9 ms·

We added support for IPv6 to Virtualmin projects about a decade ago. Even today, only a tiny percentage of our users ever enable it (this mostly includes our ow

We added support for IPv6 to Virtualmin projects about a decade ago. Even today, only a tiny percentage of our users ever enable it (this mostly includes our own sites, embarrassingly enough, even though some of our servers in colo do have IPv6 subnets available to them). I should work on making that a thing that happens more by default. There's a lot of cool things you can do when you don't have to worry about running out of IP addresses. A lot of complex stuff people are doing with cloud meshnets and overlay networks and bridged private networks with port forwarding and such becomes mostly moot if every VM and container can have as many dedicated real IPs as it needs to do its job. It's also funny/weird to think about how much development effort has gone into stretching IPv4. NAT, port forwarding, SNI (and some hacky other SSL tricks before that to fit multiple SSL sites on one IP), masquerading, tunneling, VPNs, etc. The list is incredibly long and the hours spent on development unfathomable.

otabdeveloper1 9y ago
> NAT, port forwarding, SNI, masquerading, tunneling, VPNs, etc. All that stuff is mostly done for security purposes, not because we ran out of IP addresses. (And before you reply: yes, it really works and is a valid security tool.)
- zAy0LfpBZLC8mAC 9y ago
  Please explain the security purpose of four of those six.
  - otabdeveloper1 9y ago
    Not being to address a corporate or home network computer from the outside is a feature, not a bug. Doubly so for the datacenter. Corporate IT doesn't want random internet hackers accessing sensitive information on the local corporate network. Yes, you can theoretically migrate everyone to IPv6 and implement some sort of firewall system to block outside access, but now you're effectively duplicating NAT in IPv6. Worse, due to second-system effect you're bound to end up with something even stupider and nastier than the existing stupid and nasty NAT solutions.
    - zAy0LfpBZLC8mAC 9y ago
      > Not being to address a corporate or home network computer from the outside is a feature, not a bug. What does that have to do with any of the technologies you cited as being used for security purposes?
    - Symbiote 9y ago
      > some sort of firewall system It's called a firewall, and you already have one when you use IPv4. The IPv6 one is much simpler, as there's no address translation (NAT).
      - zAy0LfpBZLC8mAC 9y ago
        > It's called a firewall, and you already have one when you use IPv4. Unless you don't. In any case that doesn't have anything to do with the technologies they cited, as a firewall was not listed among them.
      - otabdeveloper1 9y ago
        Any such firewall will need to: a) Mask end-user addresses somehow. You wouldn't want everyone on your corporate network to get a globally unique, trackable ID. b) Allow outgoing connections in arbitrary ways but forbid random incoming connections. c) Some sort of central, highly secured network node where your admins can configure this stuff. At this point you're close to reinventing NAT, except crappier.
        zAy0LfpBZLC8mAC 9y ago
        > a) Mask end-user addresses somehow. You wouldn't want everyone on your corporate network to get a globally unique, trackable ID. Everyone on your corporate network has tons of globally unique, trackable IDs. They're called cookies. Also, there are IPv6 privacy extensions. > b) Allow outgoing connections in arbitrary ways but forbid random incoming connections. Just as with IPv4? > c) Some sort of central, highly secured network node where your admins can configure this stuff. That's called a firewall. You need one with IPv4 as well. > At this point you're close to reinventing NAT, except crappier. None of that has anything to do with NAT.
  - tomjen3 9y ago
    VPNs are easy: you have all your services exposed, then you need to update every one stat when a bug is released and you are screwed if for some reason some of your services uses broken (or no) crypto, and it becomes more of a chore to decide which users gets access to what services. With VPN you have more time in case of an attack, everything is encrypted by default and you only have to watch one basket of eggs.
    - zAy0LfpBZLC8mAC 9y ago
      Which is one of six ... not quite "most" in my book. Yeah, that's the only one where I can see a use for security purposes, but even then, that's not the only reason why it's used.
