3 ms·

Not sure what you are on about. IPv6 has Unique Local Addressing (RFC 42193) and Network Prefix Translation (RFC 6296). Care to guess what those do when combi

Not sure what you are on about. IPv6 has Unique Local Addressing (RFC 42193) and Network Prefix Translation (RFC 6296). Care to guess what those do when combined? Now given that the smallest subnet in IPv6 is /64 then you are unlikely to need to bother with port mapping as well. I will grant you that putting 65000 odd IPs on a system may not be the most efficient way of doing things. Anyway at least you get a choice in the matter. Many problems with, for example, VoIP are fixed with symmetric NAT which falls out of this scheme right away. My problem with IPv6 is how you get "tied" to your initial ISP in an intimate way due to getting all your IP addressing from them. SLAAC does go a long way to fix this but it is a little like ISP assigned email addresses stopping people from moving away. Also, consider what happens when you have multiple internet connections perhaps for redundancy/backup. You actually need NPT to get that to work in any meaningful way unless you pay for private address space and take a deep dive into BGP etc.

sp332 9y ago
With IPv4 you can have a load-balancing NAT where requests are routed round-robin to different servers, and all the servers respond directly to the client using the same source IP without going through the router. I don't really see how those RFCs make that possible.
- gerdesj 9y ago
  No, that is a proxy of some sort. HA Proxy, Squid, nginx, Apache int al for application layer. IPv6 can do exactly the same - its actually nothing to do with the IP stack (or even IP - you could use IPX/SPX or whatever) At a lower layer, you can get a similar effect with VRRP/CARP. For example I have two pfSense (FreeBSD) routers at work that present an additional set of "virtual" IPs in a master/slave HA setup. I can reboot or power off either of them and the virtual addresses will move to the other if needed, along with all state entries - handy for system updates without loss of service. I also have a couple of HA Proxy systems that are NATed through those virtual addresses. Those proxies have multiple backends that actually serve content. So: 1 IP -> two firewall/routers -> two HA proxies -> many app servers. I can take out any one bit of each stage and still maintain service. Actually its a bit more complex than that due to virtualisation. If I only had one internet connection then that would be fine but I have five. I think I've given a flavour here and in other comments I've left around here that IPv6 isn't too hard and doing away with NAT is actually a good thing but IPv6 is seriously rubbish when it comes to multi-link (ISP) and rapidly becomes seriously hard and that actually a form of NAT in the form of ULA and NPT is the "fix". ULA is analogous to say 192.168.0 and NPT makes one IPv6 prefix map to another one (which could include ULA) - that's NAT by another name. You also have port mapping as well - just like IPv4 NAT. I could buy what's know as PI address space at something like £3000 per year and get that routed instead - I would then have multiple links for redundancy but not for bandwidth utilisation and besides I would not get my four FTTC (VDSL) providers to do it anyway. IPv6 does not address the whole internet connectivity thing across the whole stack - it is only concerned with logical addressing at one point and fixes only a few problems. It does fix address exhaustion very nicely despite what armchair commentators state. It will fix the rapid proliferation of routing table entries on the global internet, except that PI addresses will screw that up royally. It does do away with NAT, which really is a good thing. Except multi link screws that up. SLAAC makes setting up a network really easy. Except multi link screws that up. DHCPv6 - the darling of "enterprise" anally retentives that don't get it will probably screw something else up. Recently I decided to put a Lets Encrypt cert on my laptop. Now I do have a block of eight IPv4 addresses at home but all of them (the six usable) were already mapped on port 80 and 443/tcp to various things. I put in a AAAA record on my DNS server (and an inbound firewall rule) and got a cert. Most people have a single static IPv4 if they are lucky or a dynamic one which will change (OK - dynamic DNS) However, if you have IPv6 at the ISP, you will normally get the same prefix. At worse you get a /64, better a /56 and the intended allowance of all was /48. At worse you have billions of globally routable addresses. Security risk being globally routable? meh! every single home router I know of (IPv4 and/or 6) defaults to deny inbound. They all have a firewall that applies that policy. NAT is not a firewall and it does not give you any real, tangible, additional security. Actually, many consumer router/firewalls try to be helpful by providing UPnP support enabled out of the box - to make your gaming/music streaming/whatever experience easy. Hmmm, I'm really starting to waffle here - sorry - but I think if you have got this far, you might have an idea that NAT is the least of your worries.
wmf 9y ago
you get "tied" to your initial ISP in an intimate way due to getting all your IP addressing from them Exactly the same as in IPv4. This also applies to multihoming.

