25 ms·

The Ripe NCC Has Run Out of IPv4 Addresses

416 points by cnorthwood 7y ago

ndmrs 7y ago
And yet my ISP still doesn't support IPv6... Until something forces the transition nothing is going to change.
- maltalex 7y ago
  Why are you, as a consumer, interested in switching to IPv6?
  - oarsinsync 7y ago
    My ISP provides me with a CGN IPv4 address. I have no ability to access any self-hosted services, unless I pay them money for a static globally routable address, or pay some other company to provide this through some other means (e.g. VPN, VPS, etc) If they supported IPv6, and gave me a globally routable address that was unfiltered except at my gateway, I'd be happier.
    - iicc 7y ago
      There's the Hurricane Electric IPv6 Tunnel Broker: https://tunnelbroker.net/ https://tunnelbroker.net/ >Our free tunnel broker service enables you to reach the IPv6 Internet by tunneling over existing IPv4 connections from your IPv6 enabled host or router to one of our IPv6 routers. (It's still obviously less direct, and inferior to your ISP supplying native IPv6, but it may improve your situation.)
      - ecksii 7y ago
        That solution requires a routable, Non-RFC1918, IPv4 address somewhere to work. If I understand CG-NAT correctly, you don't get a routable address on your equipment.
        iicc 7y ago
        You're right. HE is 6in4 and won't work. There's a list of brokers at https://en.wikipedia.org/wiki/List_of_IPv6_tunnel_brokers https://en.wikipedia.org/wiki/List_of_IPv6_tunnel_brokers https://6project.org/ https://6project.org/ looks viable (OpenVPN) and cheap.
      - deleted 7y ago
        [deleted]
  - jedberg 7y ago
    Not OP, but I can tell you why I as a consumer am very much not interested in IPv6. My ISP supports it, but I have intentionally disabled it. It only causes problems for me with absolutely no gain. There isn't a single website I can't reach, and no website that I've found runs any quicker when using IPv6. But at the same time, if I have v6 on, it causes delays in name resolution and sometimes I just can't connect to a site until I disable v6. I still have an addressable v4 address, so I can still run a home server. I don't know how to fix this. I know that v6 is good for the planet, and I know these problems won't get better until more people are using v6, but it's definitely a chicken/egg problem.
    - q3k 7y ago
      > But at the same time, if I have v6 on, it causes delays in name resolution and sometimes I just can't connect to a site until I disable v6. That sounds like your ISP does not actually support IPv6, eg. doesn't have the full Internet routing table for v6. I've seen this happen. DNS v4/v6 resolutions can also hang with glibc because of a well known bug with Happy Eyeballs when ISPs that fuck up outgoing DNS packets (eg. messed up stateful NAT/DPI). "options single-request-reopen" in /etc/resolv.conf is a workaround. See https://bugzilla.redhat.com/show_bug.cgi?id=505105 https://bugzilla.redhat.com/show_bug.cgi?id=505105. I would contact your ISP, or at least publically shame them. This is not how IPv6 Internet should work (source: we provide IPv4/v6 as an ISP and take care to prevent issues like this).
      - jedberg 7y ago
        It's AT&T (UVerse). If they can't get it right, I don't have much hope for anyone else. Also, I don't even use my ISPs name servers, I use Cloudflare or Google, so I don't think it's that unless the ISP is somehow munging the packet in transit, which I suppose is possible. Honestly I think it is all due to issues with the v6 stack in MacOS. But my point is, I shouldn't have to be a network engineer to make v6 work. I should be able to turn on my computer and just have it work.
        scurvy 7y ago
  - badrabbit 7y ago
    Likewise, curious. Would be neat to have it but as someone who supported consumers,v6 is a pain(or rather v4 is still so easy people prefer it when making new software).
  - coldpie 7y ago
    I think it'd be cool to access my home machine from anywhere without bothering with port forwarding stuff.
    - ATsch 7y ago
      Well, you still need to bother with adding firewall rules. But that's a lot less annoying than port forwarding, I agree.
  - q3k 7y ago
    Not OP, but with more and more IPv4 traffic behind CGNATs, IPv6 begins to be a much better experience. CGNATs tend to be massively overloaded, and as such accessing IPv4 Internet (especially CDNs for multimedia) will tend to result in low speed and dropped connections at peak hours.
    - p1mrx 7y ago
      This is the answer. IPv6 was always about maintaining the status quo. It doesn't become "better" than IPv4 until CGNAT makes IPv4 worse. (Or if your internal network reaches the scaling limits of RFC1918.)
  - superkuh 7y ago
    Because adoption of ipv6 allows everyone to be an equal on the internet again. Right now half of the computers hooked up to the 'net aren't even given a routable IP address. They're behind carrier NAT unable to participate like a real computer. They can't use protocols, they can only consume third party services over HTTP/S for the most part. If everyone is routable it cuts the gordian knot in the "What kind of content should be allowed on our platform?" question by allowing everyone to simply be their own platform. If ipv6 gets adopted fast enough it might just save the 'net from being just a more privacy invasive form of television.
    - close04 7y ago
      > be their own platform The public commercial platforms offer far more than just a routable IP. You get reach, reliability, resilience, and security (the kind you don't get to build yourself). Being your own YouTube/FB/Twitter/someChan/etc. platform means almost nobody will ever hear about you, the ones that do can easily wipe you off the internet, coming back is a real hassle, and that your data will leak is basically a forgone conclusion. Being your own Dropbox/GDrive may not need the reach but still relies the other three to provide value. And the list can go on for almost anything you can think of for "being your own platform". The overwhelmingly vast majority of people have little to no interest in building and maintaining any such platform. It's why so few people actually do it today even when having a routable address. It's inconvenient even for skilled people, let alone regular ones. I'll wait for a counterargument.
      - echelon 7y ago
        Back in my day bittorrent was pretty popular. We'd have doused Zuck's dorm room sever in gasoline if we'd known what was to happen.
        deleted 7y ago
        [deleted]
        close04 7y ago
        But that wasn't your own platform was it? It was explicitly distributed. The crux of my comment was the "own" part. You don't just have a share in it, it's yours.
  - ndmrs 7y ago
    My interest is twofold: a) for one as a response against CGN, thankfully my ISP isn't using one right now but I have a hunch they're going to start becoming a lot more common in the future. and b) as a hacker I'm interested to finally set it up and play around with it. Also IMO even if it doesn't bring any improvements to the general consumer given all the pressure to start switching to IPv6 it is a good thing to be interested about it, pressuring more ISPs to start supporting it.
  - distantsounds 7y ago
    the casual user at home, with no exposed services to the public, has no real need for a short ipv4 address. ipv6 would suffice just fine for the end user, and the isp can handle the v6-to-v4 translation in their own infrastructure. this would free up a substantial amount of ipv4 space. the isp could also provide dynamic dns as part of their package for users who do want to access their devices at home. why remember a 4-octet ip when you can get your own subdomain from your internet provider?
    - ivlad 7y ago
      That’s not entirely true. Everything p2p is complicated with nat2nat and requires things like STUN, which are not working reliably all the time. Casual users need IPv6 to get better video and voice chats, as well as interactive gaming experience.
  - freehunter 7y ago
    This is an incredibly niche concern, but I fought to get IPv6 working for myself because I have an EC2 instance that auto-sleeps when I'm not using it (to save money) and every time it wakes up the IPv4 address changes. Amazon will give me a static address but unless the machine is running the static address costs money. Again the whole point was to save money... and static IPv6 addresses are free on AWS. So as long as I connect to the EC2 instance over IPv6, I get a free static IP address on my server.
    - ecksii 7y ago
