5 ms·

How are we not out of IPv4 addresses already? Aren't there a billion phones out there? And probably the same number of PCs and god knows how many servers?

CKN23-ARIN 6y ago
NAT
Latty 6y ago
There is a lot of NAT going on these days, and a lot of shared addresses. All those devices aren't all online at the same time. As I see it, IPv6 can't come fast enough. NAT really needs to die a death so people can actually use the internet fully, not only as a client or using hack-y work-arounds.
- therealx 6y ago
  I want ipv6 as much as anyone, but we are not spending enough time preparing for NATs death. It's responsible for far more security than we as a collective would like to admit and there's a lot more we could be doing now to get ready.
  - PurpleFoxy 6y ago
    Most routers I have seen do not leave ipv6 unprotected. By default they block incoming connections like nat would.
  - globular-toast 6y ago
    That's a common misconception. NAT isn't a security feature but rather a feature of a stateful firewall, which is. There's no reason to remove the firewalls that are in place now when ipv6 happens.
    - BlueTemplar 6y ago
      If firewalls are even needed, a recent poll on an IPv6 professional forum ended with 50/50 split between opt-in and opt-out for IPv6 firewalls in routers of consumer ISPs...
      - globular-toast 6y ago
        That's surprising and quite concerning. Imagine all the insecure IoT devices running ancient software having a direct connection to the Internet... It would be even more concerning if they were shipping routers without any firewall functionality at all. NAT basically requires a firewall. I hope the thinking isn't if you can do away with NAT you can do away with the firewall.
        BlueTemplar 6y ago
        The thinking of the opt-inners seems to be (roughly) that : -IPv6 is fundamentally much more secure than IPv4 (no scanning, etc.) -opt-out is bad for innovation, especially since the cheap default ISP router firewall software is likely to not even allow opt-out for any other protocols than TCP and UDP. (Heck, these days on IPv4 even anything different than HTTPS can be problematic...) -reliance on router firewalls is bad because they incentivize sloppy device security - the manufacturers should be instead liable when they are at fault for screwing it up (also, how many of these "insecure IoT devices running ancient software" are even able to run IPv6 ?) source : https://lafibre.info/ipv6/ipv6-le-firewall/msg704095/#msg704095 https://lafibre.info/ipv6/ipv6-le-firewall/msg704095/#msg704... (fr) Incidentally, one of the "big 4" French ISPs "Free" didn't even have an IPv6 firewall on its customers routers between 2008 and 2019, and it's probably still opt-in : 4 months ago : https://fr.answers.yahoo.com/question/index?qid=20200812110733AA8WakU https://fr.answers.yahoo.com/question/index?qid=202008121107... (fr) So I guess that we're going to see in practice the problems that having no IPv6 firewall causes (most customers not having any idea about what even is a firewall) as it gets more popular... and since Free this summer boasted about reaching 99% IPv6 coverage, and is enabled by default, and can NOT be disabled...
        deadbunny 6y ago
    - therealx 6y ago
      I'm well aware it's not a security feature and I know there are ways to punch holes, but in practice, a lot of machines are still relying on it. The number of IoT devices alone that would be screwed if they were public is massive. Yes, everyone should have a hardware firewall, but we both know most people just buy the cheapest thing, and by bad large, real firewall features are mostly targeted toward higher end devices.
  - CKN23-ARIN 6y ago
    I think we'll still see some people doing NAT66, unfortunately.
  - deadbunny 6y ago
    20+ years isn't enough? More seriously; for 99% of people their ISP router handles NAT and firewall duties. Adding DENY ALL inbound and ALLOW ALL outbound isn't a great stretch for them on ipv6.
    - therealx 6y ago
      Of course it's more than enough, but it's still barely done. We should have co2 emissions under control too, but we don't.
mifreewil 6y ago
Most of those devices only have a private IP address and use NAT to be able to communicate via the Internet. Only servers that need to be publicly accessed directly like a web server actually need a public IP.
bamboleo 6y ago
Sadly this means that the poorer countries give the same IP to multiple users. I’ve received a “you’re doing that too much” error after the first google search of the day on my phone in South East Asia. I don’t remember which country
- nucleardog 6y ago
  That's not exclusive to poorer countries. Cellular carriers in first world countries aren't assigning a public IPv4 address to every cell phone.
  - mdtusz 6y ago
    I've never really considered this before but it's interesting. Does this happen randomly or is there some geographic/tower based IP sharing?
  - Scoundreller 6y ago
    My guess is that providers allow higher rate limits on developed country ISP IPs for this reason.
- jayflux 6y ago
  I’ve had that happen in Europe so I don’t think it’s just poor countries doing that.
  - magicalhippo 6y ago
    My buddy living in the country side here in Norway switched ISP and ended up behind carrier-grade NAT. Speed is so much better with new ISP though so he just set up Wireguard to the VPS server he rents to get "his own" IP.
balola 6y ago
ISPs in China is almost exclusively NAT now, you have to specifically ask for "public network IP" and provide a reason.
JoshGlazebrook 6y ago
ipv6 is heavily used in the mobile network space.
zokier 6y ago
We are out of ipv4 addresses. That is why amazons stockpile is worth $2B, that's how we are reduced to trading the existing addresses at ever increasing prices instead of getting new fresh ones essentially for free
mqus 6y ago
When i read the title, I first thought to myself that those 2 billion dollars will be pretty much worthless once everyone uses ipv6. But as soon as more ipv6 adresses are used (or CG-NAT), ipv4 adresses will become cheaper, so there seems to be a natural balance which will keep the state of "There are IPv4 adresses left" and "IPv4 adresses will run out sometime soon"
- bluGill 6y ago
  For a while, but eventually we will hit a tipping point where nobody cares about IPv4 anymore.
- BlueTemplar 6y ago
  Well, at some point the governments will actually start doing their jobs and ban IPv4 compatible hardware for sale, just like they did for obsolete analog/digital TV tuners and incandescent light bulbs.
  - _alex_ 6y ago
    What are you talking about?
    - BlueTemplar 6y ago
      IPv4-compatible equipment is bad because it slows down the transition from IPv4 (aka ARPANET) to IPv6 (aka Internet). Since the free market seems to have trouble to find incentives to do it itself, the governments should force it, in the same way that they forced the transitions from obsolete TV tuners and incandescent light bulbs.
jlokier 6y ago
If you believe the Android screen Settings > About > Status, my phone is assigned only an IPv6 address, no IPv4. Despite this, it's able to connect to IPv4 web servers just fine. All connections from the IPv6-only phone to IPv4-only web are automatically NAT'd to IPv4 by the cell service provider. I've tested this recently and it uses a different ephemeral source IPv4 after a few minutes when doing this. Tested with HTTP, HTTPS and ICMP ECHO. It is definitely NAT. At the same time, my connections from the phone to IPv6-only web are not using NAT. The server sees the same source IPv6 as the phone reports as its own. When I enable tethering on my phone, it creates a local IPv4 wireless LAN. Devices on that LAN such as my laptop access the web using IPv4, which is NAT'd twice: Once on the phone when crossing from the WLAN to the cell network, then by the cell service provider to get an ephemeral source IPv4. This is double NAT. When the Linux VM on my laptop connects to an internet service and I'm using the Wifi hotspot on my phone, there's yet another NAT in the way, on the laptop itself. This is triple NAT. All this NAT means it doesn't matter so much that we are out of IPv4 addresses for phones. They can connect to both IPv4-only and IPv6-only services while assigned only a public IPv6. In fact phones don't need a public IPv6 either. They don't need any public address. Those NAT'd IPv4 connections don't go over the IPv6 link. They are not being translated to IPv6 and back. Rather, they go over what is effectively a private IPv4 tunnel to the cell provider. Just as IPv4 connections can work like that, so could IPv6 so there's no real need for the phone to report that it has any public IPv6 or IPv4 address at all. However, mine is currently reporting a public IPv6 and no IPv4, while able to make connections to both.
superkuh 6y ago
Most new devices on the internet are wireless phones and most wireless telcos do not give out an ipv4 addresses. They use carrier NAT to share some aspects of ipv4 connectivity but not the important things like being able to use ports.

