9 ms·
Finally. I can't wait for the outcome of this. We'll probably waste another couple of years with more NAT and other hacky short-term solutions, but in the long
by jasonvorhe 7y ago
Finally. I can't wait for the outcome of this. We'll probably waste another couple of years with more NAT and other hacky short-term solutions, but in the long run adopting IPv6 is inevitable.
- tenebrisalietum 7y agoNAT destroys the end-to-end principle and encourages things like CGNAT, which make side-stepping centralized services impossible. I really hope IPv6 starts becoming commonplace and that the outcome isn't that CGNAT becomes the norm for residential Internet connections.
- cnst 7y agoThe best part about IPv6 is that it's now possible to SSH directly into your laptop if you're using a hotspot from T-Mobile US, for example — it gives you at least a whole /64, so, your laptop gets a fully-routable IPv6 address. Which is kind of ironic, because you don't get that with most wireline connections, as they're all done through IPv4 NAT.
- cfallin 7y agoThis is my favorite bit about native IPv6 at home [0]. No more port forwarding to expose particular services -- I can just `ssh desktop.home.net` or `ssh other.home.net`, and they both get to run on default ports! (Of course, one probably wants a firewall -- I block inbound IPv6 by default except ssh.) [0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option!
- floren 7y ago> [0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option! Can you go into more detail or point me to instructions? I'm on Comcast and would be interested in getting v6 at home.
- Aloha 7y agoI think Comcast is native dual stack across their entire footprint so long as you have new enough hardware
- cfallin 7y agoSure! The keyword to look for is "DHCP-PD" (DHCP prefix delegation). I run a little OpenBSD router and my dhcpcd.conf is here [1], but I've done this before on a Linux router box too -- here are some instructions from Arch's wiki [2]. IIRC, the stock firmware on my old consumer router was also able to request a prefix and advertise it on the network. [1] https://gist.github.com/cfallin/e5865a6a93c75ace8d26d6a85287ed76 https://gist.github.com/cfallin/e5865a6a93c75ace8d26d6a85287... [2] https://wiki.archlinux.org/index.php/IPv6#Prefix_delegation_(DHCPv6-PD) https://wiki.archlinux.org/index.php/IPv6#Prefix_delegation_...
- virusduck 7y agoDo you also have an IPv4 address that you can use for NAT for those things that cant use IPv6? (Also do you have devices that aren't capable of using IPv6?)
- cfallin 7y agoYes, I have native IPv4 too, with the usual NAT. I think the default router that Comcast will rent to you actually is dualstack in this way too -- IPv4 NAT, and IPv6 prefix advertised for devices that want it. I actually played with NAT64 for a bit (IPv6-only internally, all IPv4 space is mapped to a special /96 in IPv6-space and NAT'd at the router, and local DNS server on the router returns translated AAAA records for IPv4-only hosts), but dropped that when I simplified my router config. It works, it just takes a bit of config :-)
- kadoban 7y agoThis may be a dumb question, but why does one need with a /60 ? Isn't a /64 already ridiculously huge to the point that I could never possibly use it all?
- snagglegaggle 7y agoNot with that attitude.
- oarsinsync 7y agoIETF recommend a /64 as the smallest subnet size to use, as stateless auto address configuration (SLAAC) only works with that subnet size. Any user that wants more than a single subnet at home is supposed to receive a /48 by the same recommendation base. A lot of ISPs settled on /56s. Comcast is a bit more stingy than some. That introduces a whole other set of problems.
- zaphoyd 7y agoNot a dumb question at all! The smallest IPv6 subnet is /64, so a /60 lets you split your network into multiple subnets without all the software that assumes a subnet is /64 (like address autoconfig) breaking. Why might you need multiple subnets? Lots of reasons, common ones are for security. It lets you do things like split up a home office network from home from guest wifi from IoT/home automation. Also allows new services to be created that use that capability.