      That's a direct side affect of the difference in cost between IPv4 addresses and IPv6 addresses. If IPv4 addresses weren't economically rare, AWS would charge for them.
    - imtringued 7y ago
      Does anything prevent you from using a free DynDNS provider?
      - freehunter 7y ago
        There were a number of good choices. I chose ipv6 mostly because I wanted an excuse to try ipv6. I did consider dynamic dns but didn’t explore it much.
  - everdrive 7y ago
    I would be if I could pick and choose different parts of the protocol. I don't want each interface to have multiple IPs, and I don't want to jump through hoops to assign static IPs to devices. I don't want to have each device reporting its domain to circumvent the IP problem, and I certainly never wanted 128 bit numbers.
    - ATsch 7y ago
      The vague "jumping through hoops" aside, I am very, very glad about every one of these features. Maybe you could elaborate on why you assume these things are bad?
    - jaywalk 7y ago
      Sounds like you're stuck in a very outdated mindset.
  - mrweasel 7y ago
    I’m not a regular consumer, because my views are based on being a system administrator for a company that have a ton of dual stacked and IPv6 only server, but I want IPv6 at home because I want IPv4 to go away completely. No IPv4 would remove a lot of confusion and silly work-arounds.
  - simias 7y ago
    Having just spend two hours messing with a tricky NAT configuration (VPNs were involved) I'd very gladly move to full IPv6 everywhere, thank you.
  - crest 7y ago
    I hate dealing with NAT and split horizon DNS to access my NAS.
- adrianmonk 7y ago
  I think economics are the best candidate to force it. Until IPv4 addresses get actually scarce, in a practical way that directly impacts people (not just a future, we gotta solve this eventually way), people won't feel the heat. And before now, there were still some unused addresses available. We've just begun the phase where we have to scrounge for loose change in the couch cushions. Previously there was money in the wallet. (Only a little, but that's what you use first.) My guess is scrounging will initially be easy. Then it will get gradually harder, until eventually it becomes easier to just use IPv6, and then people will switch over.
  - jasonjayr 7y ago
    I bet Residential ISP's turn to CGNAT before they roll out IPV6.
    - iagovar 7y ago
      They are alaready doing so. IPv6 test enviroments has been a disaster in the ISP I work for, too many devices don't support IPv6 in the domestic market and solution to router IPv4 over IPv6 are problematic.
      - freedomben 7y ago
        Very interesting, thanks for sharing. What kind of devices are they? IoT type stuff, smart TVs, etc?
        ecksii 7y ago
        Right now IoT devices use a communications model that overcome's NAT by tying the device to a service endpoint in the cloud. The device registers itself as an IoT device in aws and then your local hosts hit the device by going to the device endpoint in the cloud. I don't know if this model will hold up when IPv6 more widely supported though.
      - jaywalk 7y ago
        The largest ISP in the US, Comcast, has deployed IPv6 on 100% of their network. If they can do it, why can't you?
- forgot-my-pw 7y ago
  Also, only 25% of top 1000 alexa websites has IPv6: https://www.worldipv6launch.org/measurements/ https://www.worldipv6launch.org/measurements/ The adoption rate has been really slow.
sschueller 7y ago
How many ipv4 are in poss2of the US Gov and military? Do they really need all of those? With all these elastic search instances running open to the public I have the feeling that with IPv6 this will get worse as NAT no longer protects you.
- lazyguy2 7y ago
  You don't need to run NAT to have a firewall. Even a stateful one.
  - jedberg 7y ago
    You don't need to, but it's a nice side effect for people who don't know what a firewall is. I'd wager most home networks are protected only by the fact that they use NAT. ISPs are getting better about shipping routers with firewalls on by default, but it's still not there.
    - deleted 7y ago
      [deleted]
- oarsinsync 7y ago
  > How many ipv4 are in poss2of the US Gov and military? Do they really need all of those? Their requirement is probably for their addresses to be globally unique. Historical addressing plans being what they are, they probably have sparse assignments across all blocks. Re-numbering existing systems is a non-trivial exercise with high costs. There is no benefit to them to doing this, and we have known this exhaustion is coming for literally decades now. Just because they're not in use on the Internet, doesn't mean they're not in use. > With all these elastic search instances running open to the public I have the feeling that with IPv6 this will get worse as NAT no longer protects you. Stateful firewalls protect you. NAT does not.
- cm2187 7y ago
  Most home routers that support ipv6 still act as firewall.
big_chungus 7y ago
I wished IPv6 could be memorized. I can rattle the addresses of all the devices in my home network off with ease, but have trouble remembering a single IPv6. The "just use DNS" answer isn't a good one; stuff sometimes breaks, and it's much harder to fix when I've got to look everything up.
- e2le 7y ago
  There are many options. 1) ping6 ff02::1%eth0 2) Advertise the device and it's services (such as ssh) via avahi. 3) Set a static address such as fe80::1 (link local), fd00::1 (ULA), or 2001::1 (your prefix).
- htns 7y ago
  Think of it as memorizing 4 IPv4 addresses.
  - Avamander 7y ago
    In many cases big parts of the address are zeros, so it might be only one "IPv4" address one has to remember.
    - lucb1e 7y ago
      And common prefixes like 2a00:: or 2001::, not that many are in use (yet). And I prefer typing ::1 over 127.0.0.1 any day (though most software accepts 127.1 as well).
- lucb1e 7y ago
  I know my v6 prefix by heart actually, but almost never get to use it.
- huntertwo 7y ago
  Won't fix (Infeasible)
- Avamander 7y ago
  It can be, I have my server's memorized. One just has to get familiar with IPv6 just like with IPv4.
amingilani 7y ago
There are five regional internet registries (RIRs), and Ripe NCC is one of them. Here's a map of which services what region[0] Does this mean we've finally run out of new allocatable IPv4 addresses with the RIRs? [0]: https://en.wikipedia.org/wiki/Regional_Internet_registry#/media/File:Regional_Internet_Registries_world_map.svg https://en.wikipedia.org/wiki/Regional_Internet_registry#/me...
- eb0la 7y ago
  ARIN (North America) and APNIC (Asia-Pacific) ran out of addresses some time ago (2015 I guess). Game over IPv4.
  - Dagger2 7y ago
    AfriNIC still have space. They're expected to run out sometime before the end of January (20% chance) to the end of April (90% chance) next year.
    - dylz 7y ago
      They're making some seriously questionable allocations, for example nearly /9 or /10 of v4 to a Hong Kong company that has zero connections to anything in the Afrinic region, that appears to almost all be announced in Los Angeles and running proxies, with the rest being used for fraud/spam. I'm wondering how much justification validation they are actually doing, or if something worse is going on.
      - unglaublich 7y ago
        Well, that sounds like awfully little validation. I guess they are in good company with the rest of the world then.
      - gruez 7y ago
        >or if something worse is going on. given the recent corruption allegations with PIR/ICANN, I wouldn't be surprised if it was corruption.
oefrha 7y ago
https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre... Honestly stupid that USDoD controls at least 13/256 of all IPv4 addresses. It seems some entities, e.g. IBM and MIT, have returned (sold?) their /8s to their RIRs though.
- kstrauser 7y ago
  Even if those were completely reclaimed, it would only extend the IPv4 pain for another year.
- martin1975 7y ago
  Given it was the DoD's time/money (or our/taxpayers' money indirectly, but their effort) that gave rise to the Internet (or ARPANet rather) back in the day, I'd cut them some slack for owning a large segment.... The problem's obviously far greater and no amount of releasing some of the IPv4 space is going to help. We all knew this day was coming...
  - masklinn 7y ago
    Yeah to me it seems more egregious that Ford or Apple have held onto their /8. Good on GEC, IBM, HP or Xerox for having relinquished their(s).
    - addisonl 7y ago
      Well I can understand Apple, they are at least a major tech company. But Ford has no use for /8...
