4 ms·
Using IPv4 internally becomes an issue as soon as you need to interconnect with someone else's internal network which uses overlapping IPv4 address space. The
by agwa 8y ago
Using IPv4 internally becomes an issue as soon as you need to interconnect with someone else's internal network which uses overlapping IPv4 address space. The most famous example is probably Facebook's acquisition of Instagram, which required an incredible amount of iptables hackery to work around overlapping IPv4 address space: https://instagram-engineering.com/migrating-from-aws-to-fb-86b16f6766e2 https://instagram-engineering.com/migrating-from-aws-to-fb-8...
In contrast, even if you use "private" IPv6 addresses (ULA), the address space is large enough that everyone can have their own prefix. Or better, just use public IPv6 addresses and firewall them.
- endymi0n 8y agoThen again, IPv6 hasn't really been built with NAT in mind, precisely because "there are so many addresses out there you won't need it". So if you decide for an IPv6 deployment for your servers, you're essentially between a rock (you can't easily transfer an IPv6 address space from one cloud provider to the next) and a hard place (use ULA addresses internally and having to NAT to the outside anyway, but with less software and hardware support). As for me personally, I'm totally fine with IPv4 behind the load balancer: it gives me a much easier time with basically everything and I can still support both v4 and v6 for all clients connecting to my site as well.
- agwa 8y agoYes, renumbering is a PITA. NAT66 does exist and over time more software and hardware will support it. But you don't need NAT if you are using ULA; instead you would configure each system with both its ULA address and the global address from your provider (SLAAC can advertise multiple prefixes). Traffic to other internal systems would use the ULA addresses, while traffic to the Internet would use the global address.
- clhodapp 8y agoWhy would it be important to be able to switch cloud providers and keep the same addresses on your internal network? Changing providers while keeping addresses seems abstractly like a nice capability to have but it also seems that it might or might not end up being just as much logistical trouble as re-addressing everything when it came down to the implementation...
- zAy0LfpBZLC8mAC 8y agoIPv4 also hasn't been built with NAT in mind. And given the disaster it has been ... no, obviously, noone in their right mind would build a new protocol with NAT in mind. For one, you don't need NAT to use ULA internally. You just use ULA for internal stuff and global addresses for everything else. But really, if renumbering is a problem in the first place, you are doing something fundamentally very wrong. Renumbering should be a matter of adding a new prefix of the same length to your addressing plan and replicating in it the exact same subnet structure you had before, then deprecating the old prefix (so it's not used for new outbound connections), waiting a bit, and then removing the old prefix. If your problem is hard-coded addresses everywhere, that is also a problem with your system design. Almost all of your configuration should only contain host names, and your DNS should either use dynamic updates so that hosts register their current primary addresses with the DNS server, or some other mechanism that generates records from an addressing plan of sorts and a prefix. There should be very few places where you need to change addresses in order to switch prefixes.
- Oowee1Ee 8y agoChange prefix, keep the suffix.