- cfallin 7y agoThe RIPE guidelines at [0] line up with what I've heard as justification before: basically, /64 is the smallest you can go without lots of manual configuration (the way that SLAAC auto-assigns addresses from Ethernet MACs or random bytes only works when the host part of the address is 64 bits). There may be valid technical reasons to want > 1 subnet at a customer site. And finally, the space is huge -- an ISP would typically get a /32 at least (Whois says that Comcast is using a /26 just for the Bay area), so if every customer gets a /60, that's 2^28, or 256M, delegations. (With the /26, Comcast could hand out 16 billion /60 delegations to their SFBA subscribers.) [0] https://www.ripe.net/publications/docs/ripe-690#4--size-of-end-user-prefix-assignment---48---56-or-something-else- https://www.ripe.net/publications/docs/ripe-690#4--size-of-e...
- magicalhippo 7y agoThat was one of my motivations to try IPv6 at home, only to quickly get disappointed because my ISP gives me a new prefix change very often (in stark contrast to my IPv4 address for some reason).
- ripdog 7y agoI have this issue too, so I use Ddclient-curl to do dynamic dns via cloudflare. DDNS is something that I once thought would be an artifact of a less civilized time, but ISPs gotta upsell, I guess.
- magicalhippo 7y agoMain problem for me is that my router doesn't update firewall rules when prefix changes, and I can't get it to not advertise its public ip for the DNS resolver running on the router which of course breaks when the prefix changes.
- ripdog 7y agoHmm. I run pfsense, it advertises its own v6 address as a DNS resolver, and I've never had any issues with it breaking. Admittedly, I don't know it isn't just falling back to v4 for a period when the prefix changes. But I did just check and my PC is getting the correct v6 addr of my router as DNS resolver.
- magicalhippo 7y ago> Admittedly, I don't know it isn't just falling back to v4 for a period when the prefix changes. At the very least, IPv4 fallback takes a few seconds for each DNS query, and I've experienced it failing completely in some cases (can't recall if I ever figured out why). So regardless it's a PITA when it happens. I tried disabling the option for it to advertise itself as a DNS and instead insert the local IPv4 address in the DHCP options but to no avail, clients still ended up with public IPv6 as main DNS. After a few hours of trying to fix it I just turned off IPv6 again.
- tialaramex 7y agoYes, you probably should have a firewall but the sheer size of IPv6 means that whereas I'll have several idiots banging their heads on my SSH services at any one time on IPv4 I'm not sure I've ever had one trying on IPv6 in the years that I've had service available on both public IPv4 and IPv6. If you set a machine to try just one IP address per second in IPv4 you'll explore a significant fraction of the whole public address space per year. In IPv6 doing that is extremely unlikely to find even a single valid address to connect to in a human lifetime.
- dvdbloc 7y agoWas the former more secure? Most people don’t want their laptop exposed with a fully routable address.
- cnst 7y agoThat's why you have firewalls. You're already often exposed to all the other users in your coffee shop anyways. SSH is normally not enabled, either.
- rohan1024 7y agoIf you are on Ubuntu, you can run sudo ufw default deny incoming and your laptop is now secure.
- msbarnett 7y agoNAT is not a security measure. You want a firewall regardless of whether you’re running IPv4 or IPv6
- booi 7y agoWhat do you do for something like printers? I highly doubt Epson's "firewall" is totally secure.
- jlgaddis 7y agoIMO, the "right" answer is that printers go on their own subnet. Access control is managed on their default gateway.
- Jonnax 7y agoYour home has a gateway router. You can configure firewall rules on that. In fact, the default is almost always to disallow all inbound and allow all outbound.
- apk17 7y agoTheoretically, yes. Practically, my laptop is in some Wifi network and has an IPv6 address, but that isn't accessible from the outside because the Wifi/router box blocks incoming connection. That is a wise decision overall, but unforunately replaces the "can't connect because NAT" by "glorious IPv6, bit still can't connect". And I'm not the owner of those boxes.