- kevin_thibedeau 7y ago
  It is their network.
  - anticensor 7y ago
    Then fork it. The difficult part is figuring out where the minimal cut is.
deleted 7y ago
[deleted]
PaulHoule 7y ago
Carrier-grade NAT has a much bigger impact than IPv6 will.
- kstrauser 7y ago
  Good God, I hope not. Having lived behind CGN for a little bit while I was scrambling for another provider, it was a horrible experience with lots of broken services. CGN is a technical dead end.
  - JorgeGT 7y ago
    My ISP (Orange) actually backed out and started giving IPv4 addresses to those of us who complained in their forums about their terrible CGN.
    - kstrauser 7y ago
      Outstanding. That's the only way I could see it being remotely tolerable.
  - ejbam 7y ago
    I've been behind a CGNAT for years and I haven't had a single problem, perhaps your problems lied with something else?
    - kstrauser 7y ago
      Nope. CGNAT is broken by design. It's bad enough trying to establish connections between two hosts that are behind NATs. It's worse when protocols have to traverse additional layers.
      - ejbam 7y ago
        I think it's perfectly functional for end users. In fact, I've been behind a triple NAT for years (CGNAT + 2 routers at home) and I have no problems at all. This is not 1995 when you needed to connect to other users of the Internet to get stuff done.
rb808 7y ago
Is it even possible to have a webserver that is IPv6 only? How many people wouldn't be able to use it?
- rschoon 7y ago
  Of course it's possible. What you're probably going to see is increasing cost to keep a dedicated public IPv4 address. If you don't, you will probably either have to have IPv6 or NAT. Residential will probably lose public IPv4 addresses faster than for hosting services.
- ivlad 7y ago
  It is possible. Depending on what stats you trust (https://stats.labs.apnic.net/ipv6 https://stats.labs.apnic.net/ipv6 or https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html) it’ll be between 24% and 30% of the Internet population.
- miyuru 7y ago
  Yes its possible, I run a website on 2 IPv6 only servers. Although I had to use cloudflare as gateway for IPv4 only users. If I were to remove cloudflare, more than 30% of users can connect to the site via IPv6. Problem is that other 70% will consider the site dead and move on.
- fanf2 7y ago
  IPv6-only hosting typically includes a shared IPv4 reverse proxy for backwards compatibility, eg. https://www.mythic-beasts.com/support/topics/proxy https://www.mythic-beasts.com/support/topics/proxy (Mythic Beasts host the Raspberry Pi website; I am a friend and customer.)
- tialaramex 7y ago
  Technically yes it's very easy to bind the server only to IPv6. Most systems (maybe 70% today) couldn't reach it, it's harder to estimate how many _people_ because people may have many options to access the Network and some are more likely than others to be IPv6 enabled. It also varies geographically, in some places (e.g. Germany) it may be about half of people who have IPv6 access, in say Australia it might be more like a quarter and so 75% could not reach that site. As we see above in this HN thread some users intentionally disable IPv6.
zamadatix 7y ago
https://ipv4.potaroo.net/ https://ipv4.potaroo.net/
jannes 7y ago
My ISP-provided router supports IPv6, but I've disabled it because I don't feel like setting up a firewall for all those poor devices on my network. Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience?
- xur17 7y ago
  My router automatically blocks all incoming traffic over ipv6 - you have to manually enable ports.
  - unicornfinder 7y ago
    Can't say if this is still the case but when I had a MikroTik Routerboard by default it allowed everything through on IPv6.
    - ATsch 7y ago
      This is probably going to be the case for most professional devices that have CLI configuration and expect the user to be familiar with networking. They don't know what you're going to use it for and in real networks, the sensible home default of "allow outcoming deny incoming" doesn't usually make much sense. You're probably going to have dedicated firewall devices somewhere else in your network.
- mrpippy 7y ago
  I suppose you should never blindly trust the competence of an ISP-provided router, but I would expect it to automatically block all incoming IPv6 traffic unless you explicitly add forwarding rules. You can always enable v6, then see if you can reach internal machines from a machine on the internet (like a VPS or over a cell connection)
- e2le 7y ago
  You can likely re-enable IPv6 and simply block all incoming IPv6 traffic except for icmp and it'll be quite alright. If you're using OpenWrt for example the default firewall has this exact configuration.
exabrial 7y ago
Using SRV records would eliminate a huge number of IPv4 problems.
- icedchai 7y ago
  Not really. You'd have to update a ton of software to actually support SRV records.
  - exabrial 7y ago
    Yes, unfortunately. I feel like that's marginally better than updating millions of pieces of hardware for ipv6 support :/
- lemcoe9 7y ago
  Having used SRV for both TCP and UDP applications for over 5 years, I can say that it is a somewhat-terrible way to do things.
parliament32 7y ago
This will lead to ipv6-only services pretty soon. As the cost of ipv4 space gets higher and higher you'll see things like VPSes and cloud hosting stop offering a free IP with their services, and eventually businesses will stop using it too.
- 3fe9a03ccd14ca5 7y ago
  Very unlikely to lead to ipv6 only services any time in the distant future, unless of course your service requires thousands of ip4 addresses. Eventually maybe a premium for an ipv4 static IP on some cloud provider but that’s about it. The big players have plenty of CIDR. They already have high-performance domain-aware routers, so you can still basically run a million websites via a single ipv4 address.
  - DaiPlusPlus 7y ago
    I can see CDNs colocated inside ISP's internal networks shifting to be IPv6-exclusive at first because there will be guarantees of IPv6 connectivity to the ISP's customers. ...if not residential ISPs then certainly mobile-phone/wireless providers.
- ATsch 7y ago
  The more likely scenario to me is everyone slowly running more and more ipv4 traffic over ipv6. Home providers will start tunnelling ipv4 traffic over v6 (this is already the case here, termed "Dual-Stack Lite"), computers will start start doing 4->6 translation locally according to instructions given over Route Advertisements, hosters will start providing ipv4 load balancers to make their VMs v4-reachable, etc. It looks to me like we are heading to world where ipv4 will work forever, but be turned into ipv6 at the first possible opportunity.
- MayeulC 7y ago
  I don't see that happening until at least 50 to 70 percent of users use IPv6-compatible connections. One way to accelerate their adoption, though, could be throttling IPv4 transfers: have, say, youtube or Netflix faster at an ISP that enabled it. Or less lag for online games.
yyyk 7y ago
Ripe NCC has run out of address it will give for almost nothing. I checked, and IPv4 address price is somewhere between $20 and $30[0]. It's not so bad given it's a one-time buy - and using cloud services de facto creates a situation where the buying is in bulk. The real shortage will start be when prices reach $170 I guess? Should take a few years... [0] https://ipv4marketgroup.com/broker-services/buy/ https://ipv4marketgroup.com/broker-services/buy/
- ben509 7y ago
  No, as prices increase, the economic justification of switching to IPv6 increases. Businesses will watch the inflation and when their IPv4 bill gets high enough, they'll pay someone to fix their systems. Not only will no shortage occur, but the upgrades will be performed for the least cost possible. This is the kind of resource allocation problem that markets solve optimally.
  - yyyk 7y ago
    I was referring to 'shortage' as 'sufficient scarcity so as to make people switch to IPv6'. However, you're completely correct given the literal meaning of 'shortage' (hence upvote). There won't be a situation where a business will not put up a site due to lack of IPs, they'll switch if/when they have to.
throwawayimp 7y ago
Time to shut down the Internet and go outside. So why are IPv4 addresses so valuable? Mostly because IPv6 is overly-complicated and a pain to work with. We should have first added a new range where 5 of the 8 hextets were 0000. And found a simple way to write it without :: Why wasn't that done?
- lemcoe9 7y ago