- belorn 9y ago
  The claim that SNI is a security feature is based on the assumption that it is more common to sniff the wire and collect the IP header rather than doing deep package inspection. I don't see this to be true with modern surveillance equipment and raw network taps. Additionally, you could create a setup where every visitor dynamically get a ip address from a pool (shared between multiple websites) when asked over encrypted dns. This kind of setup would clearly be superior over SNI's plain text issue.
- SwellJoe 9y ago
  The thing is, the security elements of those things are often only marginal and were not the purpose of their existence (in most cases), and they mostly (though not all) boil down to security-through-obscurity. We're all mostly agreed that security-through-obscurity generally only provides a false sense of security and isn't the real deal. So, what if instead of working around an IP limit with all this complicated technology, the same folks had instead been working on good point-to-point encryption for everything all this time? And, what if all that complexity didn't have to exist in every device? Every line of code increases the likelihood of a security bug, and a network stack with all this extra stuff has a lot of extra lines of code. I dunno if NAT code has been responsible for exploits, but I'd be shocked if it hasn't. NAT didn't come into common use for security purposes. It just didn't. It came into common use because not every company owns a big enough sub-network for every device to have an IP and no individual household does. It would require completely rewriting history to suggest NAT is and has been used primarily as a security feature. Certainly, VPNs have a useful purpose other than dealing with the IP shortage of IPv4, but a lot of VPNs at the corporate level are used to tie two private networks together. And, a lot of development has gone into that purpose. I'm just saying that in a world without a strictly limited set of IPs over the past decade or two, we would likely have a very different looking internet, and I think it'd be a better internet than what we have, because of how much effort has gone into dealing with the complexity of NATted/tunneled/VPNed/etc. networks.
walshemj 9y ago
You could say the same for the effort expended on ipv6 when it was obvious in the 90's that given the explosion of consumer use of the internet that the lack of a migration path from ipv4 was a killer - and that they should have thrown away ipv6 and started again. BT before you down vote me I used to work in international networking for BT so I know what I am talking about when it comes to interoperability
- zAy0LfpBZLC8mAC 9y ago
  So, what would that magical migration path look like, then?
  - Asooka 9y ago
    For one, all IPv4 addresses could also be IPv6 addresses. There could be a straightforward translation between an IPv4 packet and an IPv6 packet and back just by prepending the address with 0s. You could enable backbone routers to speak only IPv6 and then translate those packets to IPv4 packets only when sending them to the endpoint devices. In short, IPv6 could have been designed as a backwards-compatible extension of IPv4, not a completely new network.
    - growse 9y ago
      > For one, all IPv4 addresses could also be IPv6 addresses You mean how you can map from IPv4 addresses to IPv6 addresses? See RFC4291 section 2.5.5. https://www.ietf.org/rfc/rfc4291.txt https://www.ietf.org/rfc/rfc4291.txt
    - zAy0LfpBZLC8mAC 9y ago
      > For one, all IPv4 addresses could also be IPv6 addresses. You have that today, all IPv4 addresses are also dualstack addresses, which is how IPv6 is normally deployed for the transition. > There could be a straightforward translation between an IPv4 packet and an IPv6 packet and back just by prepending the address with 0s. Which doesn't help you anything because it doesn't enable IPv4 hosts to communicate with IPv6 hosts. > You could enable backbone routers to speak only IPv6 and then translate those packets to IPv4 packets only when sending them to the endpoint devices. That's called a tunnel, you can have that today. > IPv6 could have been designed as a backwards-compatible extension of IPv4, not a completely new network. What exactly is the backwards compatibility if none of that allows IPv4 and IPv6 hosts to interoperate?
Klathmon 9y ago