- cnst 7y agoIt depends.™ I've had a static IPv4 subnet allocation from AT&T on AT&T U-verse, and tried using it on a couple of consumer routers for the local network. Well, guess what — all these devices from major brands that are called "routers" don't actually route between the interfaces, after all — all they did was NAT between my public IPv4 allocation and the main IPv4 address assigned by DHCP. And disabling the NAT simply disconnected the networks — instead of rounting one interface to the other. I actually opened up a support ticket with ZyXEL, which got escalated to their engineering managers, and they did confirm my finding that their routers had a bug in sysctl settings that stops them from routing the interfaces (e.g., sysctl net.ipv4.ip_forward not set to 1). Anyhow, back to T-Mobile US IPv6 on a hotspot — when I originally tried ssh'ing back to my own box via the public IPv6, things didn't work, either; but I then found out that it was some sort of a local policy on the local machine, because another laptop without a firewall was able to receive connections on IPv6 from the internet without any issues.
- anticensor 7y agoWere they all just selling NAT-ing bridges instead of routers? This is a serious fraud.
- apk17 7y agoFrom my vantage point, it is already. The only parties that don't have IPv6 are my employer (which I maybe need to nag about since we're an ISP and have our own AS), and the customer I'm dealing with.
- JohnFen 7y ago> NAT destroys the end-to-end principle Yes, and that precisely why I use it in my home network, and will continue to use is with IPv6. I explicitly don't want any IP addresses in my green zone to be directly accessibly from my red zone.
- Dagger2 7y agoThen you're doing something very wrong. You can't rely on NAT to stop connections, because that's not a thing NAT does. You need to be using a firewall. NAT is just an extra, useless, complicated and unnecessary thing to be adding to the top of that; one that makes it hard to understand how your network is even working, and which makes it harder rather than easier to secure.
- umanwizard 7y agoCan you explain how an outside person (other than my ISP) can make an outside connection to my laptop despite being behind a NAT? Assuming for concreteness that my laptop's internal (NATted) address is 192.168.1.123 and my router's public address is 123.45.67.89. What sequence of commands would you type to open a TCP connection to my laptop?
- takeda 7y agoNAT is implemented on a firewall, the blocking of incoming connections is a side effect and isn't even intentional (that's why UPnP exists). Since you already have a firewall you can just add a single rule that block incoming connections and that's all you actually need.
- ATsch 7y agoYou are right that it would be hard to open a TCP connection with you on a specific target port on a 1:N NAT without UPnP. If you could, IPv4 exhaustion would not be an issue. However, NAT is just a mapping from an internal IP to an external Port number. With pure NAT, once you have created a connection to the outside, anyone can send packets to that external port, and have them delivered to your device. Of course, this mapping is inherently lossy. You are mapping the port space of one device onto N devices. This does mean external IPs can only send your devices packets on ports they have previously used as source ports, but you are still not safe. You might own devices that, for example, have vulnerabilities in their networking stack. Not that rare. You also might not want to disclose the number of devices active in a network, allow them to be fingerprinted by their response, or similar. Some UDP client applications might also not check the IP addresses of incoming packets. UDP server applications also commonly use the same socket for connections to other hosts as it listens on. So, to elaborate on that last example, you might run, say, a video surveillance server. It might listen for RTP on UDP port 12345. It then uses that same socket to send a UDP packet to licensecheck.example.com. That packet will have a source port of 12345. NAT will then map internal_ip:12345 to external_ip:xyz. Anyone can now view your cameras on external_ip:xyz. So either way, you'll want a stateful firewall. Deny incoming, allow outgoing. That's what firewalls are there for, and that's what gives you your security, NAT or no NAT.
- pas 7y agoSo does RIPE automatically hand out a v6 block for every v4 one, and do the LIRs also, and is there a policy to also hand out zero added cost v6 blocks? No? Oh, okay then.