  IPv6 is not "overly-complicated." It requires some new knowledge on IP address notations and new concepts when talking about DHCP and such, but it is functionally not more difficult than IPv4.
- kstrauser 7y ago
  Because it would have been as difficult to update software to use the halfway solution, and then we'd all have to migrate again from that to "real" IPv6.
souterrain 7y ago
I’m in the ARIN region. Two things: 1. My home has Verizon fiber. No native IPv6. I have a tunnel for this, but such solutions aren’t going to work for the masses. The other in-region residential provider, Comcast, has great native IPv6 service, but had layer 2 performance issues versus price. 2. At $dayjob I just ordered a circuit from Level3/Centurylink for a branch site. No IP justification form was required if I needed only IPv4 /30. But for dual IPv4 /30 + IPv6 /126, I was required to provide written justification. Shouldn’t this be the other way around? Unencumbered IPv6 for all, with paperwork for IPv4? EDIT: these are not site allocations, just point-to-point link addresses, hence the /126. Still, I’m being asked to justify IPv6 but not IPv4.
- kstrauser 7y ago
  A /126, seriously? Comcast Business gave us a /56, unprompted, as part of our account setup.
  - RKearney 7y ago
    This sounds like a simple P2P link to do BGP over. I highly doubt CL is using /126’s as standard allocation sizes.
    - kstrauser 7y ago
      That makes a lot more sense! Good call.
  - cyberpunk 7y ago
    My home connection has a /56 (o2/telephonica de) ....
    - rndgermandude 7y ago
      Yeah, I too got a /56, same country, different ISP. It just showed up one day, which confused me at first.
ejbam 7y ago
We ran out of IPv4 addresses again. How many times has this happened this past decade? https://news.ycombinator.com/item?id=2174992 https://news.ycombinator.com/item?id=2174992 9y https://news.ycombinator.com/item?id=4480532 https://news.ycombinator.com/item?id=4480532 7y Looking forward to the next time we run out of IPv4 addresses.
- p1mrx 7y ago
  Your first link was when IANA allocated five final /8s to the RIRs, including RIPE. Your second link was when RIPE reached their final /8, and switched to a "one /22 per company" rationing policy. Today, the rations ran out.
- q3k 7y ago
  These are different levels of exhaustion. First link: Last ICANN (global) RIR-reserved block assigned allocated to a RIR. End of the line for blocks that were globally reserved for, but yet unused by RIRs. Second link: RIPE (a RIR) has one month until it starts distributing its last /8 block (185.0.0.0/8) to LIRs. Now: 185.0.0.0/8 and small bits and bobs that RIPE still had for LIRs (ISPs) is gone. No more IPv4 for European/ME ISPs from RIPE, only gray market available. The previous posts were the writing on the wall. Now we're actually fucked.
- ta0987 7y ago
  I wonder which will happen next, IP addresses again or Voyager leaving the solar system again?
questionasked 7y ago
Unbelievably, github.com and reddit.com _still_ don't have ipv6 addresses.
- alienth 7y ago
  We (reddit) were blocked by AWS on this until 2017 or so. Since then it's mostly been an issue of reworking internal tooling and storage. There are a huge number of places we'd need to futz with to support IPv6, and to be honest we've had basically zero pressure to do so. When pressure is zero and effort is high, things will go unchanged. I'm sure once pressure exists then some movement will occur. It seems most of the industry is doing everything they can to put off incurring pressure, though.
  - miyuru 7y ago
    what about deploying IPv6 via your CDN(Fastly) on the frontend?
  - commandersaki 7y ago
    Thanks to CGNAT we have shifted from a 32-bit to a 48-bit address space (since the port is now part of the address). Ipv6 really only serves to shed load off CGNAT since we rely on the continued use of v4 addresses since v6 is not interoperable with v4. But why should Reddit support v6? For the greater good of v4 by reducing pressure of CGNAT for dual homed users. But wait, who are the dual homed users you may ask? Mobile users. And it will only be mobile users since autoconfiguring residental networks to dual home is not going to happen. But Mobile carriers have full control of addressing and TCP/IP configuration of handsets, and so they can easily deploy usable v6. So the smaller sites shouldn't bother with v6 because they're not an essential part of the Internet with large traffic. But a site like Reddit can reduce enormous pressure for mobile carriers to deliver use of the Internet.
- caller9 7y ago
  https://whynoipv6.com/ https://whynoipv6.com/ "Out of the top 1000 Alexa sites, only 358 has IPv6 enabled"
AceyMan 7y ago
Typical of humanity's poor prioritization algorithm, I submitted on this 88 days ago … and got zero comments <whomp_whaa>. But, now that it's happened … it shoots to the top story. For anyone interested, the blog post from RIPE that I submitted is still up, here: https://www.ripe.net/publications/news/about-ripe-ncc-and-ripe/getting-ready-for-ipv4-run-out https://www.ripe.net/publications/news/about-ripe-ncc-and-ri...
devit 7y ago
Is IPv4 shortage really going to be a problem? For client use, carrier-grade NATs allows to have 1000 IPs per customer, giving 6 million addresses. For server use, TLS SNI allows to have one IP per datacenter, which are estimated to be around 10 million in the world. Non-TLS inbound usage is probably relatively rare, so overall around 100 million addresses should be fundamentally enough even accounting growth. Of course there's a lot of inefficiencies, but the fundamentals seem to say that the IPv4 address space is enough.
- kstrauser 7y ago
  Carrier-grade NAT is a non-starter. It's fundamentally broken from an end user perspective and destined for the junk heap of forgotten bad ideas. TLS SNI is awesome, but no plausible implementation is going to let you put an entire datacenter worth of addresses behind a single address. That's not going to happen. IPv4's time is soon to be past. Google is nearly hitting 30% IPv6 usage already, and it's still growing. This is the way forward, not junk tech like CGN or millions of hosts on a single TLS SNI address.
  - zokier 7y ago
    CGNAT (or comparable tech like DSlite) will happen anyways even when majority of traffic is IPv6. The long tail of IPv4 is long; people will be wanting some form of IPv4 connectivity long after all the major things have switched to IPv6 and ISPs are not going to go back to handing out public IPv4 addresses. The timeline just doesn't work anymore to make a clean transition. Of course how much do you care if it is CGNAT if you are not using IPv4 is another matter.
    - zamadatix 7y ago
      I'd be willing to get there are more clients running through NAT64 than CGNAT currently thanks to mobile networks.
JackRabbitSlim 7y ago
Technical arguments aside; IPv6 is just "advanced" enough to allow corporations to fuck over the last bastions of free internet and turn it into nothing but tightly controlled broadcast TV 2.0. The road to hell is paved with good intentions so I guess I will see you all in hell.
rini17 7y ago
I'm in Slovakia. The IPv6 adoption is below 1% and the ISPs don't plan IPv6 rollout because "We have enough IPv4 addresses.". Nowhere I ever had native IPv6 available on home connection, it is option only to business clients.
- vetinari 7y ago
  Out of the tree biggest ISPs in Slovakia, only T-Com doesn't support IPv6, unlike it's German parent. UPC (Liberty Global) switched all their residential customers with new enough CPE to DS-Lite years ago, and Orange also had a flag day, since then all new customers are also on DS-Lite (they allow getting public IPv4 for nice 99 EUR one-time fee, static one is additional 8 EUR/month).
  - rini17 7y ago
    Thanks. However, "years ago" means 2017 afaik :)
    - vetinari 7y ago
      Yeah, two, plural :)
- Dagger2 7y ago
  It's actually closer to 5% according to Google's stats. Still far too low, but 5x higher than you thought.
beagle3 7y ago
I hope all home provision moves to CGNAT IPv4; IPV6 are too easy to track, and every ISP that I've seen ties the prefix to the customer. Who cares about cookies, 1st party or 3rd party, when you have a unique ~60 bit per customer identifier? My ISP gives un-natted IPv4, but I get a different one each time I reboot the modem, which I do every now and then.
anticensor 7y ago
Why have successors to IPv4 been designed with variable-length addresses as in earlier versions?
- anticensor 7y ago
  Missed a "not" before "designed", and got a down.
- zamadatix 7y ago
  Routing hardware would prefer you just pick a very large address size and stick to it.

