32 ms·
Why you need IPv6
- gerdesj 8y agoBugger off! I am an IPv6 evangelist by the way but feel sold short and here's why: IPv6 out of the box is not able to safely cope with multiple links to the rest of the internet. For example, you have a 100MB leased line and four FTTC connections to your site - which I happen to have. Each of those links has a IPv6 prefix and for me those are all /56. So far so good - I've got a lot of IPv6 addresses. So, I use SLAAC to dole out five lots of addresses to my systems. There is no way for my systems to know which links are up or even to decide which ones would be favourite unless I turn everyone into a "router lite" via say OSPF. So I have to use my router to do that and use NPT to do NAT by another name. IPv6 out of the box does not work properly with multiple links to the internet. I really do feel quite ashamed when I say that I think IPv6 is badly broken. I deploy the bloody thing because its all we have. I remember that back in the seventies that this internet thing was touted as being able to route around problems due to nuclear attack. That was IPv4. Which is shit. We have been sold out big style, several times. IPv6 can't cope with multi link without NAT via a different name and telephony has no useful ENUM. Your internet is not run by genial Engineers. It's fucked up by entrenched monopolies, worldwide.
- telmich 8y agoCan you describe the routing problem a bit more in detail? I'm trying to understand why multi link should be more a problem in IPv6 than in IPv4. If you are multi homed it sounds as if you should have your own /48 IPv6 network (PI) and then only use the link addresses for routing - but maybe there is something that prevents you from - looking forward to hear your fully story!
- hartator 8y agoI wonder as well. The main downside I have heard about IpV6 until now is that many softwares are not compatible.
- telmich 8y agoI have to admit there is actually some. Luckily though, when we saw problems, recent updates (i.e. mosh, ping, etc.) actually fixed them. However there is some really broken software out there that hard codes IPv4 addresses - which even breaks NAT64/DNS64!
- gsich 8y agoWhich for example?
- yardstick 8y agoMulti-homed doesn’t help when you have two links to two different ISPs that you want to load balance. You need NAT for that. Also, I haven’t looked at multi-homing costs but I assume they are not free (let me know if I’m wrong). Plus in a small office or retail location, you don’t need a consistent public IP when you aren’t hosting servers (or they are only via VPN).
- AstralStorm 8y agoWhat. If your ISP is not terrible, it just takes a route advertisement to switch the same IP address between networks. And route the same subnet through multiple networks. There is no need for OSPF, RA is good enough. The ISP just has to not filter them out and forward into routing. (You will have to inform them that you use a specific separate subnet on your network. This means typically a business contract.)
- yardstick 8y agoNot all ISPs offer this functionality. I can’t realistically tell the customers I manage that we can’t support their preferred provider because of this, when they rightly point out that it just works on IPv4 without need for multi-homing. And again, multi-homing does not address load balancing / policy based routing with active active links. Eg it’s possible to have 2 Ethernet connections, 1 VDSL connection and a LTE link. Can multi-homing IPv6 work in such a situation while providing fast failover and load balancing by service/application/policy?
- hossbeast 8y agoHow is this particular situation better with ipv4?
- lwhalen 8y agoBGP, most likely.
- wmf 8y agoIn IPv4 people have accepted that NAT is the best they'll ever get and it's pretty easy to do redneck multihoming by round-robin NATing a private network behind multiple public IPs. In contrast, some people thought IPv6 was going to violate the laws of physics in their favor so they're disappointed that it hasn't happened.
- dmayle 8y agoSo... you have multiple advertising routes, and each box has 5 public addresses, and the complaint is that the boxes can't magically decide how to handle all of the different routes? When it comes to routing, you have two options, delegate or self-manage. In the case of self-management, yes, if you want complex route management, then you'll need software that handles complex route management. Why not use Stateless DHCP, and configure a machine with short leases that can update the others as needed? It can handle the complex routing, and the clients just have to frequently ask if there are updates.
- yardstick 8y agoIn my case, I want to fail over from VDSL to 4G within a couple seconds of VDSL going down. Will short leases cover that? I also like to load balance traffic on another site with two VDSL links and a 4G backup. I can’t do that without NAT.
