3 ms·

There are widely used ways to deploy IPv6 networks compatible with the IPv4 internet. NAT64/DNS64 (iOS): Your device only gets an IPv6 address, but when it que

There are widely used ways to deploy IPv6 networks compatible with the IPv4 internet. NAT64/DNS64 (iOS): Your device only gets an IPv6 address, but when it queries an ipv4onlydomain.com, it receives an IPv6 address mapped to the domains IPv4 address. When it sends packets to it, they are translated by the ISP to IPv4. All their customers remain IPv6-only. This method requires apps to be able to handle IPv6 addresses, which Apple enforced. XLAT464 (Android, Windows): your device gets an IPv6 address. The OS translates IPv4 packets to a special range of IPv6 before sending them out, because you’re only connected over IPv6. The ISP translates them to IPv4 to reach legacy services. The benfit is: absolutely no NAT for IPv6 packets. Complete end-to-end connectivity. 192.168.0.1 shouldn’t be glorified. Good riddance. We have mDNS now, just have the user type router.local into their browser.

ay 6y ago
You can also do the ipv4 to IPv6 translation on the server itself, then the server is can be purely IPv6 attached. Fun trivia: A few years ago I wrote a kernel module, that together with existing kernel mechanisms allowed almost all transition tech at a time, and ended up in a bunch of CPEs: https://github.com/ayourtch/nat46/tree/master/nat46/modules https://github.com/ayourtch/nat46/tree/master/nat46/modules You can see the pull request activity... two pull requests in the past month... before that it was last time in 2017. So some things seem to be moving.
m463 6y ago
> The benfit is: absolutely no NAT for IPv6 packets. Complete end-to-end connectivity. do the privacy extensions (which I've heard of, but don't get at even a basic level) allow a little privacy in this scenario?
- Dagger2 6y ago
  Privacy extensions means that every host on your network picks a random IP to make outbound connections from. They pick new random IPs periodically (by default usually after 24 hours), while keeping the old ones for a short period (by default usually 7 days) so that existing connections aren't broken. Rebooting or connecting to a new network will also remove the existing privacy addresses and generate new ones. Remote servers will see the privacy address, but they won't know which machine the address belongs to. The addresses will also be abandoned after a maximum of a week, so you can't trawling through your old server logs to find active v6 addresses either. They'll still be able to see what network you're coming from, but that's not something that NATing outbound connections from your network would help with anyway.

ay 6y ago

You can also do the ipv4 to IPv6 translation on the server itself, then the server is can be purely IPv6 attached. Fun trivia: A few years ago I wrote a kernel module, that together with existing kernel mechanisms allowed almost all transition tech at a time, and ended up in a bunch of CPEs: https://github.com/ayourtch/nat46/tree/master/nat46/modules https://github.com/ayourtch/nat46/tree/master/nat46/modules You can see the pull request activity... two pull requests in the past month... before that it was last time in 2017. So some things seem to be moving.

m463 6y ago

> The benfit is: absolutely no NAT for IPv6 packets. Complete end-to-end connectivity. do the privacy extensions (which I've heard of, but don't get at even a basic level) allow a little privacy in this scenario?

Dagger2 6y ago
Privacy extensions means that every host on your network picks a random IP to make outbound connections from. They pick new random IPs periodically (by default usually after 24 hours), while keeping the old ones for a short period (by default usually 7 days) so that existing connections aren't broken. Rebooting or connecting to a new network will also remove the existing privacy addresses and generate new ones. Remote servers will see the privacy address, but they won't know which machine the address belongs to. The addresses will also be abandoned after a maximum of a week, so you can't trawling through your old server logs to find active v6 addresses either. They'll still be able to see what network you're coming from, but that's not something that NATing outbound connections from your network would help with anyway.