I think the big reason that so much effort is put into NAT and other "workarounds" is because those are things "you" can do to solve the problem. If your upstream provider doesn't support IPV6, you can't do anything to help that besides complain about it and hope they provide it one day.
- chiph 9y ago
  One of the places I used to work had a large number of corporate acquisitions. And sure enough, all of the new purchases also used the 10.x.x.x private space. So to get the systems to integrate quickly and meet the schedule, they used NAT. They were likely one of Cisco's largest NAT customers...
  - faraggi 9y ago
    I'm not very knowledgeable in IPv6 adoption. Why do you think that?
    - chiph 9y ago
      In this scenario, NAT was required for them to merge their IPv4 networks because of the high chance (almost certainty!) of address space collision. With IPv6, the chance of address ranges colliding are much lower because of the wider address space, and the upstream provider wasn't supposed to have been handing out duplicate blocks. IPv6 also has it's own private address prefix (ULA) - fdxx:xxxx:xxxx:.... and if two organizations were both using it for internal addresses, there's a increased non-zero chance of a collision if they merge networks.
- stretchwithme 9y ago
  Or switch providers. Not that is necessarily practical either.
oblio 9y ago
Well, the good news is that IPv6 is winning. If Google's stats are accurate - and they probably are - IPv6 went from 1% usage to 16% usage in 5 years (January 2012 - January 2017). And in tech it's all about critical mass. We've passed innovators and early adopters and we're getting closer to early majority. I'd bet that once we're around 30-40% adoption will ramp up since few people want to be considered laggards. And according to Google's graph I'd say we're about 5 years away from reaching 40%.
- gourou 9y ago
  I imagine it accounts mostly for Africa and South Asia since they didn't get many IPv4 addresses. They got less addresses than Europe and they're at least 4 times more populated. So I don't think we're gonna see adoption in Western countries that soon. Here's an IPv4 map for comparison: https://www.jessevaughn.com/images/ipv4_map_of_the_internet.png https://www.jessevaughn.com/images/ipv4_map_of_the_internet....
  - ac29 9y ago
    Nope, the highest rates of adoption are in North America and Europe: https://www.google.com/intl/en/ipv6/statistics.html#20&tab=per-country-ipv6-adoption&tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#20&tab=p... India, Japan, Brazil, and Australia also rank relatively high. Keep in mind some of the largest US ISPs (like Comcast) are offering native dual stack now by default. You'd have to go out of your way to disable it. Edit: Cell phone carriers are a big driver of this as well, both Tmobile and Verizon are majority IPv6 according to [0]. [0] https://en.wikipedia.org/wiki/IPv6_deployment#United_States https://en.wikipedia.org/wiki/IPv6_deployment#United_States
    - cbhl 9y ago
      A big part of that is how quickly people upgrade their cell phones -- on T-mo at least, a device had to support IPv6 and 464XLAT in order to connect to the LTE network.
  - jvannistelrooy 9y ago
scurvy 9y ago
Since when is tunneling a response to running out of IPv4 addresses? Do you mean v6 tunnel brokers? That's a response to not supporting native v6, not running out of v4 space.
- Arnt 9y ago
  If you have or can get addresses at location A and need some at location B, you can tunnel. Or if you have BGP access you can publish a really long prefix. Both are brittle.
- SwellJoe 9y ago
  Tunnels are used for all sorts of things, including some that aren't IP-shortage related (but many uses are related to IP shortage; connections between devices on private networks, for instance, and connecting IPv6 networks to IPv4 networks). But, I wasn't saying that all of those technologies only have application in solving IPv4 IP shortages, but they often have had a lot of effort expended on making the work for that purpose, because it's such a pervasive problem. My point is that the IPv4 IP shortage is like the ocean and we're all fish swiming around in it. We don't see the water because it's all around us. But, it's shaped our thinking about networks in real ways that most people working in the field today have never had an "every device has a unique address" mindset. The inventors of the internet and some of the greatest innovators of networking existed in a world where "every device is addressable". I think that's a major difference in mindset and I think it has consequences.

