8 ms·

I bet Residential ISP's turn to CGNAT before they roll out IPV6.

iagovar 7y ago
They are alaready doing so. IPv6 test enviroments has been a disaster in the ISP I work for, too many devices don't support IPv6 in the domestic market and solution to router IPv4 over IPv6 are problematic.
- freedomben 7y ago
  Very interesting, thanks for sharing. What kind of devices are they? IoT type stuff, smart TVs, etc?
  - ecksii 7y ago
    Right now IoT devices use a communications model that overcome's NAT by tying the device to a service endpoint in the cloud. The device registers itself as an IoT device in aws and then your local hosts hit the device by going to the device endpoint in the cloud. I don't know if this model will hold up when IPv6 more widely supported though.
- jaywalk 7y ago
  The largest ISP in the US, Comcast, has deployed IPv6 on 100% of their network. If they can do it, why can't you?
  - notdonspaulding 7y ago
    To the best of my knowledge, Comcast is running dual-stack v4 and v6. The GP was talking about running a purely v6 network, and pointing out that it wasn't yet feasible. Your example of Comcast doesn't really fit the bill because Comcast already has a v4 network to all of their customers, and they are not migrating customers to a solely-v6 network. This is the chicken-and-egg problem that all new networks are facing with regard to IPv6 adoption. In order to have a usable network, you have to support IPv4 to all endpoints. But once you have v4 at all endpoints, the incentive to run v6 is greatly diminished. As always, v6 needs a "killer app" that Grandma wants to use that is unavailable over the v4 internet, and then network administrators could use the actual demand from their customers as a justification for moving to v6. Unfortunately, at the moment, the list of v4-only must-have apps is still greater than the list of v6-only must-have apps.
    - wmf 7y ago
      v6 with DS-Lite/464/MAP is going to be cheaper than v4-only because it allows the ISP to sell off (or not buy) most of their v4 addresses while also using less equipment. T-Mobile has already adopted this architecture.
    - throw0101a 7y ago
      > The GP was talking about running a purely v6 network, and pointing out that it wasn't yet feasible. Amusingly that's how mobile/smartphones are supposedly run: the devices get IPv6-only, and if they need to hit an IPv4-only address they are CGNATed. * https://www.internetsociety.org/resources/deploy360/2014/case-study-t-mobile-us-goes-ipv6-only-using-464xlat/ https://www.internetsociety.org/resources/deploy360/2014/cas... * https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mobile-networks-why-and-how.html https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mob...
      - exhilaration 7y ago
        Ah, so that explains it. I just switched from Sprint (which always gave me an IPv4 address) to T-Mobile (which gives me an IPv6 address).
      - jaywalk 7y ago
        My Verizon iPhone has both a public IPv4 address and a public IPv6 address. They certainly could be using CGNAT, but that seems like a weird way to do it.
        throw0101a 7y ago
        > My Verizon iPhone has both a public IPv4 address and a public IPv6 address. How are you able to tell with IPv4? You cannot run ifconfig on an iPhone, so how are you determining that?
        briffle 7y ago
        Seriously? On Android it's just settings->about phone
  - iagovar 7y ago
    Maybe you just don't get to know what problems it causes because they don't talk about it. Dual stack is currently under testing and afaik higher ups are not very happy about it. Maybe we've done too early (it was about five years ago maybe, I don't really remember exactly) and now tooling is better, idk
- dan1234 7y ago
  Both BT & Sky have managed to deploy IPv6 in the UK, so the problems must be reasonably easy to solve. Unfortunately Virgin Media (my ISP) are still dragging their heels but have decided to go with DS-Lite.
gertrunde 7y ago
I recall hearing a while ago that those who were early adopters of CGNAT (predominantly mobile providers) are backing away from it due to problems, and shifting more rapidly to IPv6. (And apparently the police are not big fans either, as it makes it more difficult to track down miscreants).
- freedomben 7y ago
  Would be interested in hearing more about the problems. From a consumer standpoint the problems I've run into and heard about are: 1. Can't use port-forwarding anymore since you can't configure the ISPs router doing the NAT 2. A bad neighbor sharing your IP can get you IP banned on sites that still think IP address is a good way to block/throttle bad players 3. Connections can be unstable if there's a lot of connections going on, so prime-time can often run into issues.
