6 ms·

Is it just me or did we actually start regressing in terms of moving things off IPv4? A couple of years ago I had a working IPv6 connection at home with a stati

by avian 6y ago

Is it just me or did we actually start regressing in terms of moving things off IPv4? A couple of years ago I had a working IPv6 connection at home with a static /64 delegation. I had full IPv6 connectivity at work. Since I had IPv6 connectivity on my laptop ~90% of the time I actually moved a lot of my own private services to be IPv6 only, since that helped a lot with the usual background of port scans and other random annoyances. Now I'm forced to move these things back to IPv4. My home ISP has first moved off static delegations in favor of dynamic ones via DHCPv6, and then broke IPv6 routing completely [1] and after a few weeks of me complaining still seemingly has no interest in fixing it. The place I work for now has no IPv6 connectivity and has no plans for it in the future. Many people I talk with don't believe that IPv6 is the future and I commonly hear that they have forcibly disabled it on their computers due to this or that random problem. [1] https://www.tablix.org/~avian/blog/archives/2020/05/on_missing_ipv6_router_advertisements/ https://www.tablix.org/~avian/blog/archives/2020/05/on_missi...

magicalhippo 6y ago
My ISP had a page about IPv6, but they've since removed it and when asked now say IPv6 is only supported by their own router box. They do DHCPv6 as well, with a single /64. Which makes IPv6 a PITA. Of course it doesn't help that a lot of software (hello pfSense) is written around the idea that everybody will get a static /56 or similar that'll never ever change. Which is a pretty silly assumption IMHO.
- thequux 6y ago
  My ISP (Telenet in Belgium) may just be unusually good, but, while there's fairly sparse documentation on IPv6 and their DHCPv6 only gave me a /64 by default, all I needed to do to get more was to configure my router's DHCP client to request a larger delegation. I didn't need to even contact their support line. At the moment I'm only asking for a /60, because that's all I need, but I strongly suspect that a /56 or even larger is easily available.
  - deleted 6y ago
    [deleted]
1_player 6y ago
I'm not sure about regressing, but I think we've almost reached peak IPv6: everyone who planned to support IPv6 have upgraded their software and infrastructure, those that were sceptical, lazy or downright opposed to IPv6 have no plans to support it, now or ever. Having an "ipv6" configuration option in your software, which defaults to false, falls into the latter group. (Hello, Docker!)
- citrin_ru 6y ago
  Having IPv6 turned off by default is not the only Docker problem with IPv6. When I tried to use IPv6 in Docker couple of years ago I found it to be unusable for my use case. I don't remember details, but remember finding tickets in github issue tracker with long discussions which went nowhere.
corty 6y ago
I do blame "Happy Eyeballs". Broken IPv6 has become invisible and therefore unimportant for ISPs. Disabling IPv6 because of some -maybe imagined- problem is akin to disabling every new tech because it might be to blame. Tech will just progress one admin funeral at a time here.
- magicalhippo 6y ago
  > Disabling IPv6 because of some -maybe imagined- problem I've had very real IPv6 problems at home, which has caused me to disable it for long stretches. I turn it back on every now and then to see if life has improved though. Most of my issues have been down to my ISP only handing out a dynamic /64 prefix. Apparently that's not how you do it and the software side doesn't seem to want to accommodate that, but that's what I got so...
  - avian 6y ago
    > Most of my issues have been down to my ISP only handing out a dynamic /64 prefix. Yes, this is my biggest issue with the move to dynamic prefix delegation as well. Delegated prefix change seems to be handled very badly in the stack. It basically breaks all your IPv6 connectivity until LAN hosts get to renew their DHCPv6 leases and/or SLAAC autoconfiguration. Even connectivity between hosts on the LAN will break, since their addresses will slowly change while they update. The funny part is that I now have a static IPv4 and a dynamic IPv6 - a situation I would never imagine could happen.
    - magicalhippo 6y ago
      > It basically breaks all your IPv6 connectivity For me it basically breaks all connectivity, because pfSense tells LAN clients to use the public IPv6 address for DNS. So when the prefix changes pfSense updates its public IP, but LAN clients still try to use the old address for DNS resolution. I've tried to get pfSense to only use IPv4 for DNS address, but I've so far been unsuccessful. There's also the issue of updating firewall rules.
      - 6y ago
m-p-3 6y ago
The frustrating thing is that they mostly believe IP 4 can be salvaged and stretched to the limit using NAT, but they often forget that we're running out of IPv4 addresses and that's just gonna make thing even more painful over time.