416 points by cnorthwood 7y ago

ndmrs 7y ago

And yet my ISP still doesn't support IPv6... Until something forces the transition nothing is going to change.

maltalex 7y ago
Why are you, as a consumer, interested in switching to IPv6?
- oarsinsync 7y ago
  My ISP provides me with a CGN IPv4 address. I have no ability to access any self-hosted services, unless I pay them money for a static globally routable address, or pay some other company to provide this through some other means (e.g. VPN, VPS, etc) If they supported IPv6, and gave me a globally routable address that was unfiltered except at my gateway, I'd be happier.
  - iicc 7y ago
    There's the Hurricane Electric IPv6 Tunnel Broker: https://tunnelbroker.net/ https://tunnelbroker.net/ >Our free tunnel broker service enables you to reach the IPv6 Internet by tunneling over existing IPv4 connections from your IPv6 enabled host or router to one of our IPv6 routers. (It's still obviously less direct, and inferior to your ISP supplying native IPv6, but it may improve your situation.)
    - ecksii 7y ago
      That solution requires a routable, Non-RFC1918, IPv4 address somewhere to work. If I understand CG-NAT correctly, you don't get a routable address on your equipment.
      - iicc 7y ago
        You're right. HE is 6in4 and won't work. There's a list of brokers at https://en.wikipedia.org/wiki/List_of_IPv6_tunnel_brokers https://en.wikipedia.org/wiki/List_of_IPv6_tunnel_brokers https://6project.org/ https://6project.org/ looks viable (OpenVPN) and cheap.
    - deleted 7y ago
      [deleted]
- jedberg 7y ago
  Not OP, but I can tell you why I as a consumer am very much not interested in IPv6. My ISP supports it, but I have intentionally disabled it. It only causes problems for me with absolutely no gain. There isn't a single website I can't reach, and no website that I've found runs any quicker when using IPv6. But at the same time, if I have v6 on, it causes delays in name resolution and sometimes I just can't connect to a site until I disable v6. I still have an addressable v4 address, so I can still run a home server. I don't know how to fix this. I know that v6 is good for the planet, and I know these problems won't get better until more people are using v6, but it's definitely a chicken/egg problem.
  - q3k 7y ago
    > But at the same time, if I have v6 on, it causes delays in name resolution and sometimes I just can't connect to a site until I disable v6. That sounds like your ISP does not actually support IPv6, eg. doesn't have the full Internet routing table for v6. I've seen this happen. DNS v4/v6 resolutions can also hang with glibc because of a well known bug with Happy Eyeballs when ISPs that fuck up outgoing DNS packets (eg. messed up stateful NAT/DPI). "options single-request-reopen" in /etc/resolv.conf is a workaround. See https://bugzilla.redhat.com/show_bug.cgi?id=505105 https://bugzilla.redhat.com/show_bug.cgi?id=505105. I would contact your ISP, or at least publically shame them. This is not how IPv6 Internet should work (source: we provide IPv4/v6 as an ISP and take care to prevent issues like this).
    - jedberg 7y ago
      It's AT&T (UVerse). If they can't get it right, I don't have much hope for anyone else. Also, I don't even use my ISPs name servers, I use Cloudflare or Google, so I don't think it's that unless the ISP is somehow munging the packet in transit, which I suppose is possible. Honestly I think it is all due to issues with the v6 stack in MacOS. But my point is, I shouldn't have to be a network engineer to make v6 work. I should be able to turn on my computer and just have it work.
      - scurvy 7y ago
- badrabbit 7y ago
  Likewise, curious. Would be neat to have it but as someone who supported consumers,v6 is a pain(or rather v4 is still so easy people prefer it when making new software).
- coldpie 7y ago
  I think it'd be cool to access my home machine from anywhere without bothering with port forwarding stuff.
  - ATsch 7y ago
    Well, you still need to bother with adding firewall rules. But that's a lot less annoying than port forwarding, I agree.
- q3k 7y ago
  Not OP, but with more and more IPv4 traffic behind CGNATs, IPv6 begins to be a much better experience. CGNATs tend to be massively overloaded, and as such accessing IPv4 Internet (especially CDNs for multimedia) will tend to result in low speed and dropped connections at peak hours.
  - p1mrx 7y ago
    This is the answer. IPv6 was always about maintaining the status quo. It doesn't become "better" than IPv4 until CGNAT makes IPv4 worse. (Or if your internal network reaches the scaling limits of RFC1918.)
- superkuh 7y ago
  Because adoption of ipv6 allows everyone to be an equal on the internet again. Right now half of the computers hooked up to the 'net aren't even given a routable IP address. They're behind carrier NAT unable to participate like a real computer. They can't use protocols, they can only consume third party services over HTTP/S for the most part. If everyone is routable it cuts the gordian knot in the "What kind of content should be allowed on our platform?" question by allowing everyone to simply be their own platform. If ipv6 gets adopted fast enough it might just save the 'net from being just a more privacy invasive form of television.
  - close04 7y ago
    > be their own platform The public commercial platforms offer far more than just a routable IP. You get reach, reliability, resilience, and security (the kind you don't get to build yourself). Being your own YouTube/FB/Twitter/someChan/etc. platform means almost nobody will ever hear about you, the ones that do can easily wipe you off the internet, coming back is a real hassle, and that your data will leak is basically a forgone conclusion. Being your own Dropbox/GDrive may not need the reach but still relies the other three to provide value. And the list can go on for almost anything you can think of for "being your own platform". The overwhelmingly vast majority of people have little to no interest in building and maintaining any such platform. It's why so few people actually do it today even when having a routable address. It's inconvenient even for skilled people, let alone regular ones. I'll wait for a counterargument.
    - echelon 7y ago
      Back in my day bittorrent was pretty popular. We'd have doused Zuck's dorm room sever in gasoline if we'd known what was to happen.
      - deleted 7y ago
        [deleted]
      - close04 7y ago
        But that wasn't your own platform was it? It was explicitly distributed. The crux of my comment was the "own" part. You don't just have a share in it, it's yours.
- ndmrs 7y ago
  My interest is twofold: a) for one as a response against CGN, thankfully my ISP isn't using one right now but I have a hunch they're going to start becoming a lot more common in the future. and b) as a hacker I'm interested to finally set it up and play around with it. Also IMO even if it doesn't bring any improvements to the general consumer given all the pressure to start switching to IPv6 it is a good thing to be interested about it, pressuring more ISPs to start supporting it.
- distantsounds 7y ago
  the casual user at home, with no exposed services to the public, has no real need for a short ipv4 address. ipv6 would suffice just fine for the end user, and the isp can handle the v6-to-v4 translation in their own infrastructure. this would free up a substantial amount of ipv4 space. the isp could also provide dynamic dns as part of their package for users who do want to access their devices at home. why remember a 4-octet ip when you can get your own subdomain from your internet provider?
  - ivlad 7y ago
    That’s not entirely true. Everything p2p is complicated with nat2nat and requires things like STUN, which are not working reliably all the time. Casual users need IPv6 to get better video and voice chats, as well as interactive gaming experience.
- freehunter 7y ago
  This is an incredibly niche concern, but I fought to get IPv6 working for myself because I have an EC2 instance that auto-sleeps when I'm not using it (to save money) and every time it wakes up the IPv4 address changes. Amazon will give me a static address but unless the machine is running the static address costs money. Again the whole point was to save money... and static IPv6 addresses are free on AWS. So as long as I connect to the EC2 instance over IPv6, I get a free static IP address on my server.
  - ecksii 7y ago
    That's a direct side affect of the difference in cost between IPv4 addresses and IPv6 addresses. If IPv4 addresses weren't economically rare, AWS would charge for them.
  - imtringued 7y ago
    Does anything prevent you from using a free DynDNS provider?
    - freehunter 7y ago
      There were a number of good choices. I chose ipv6 mostly because I wanted an excuse to try ipv6. I did consider dynamic dns but didn’t explore it much.
- everdrive 7y ago
  I would be if I could pick and choose different parts of the protocol. I don't want each interface to have multiple IPs, and I don't want to jump through hoops to assign static IPs to devices. I don't want to have each device reporting its domain to circumvent the IP problem, and I certainly never wanted 128 bit numbers.
  - ATsch 7y ago
    The vague "jumping through hoops" aside, I am very, very glad about every one of these features. Maybe you could elaborate on why you assume these things are bad?
  - jaywalk 7y ago
    Sounds like you're stuck in a very outdated mindset.
- mrweasel 7y ago
  I’m not a regular consumer, because my views are based on being a system administrator for a company that have a ton of dual stacked and IPv6 only server, but I want IPv6 at home because I want IPv4 to go away completely. No IPv4 would remove a lot of confusion and silly work-arounds.
- simias 7y ago
  Having just spend two hours messing with a tricky NAT configuration (VPNs were involved) I'd very gladly move to full IPv6 everywhere, thank you.
- crest 7y ago
  I hate dealing with NAT and split horizon DNS to access my NAS.
adrianmonk 7y ago
I think economics are the best candidate to force it. Until IPv4 addresses get actually scarce, in a practical way that directly impacts people (not just a future, we gotta solve this eventually way), people won't feel the heat. And before now, there were still some unused addresses available. We've just begun the phase where we have to scrounge for loose change in the couch cushions. Previously there was money in the wallet. (Only a little, but that's what you use first.) My guess is scrounging will initially be easy. Then it will get gradually harder, until eventually it becomes easier to just use IPv6, and then people will switch over.
- jasonjayr 7y ago
  I bet Residential ISP's turn to CGNAT before they roll out IPV6.
  - iagovar 7y ago
    They are alaready doing so. IPv6 test enviroments has been a disaster in the ISP I work for, too many devices don't support IPv6 in the domestic market and solution to router IPv4 over IPv6 are problematic.
    - freedomben 7y ago
      Very interesting, thanks for sharing. What kind of devices are they? IoT type stuff, smart TVs, etc?
      - ecksii 7y ago
        Right now IoT devices use a communications model that overcome's NAT by tying the device to a service endpoint in the cloud. The device registers itself as an IoT device in aws and then your local hosts hit the device by going to the device endpoint in the cloud. I don't know if this model will hold up when IPv6 more widely supported though.
    - jaywalk 7y ago
      The largest ISP in the US, Comcast, has deployed IPv6 on 100% of their network. If they can do it, why can't you?
forgot-my-pw 7y ago
Also, only 25% of top 1000 alexa websites has IPv6: https://www.worldipv6launch.org/measurements/ https://www.worldipv6launch.org/measurements/ The adoption rate has been really slow.