  - thefreeman 7y ago
    2 is an interesting point. Let's say you want to rate limit login attempts to help reduce brute force attacks. How would you recommend doing it if not by ip? You can tie it to the specific username being requested but this has other downsides, ie. you can DOS someones account by sending fraudulent login attempts to it, and it also doesn't prevent attacks where people just test previously leaked username / password combos against your site.
    - wmf 7y ago
      This is where CAPTCHAs come in, unfortunately.
    - zAy0LfpBZLC8mAC 7y ago
      > How would you recommend doing it if not by ip? Not at all, it's a stupid idea. You are trying to nail down an identity without authentication, that can not work. If you use credentials with sufficiently high entropy, which you should do anyway, you don't have a problem that this could be the solution to.
    - 7y ago
usr1106 7y ago
Depends on the country. Whenever I visit Belgium I get IPv6 in random guest houses. Google sees nearly 50% adoption. https://www.google.com/ipv6 https://www.google.com/ipv6 In Finland 2 out of 3 mobile operators give you IPv6 by default (and mobile data usage is very high).
- Itsdijital 7y ago
  Why is the graph so perfectly periodic?
  - ivlad 7y ago
    Weekend vs workdays. Shows that IPv6 penetration for residential ISPs is higher than IPv6 adoption at corporations.
    - usr1106 7y ago
      Exactly. And you can see Christmas. As soon as a paid network administrator is involved IPv6 seems to be a problem :)
vlan0 7y ago
Maybe the smaller ISPs. Many large cable ISPs in the USA have been running IPv6 internally for years now. They likely have some of the largest deployments if you account for all their IP managed gear. Of course, these are the same ISPs that already provide a dual-stack gateway to their customers.
- snuxoll 7y ago
  > Many large cable ISPs in the USA have been running IPv6 internally for years now. CableOne/Sparklight says hi, because they have zero intention on deploying v6 for the foreseeable future.
  - tssva 7y ago
    Not sure I would classify CableOne/Sparklight as a large cable ISP. Their website says they service about 900k customers. Even if all of these customers had internet service this would put them fairly far down the list of ISPs. I would more classify them as a medium sized ISP.
q3k 7y ago
There's one big issue with CGNAT for ISPs: compliance. At least in Poland, you must provide law enforcement with information about your subscriber for any given 5-tuple at a given time (timestamp, {src,dest}{ip,port} and protocol). If you're CGNATing everyone, you have to either: - log all outgoing connections (which is a GDPR hazard) - design your CGNAT to use static outgoing ports for a given customer (but then you're running out of ports pretty fast, if you're doing anything close to >=500 subscribers) With IPv6, you can just immediately tell who the subscriber is based on the IP address, and as such don't have to log anything.
- trollied 7y ago
  Crikey, the amount of storage required to keep that will be insane. What's the retention period?
  - q3k 7y ago
    One year but not a day more (data protection laws).
- ec109685 7y ago
  If you need consistent ports, you could assign many internal IP’s to the NAT to support more ports for your NAT.
- Mathnerd314 7y ago
  Does the GPDR override the data retention law? I was reading some stuff about VPNs which suggested it might.
  - q3k 7y ago
    No. The GDPR explicitly doesn't concern matters of lawful interception, intelligence, police and justice.
p1mrx 7y ago
The correct answer is "both". IPv4 CGN is inevitable because there are more people than addresses. Native IPv6 lets people bypass the CGN.
kitteh 7y ago
Look to the mobile networks as a sign for things to come. How much money do you think network operators are going to invest in a highly available and performant IPv4 CGNAT experience? I know of one large mobile network that said they're constrained on CGNAT capacity and their plans arent positive.
- kalleboo 7y ago
  My fiber ISP gives you overloaded PPPoE for the legacy "dedicated dynamic IP" experience, IPv6 is carried over more modern and performant IPoE infrastructure, and if you want you can use DS-lite for IPv4 to trade CGNAT for performance Most of the stuff regular people care about performance for is on CDNs that support IPv6 (or is YouTube, Netflix etc)
nostalgiac 7y ago
This is already happening in Australia. https://www.aussiebroadband.com.au/help-centre/nbn/tech-support/cg-nat/ https://www.aussiebroadband.com.au/help-centre/nbn/tech-supp...