- sp332 6y ago
  Doesn't NAT decrease the pressure on IPv4 address space?
  - corty 6y ago
    Current state of the art is already "multiple layers of NAT". So yes, but only to a certain point.
  - zlynx 6y ago
    It does and did, yes. Now we're running out of IPv4 even with NAT.
msh 6y ago
yeah. My ISP actually have a deccent IPv6 implementation (but uses CGNAT unless you pay extra for a fixed IP) but their default router is crappy so I replaced it with a ubiquity ampliFI which is great on IPv4, can more or less fill my gigabit fiber, but on IPv6 it maxes out at 250 megabits. So I get better performance disabling IPv6 :( The isp router have no such issue, just bad WIFI and bad NAT performance for IPv4.
vetinari 6y ago
Last time I moved, my options were: a) DS Lite, with /64 prefix (no /56, no PCP), with mandatory ISP provided crapbox as the router; b) public static IPv4, no IPv6 at all, with any router I want. It is obvious which option I took.
- edoceo 6y ago
  b) right?
  - vetinari 6y ago
    Right.
pwdisswordfish2 6y ago
"Many people I talk with don't believe that IPv6 is the future and I commonly hear that they have forcibly disabled it on their computers due to this or that random problem." It is their choice to make not anyone else's. They could be right. It might not be the future. I am one of those non-believers. I would love an improved protocol but I do not see IPv6 as the right fit. I think it is no coincidence that the providers are having problems with offering it to customers. Networking is complex and error-prone enough without IPv6. It is less so with IPv6? We know what the IPv6 zealots will say. Beware of "analyses" that focus solely on benefits without considering costs.
- black_puppydog 6y ago
  I think GP was criticizing that this might be the correct choice for them, given that the rest of the world seems to randomly break v6 and somehow it's acceptable.
- Dagger2 6y ago
  That also means that you should beware of "analyses" that ignore the costs of staying on v4 and not doing v6. NAT, split DNS, VPNs, RFC1918 clashes and renumbering... this stuff isn't free, and most of it is totally unnecessary when you have enough address space.
  - ipv6fix 6y ago
    While the above are real costs, beware of promises that IPv6 will remove, reduce or even lower the cost of doing NAT. As long as there is an IPv4 Internet, NAT will be an integral part of any IPv6 deployment.
    - Dagger2 6y ago
      It will do all of those things in the right circumstances though. Dual-stacked eyeball ISPs see over 50% of their traffic go via native v6. If they're CGNATing then that corresponds to a substantial drop in the amount of traffic that needs to be CGNATed, and therefore also a corresponding drop in the cost of the hardware needed to do it.
everdrive 6y ago
I had similar problems. I decided to take the dive to IPv6, but it turned out I was getting regularly-changing dynamic IPv6 addresses. I wasn't succeeding in getting ULAs to work, and it was starting to look like IPv6 was a lot of headache with no benefit that I could identify.
toast0 6y ago
I don't think we're regressing as a whole, but current penetration is fairly low, so odds of moving to a company with IPv6 is low, and if you moved from a company with IPv6, you're likely to lose it. Some ISPs consider it critical, but most don't. If they have enough IPv4 addresses, given that there's no high profile IPv6 only things, and that Happy Eyeballs is fairly well implemented, only a couple people are going to notice. Also, given the success some large networks are having with deploying IPv6, there's less pressure on IPv4 resources. Happy Eyeballs itself is a compromise --- it hides broken configurations, so people who could fix things might not notice / be told IPv6 is broken, but it also hides broken configurations so people who can't fix things don't just turn off IPv6 forever, which leads to higher use when it does work.
cptskippy 6y ago
> Is it just me or did we actually start regressing in terms of moving things off IPv4? To my knowledge, nothing was ever moved off IPv4. IPv6 was setup in parallel, but IPv4 was never removed.
rleigh 6y ago
No, I think it's slowly increasing in the background. Look at https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html It's been a steady linear increase for the past three years, now over 30%. Interestingly, zoom in to 2020, and you'll see the effect of the coronavirus lockdown--all those home workers and people in self-isolation on IPv6 rather than on IPv4-only work networks. With the increase in dependence upon cloud computing and containers, I believe that one of the big blockers today is the poor support for IPv6 by cloud providers and by docker and other virtualisation/container systems. Their lack of IPv6 support is what precludes wider adoption on client systems and internally in companies. Pervasive IPv6 support would be reason to use it, but right now it's a hindrance.

