5 ms·

> 2) For tethering with IPv6, you need multiple IP addresses. You cannot do NAT as you do with IPv4. I definitely don't want to see NAT with IPv6, but what mak

> 2) For tethering with IPv6, you need multiple IP addresses. You cannot do NAT as you do with IPv4. I definitely don't want to see NAT with IPv6, but what makes it impossible?

garaetjjte 6y ago
It's possible. https://tools.ietf.org/id/draft-mrw-nat66-00.html https://tools.ietf.org/id/draft-mrw-nat66-00.html https://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html
- elp 6y ago
  Its also in active use by some styles of server load balancers. Keepalived in nat mode is one that springs to my mind. The "nat is evil" objection was a moral high horse in the IETF around the time that Android adopted this policy. They may have a point but its largely irrelevant in the real world.
- vetinari 6y ago
  Note that the IETF draft expired 9 years ago. Yes, Cisco tried, but it went nowhere.
- qalmakka 6y ago
  NAT66 is indeed possible, and it actually happened to me to use it, but it's really ugly and clunky to use. This is mostly because you are forced to use ULAs, which almost every IP stack by default rightfully considers as private addresses (see RFC 3484). So, if a host has a valid IPv4 route for 0.0.0.0/0 and one for the IPv6 internet that refers to an ULA, its resolver will almost always prioritise the former route unless you configure it to do otherwise (i.e. on Glibc you can change how getaddrinfo() works by editing its label table in /etc/gai.conf).
  - joecool1029 6y ago
    Since running wireguard with algo.sh seems to be popular now, this is the situation you'll end up in with most ipv6 supporting cloud hosting providers. Digital Ocean only gives 16 ipv6 addresses to the best of my knowledge, others are probably limited to only 1.
    - ninjaguardsheep 6y ago
      I moved from Digital Ocean to Hetzner for my personal VPSes recently. One of the reasons was that Hetzner assigns ipv6 addresses in /64 blocks. Rent an ipv6 enabled vps: get a /64. Rent an additional "floating ip": get a /64.
    - amaccuish 6y ago
      I moved from OWH because they only assigned a /128 to VPSes, so you're sharing a /64 with other servers. That was problematic because I run my own email server, and blacklists for IPv6 tend to be specific to a /64, meaning neighbouring servers landed my own server on blacklists (i.e. they blanket blacklist the whole /64). And obvs cloud providers sadly host a lot of spammers. In the end, since OVH even after being asked for years offer no option for /64s on VPSes, I moved to Hetzner, where a VPS gets it's own /64, so only I am responsible for my mail server's reputation.
      - Avamander 6y ago
        I just recently had the same issue, I really don't understand why the fsck they're doing that s*. Don't they have billions of IPv6 addresses?
    - qalmakka 6y ago
      yeah, I also give out ULAs to my clients in VPNs (both OpenVPN and WireGuard), but it's mostly for local, in LAN traffic. I still haven't figured out how to convince Windows to actually prefer ULAs to IPv4 like I can do on Linux.

> 2) For tethering with IPv6, you need multiple IP addresses. You cannot do NAT as you do with IPv4. I definitely don't want to see NAT with IPv6, but what makes it impossible?

garaetjjte 6y ago

It's possible. https://tools.ietf.org/id/draft-mrw-nat66-00.html https://tools.ietf.org/id/draft-mrw-nat66-00.html https://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html

elp 6y ago
Its also in active use by some styles of server load balancers. Keepalived in nat mode is one that springs to my mind. The "nat is evil" objection was a moral high horse in the IETF around the time that Android adopted this policy. They may have a point but its largely irrelevant in the real world.
vetinari 6y ago
Note that the IETF draft expired 9 years ago. Yes, Cisco tried, but it went nowhere.
qalmakka 6y ago
NAT66 is indeed possible, and it actually happened to me to use it, but it's really ugly and clunky to use. This is mostly because you are forced to use ULAs, which almost every IP stack by default rightfully considers as private addresses (see RFC 3484). So, if a host has a valid IPv4 route for 0.0.0.0/0 and one for the IPv6 internet that refers to an ULA, its resolver will almost always prioritise the former route unless you configure it to do otherwise (i.e. on Glibc you can change how getaddrinfo() works by editing its label table in /etc/gai.conf).
- joecool1029 6y ago
  Since running wireguard with algo.sh seems to be popular now, this is the situation you'll end up in with most ipv6 supporting cloud hosting providers. Digital Ocean only gives 16 ipv6 addresses to the best of my knowledge, others are probably limited to only 1.
  - ninjaguardsheep 6y ago
    I moved from Digital Ocean to Hetzner for my personal VPSes recently. One of the reasons was that Hetzner assigns ipv6 addresses in /64 blocks. Rent an ipv6 enabled vps: get a /64. Rent an additional "floating ip": get a /64.
  - amaccuish 6y ago
    I moved from OWH because they only assigned a /128 to VPSes, so you're sharing a /64 with other servers. That was problematic because I run my own email server, and blacklists for IPv6 tend to be specific to a /64, meaning neighbouring servers landed my own server on blacklists (i.e. they blanket blacklist the whole /64). And obvs cloud providers sadly host a lot of spammers. In the end, since OVH even after being asked for years offer no option for /64s on VPSes, I moved to Hetzner, where a VPS gets it's own /64, so only I am responsible for my mail server's reputation.
    - Avamander 6y ago
      I just recently had the same issue, I really don't understand why the fsck they're doing that s*. Don't they have billions of IPv6 addresses?
  - qalmakka 6y ago
    yeah, I also give out ULAs to my clients in VPNs (both OpenVPN and WireGuard), but it's mostly for local, in LAN traffic. I still haven't figured out how to convince Windows to actually prefer ULAs to IPv4 like I can do on Linux.