5 ms·

Why is IPv6 more attractive for address exhaustion than IPv4 NAT? As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services

by geofft 8y ago

Why is IPv6 more attractive for address exhaustion than IPv4 NAT? As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services on the internet because the internet is IPv4. That answer is going to be either publicly routable IPv4, IPv4-to-IPv4 NAT, or IPv4-to-IPv6 NAT. If you do the latter (or if you do dual stack) you can route directly to other IPv6 hosts without NAT - but what's the benefit? Are there systems of communication between parties on the public internet that can guarantee native IPv6 on both ends, don't want to use IPv4 NAT, and don't want to set up a point-to-point VPN? (I am actually okay with IPv6 ULAs for private addressing on private VPNs to avoid RFC 1918 collisions/exhaustion, but that also saves you a lot of the complexity of IPv6 deployment because you don't need any network device support, you generally get address assignments from your VPN layer and don't need to think about SLAAC or DHCPv6 or anything, etc. And it's unrelated to public IPv4 exhaustion.)

wmf 8y ago
Native IPv6 is cheaper than NAT at ISP scale. If a consumer ISP adopts IPv6, half of their traffic will be native IPv6 without NAT. If the ISP tries to do NAT444 then all of their traffic will be NATed, requiring more equipment.
phicoh 8y ago
There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a wide area share a pool of addresses. For some ad placement you really want to know where addresses are. - But the bigger problem is that network speeds keep growing. Compared to an IPv6 router, boxes that can do NAT at a large scale and high speed are quite expensive. So an ISP has an incentive to move traffic volume to IPv6. Relatively low volume oddball sites can go over the NAT box.
- geofft 8y ago
  Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address? If enough of the Internet is running IPv6 that you save significantly on performance by bypassing NAT for IPv6 sites only, that seems worthwhile, sure. But also I'd intuitively find that surprising, at least at present - maybe my intuitions are just wrong about how much IPv6 there is.
  - phicoh 8y ago
    For ad networks, the sensible thing to do is to support IPv6. Then any ISP with CGNAT only has to enable IPv6 to make it work. I have no clue what law enforcement plans to do. Video services use most of the bandwidth. So with youtube and netflix on IPv6, you can easily have most the traffic go over IPv6.
  - Dagger2 8y ago
    The most recent figures I've heard were that something like 40-60% of traffic (by bytes) on a dual-stacked client ISP will go over v6. I heard that stat about 4-5 years ago, so it seems reasonable to expect it to be even higher nowadays. Another advantage is that v6 is easy to hand off early, but if you're CGNATing v4 then your v4 traffic has to go via your CGNAT routers. For cost reasons you probably want as few of those as possible, which means v4 traffic may need to go further to reach them. T-Mobile in the US is like this; v6 traffic is passed off as soon as possible and gets a relatively direct network path, but v4 traffic has to go all the way to one of their datacenters to get NATed. That can add a lot of latency.
  - devdas 8y ago
    But you would have far fewer connections behind the IPv6 - IPv4 NAT. Then the performance problems are limited to sites without IPv6.
- logifail 8y ago
  >> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply. </sarc> [0] https://learningnetwork.cisco.com/thread/81720 https://learningnetwork.cisco.com/thread/81720
buzer 8y ago
> Are there systems of communication between parties on the public internet that can guarantee native IPv6 on both ends, don't want to use IPv4 NAT, and don't want to set up a point-to-point VPN? WebRTC is one example of something that can greatly benefit from having publicly routable addresses on clients (in practice this tends to mean IPv6). If both clients are behind IPv4 NAT that doesn't allow hole punching, they will need TURN (or media) server in order to communicate. While clients might be close to each other (e.g. same apartment building), that TURN server can have horrible routing for this set of clients. For example, it could be in Europe while both of the clients are in west coast of USA (and that's not even nearly the worst case).
the8472 8y ago
NAT has many severe limitations. When I was on an ISP with CGNAT I regularly saturated the connection tracking tables which resulted in all new connections failing until some some slots were freed up. NAT also makes it difficult to run any kind of server at home (PCP support varies) or use any kind of p2p protocol. NAT traversal techniques don't work all the time and even when they work they may only help for coordinated connections but not for unsolicited contacts.
- Wowfunhappy 8y ago
  > NAT also makes it difficult to run any kind of server at home (PCP support varies) or use any kind of p2p protocol. I care about this greatly, but I'm not clear that ISP's do. On the contrary, my ISP's TOS states that I'm technically not allowed to run my own server on my home internet plan.
  - syncsynchalt 8y ago
    P2P isn't just file sharing and home servers, for example the popular PS4/Xbox/PC game "Destiny" is all serverless P2P instances. I can't imagine an ISP banning you from playing PS4 games.
    - Wowfunhappy 8y ago
      I recall reading that you could make P2P connections work behind a NAT by having an external server route the connections initially. Is this not true, or does it only work in some circumstances?
      - wsimmons 8y ago
        It often works, a common method is called “UDP hole punching”.
      - the8472 8y ago
        This is the "nat traversal techniques don't work all the time" caveat, especially with TCP.