by avian 6y ago

magicalhippo 6y ago

My ISP had a page about IPv6, but they've since removed it and when asked now say IPv6 is only supported by their own router box. They do DHCPv6 as well, with a single /64. Which makes IPv6 a PITA. Of course it doesn't help that a lot of software (hello pfSense) is written around the idea that everybody will get a static /56 or similar that'll never ever change. Which is a pretty silly assumption IMHO.

thequux 6y ago
My ISP (Telenet in Belgium) may just be unusually good, but, while there's fairly sparse documentation on IPv6 and their DHCPv6 only gave me a /64 by default, all I needed to do to get more was to configure my router's DHCP client to request a larger delegation. I didn't need to even contact their support line. At the moment I'm only asking for a /60, because that's all I need, but I strongly suspect that a /56 or even larger is easily available.
- deleted 6y ago
  [deleted]

1_player 6y ago

I'm not sure about regressing, but I think we've almost reached peak IPv6: everyone who planned to support IPv6 have upgraded their software and infrastructure, those that were sceptical, lazy or downright opposed to IPv6 have no plans to support it, now or ever. Having an "ipv6" configuration option in your software, which defaults to false, falls into the latter group. (Hello, Docker!)

citrin_ru 6y ago
Having IPv6 turned off by default is not the only Docker problem with IPv6. When I tried to use IPv6 in Docker couple of years ago I found it to be unusable for my use case. I don't remember details, but remember finding tickets in github issue tracker with long discussions which went nowhere.

corty 6y ago

I do blame "Happy Eyeballs". Broken IPv6 has become invisible and therefore unimportant for ISPs. Disabling IPv6 because of some -maybe imagined- problem is akin to disabling every new tech because it might be to blame. Tech will just progress one admin funeral at a time here.

magicalhippo 6y ago
> Disabling IPv6 because of some -maybe imagined- problem I've had very real IPv6 problems at home, which has caused me to disable it for long stretches. I turn it back on every now and then to see if life has improved though. Most of my issues have been down to my ISP only handing out a dynamic /64 prefix. Apparently that's not how you do it and the software side doesn't seem to want to accommodate that, but that's what I got so...
- avian 6y ago
  > Most of my issues have been down to my ISP only handing out a dynamic /64 prefix. Yes, this is my biggest issue with the move to dynamic prefix delegation as well. Delegated prefix change seems to be handled very badly in the stack. It basically breaks all your IPv6 connectivity until LAN hosts get to renew their DHCPv6 leases and/or SLAAC autoconfiguration. Even connectivity between hosts on the LAN will break, since their addresses will slowly change while they update. The funny part is that I now have a static IPv4 and a dynamic IPv6 - a situation I would never imagine could happen.
  - magicalhippo 6y ago
    > It basically breaks all your IPv6 connectivity For me it basically breaks all connectivity, because pfSense tells LAN clients to use the public IPv6 address for DNS. So when the prefix changes pfSense updates its public IP, but LAN clients still try to use the old address for DNS resolution. I've tried to get pfSense to only use IPv4 for DNS address, but I've so far been unsuccessful. There's also the issue of updating firewall rules.
    - 6y ago

m-p-3 6y ago

The frustrating thing is that they mostly believe IP 4 can be salvaged and stretched to the limit using NAT, but they often forget that we're running out of IPv4 addresses and that's just gonna make thing even more painful over time.

sp332 6y ago
Doesn't NAT decrease the pressure on IPv4 address space?
- corty 6y ago
  Current state of the art is already "multiple layers of NAT". So yes, but only to a certain point.
- zlynx 6y ago
  It does and did, yes. Now we're running out of IPv4 even with NAT.