- AstralStorm 8y agoLeases? What leases, this is not DHCP. If you mean Route Advertisement with short life, then yes.
- yardstick 8y agoThe leases referenced by the post I was replying to: “Why not use Stateless DHCP, and configure a machine with short leases” How do you deal with one missed RA causing an inadvertent failover to using a different WAN, while maintaining 1-2s failover after the first WAN link goes down? Also this does not fix the issue with inability to load balance without NAT. Eg I have a desktop (or tablet etc) that I want to send VoIP out one WAN and everything else out another.
- dmayle 8y agoDHCP traffic is approximately 512 bytes in each direction for each half lease period. Stick 1000 clients on a single node, with 2 second leases, and you'll use 0.5% of your bandwidth, and be able to update your default gateway every second
- daurnimator 8y agoI've got the exact same issue. The solution when I investigated was to use IPv6 network prefix translation; however most routers do not support it (including Mikrotik routerOS, which is what I mostly use). So lacking that, instead I've gotten my own AS and am now a 'proper' internet peer.
- X-Istence 8y agoSounds like you should have your own PI space if you have multiple uplinks, and have that PI space advertised out across all four links. Then you can route packets however/wherever you want using whatever policy you'd like.
- chaz6 8y agoThis is cost prohibitive, and I doubt most residential ISP's have the capability for this. I would like to have both a cable and a DSL ISP for redundancy but it's far from straightforward with IPv6 (and I have run IPv6 networks for not far off 20 years).
- X-Istence 8y agoYou are so far outside the norm here... Do prefix translation, it's like NAT, but run ULA space inside. Now you can load balance across all your links without issues.
- nanamo 8y agoThe fact that every device in your network is given a publicly reachable IP address is not something to brag about. It’s a security problem. I’ll stick to my NAT, thank you.
- zlynx 8y agoImplement security properly and stop worrying about it. If your devices have open services with vulnerabilities. AND You completely forgot or didn't bother to use a firewall. AND Your devices are using permanent instead of temporary IPv6 addresses. THEN you might have a problem. But it's more likely that your badly protected IoT devices are downloading their software updates from a HTTP site without SSL or checksum verification while using a DNS vulnerable to cache poisoning.
- AstralStorm 8y agoTemporary v6 addresses are not a security measure, they're a privacy measure. (And a weak one at that.) An attacker can get route advertisements from your subnet if something is misconfigured on ISP side so they get out and do a tiny bit of inference to figure out which device it is.
- AceJohnny2 8y agoNAT accidentally and poorly gives you security through obscurity. Use a firewall.
- zAy0LfpBZLC8mAC 8y agoNo, it doesn't. NAT alone does not prevent inbound connections. You need a stateful firewall in addition to the NAT for that. And if you have that, well, yeah, you obviously don't need NAT.
- jandrese 8y agoNAT is stateful, at least in the most common configuration. Static NAT is not something a home user needs to worry about. Honestly, if you have NAT you almost certainly have a firewall because NAT is nearly always implemented as part of the firewall. It may not be a properly configured firewall, but the functionality is there.
- sliken 8y agoI pretty much agree with the article. Seems like quite a few of the .com companies exist because consumers don't have public IP's. With IPv6 suddenly replacing various services are easy. Assuming you have a router, raspberry Pi, or other machine you leave on 24/7. After all seems like most end user use of the cloud could be replaced by a raspberry Pi. Things like file sharing via dropbox, webcams/security cams, photo sharing/browsing, internet enabled door locks and garage doors, and monitoring temperatures, furnace, AC, solar, power use, Sure it's a bit of work, but I suspect many would happily run things themselves if there was a community solution that did it well. Last thing anyone wants to do is replace their smarthone because a random vendor died, lost interest, or was purchased. Like say google killing off Revolv after they bought Nest. Not to mention paying even a few $ a month for an internet enabled lock is silly.
- blackflame7000 8y agoNot with that measily 480mbps USB controller split between 4USBs and 1 Ethernet. RaspberryPi4 hopefully.