They are alaready doing so. IPv6 test enviroments has been a disaster in the ISP I work for, too many devices don't support IPv6 in the domestic market and solution to router IPv4 over IPv6 are problematic.

freedomben 7y ago
Very interesting, thanks for sharing. What kind of devices are they? IoT type stuff, smart TVs, etc?
- ecksii 7y ago
  Right now IoT devices use a communications model that overcome's NAT by tying the device to a service endpoint in the cloud. The device registers itself as an IoT device in aws and then your local hosts hit the device by going to the device endpoint in the cloud. I don't know if this model will hold up when IPv6 more widely supported though.
jaywalk 7y ago
The largest ISP in the US, Comcast, has deployed IPv6 on 100% of their network. If they can do it, why can't you?
- notdonspaulding 7y ago
  To the best of my knowledge, Comcast is running dual-stack v4 and v6. The GP was talking about running a purely v6 network, and pointing out that it wasn't yet feasible. Your example of Comcast doesn't really fit the bill because Comcast already has a v4 network to all of their customers, and they are not migrating customers to a solely-v6 network. This is the chicken-and-egg problem that all new networks are facing with regard to IPv6 adoption. In order to have a usable network, you have to support IPv4 to all endpoints. But once you have v4 at all endpoints, the incentive to run v6 is greatly diminished. As always, v6 needs a "killer app" that Grandma wants to use that is unavailable over the v4 internet, and then network administrators could use the actual demand from their customers as a justification for moving to v6. Unfortunately, at the moment, the list of v4-only must-have apps is still greater than the list of v6-only must-have apps.
  - wmf 7y ago
    v6 with DS-Lite/464/MAP is going to be cheaper than v4-only because it allows the ISP to sell off (or not buy) most of their v4 addresses while also using less equipment. T-Mobile has already adopted this architecture.
  - throw0101a 7y ago
    > The GP was talking about running a purely v6 network, and pointing out that it wasn't yet feasible. Amusingly that's how mobile/smartphones are supposedly run: the devices get IPv6-only, and if they need to hit an IPv4-only address they are CGNATed. * https://www.internetsociety.org/resources/deploy360/2014/case-study-t-mobile-us-goes-ipv6-only-using-464xlat/ https://www.internetsociety.org/resources/deploy360/2014/cas... * https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mobile-networks-why-and-how.html https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mob...
    - exhilaration 7y ago
      Ah, so that explains it. I just switched from Sprint (which always gave me an IPv4 address) to T-Mobile (which gives me an IPv6 address).
    - jaywalk 7y ago
      My Verizon iPhone has both a public IPv4 address and a public IPv6 address. They certainly could be using CGNAT, but that seems like a weird way to do it.
      - throw0101a 7y ago
        > My Verizon iPhone has both a public IPv4 address and a public IPv6 address. How are you able to tell with IPv4? You cannot run ifconfig on an iPhone, so how are you determining that?
        briffle 7y ago
        Seriously? On Android it's just settings->about phone
- iagovar 7y ago
  Maybe you just don't get to know what problems it causes because they don't talk about it. Dual stack is currently under testing and afaik higher ups are not very happy about it. Maybe we've done too early (it was about five years ago maybe, I don't really remember exactly) and now tooling is better, idk
dan1234 7y ago
Both BT & Sky have managed to deploy IPv6 in the UK, so the problems must be reasonably easy to solve. Unfortunately Virgin Media (my ISP) are still dragging their heels but have decided to go with DS-Lite.

gertrunde 7y ago

I recall hearing a while ago that those who were early adopters of CGNAT (predominantly mobile providers) are backing away from it due to problems, and shifting more rapidly to IPv6. (And apparently the police are not big fans either, as it makes it more difficult to track down miscreants).

