7 ms·

For most purposes, IPv6 works the same as v4 (only it has bigger addresses: 128-bit instead of 32-bit). Everything in the blog post works identically if you ju

by chungy 8y ago

For most purposes, IPv6 works the same as v4 (only it has bigger addresses: 128-bit instead of 32-bit). Everything in the blog post works identically if you just swap in IPv6 addresses :)

blattimwind 8y ago
> For most purposes, IPv6 works the same as v4 Theoretically yes, in practice not at all. Just one major difference: No NAT any more.
- okket 8y ago
  > No NAT any more The funny thing is, there will be mandatory NAT on the carrier side during transition to IPv6 because of unwillingness of major websites to announce AAAA (including this one). See [0] for some transition method examples. The common theme of these methods is: They spoof DNS to point to fake IPv6 addresses, which is horrible, HORRIBLE, but hopefully motivates IPv4 holdouts to move to IPv6, announce AAAAs. If you want to see what a wasteland IPv6 still currently is, and why such transition NAT madness will be necessary (sadly): Try disabling IPv4 when you have native IPv6 and your carrier has not enabled such DNS spoofing transition methods yet. [0] https://en.wikipedia.org/wiki/IPv6_transition_mechanism https://en.wikipedia.org/wiki/IPv6_transition_mechanism
  - disiplus 8y ago
    i also disable ipv6 on my servers for abuse purposes, it is to easy to get iv6 addresses
    - okket 8y ago
      Please do not disable IPv6.
      - blattimwind 8y ago
        Disagree. If you've only got IPv4 experience and have a number of possibly legacy devices on your network, then there is a significant amount of learning and changes required to make it work with IPv6 (securely). It's entirely reasonable to say "It works fine without [=zero business value], no need to invest that amount of work.". This makes IPv6 a negative value proposition for many orgs.
      - mirimir 8y ago
        It depends on the context. I mostly focus on users of VPN services. It's still rare for them to handle IPv6 traffic. So if you have IPv6 connectivity, IPv6 will leak, bypassing the VPN. Unless you have firewall rules, or disable IPv6 while using the VPN.
    - kiallmacinnes 8y ago
      Do you mean you turn off IPv6, because it's easy for others to get lots of IPs and bypass a IP blacklist? If so, that is a difference from IPv4. Don't block IPs, block subnets. Block the whole /64. It's what you were doing with IPv4 anyway - blocking a whole building / office / etc at once! That's still no reason to turn IPv6 off in my humble opinion...
      - ryanlol 8y ago
        IPv6 ratelimiting can be a bit tricky, you block my /64 and I come back with a /48 and so on. Most stuff defaults to bucketing by /64s.
        kiallmacinnes 8y ago
        Right, but how does this differ from IPv4? Every time I restart my cable modem, I get a new IP from a /18 or so of IPv4 space. IP blocking is far from ideal, in both versions of IP.. IPv6 makes this no better, or worse.
        ryanlol 8y ago
        You get a single IP, that doesn’t scale well at all.
  - mrpippy 8y ago
    Horrible? Sure it's not ideal, but it allows carriers to go IPv6-only on their internal networks. Mobile carriers already put all IPv4 traffic behind a NAT, so this isn't a step backwards. For most users, the transition will happen via dual-stack (where the customer runs their own IPv4 NAT), not NAT64.
- rohan1024 8y ago
  >No NAT I'm in India and my mobile service provider (Jio) is handing out ipv6 addresses. The fascinating thing about this is I was able to access a server hosted on my phone from Internet. Crazy!
  - ramshanker 8y ago
    Next everyone hosting his/her own website from his/her own smartphone. I am loving this era.
  - mirimir 8y ago
    What phone? And what scope, local or global? Maybe a firewall would be prudent ;)
    - rohan1024 8y ago
      Global. OnePlus. But I don't think phone is limiting factor. Any Android should be able to run http server. Plenty are available on play store
      - mirimir 8y ago
        It's cool, I'm sure. But I worry about malware apps streaming video surveillance.
dvfjsdhgfv 8y ago
> For most purposes, IPv6 works the same as v4 (only it has bigger addresses: 128-bit instead of 32-bit) That's the understatement of the year. IPv6 is a huge protocol and its complexity is its main weakness and one of the main reasons people and organizations stay away from it.
ldite 8y ago
Off the top of my head, ARP &. NDP are rather different - NDP is an IP protocol, unlike ARP.
magicalhippo 8y ago
If by "for most purposes" you mean something else than actually using IPv6 in a network. For one, address allocation is entirely different. Devices will have several addresses, and some of them can be temporary addresses. If your ISP assigns you dynamic prefixes (mine does), you can end up with devices not being able to connect to the internet after the router/modem reboots, since they're not told about the new prefix you just got from your ISP and happily keeps using the old one. If your ISP assigns you dynamic prefixes (mine does), dynamic DNS is required for each server box (apparently one can centralize this by using DHCP-PD, but I haven't figured this out for my pfSense router). And if you're writing an IPv6-enabled application, parsing client/server address input is a PITA compared to IPv4. The list goes on and on, but these were the major pain points I found while trying to use IPv6 at home, which are non-existent when using IPv4.
- navaati 8y ago
  > If your ISP assigns you dynamic prefixes (mine does) Well there goes your problem…
  - magicalhippo 8y ago
    Yes it's not what is currently (19 years after IPv6 RFC) considered best practices[1], but that's what my ISP hands me, so that's what I got to work with. [1]: https://www.ripe.net/publications/docs/ripe-690 https://www.ripe.net/publications/docs/ripe-690
    - dnel 8y ago
      Either they really don't understand IPv6 or they are creating a false scarecity to charge you more money for what is essentially a free and virtually infinite resource to them, probably both.
      - toast0 8y ago
        Or they're running 6rd and giving him a dynamic ipv4?
woah 8y ago
This is not true. They changed almost every detail in ipv6, from the address notation, to the fragmentation, to the peer discovery. Some of these may have been improvements, some not. But at the end of the day, all that anyone ever needed was a few more octets on the address. IPv4 with a couple extra dots would have been adopted 15 years ago.
- sp332 8y ago
  Yeah, remember when IPSec was mandatory? And the two different schemes (never standardized I guess) that would have let you have a "home" IP address and a "network"/real IP address, so if you were streaming a video the source would send to one IP even as you hopped networks? Good times.
- sedachv 8y ago
  > But at the end of the day, all that anyone ever needed was a few more octets on the address. IPv4 with a couple extra dots would have been adopted 15 years ago. You are completely ignoring routing issues. IPv6 is designed from the ground up for efficient route aggregation, and more importantly the processes ARIN and RIR use for allocation are based around this. There is no way IPv4 routing would scale to what IPv6 is going to be in 10 years if you "just added" some octets. What are you going to do, force everyone to re-number?

