new world they live in.
- mirimir 11y ago
  Yes. And it's not just multiple IPv6. I don't know iOS, but Windows, OS X and Debian all use only "privacy-friendly" (RFC 4941) IPv6 with remote devices. And they change frequently. That gets to be a pain when you're pushing static routes. NAT was so easy.
  - DanielDent 11y ago
    I'm not sure I understand what your use case is for pushing static routes & would be interested to understand what you mean. I've been trying a few different approaches to routing. Putting link-local addresses in routing tables has worked well in some deployments. Debian & OS X use MAC based addresses in addition to their privacy addresses. https://www.danieldent.com/blog/remote-ipv6-device-fingerprinting/ https://www.danieldent.com/blog/remote-ipv6-device-fingerpri...

callesgg 11y ago

Because of wifi?