otabdeveloper1 9y ago

> NAT, port forwarding, SNI, masquerading, tunneling, VPNs, etc. All that stuff is mostly done for security purposes, not because we ran out of IP addresses. (And before you reply: yes, it really works and is a valid security tool.)

zAy0LfpBZLC8mAC 9y ago
Please explain the security purpose of four of those six.
- otabdeveloper1 9y ago
  Not being to address a corporate or home network computer from the outside is a feature, not a bug. Doubly so for the datacenter. Corporate IT doesn't want random internet hackers accessing sensitive information on the local corporate network. Yes, you can theoretically migrate everyone to IPv6 and implement some sort of firewall system to block outside access, but now you're effectively duplicating NAT in IPv6. Worse, due to second-system effect you're bound to end up with something even stupider and nastier than the existing stupid and nasty NAT solutions.
  - zAy0LfpBZLC8mAC 9y ago
    > Not being to address a corporate or home network computer from the outside is a feature, not a bug. What does that have to do with any of the technologies you cited as being used for security purposes?
  - Symbiote 9y ago
    > some sort of firewall system It's called a firewall, and you already have one when you use IPv4. The IPv6 one is much simpler, as there's no address translation (NAT).
    - zAy0LfpBZLC8mAC 9y ago
      > It's called a firewall, and you already have one when you use IPv4. Unless you don't. In any case that doesn't have anything to do with the technologies they cited, as a firewall was not listed among them.
    - otabdeveloper1 9y ago
      Any such firewall will need to: a) Mask end-user addresses somehow. You wouldn't want everyone on your corporate network to get a globally unique, trackable ID. b) Allow outgoing connections in arbitrary ways but forbid random incoming connections. c) Some sort of central, highly secured network node where your admins can configure this stuff. At this point you're close to reinventing NAT, except crappier.
      - zAy0LfpBZLC8mAC 9y ago
        > a) Mask end-user addresses somehow. You wouldn't want everyone on your corporate network to get a globally unique, trackable ID. Everyone on your corporate network has tons of globally unique, trackable IDs. They're called cookies. Also, there are IPv6 privacy extensions. > b) Allow outgoing connections in arbitrary ways but forbid random incoming connections. Just as with IPv4? > c) Some sort of central, highly secured network node where your admins can configure this stuff. That's called a firewall. You need one with IPv4 as well. > At this point you're close to reinventing NAT, except crappier. None of that has anything to do with NAT.
- tomjen3 9y ago
  VPNs are easy: you have all your services exposed, then you need to update every one stat when a bug is released and you are screwed if for some reason some of your services uses broken (or no) crypto, and it becomes more of a chore to decide which users gets access to what services. With VPN you have more time in case of an attack, everything is encrypted by default and you only have to watch one basket of eggs.
  - zAy0LfpBZLC8mAC 9y ago
    Which is one of six ... not quite "most" in my book. Yeah, that's the only one where I can see a use for security purposes, but even then, that's not the only reason why it's used.
belorn 9y ago
The claim that SNI is a security feature is based on the assumption that it is more common to sniff the wire and collect the IP header rather than doing deep package inspection. I don't see this to be true with modern surveillance equipment and raw network taps. Additionally, you could create a setup where every visitor dynamically get a ip address from a pool (shared between multiple websites) when asked over encrypted dns. This kind of setup would clearly be superior over SNI's plain text issue.
SwellJoe 9y ago
The thing is, the security elements of those things are often only marginal and were not the purpose of their existence (in most cases), and they mostly (though not all) boil down to security-through-obscurity. We're all mostly agreed that security-through-obscurity generally only provides a false sense of security and isn't the real deal. So, what if instead of working around an IP limit with all this complicated technology, the same folks had instead been working on good point-to-point encryption for everything all this time? And, what if all that complexity didn't have to exist in every device? Every line of code increases the likelihood of a security bug, and a network stack with all this extra stuff has a lot of extra lines of code. I dunno if NAT code has been responsible for exploits, but I'd be shocked if it hasn't. NAT didn't come into common use for security purposes. It just didn't. It came into common use because not every company owns a big enough sub-network for every device to have an IP and no individual household does. It would require completely rewriting history to suggest NAT is and has been used primarily as a security feature. Certainly, VPNs have a useful purpose other than dealing with the IP shortage of IPv4, but a lot of VPNs at the corporate level are used to tie two private networks together. And, a lot of development has gone into that purpose. I'm just saying that in a world without a strictly limited set of IPs over the past decade or two, we would likely have a very different looking internet, and I think it'd be a better internet than what we have, because of how much effort has gone into dealing with the complexity of NATted/tunneled/VPNed/etc. networks.

walshemj 9y ago

You could say the same for the effort expended on ipv6 when it was obvious in the 90's that given the explosion of consumer use of the internet that the lack of a migration path from ipv4 was a killer - and that they should have thrown away ipv6 and started again. BT before you down vote me I used to work in international networking for BT so I know what I am talking about when it comes to interoperability

zAy0LfpBZLC8mAC 9y ago
So, what would that magical migration path look like, then?
- Asooka 9y ago
  For one, all IPv4 addresses could also be IPv6 addresses. There could be a straightforward translation between an IPv4 packet and an IPv6 packet and back just by prepending the address with 0s. You could enable backbone routers to speak only IPv6 and then translate those packets to IPv4 packets only when sending them to the endpoint devices. In short, IPv6 could have been designed as a backwards-compatible extension of IPv4, not a completely new network.
  - growse 9y ago
    > For one, all IPv4 addresses could also be IPv6 addresses You mean how you can map from IPv4 addresses to IPv6 addresses? See RFC4291 section 2.5.5. https://www.ietf.org/rfc/rfc4291.txt https://www.ietf.org/rfc/rfc4291.txt
  - zAy0LfpBZLC8mAC 9y ago
    > For one, all IPv4 addresses could also be IPv6 addresses. You have that today, all IPv4 addresses are also dualstack addresses, which is how IPv6 is normally deployed for the transition. > There could be a straightforward translation between an IPv4 packet and an IPv6 packet and back just by prepending the address with 0s. Which doesn't help you anything because it doesn't enable IPv4 hosts to communicate with IPv6 hosts. > You could enable backbone routers to speak only IPv6 and then translate those packets to IPv4 packets only when sending them to the endpoint devices. That's called a tunnel, you can have that today. > IPv6 could have been designed as a backwards-compatible extension of IPv4, not a completely new network. What exactly is the backwards compatibility if none of that allows IPv4 and IPv6 hosts to interoperate?