by chungy 8y ago

For most purposes, IPv6 works the same as v4 (only it has bigger addresses: 128-bit instead of 32-bit). Everything in the blog post works identically if you just swap in IPv6 addresses :)

blattimwind 8y ago

> For most purposes, IPv6 works the same as v4 Theoretically yes, in practice not at all. Just one major difference: No NAT any more.

okket 8y ago
> No NAT any more The funny thing is, there will be mandatory NAT on the carrier side during transition to IPv6 because of unwillingness of major websites to announce AAAA (including this one). See [0] for some transition method examples. The common theme of these methods is: They spoof DNS to point to fake IPv6 addresses, which is horrible, HORRIBLE, but hopefully motivates IPv4 holdouts to move to IPv6, announce AAAAs. If you want to see what a wasteland IPv6 still currently is, and why such transition NAT madness will be necessary (sadly): Try disabling IPv4 when you have native IPv6 and your carrier has not enabled such DNS spoofing transition methods yet. [0] https://en.wikipedia.org/wiki/IPv6_transition_mechanism https://en.wikipedia.org/wiki/IPv6_transition_mechanism
- disiplus 8y ago
  i also disable ipv6 on my servers for abuse purposes, it is to easy to get iv6 addresses
  - okket 8y ago
    Please do not disable IPv6.
    - blattimwind 8y ago
      Disagree. If you've only got IPv4 experience and have a number of possibly legacy devices on your network, then there is a significant amount of learning and changes required to make it work with IPv6 (securely). It's entirely reasonable to say "It works fine without [=zero business value], no need to invest that amount of work.". This makes IPv6 a negative value proposition for many orgs.
    - mirimir 8y ago
      It depends on the context. I mostly focus on users of VPN services. It's still rare for them to handle IPv6 traffic. So if you have IPv6 connectivity, IPv6 will leak, bypassing the VPN. Unless you have firewall rules, or disable IPv6 while using the VPN.
  - kiallmacinnes 8y ago
    Do you mean you turn off IPv6, because it's easy for others to get lots of IPs and bypass a IP blacklist? If so, that is a difference from IPv4. Don't block IPs, block subnets. Block the whole /64. It's what you were doing with IPv4 anyway - blocking a whole building / office / etc at once! That's still no reason to turn IPv6 off in my humble opinion...
    - ryanlol 8y ago
      IPv6 ratelimiting can be a bit tricky, you block my /64 and I come back with a /48 and so on. Most stuff defaults to bucketing by /64s.
      - kiallmacinnes 8y ago
        Right, but how does this differ from IPv4? Every time I restart my cable modem, I get a new IP from a /18 or so of IPv4 space. IP blocking is far from ideal, in both versions of IP.. IPv6 makes this no better, or worse.
        ryanlol 8y ago
        You get a single IP, that doesn’t scale well at all.
- mrpippy 8y ago
  Horrible? Sure it's not ideal, but it allows carriers to go IPv6-only on their internal networks. Mobile carriers already put all IPv4 traffic behind a NAT, so this isn't a step backwards. For most users, the transition will happen via dual-stack (where the customer runs their own IPv4 NAT), not NAT64.
rohan1024 8y ago
>No NAT I'm in India and my mobile service provider (Jio) is handing out ipv6 addresses. The fascinating thing about this is I was able to access a server hosted on my phone from Internet. Crazy!
- ramshanker 8y ago
  Next everyone hosting his/her own website from his/her own smartphone. I am loving this era.
- mirimir 8y ago
  What phone? And what scope, local or global? Maybe a firewall would be prudent ;)
  - rohan1024 8y ago
    Global. OnePlus. But I don't think phone is limiting factor. Any Android should be able to run http server. Plenty are available on play store
    - mirimir 8y ago
      It's cool, I'm sure. But I worry about malware apps streaming video surveillance.