msh 6y ago

yeah. My ISP actually have a deccent IPv6 implementation (but uses CGNAT unless you pay extra for a fixed IP) but their default router is crappy so I replaced it with a ubiquity ampliFI which is great on IPv4, can more or less fill my gigabit fiber, but on IPv6 it maxes out at 250 megabits. So I get better performance disabling IPv6 :( The isp router have no such issue, just bad WIFI and bad NAT performance for IPv4.

vetinari 6y ago

Last time I moved, my options were: a) DS Lite, with /64 prefix (no /56, no PCP), with mandatory ISP provided crapbox as the router; b) public static IPv4, no IPv6 at all, with any router I want. It is obvious which option I took.

edoceo 6y ago
b) right?
- vetinari 6y ago
  Right.

pwdisswordfish2 6y ago

"Many people I talk with don't believe that IPv6 is the future and I commonly hear that they have forcibly disabled it on their computers due to this or that random problem." It is their choice to make not anyone else's. They could be right. It might not be the future. I am one of those non-believers. I would love an improved protocol but I do not see IPv6 as the right fit. I think it is no coincidence that the providers are having problems with offering it to customers. Networking is complex and error-prone enough without IPv6. It is less so with IPv6? We know what the IPv6 zealots will say. Beware of "analyses" that focus solely on benefits without considering costs.

black_puppydog 6y ago
I think GP was criticizing that this might be the correct choice for them, given that the rest of the world seems to randomly break v6 and somehow it's acceptable.
Dagger2 6y ago
That also means that you should beware of "analyses" that ignore the costs of staying on v4 and not doing v6. NAT, split DNS, VPNs, RFC1918 clashes and renumbering... this stuff isn't free, and most of it is totally unnecessary when you have enough address space.
- ipv6fix 6y ago
  While the above are real costs, beware of promises that IPv6 will remove, reduce or even lower the cost of doing NAT. As long as there is an IPv4 Internet, NAT will be an integral part of any IPv6 deployment.
  - Dagger2 6y ago
    It will do all of those things in the right circumstances though. Dual-stacked eyeball ISPs see over 50% of their traffic go via native v6. If they're CGNATing then that corresponds to a substantial drop in the amount of traffic that needs to be CGNATed, and therefore also a corresponding drop in the cost of the hardware needed to do it.

everdrive 6y ago

I had similar problems. I decided to take the dive to IPv6, but it turned out I was getting regularly-changing dynamic IPv6 addresses. I wasn't succeeding in getting ULAs to work, and it was starting to look like IPv6 was a lot of headache with no benefit that I could identify.

toast0 6y ago

I don't think we're regressing as a whole, but current penetration is fairly low, so odds of moving to a company with IPv6 is low, and if you moved from a company with IPv6, you're likely to lose it. Some ISPs consider it critical, but most don't. If they have enough IPv4 addresses, given that there's no high profile IPv6 only things, and that Happy Eyeballs is fairly well implemented, only a couple people are going to notice. Also, given the success some large networks are having with deploying IPv6, there's less pressure on IPv4 resources. Happy Eyeballs itself is a compromise --- it hides broken configurations, so people who could fix things might not notice / be told IPv6 is broken, but it also hides broken configurations so people who can't fix things don't just turn off IPv6 forever, which leads to higher use when it does work.

cptskippy 6y ago

> Is it just me or did we actually start regressing in terms of moving things off IPv4? To my knowledge, nothing was ever moved off IPv4. IPv6 was setup in parallel, but IPv4 was never removed.

rleigh 6y ago

No, I think it's slowly increasing in the background. Look at https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html It's been a steady linear increase for the past three years, now over 30%. Interestingly, zoom in to 2020, and you'll see the effect of the coronavirus lockdown--all those home workers and people in self-isolation on IPv6 rather than on IPv4-only work networks. With the increase in dependence upon cloud computing and containers, I believe that one of the big blockers today is the poor support for IPv6 by cloud providers and by docker and other virtualisation/container systems. Their lack of IPv6 support is what precludes wider adoption on client systems and internally in companies. Pervasive IPv6 support would be reason to use it, but right now it's a hindrance.