sschueller 7y ago

How many ipv4 are in poss2of the US Gov and military? Do they really need all of those? With all these elastic search instances running open to the public I have the feeling that with IPv6 this will get worse as NAT no longer protects you.

lazyguy2 7y ago
You don't need to run NAT to have a firewall. Even a stateful one.
- jedberg 7y ago
  You don't need to, but it's a nice side effect for people who don't know what a firewall is. I'd wager most home networks are protected only by the fact that they use NAT. ISPs are getting better about shipping routers with firewalls on by default, but it's still not there.
  - deleted 7y ago
    [deleted]
oarsinsync 7y ago
> How many ipv4 are in poss2of the US Gov and military? Do they really need all of those? Their requirement is probably for their addresses to be globally unique. Historical addressing plans being what they are, they probably have sparse assignments across all blocks. Re-numbering existing systems is a non-trivial exercise with high costs. There is no benefit to them to doing this, and we have known this exhaustion is coming for literally decades now. Just because they're not in use on the Internet, doesn't mean they're not in use. > With all these elastic search instances running open to the public I have the feeling that with IPv6 this will get worse as NAT no longer protects you. Stateful firewalls protect you. NAT does not.
cm2187 7y ago
Most home routers that support ipv6 still act as firewall.

big_chungus 7y ago

I wished IPv6 could be memorized. I can rattle the addresses of all the devices in my home network off with ease, but have trouble remembering a single IPv6. The "just use DNS" answer isn't a good one; stuff sometimes breaks, and it's much harder to fix when I've got to look everything up.

e2le 7y ago
There are many options. 1) ping6 ff02::1%eth0 2) Advertise the device and it's services (such as ssh) via avahi. 3) Set a static address such as fe80::1 (link local), fd00::1 (ULA), or 2001::1 (your prefix).
htns 7y ago
Think of it as memorizing 4 IPv4 addresses.
- Avamander 7y ago
  In many cases big parts of the address are zeros, so it might be only one "IPv4" address one has to remember.
  - lucb1e 7y ago
    And common prefixes like 2a00:: or 2001::, not that many are in use (yet). And I prefer typing ::1 over 127.0.0.1 any day (though most software accepts 127.1 as well).
lucb1e 7y ago
I know my v6 prefix by heart actually, but almost never get to use it.
huntertwo 7y ago
Won't fix (Infeasible)
Avamander 7y ago
It can be, I have my server's memorized. One just has to get familiar with IPv6 just like with IPv4.

amingilani 7y ago

There are five regional internet registries (RIRs), and Ripe NCC is one of them. Here's a map of which services what region[0] Does this mean we've finally run out of new allocatable IPv4 addresses with the RIRs? [0]: https://en.wikipedia.org/wiki/Regional_Internet_registry#/media/File:Regional_Internet_Registries_world_map.svg https://en.wikipedia.org/wiki/Regional_Internet_registry#/me...

eb0la 7y ago
ARIN (North America) and APNIC (Asia-Pacific) ran out of addresses some time ago (2015 I guess). Game over IPv4.
- Dagger2 7y ago
  AfriNIC still have space. They're expected to run out sometime before the end of January (20% chance) to the end of April (90% chance) next year.
  - dylz 7y ago
    They're making some seriously questionable allocations, for example nearly /9 or /10 of v4 to a Hong Kong company that has zero connections to anything in the Afrinic region, that appears to almost all be announced in Los Angeles and running proxies, with the rest being used for fraud/spam. I'm wondering how much justification validation they are actually doing, or if something worse is going on.
    - unglaublich 7y ago
      Well, that sounds like awfully little validation. I guess they are in good company with the rest of the world then.
    - gruez 7y ago
      >or if something worse is going on. given the recent corruption allegations with PIR/ICANN, I wouldn't be surprised if it was corruption.

oefrha 7y ago

https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre... Honestly stupid that USDoD controls at least 13/256 of all IPv4 addresses. It seems some entities, e.g. IBM and MIT, have returned (sold?) their /8s to their RIRs though.

kstrauser 7y ago
Even if those were completely reclaimed, it would only extend the IPv4 pain for another year.
martin1975 7y ago
Given it was the DoD's time/money (or our/taxpayers' money indirectly, but their effort) that gave rise to the Internet (or ARPANet rather) back in the day, I'd cut them some slack for owning a large segment.... The problem's obviously far greater and no amount of releasing some of the IPv4 space is going to help. We all knew this day was coming...
- masklinn 7y ago
  Yeah to me it seems more egregious that Ford or Apple have held onto their /8. Good on GEC, IBM, HP or Xerox for having relinquished their(s).
  - addisonl 7y ago
    Well I can understand Apple, they are at least a major tech company. But Ford has no use for /8...
kevin_thibedeau 7y ago
It is their network.
- anticensor 7y ago
  Then fork it. The difficult part is figuring out where the minimal cut is.