sp332 9y ago

With IPv4 you can have a load-balancing NAT where requests are routed round-robin to different servers, and all the servers respond directly to the client using the same source IP without going through the router. I don't really see how those RFCs make that possible.

gerdesj 9y ago
No, that is a proxy of some sort. HA Proxy, Squid, nginx, Apache int al for application layer. IPv6 can do exactly the same - its actually nothing to do with the IP stack (or even IP - you could use IPX/SPX or whatever) At a lower layer, you can get a similar effect with VRRP/CARP. For example I have two pfSense (FreeBSD) routers at work that present an additional set of "virtual" IPs in a master/slave HA setup. I can reboot or power off either of them and the virtual addresses will move to the other if needed, along with all state entries - handy for system updates without loss of service. I also have a couple of HA Proxy systems that are NATed through those virtual addresses. Those proxies have multiple backends that actually serve content. So: 1 IP -> two firewall/routers -> two HA proxies -> many app servers. I can take out any one bit of each stage and still maintain service. Actually its a bit more complex than that due to virtualisation. If I only had one internet connection then that would be fine but I have five. I think I've given a flavour here and in other comments I've left around here that IPv6 isn't too hard and doing away with NAT is actually a good thing but IPv6 is seriously rubbish when it comes to multi-link (ISP) and rapidly becomes seriously hard and that actually a form of NAT in the form of ULA and NPT is the "fix". ULA is analogous to say 192.168.0 and NPT makes one IPv6 prefix map to another one (which could include ULA) - that's NAT by another name. You also have port mapping as well - just like IPv4 NAT. I could buy what's know as PI address space at something like £3000 per year and get that routed instead - I would then have multiple links for redundancy but not for bandwidth utilisation and besides I would not get my four FTTC (VDSL) providers to do it anyway. IPv6 does not address the whole internet connectivity thing across the whole stack - it is only concerned with logical addressing at one point and fixes only a few problems. It does fix address exhaustion very nicely despite what armchair commentators state. It will fix the rapid proliferation of routing table entries on the global internet, except that PI addresses will screw that up royally. It does do away with NAT, which really is a good thing. Except multi link screws that up. SLAAC makes setting up a network really easy. Except multi link screws that up. DHCPv6 - the darling of "enterprise" anally retentives that don't get it will probably screw something else up. Recently I decided to put a Lets Encrypt cert on my laptop. Now I do have a block of eight IPv4 addresses at home but all of them (the six usable) were already mapped on port 80 and 443/tcp to various things. I put in a AAAA record on my DNS server (and an inbound firewall rule) and got a cert. Most people have a single static IPv4 if they are lucky or a dynamic one which will change (OK - dynamic DNS) However, if you have IPv6 at the ISP, you will normally get the same prefix. At worse you get a /64, better a /56 and the intended allowance of all was /48. At worse you have billions of globally routable addresses. Security risk being globally routable? meh! every single home router I know of (IPv4 and/or 6) defaults to deny inbound. They all have a firewall that applies that policy. NAT is not a firewall and it does not give you any real, tangible, additional security. Actually, many consumer router/firewalls try to be helpful by providing UPnP support enabled out of the box - to make your gaming/music streaming/whatever experience easy. Hmmm, I'm really starting to waffle here - sorry - but I think if you have got this far, you might have an idea that NAT is the least of your worries.

wmf 9y ago

you get "tied" to your initial ISP in an intimate way due to getting all your IP addressing from them Exactly the same as in IPv4. This also applies to multihoming.