5 ms·

I’m still hoping one of these days we can just get on with everybody lighting up IPv6. Enterprises continue to drag their feet with misguided knowledge of NAT

I’m still hoping one of these days we can just get on with everybody lighting up IPv6. Enterprises continue to drag their feet with misguided knowledge of NAT as a security feature (it’s a glorified stateful firewall, enable the IPv6 one your network equipment is practically bound to have). SAAS solutions frequently fail to deploy IPv6 support still, even as major US mobile networks are IPv6-only. Email seems to be stuck in IPv4 land because we’ve put far too much into IP reputation, even though DKIM/SPF/DMARC and proper content-analyzing spam filters are a better and less brute force solution. Don’t get me started on residential ISPs. CableOne STILL doesn’t support IPv6, and CenturyLink supposedly supports native IPv6 in my area (I ordered a static v4 w/ native v6 online) but nobody can tell me how to configure it. Let’s get moving already! I’m tired of the hacks.

btgeekboy 7y ago
CenturyLink uses 6rd, at least on the fiber connection I used to have through them. This blog helped me configure it on pfSense: https://kdemaria.wordpress.com/2015/04/26/how-to-configure-pfsense-2-2-2-for-ipv6-on-centurylink-gig-fiber/ https://kdemaria.wordpress.com/2015/04/26/how-to-configure-p...
- snuxoll 7y ago
  Yes, they have 6rd deployed - but in select markets they supposedly have native dualstack as well (this was the option I chose on their static IP portal when ordering mine). I have not been able to get either working correctly with my Sophos XG box which has rather infuriated me.
red_phone 7y ago
My understanding is that residential usage of IPv6 actually outpaces Enterprise adoption in the US.
- wiml 7y ago
  This wouldn't surprise me at all. My residential internet service has provided IPv6 for years. (I think it's 6rd, but I don't care — the company-provided router does the IPv6 router advertisement thing, and all the devices on my home network acquire IPv6 addresses. It's pretty transparent.) And cell networks are now, as I understand it, mostly IPv6-native. IPv4 traffic goes through NAT.
aidenn0 7y ago
NATs vs stateful firewall have different failure modes though; a NAT will fail closed, while many stateful firewalls will fail open.
- fulafel 7y ago
  NAT-as-poor-mans-firewall use case has fail-open failure modes too: the ambiguously addressed trafic ends up in egress/ingress routing outside the intended "local network". In practice this means someone else on the net sees your private-addressed traffic and can connect to your private-addressed network. This happens more frequently than you'd think, and may go on undetected for long periods of time if it's happening only in limited circumstances/context. Only in this case you can't easily identify the traffic in your monitoring and logs because of ambiguous addressing.

btgeekboy 7y ago

CenturyLink uses 6rd, at least on the fiber connection I used to have through them. This blog helped me configure it on pfSense: https://kdemaria.wordpress.com/2015/04/26/how-to-configure-pfsense-2-2-2-for-ipv6-on-centurylink-gig-fiber/ https://kdemaria.wordpress.com/2015/04/26/how-to-configure-p...

snuxoll 7y ago
Yes, they have 6rd deployed - but in select markets they supposedly have native dualstack as well (this was the option I chose on their static IP portal when ordering mine). I have not been able to get either working correctly with my Sophos XG box which has rather infuriated me.

red_phone 7y ago

My understanding is that residential usage of IPv6 actually outpaces Enterprise adoption in the US.

wiml 7y ago
This wouldn't surprise me at all. My residential internet service has provided IPv6 for years. (I think it's 6rd, but I don't care — the company-provided router does the IPv6 router advertisement thing, and all the devices on my home network acquire IPv6 addresses. It's pretty transparent.) And cell networks are now, as I understand it, mostly IPv6-native. IPv4 traffic goes through NAT.

aidenn0 7y ago

NATs vs stateful firewall have different failure modes though; a NAT will fail closed, while many stateful firewalls will fail open.

fulafel 7y ago
NAT-as-poor-mans-firewall use case has fail-open failure modes too: the ambiguously addressed trafic ends up in egress/ingress routing outside the intended "local network". In practice this means someone else on the net sees your private-addressed traffic and can connect to your private-addressed network. This happens more frequently than you'd think, and may go on undetected for long periods of time if it's happening only in limited circumstances/context. Only in this case you can't easily identify the traffic in your monitoring and logs because of ambiguous addressing.