freedomben 7y ago
Would be interested in hearing more about the problems. From a consumer standpoint the problems I've run into and heard about are: 1. Can't use port-forwarding anymore since you can't configure the ISPs router doing the NAT 2. A bad neighbor sharing your IP can get you IP banned on sites that still think IP address is a good way to block/throttle bad players 3. Connections can be unstable if there's a lot of connections going on, so prime-time can often run into issues.
- thefreeman 7y ago
  2 is an interesting point. Let's say you want to rate limit login attempts to help reduce brute force attacks. How would you recommend doing it if not by ip? You can tie it to the specific username being requested but this has other downsides, ie. you can DOS someones account by sending fraudulent login attempts to it, and it also doesn't prevent attacks where people just test previously leaked username / password combos against your site.
  - wmf 7y ago
    This is where CAPTCHAs come in, unfortunately.
  - zAy0LfpBZLC8mAC 7y ago
    > How would you recommend doing it if not by ip? Not at all, it's a stupid idea. You are trying to nail down an identity without authentication, that can not work. If you use credentials with sufficiently high entropy, which you should do anyway, you don't have a problem that this could be the solution to.
  - 7y ago

usr1106 7y ago

Depends on the country. Whenever I visit Belgium I get IPv6 in random guest houses. Google sees nearly 50% adoption. https://www.google.com/ipv6 https://www.google.com/ipv6 In Finland 2 out of 3 mobile operators give you IPv6 by default (and mobile data usage is very high).

Itsdijital 7y ago
Why is the graph so perfectly periodic?
- ivlad 7y ago
  Weekend vs workdays. Shows that IPv6 penetration for residential ISPs is higher than IPv6 adoption at corporations.
  - usr1106 7y ago
    Exactly. And you can see Christmas. As soon as a paid network administrator is involved IPv6 seems to be a problem :)

vlan0 7y ago

Maybe the smaller ISPs. Many large cable ISPs in the USA have been running IPv6 internally for years now. They likely have some of the largest deployments if you account for all their IP managed gear. Of course, these are the same ISPs that already provide a dual-stack gateway to their customers.

snuxoll 7y ago
> Many large cable ISPs in the USA have been running IPv6 internally for years now. CableOne/Sparklight says hi, because they have zero intention on deploying v6 for the foreseeable future.
- tssva 7y ago
  Not sure I would classify CableOne/Sparklight as a large cable ISP. Their website says they service about 900k customers. Even if all of these customers had internet service this would put them fairly far down the list of ISPs. I would more classify them as a medium sized ISP.

q3k 7y ago

There's one big issue with CGNAT for ISPs: compliance. At least in Poland, you must provide law enforcement with information about your subscriber for any given 5-tuple at a given time (timestamp, {src,dest}{ip,port} and protocol). If you're CGNATing everyone, you have to either: - log all outgoing connections (which is a GDPR hazard) - design your CGNAT to use static outgoing ports for a given customer (but then you're running out of ports pretty fast, if you're doing anything close to >=500 subscribers) With IPv6, you can just immediately tell who the subscriber is based on the IP address, and as such don't have to log anything.

trollied 7y ago
Crikey, the amount of storage required to keep that will be insane. What's the retention period?
- q3k 7y ago
  One year but not a day more (data protection laws).
ec109685 7y ago
If you need consistent ports, you could assign many internal IP’s to the NAT to support more ports for your NAT.
Mathnerd314 7y ago
Does the GPDR override the data retention law? I was reading some stuff about VPNs which suggested it might.
- q3k 7y ago
  No. The GDPR explicitly doesn't concern matters of lawful interception, intelligence, police and justice.

p1mrx 7y ago

The correct answer is "both". IPv4 CGN is inevitable because there are more people than addresses. Native IPv6 lets people bypass the CGN.

kitteh 7y ago

Look to the mobile networks as a sign for things to come. How much money do you think network operators are going to invest in a highly available and performant IPv4 CGNAT experience? I know of one large mobile network that said they're constrained on CGNAT capacity and their plans arent positive.

kalleboo 7y ago
My fiber ISP gives you overloaded PPPoE for the legacy "dedicated dynamic IP" experience, IPv6 is carried over more modern and performant IPoE infrastructure, and if you want you can use DS-lite for IPv4 to trade CGNAT for performance Most of the stuff regular people care about performance for is on CDNs that support IPv6 (or is YouTube, Netflix etc)

nostalgiac 7y ago

This is already happening in Australia. https://www.aussiebroadband.com.au/help-centre/nbn/tech-support/cg-nat/ https://www.aussiebroadband.com.au/help-centre/nbn/tech-supp...