Klathmon 9y ago

I think the big reason that so much effort is put into NAT and other "workarounds" is because those are things "you" can do to solve the problem. If your upstream provider doesn't support IPV6, you can't do anything to help that besides complain about it and hope they provide it one day.

chiph 9y ago
One of the places I used to work had a large number of corporate acquisitions. And sure enough, all of the new purchases also used the 10.x.x.x private space. So to get the systems to integrate quickly and meet the schedule, they used NAT. They were likely one of Cisco's largest NAT customers...
- faraggi 9y ago
  I'm not very knowledgeable in IPv6 adoption. Why do you think that?
  - chiph 9y ago
    In this scenario, NAT was required for them to merge their IPv4 networks because of the high chance (almost certainty!) of address space collision. With IPv6, the chance of address ranges colliding are much lower because of the wider address space, and the upstream provider wasn't supposed to have been handing out duplicate blocks. IPv6 also has it's own private address prefix (ULA) - fdxx:xxxx:xxxx:.... and if two organizations were both using it for internal addresses, there's a increased non-zero chance of a collision if they merge networks.
stretchwithme 9y ago
Or switch providers. Not that is necessarily practical either.

oblio 9y ago

Well, the good news is that IPv6 is winning. If Google's stats are accurate - and they probably are - IPv6 went from 1% usage to 16% usage in 5 years (January 2012 - January 2017). And in tech it's all about critical mass. We've passed innovators and early adopters and we're getting closer to early majority. I'd bet that once we're around 30-40% adoption will ramp up since few people want to be considered laggards. And according to Google's graph I'd say we're about 5 years away from reaching 40%.

gourou 9y ago
I imagine it accounts mostly for Africa and South Asia since they didn't get many IPv4 addresses. They got less addresses than Europe and they're at least 4 times more populated. So I don't think we're gonna see adoption in Western countries that soon. Here's an IPv4 map for comparison: https://www.jessevaughn.com/images/ipv4_map_of_the_internet.png https://www.jessevaughn.com/images/ipv4_map_of_the_internet....
- ac29 9y ago
  Nope, the highest rates of adoption are in North America and Europe: https://www.google.com/intl/en/ipv6/statistics.html#20&tab=per-country-ipv6-adoption&tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#20&tab=p... India, Japan, Brazil, and Australia also rank relatively high. Keep in mind some of the largest US ISPs (like Comcast) are offering native dual stack now by default. You'd have to go out of your way to disable it. Edit: Cell phone carriers are a big driver of this as well, both Tmobile and Verizon are majority IPv6 according to [0]. [0] https://en.wikipedia.org/wiki/IPv6_deployment#United_States https://en.wikipedia.org/wiki/IPv6_deployment#United_States
  - cbhl 9y ago
    A big part of that is how quickly people upgrade their cell phones -- on T-mo at least, a device had to support IPv6 and 464XLAT in order to connect to the LTE network.
- jvannistelrooy 9y ago

scurvy 9y ago

Since when is tunneling a response to running out of IPv4 addresses? Do you mean v6 tunnel brokers? That's a response to not supporting native v6, not running out of v4 space.

Arnt 9y ago
If you have or can get addresses at location A and need some at location B, you can tunnel. Or if you have BGP access you can publish a really long prefix. Both are brittle.
SwellJoe 9y ago
Tunnels are used for all sorts of things, including some that aren't IP-shortage related (but many uses are related to IP shortage; connections between devices on private networks, for instance, and connecting IPv6 networks to IPv4 networks). But, I wasn't saying that all of those technologies only have application in solving IPv4 IP shortages, but they often have had a lot of effort expended on making the work for that purpose, because it's such a pervasive problem. My point is that the IPv4 IP shortage is like the ocean and we're all fish swiming around in it. We don't see the water because it's all around us. But, it's shaped our thinking about networks in real ways that most people working in the field today have never had an "every device has a unique address" mindset. The inventors of the internet and some of the greatest innovators of networking existed in a world where "every device is addressable". I think that's a major difference in mindset and I think it has consequences.