deleted 7y ago

[deleted]

PaulHoule 7y ago

Carrier-grade NAT has a much bigger impact than IPv6 will.

kstrauser 7y ago
Good God, I hope not. Having lived behind CGN for a little bit while I was scrambling for another provider, it was a horrible experience with lots of broken services. CGN is a technical dead end.
- JorgeGT 7y ago
  My ISP (Orange) actually backed out and started giving IPv4 addresses to those of us who complained in their forums about their terrible CGN.
  - kstrauser 7y ago
    Outstanding. That's the only way I could see it being remotely tolerable.
- ejbam 7y ago
  I've been behind a CGNAT for years and I haven't had a single problem, perhaps your problems lied with something else?
  - kstrauser 7y ago
    Nope. CGNAT is broken by design. It's bad enough trying to establish connections between two hosts that are behind NATs. It's worse when protocols have to traverse additional layers.
    - ejbam 7y ago
      I think it's perfectly functional for end users. In fact, I've been behind a triple NAT for years (CGNAT + 2 routers at home) and I have no problems at all. This is not 1995 when you needed to connect to other users of the Internet to get stuff done.

rb808 7y ago

Is it even possible to have a webserver that is IPv6 only? How many people wouldn't be able to use it?

rschoon 7y ago
Of course it's possible. What you're probably going to see is increasing cost to keep a dedicated public IPv4 address. If you don't, you will probably either have to have IPv6 or NAT. Residential will probably lose public IPv4 addresses faster than for hosting services.
ivlad 7y ago
It is possible. Depending on what stats you trust (https://stats.labs.apnic.net/ipv6 https://stats.labs.apnic.net/ipv6 or https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html) it’ll be between 24% and 30% of the Internet population.
miyuru 7y ago
Yes its possible, I run a website on 2 IPv6 only servers. Although I had to use cloudflare as gateway for IPv4 only users. If I were to remove cloudflare, more than 30% of users can connect to the site via IPv6. Problem is that other 70% will consider the site dead and move on.
fanf2 7y ago
IPv6-only hosting typically includes a shared IPv4 reverse proxy for backwards compatibility, eg. https://www.mythic-beasts.com/support/topics/proxy https://www.mythic-beasts.com/support/topics/proxy (Mythic Beasts host the Raspberry Pi website; I am a friend and customer.)
tialaramex 7y ago
Technically yes it's very easy to bind the server only to IPv6. Most systems (maybe 70% today) couldn't reach it, it's harder to estimate how many _people_ because people may have many options to access the Network and some are more likely than others to be IPv6 enabled. It also varies geographically, in some places (e.g. Germany) it may be about half of people who have IPv6 access, in say Australia it might be more like a quarter and so 75% could not reach that site. As we see above in this HN thread some users intentionally disable IPv6.

zamadatix 7y ago

https://ipv4.potaroo.net/ https://ipv4.potaroo.net/

jannes 7y ago

My ISP-provided router supports IPv6, but I've disabled it because I don't feel like setting up a firewall for all those poor devices on my network. Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience?

xur17 7y ago
My router automatically blocks all incoming traffic over ipv6 - you have to manually enable ports.
- unicornfinder 7y ago
  Can't say if this is still the case but when I had a MikroTik Routerboard by default it allowed everything through on IPv6.
  - ATsch 7y ago
    This is probably going to be the case for most professional devices that have CLI configuration and expect the user to be familiar with networking. They don't know what you're going to use it for and in real networks, the sensible home default of "allow outcoming deny incoming" doesn't usually make much sense. You're probably going to have dedicated firewall devices somewhere else in your network.
mrpippy 7y ago
I suppose you should never blindly trust the competence of an ISP-provided router, but I would expect it to automatically block all incoming IPv6 traffic unless you explicitly add forwarding rules. You can always enable v6, then see if you can reach internal machines from a machine on the internet (like a VPS or over a cell connection)
e2le 7y ago
You can likely re-enable IPv6 and simply block all incoming IPv6 traffic except for icmp and it'll be quite alright. If you're using OpenWrt for example the default firewall has this exact configuration.

exabrial 7y ago

Using SRV records would eliminate a huge number of IPv4 problems.

icedchai 7y ago
Not really. You'd have to update a ton of software to actually support SRV records.
- exabrial 7y ago
  Yes, unfortunately. I feel like that's marginally better than updating millions of pieces of hardware for ipv6 support :/
lemcoe9 7y ago
Having used SRV for both TCP and UDP applications for over 5 years, I can say that it is a somewhat-terrible way to do things.

parliament32 7y ago

This will lead to ipv6-only services pretty soon. As the cost of ipv4 space gets higher and higher you'll see things like VPSes and cloud hosting stop offering a free IP with their services, and eventually businesses will stop using it too.

3fe9a03ccd14ca5 7y ago
Very unlikely to lead to ipv6 only services any time in the distant future, unless of course your service requires thousands of ip4 addresses. Eventually maybe a premium for an ipv4 static IP on some cloud provider but that’s about it. The big players have plenty of CIDR. They already have high-performance domain-aware routers, so you can still basically run a million websites via a single ipv4 address.
- DaiPlusPlus 7y ago
  I can see CDNs colocated inside ISP's internal networks shifting to be IPv6-exclusive at first because there will be guarantees of IPv6 connectivity to the ISP's customers. ...if not residential ISPs then certainly mobile-phone/wireless providers.
ATsch 7y ago
The more likely scenario to me is everyone slowly running more and more ipv4 traffic over ipv6. Home providers will start tunnelling ipv4 traffic over v6 (this is already the case here, termed "Dual-Stack Lite"), computers will start start doing 4->6 translation locally according to instructions given over Route Advertisements, hosters will start providing ipv4 load balancers to make their VMs v4-reachable, etc. It looks to me like we are heading to world where ipv4 will work forever, but be turned into ipv6 at the first possible opportunity.
MayeulC 7y ago
I don't see that happening until at least 50 to 70 percent of users use IPv6-compatible connections. One way to accelerate their adoption, though, could be throttling IPv4 transfers: have, say, youtube or Netflix faster at an ISP that enabled it. Or less lag for online games.

yyyk 7y ago

Ripe NCC has run out of address it will give for almost nothing. I checked, and IPv4 address price is somewhere between $20 and $30[0]. It's not so bad given it's a one-time buy - and using cloud services de facto creates a situation where the buying is in bulk. The real shortage will start be when prices reach $170 I guess? Should take a few years... [0] https://ipv4marketgroup.com/broker-services/buy/ https://ipv4marketgroup.com/broker-services/buy/

ben509 7y ago
No, as prices increase, the economic justification of switching to IPv6 increases. Businesses will watch the inflation and when their IPv4 bill gets high enough, they'll pay someone to fix their systems. Not only will no shortage occur, but the upgrades will be performed for the least cost possible. This is the kind of resource allocation problem that markets solve optimally.
- yyyk 7y ago
  I was referring to 'shortage' as 'sufficient scarcity so as to make people switch to IPv6'. However, you're completely correct given the literal meaning of 'shortage' (hence upvote). There won't be a situation where a business will not put up a site due to lack of IPs, they'll switch if/when they have to.

throwawayimp 7y ago

Time to shut down the Internet and go outside. So why are IPv4 addresses so valuable? Mostly because IPv6 is overly-complicated and a pain to work with. We should have first added a new range where 5 of the 8 hextets were 0000. And found a simple way to write it without :: Why wasn't that done?

lemcoe9 7y ago
IPv6 is not "overly-complicated." It requires some new knowledge on IP address notations and new concepts when talking about DHCP and such, but it is functionally not more difficult than IPv4.
kstrauser 7y ago
Because it would have been as difficult to update software to use the halfway solution, and then we'd all have to migrate again from that to "real" IPv6.