dvfjsdhgfv 8y ago

> For most purposes, IPv6 works the same as v4 (only it has bigger addresses: 128-bit instead of 32-bit) That's the understatement of the year. IPv6 is a huge protocol and its complexity is its main weakness and one of the main reasons people and organizations stay away from it.

ldite 8y ago

Off the top of my head, ARP &. NDP are rather different - NDP is an IP protocol, unlike ARP.

magicalhippo 8y ago

If by "for most purposes" you mean something else than actually using IPv6 in a network. For one, address allocation is entirely different. Devices will have several addresses, and some of them can be temporary addresses. If your ISP assigns you dynamic prefixes (mine does), you can end up with devices not being able to connect to the internet after the router/modem reboots, since they're not told about the new prefix you just got from your ISP and happily keeps using the old one. If your ISP assigns you dynamic prefixes (mine does), dynamic DNS is required for each server box (apparently one can centralize this by using DHCP-PD, but I haven't figured this out for my pfSense router). And if you're writing an IPv6-enabled application, parsing client/server address input is a PITA compared to IPv4. The list goes on and on, but these were the major pain points I found while trying to use IPv6 at home, which are non-existent when using IPv4.

navaati 8y ago
> If your ISP assigns you dynamic prefixes (mine does) Well there goes your problem…
- magicalhippo 8y ago
  Yes it's not what is currently (19 years after IPv6 RFC) considered best practices[1], but that's what my ISP hands me, so that's what I got to work with. [1]: https://www.ripe.net/publications/docs/ripe-690 https://www.ripe.net/publications/docs/ripe-690
  - dnel 8y ago
    Either they really don't understand IPv6 or they are creating a false scarecity to charge you more money for what is essentially a free and virtually infinite resource to them, probably both.
    - toast0 8y ago
      Or they're running 6rd and giving him a dynamic ipv4?

woah 8y ago

This is not true. They changed almost every detail in ipv6, from the address notation, to the fragmentation, to the peer discovery. Some of these may have been improvements, some not. But at the end of the day, all that anyone ever needed was a few more octets on the address. IPv4 with a couple extra dots would have been adopted 15 years ago.

sp332 8y ago
Yeah, remember when IPSec was mandatory? And the two different schemes (never standardized I guess) that would have let you have a "home" IP address and a "network"/real IP address, so if you were streaming a video the source would send to one IP even as you hopped networks? Good times.
sedachv 8y ago
> But at the end of the day, all that anyone ever needed was a few more octets on the address. IPv4 with a couple extra dots would have been adopted 15 years ago. You are completely ignoring routing issues. IPv6 is designed from the ground up for efficient route aggregation, and more importantly the processes ARIN and RIR use for allocation are based around this. There is no way IPv4 routing would scale to what IPv6 is going to be in 10 years if you "just added" some octets. What are you going to do, force everyone to re-number?