by geofft 8y ago

wmf 8y ago

Native IPv6 is cheaper than NAT at ISP scale. If a consumer ISP adopts IPv6, half of their traffic will be native IPv6 without NAT. If the ISP tries to do NAT444 then all of their traffic will be NATed, requiring more equipment.

phicoh 8y ago

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a wide area share a pool of addresses. For some ad placement you really want to know where addresses are. - But the bigger problem is that network speeds keep growing. Compared to an IPv6 router, boxes that can do NAT at a large scale and high speed are quite expensive. So an ISP has an incentive to move traffic volume to IPv6. Relatively low volume oddball sites can go over the NAT box.

geofft 8y ago
Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address? If enough of the Internet is running IPv6 that you save significantly on performance by bypassing NAT for IPv6 sites only, that seems worthwhile, sure. But also I'd intuitively find that surprising, at least at present - maybe my intuitions are just wrong about how much IPv6 there is.
- phicoh 8y ago
  For ad networks, the sensible thing to do is to support IPv6. Then any ISP with CGNAT only has to enable IPv6 to make it work. I have no clue what law enforcement plans to do. Video services use most of the bandwidth. So with youtube and netflix on IPv6, you can easily have most the traffic go over IPv6.
- Dagger2 8y ago
  The most recent figures I've heard were that something like 40-60% of traffic (by bytes) on a dual-stacked client ISP will go over v6. I heard that stat about 4-5 years ago, so it seems reasonable to expect it to be even higher nowadays. Another advantage is that v6 is easy to hand off early, but if you're CGNATing v4 then your v4 traffic has to go via your CGNAT routers. For cost reasons you probably want as few of those as possible, which means v4 traffic may need to go further to reach them. T-Mobile in the US is like this; v6 traffic is passed off as soon as possible and gets a relatively direct network path, but v4 traffic has to go all the way to one of their datacenters to get NATed. That can add a lot of latency.
- devdas 8y ago
  But you would have far fewer connections behind the IPv6 - IPv4 NAT. Then the performance problems are limited to sites without IPv6.
logifail 8y ago
>> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply. </sarc> [0] https://learningnetwork.cisco.com/thread/81720 https://learningnetwork.cisco.com/thread/81720

buzer 8y ago

> Are there systems of communication between parties on the public internet that can guarantee native IPv6 on both ends, don't want to use IPv4 NAT, and don't want to set up a point-to-point VPN? WebRTC is one example of something that can greatly benefit from having publicly routable addresses on clients (in practice this tends to mean IPv6). If both clients are behind IPv4 NAT that doesn't allow hole punching, they will need TURN (or media) server in order to communicate. While clients might be close to each other (e.g. same apartment building), that TURN server can have horrible routing for this set of clients. For example, it could be in Europe while both of the clients are in west coast of USA (and that's not even nearly the worst case).

the8472 8y ago

NAT has many severe limitations. When I was on an ISP with CGNAT I regularly saturated the connection tracking tables which resulted in all new connections failing until some some slots were freed up. NAT also makes it difficult to run any kind of server at home (PCP support varies) or use any kind of p2p protocol. NAT traversal techniques don't work all the time and even when they work they may only help for coordinated connections but not for unsolicited contacts.

Wowfunhappy 8y ago
> NAT also makes it difficult to run any kind of server at home (PCP support varies) or use any kind of p2p protocol. I care about this greatly, but I'm not clear that ISP's do. On the contrary, my ISP's TOS states that I'm technically not allowed to run my own server on my home internet plan.
- syncsynchalt 8y ago
  P2P isn't just file sharing and home servers, for example the popular PS4/Xbox/PC game "Destiny" is all serverless P2P instances. I can't imagine an ISP banning you from playing PS4 games.
  - Wowfunhappy 8y ago
    I recall reading that you could make P2P connections work behind a NAT by having an external server route the connections initially. Is this not true, or does it only work in some circumstances?
    - wsimmons 8y ago
      It often works, a common method is called “UDP hole punching”.
    - the8472 8y ago
      This is the "nat traversal techniques don't work all the time" caveat, especially with TCP.