- StudentStuff 8y agoThe Raspberry Pi Foundation seems deadset on pushing the same genre of chip from Broadcom forward. I doubt the serious bandwidth limitations (all your I/O going over 1 USB port) or the notable chipset flaws (1GB of ram max) will be amended any time soon. They've had 6 years to fix the Raspberry Pi, yet it still has the same hard limits.
- blackflame7000 8y agoIDK I'm hoping the RPI4 will arrive when 4K starts become more prevalent and can do the HVEC decoding
- StudentStuff 8y agoHEVC on the next generation of Raspberry Pi is highly unlikely due to both licensing costs and Broadcom not having a cheap IP block to use for adding HEVC. 4K is more likely, but if you want that today go get an OrangePi for less than the cost of a Raspberry Pi. It even has HEVC 8bit support!
- zAy0LfpBZLC8mAC 8y agoThey evangelize for IPv6 ... and then they ask for money for a single /64? Seriously? I would suggest anyone who wants a tunnel should look here: https://tunnelbroker.net/ https://tunnelbroker.net/ Nothing wrong with earning money, but please stop selling broken products.
- telmich 8y agoWe absolutely agree: if possible, use free tunnel services. Unfortunately HE does not work with NAT (sic!), which is why we initially rolled out IPv6 VPNs internally. Also in most combinations you can actually use miredo/teredo, however some of our customer networks block teredo traffic, because they don't want their windows machines to be reachable from the IPv6 internet. Just curious, why do you think it is a broken to sell IPv6 vpns?
- zAy0LfpBZLC8mAC 8y agoIt is broken to sell single /64s, that is not a sensible allocation size across administrative boundaries. A /56 would be the absolute minimum, and really it should be a /48.
- magicalhippo 8y agoMy cable ISP added IPv6 some years ago and recently my router finally got stable IPv6 support, so I decided to give it a try. My use-case was exactly what the article highlights, putting my RPi on the net exposing a service. As I quickly found out DNS was required, as the IPv6 addresses were just impossible to remember. The prefix I got from the ISP was a far cry from the 2001::42 shown in various articles on IPv6. Then I discovered the prefix wasn't stable across cable modem reboots, and I used autoconfig on the RPi, so the suffix wasn't stable either. So that meant I dynamic DNS was suddenly a required feature, not an optional thing. After spending half a day trying and failing to find a dynamic DNS service which supported IPv6 and which supported a client I could successfully and reliably use on my RPi, I gave up and went back to plain old IPv4 and NAT.
- telmich 8y agoThat's impressive to hear. If that is still the case, we will implement and offer an IPv6 DDNS service mid future. Seriously. If you are blocked for using IPv6 by this, we will provide this service and announce it on https://twitter.com/datacenterlight https://twitter.com/datacenterlight.
- magicalhippo 8y agoCheers, I'll keep a look out. Not sure how common it is for "home ISPs" to issue unstable prefixes, but that's what I got so...
- wink 8y ago> You want to expose services of your home network? You can fiddle around with NAT, hack some proxies and waste a lot of time and energy on this setup. > With IPv6, you can assign every device in your network a public IPv6 address and decide on your router / firewall, which services to expose publicly. Yeah, I used to think like this. Now I'm older and wiser (grumpier? lazier?) and because with great power comes great responsibility.. and everyone (including me) is running shitty router boxes instead of a perfectly tuned OpenBSD gateway... I think it would be really nice to have it but I'm not sold it will make the internet a safer place, instead it will expose all those IoT devices that can be wormed. I also wanted to self-host stuff at home. Back when I had access to a basement (and no proper connection) running decent hardware was no problem, now in an apartment even a small silent NAS is annyoing enough already. Also I don't have no high hopes the fiber market in Germany will improve to a point where I can reasonably assume to have more than 10/20Mbit of upstream behind a static IP. So yeah, this is a freedom for (from my PoV) a few percent of people, the rest won't bother or it will actively cause problems because nobody understands IPv6 firewalling and stuff. (Not you, dear readers, the masses that are happy if their wifi at home works, at all).