souterrain 7y ago

I’m in the ARIN region. Two things: 1. My home has Verizon fiber. No native IPv6. I have a tunnel for this, but such solutions aren’t going to work for the masses. The other in-region residential provider, Comcast, has great native IPv6 service, but had layer 2 performance issues versus price. 2. At $dayjob I just ordered a circuit from Level3/Centurylink for a branch site. No IP justification form was required if I needed only IPv4 /30. But for dual IPv4 /30 + IPv6 /126, I was required to provide written justification. Shouldn’t this be the other way around? Unencumbered IPv6 for all, with paperwork for IPv4? EDIT: these are not site allocations, just point-to-point link addresses, hence the /126. Still, I’m being asked to justify IPv6 but not IPv4.

kstrauser 7y ago
A /126, seriously? Comcast Business gave us a /56, unprompted, as part of our account setup.
- RKearney 7y ago
  This sounds like a simple P2P link to do BGP over. I highly doubt CL is using /126’s as standard allocation sizes.
  - kstrauser 7y ago
    That makes a lot more sense! Good call.
- cyberpunk 7y ago
  My home connection has a /56 (o2/telephonica de) ....
  - rndgermandude 7y ago
    Yeah, I too got a /56, same country, different ISP. It just showed up one day, which confused me at first.

ejbam 7y ago

We ran out of IPv4 addresses again. How many times has this happened this past decade? https://news.ycombinator.com/item?id=2174992 https://news.ycombinator.com/item?id=2174992 9y https://news.ycombinator.com/item?id=4480532 https://news.ycombinator.com/item?id=4480532 7y Looking forward to the next time we run out of IPv4 addresses.

p1mrx 7y ago
Your first link was when IANA allocated five final /8s to the RIRs, including RIPE. Your second link was when RIPE reached their final /8, and switched to a "one /22 per company" rationing policy. Today, the rations ran out.
q3k 7y ago
These are different levels of exhaustion. First link: Last ICANN (global) RIR-reserved block assigned allocated to a RIR. End of the line for blocks that were globally reserved for, but yet unused by RIRs. Second link: RIPE (a RIR) has one month until it starts distributing its last /8 block (185.0.0.0/8) to LIRs. Now: 185.0.0.0/8 and small bits and bobs that RIPE still had for LIRs (ISPs) is gone. No more IPv4 for European/ME ISPs from RIPE, only gray market available. The previous posts were the writing on the wall. Now we're actually fucked.
ta0987 7y ago
I wonder which will happen next, IP addresses again or Voyager leaving the solar system again?

questionasked 7y ago

Unbelievably, github.com and reddit.com _still_ don't have ipv6 addresses.

alienth 7y ago
We (reddit) were blocked by AWS on this until 2017 or so. Since then it's mostly been an issue of reworking internal tooling and storage. There are a huge number of places we'd need to futz with to support IPv6, and to be honest we've had basically zero pressure to do so. When pressure is zero and effort is high, things will go unchanged. I'm sure once pressure exists then some movement will occur. It seems most of the industry is doing everything they can to put off incurring pressure, though.
- miyuru 7y ago
  what about deploying IPv6 via your CDN(Fastly) on the frontend?
- commandersaki 7y ago
  Thanks to CGNAT we have shifted from a 32-bit to a 48-bit address space (since the port is now part of the address). Ipv6 really only serves to shed load off CGNAT since we rely on the continued use of v4 addresses since v6 is not interoperable with v4. But why should Reddit support v6? For the greater good of v4 by reducing pressure of CGNAT for dual homed users. But wait, who are the dual homed users you may ask? Mobile users. And it will only be mobile users since autoconfiguring residental networks to dual home is not going to happen. But Mobile carriers have full control of addressing and TCP/IP configuration of handsets, and so they can easily deploy usable v6. So the smaller sites shouldn't bother with v6 because they're not an essential part of the Internet with large traffic. But a site like Reddit can reduce enormous pressure for mobile carriers to deliver use of the Internet.
caller9 7y ago
https://whynoipv6.com/ https://whynoipv6.com/ "Out of the top 1000 Alexa sites, only 358 has IPv6 enabled"

AceyMan 7y ago

Typical of humanity's poor prioritization algorithm, I submitted on this 88 days ago … and got zero comments <whomp_whaa>. But, now that it's happened … it shoots to the top story. For anyone interested, the blog post from RIPE that I submitted is still up, here: https://www.ripe.net/publications/news/about-ripe-ncc-and-ripe/getting-ready-for-ipv4-run-out https://www.ripe.net/publications/news/about-ripe-ncc-and-ri...

devit 7y ago

Is IPv4 shortage really going to be a problem? For client use, carrier-grade NATs allows to have 1000 IPs per customer, giving 6 million addresses. For server use, TLS SNI allows to have one IP per datacenter, which are estimated to be around 10 million in the world. Non-TLS inbound usage is probably relatively rare, so overall around 100 million addresses should be fundamentally enough even accounting growth. Of course there's a lot of inefficiencies, but the fundamentals seem to say that the IPv4 address space is enough.

kstrauser 7y ago
Carrier-grade NAT is a non-starter. It's fundamentally broken from an end user perspective and destined for the junk heap of forgotten bad ideas. TLS SNI is awesome, but no plausible implementation is going to let you put an entire datacenter worth of addresses behind a single address. That's not going to happen. IPv4's time is soon to be past. Google is nearly hitting 30% IPv6 usage already, and it's still growing. This is the way forward, not junk tech like CGN or millions of hosts on a single TLS SNI address.
- zokier 7y ago
  CGNAT (or comparable tech like DSlite) will happen anyways even when majority of traffic is IPv6. The long tail of IPv4 is long; people will be wanting some form of IPv4 connectivity long after all the major things have switched to IPv6 and ISPs are not going to go back to handing out public IPv4 addresses. The timeline just doesn't work anymore to make a clean transition. Of course how much do you care if it is CGNAT if you are not using IPv4 is another matter.
  - zamadatix 7y ago
    I'd be willing to get there are more clients running through NAT64 than CGNAT currently thanks to mobile networks.

JackRabbitSlim 7y ago

Technical arguments aside; IPv6 is just "advanced" enough to allow corporations to fuck over the last bastions of free internet and turn it into nothing but tightly controlled broadcast TV 2.0. The road to hell is paved with good intentions so I guess I will see you all in hell.

rini17 7y ago

I'm in Slovakia. The IPv6 adoption is below 1% and the ISPs don't plan IPv6 rollout because "We have enough IPv4 addresses.". Nowhere I ever had native IPv6 available on home connection, it is option only to business clients.

vetinari 7y ago
Out of the tree biggest ISPs in Slovakia, only T-Com doesn't support IPv6, unlike it's German parent. UPC (Liberty Global) switched all their residential customers with new enough CPE to DS-Lite years ago, and Orange also had a flag day, since then all new customers are also on DS-Lite (they allow getting public IPv4 for nice 99 EUR one-time fee, static one is additional 8 EUR/month).
- rini17 7y ago
  Thanks. However, "years ago" means 2017 afaik :)
  - vetinari 7y ago
    Yeah, two, plural :)
Dagger2 7y ago
It's actually closer to 5% according to Google's stats. Still far too low, but 5x higher than you thought.

beagle3 7y ago

I hope all home provision moves to CGNAT IPv4; IPV6 are too easy to track, and every ISP that I've seen ties the prefix to the customer. Who cares about cookies, 1st party or 3rd party, when you have a unique ~60 bit per customer identifier? My ISP gives un-natted IPv4, but I get a different one each time I reboot the modem, which I do every now and then.

anticensor 7y ago

Why have successors to IPv4 been designed with variable-length addresses as in earlier versions?

anticensor 7y ago
Missed a "not" before "designed", and got a down.
zamadatix 7y ago
Routing hardware would prefer you just pick a very large address size and stick to it.