CKN23-ARIN 6y ago

NAT

Latty 6y ago

There is a lot of NAT going on these days, and a lot of shared addresses. All those devices aren't all online at the same time. As I see it, IPv6 can't come fast enough. NAT really needs to die a death so people can actually use the internet fully, not only as a client or using hack-y work-arounds.

therealx 6y ago
I want ipv6 as much as anyone, but we are not spending enough time preparing for NATs death. It's responsible for far more security than we as a collective would like to admit and there's a lot more we could be doing now to get ready.
- PurpleFoxy 6y ago
  Most routers I have seen do not leave ipv6 unprotected. By default they block incoming connections like nat would.
- globular-toast 6y ago
  That's a common misconception. NAT isn't a security feature but rather a feature of a stateful firewall, which is. There's no reason to remove the firewalls that are in place now when ipv6 happens.
  - BlueTemplar 6y ago
    If firewalls are even needed, a recent poll on an IPv6 professional forum ended with 50/50 split between opt-in and opt-out for IPv6 firewalls in routers of consumer ISPs...
    - globular-toast 6y ago
      That's surprising and quite concerning. Imagine all the insecure IoT devices running ancient software having a direct connection to the Internet... It would be even more concerning if they were shipping routers without any firewall functionality at all. NAT basically requires a firewall. I hope the thinking isn't if you can do away with NAT you can do away with the firewall.
      - BlueTemplar 6y ago
        The thinking of the opt-inners seems to be (roughly) that : -IPv6 is fundamentally much more secure than IPv4 (no scanning, etc.) -opt-out is bad for innovation, especially since the cheap default ISP router firewall software is likely to not even allow opt-out for any other protocols than TCP and UDP. (Heck, these days on IPv4 even anything different than HTTPS can be problematic...) -reliance on router firewalls is bad because they incentivize sloppy device security - the manufacturers should be instead liable when they are at fault for screwing it up (also, how many of these "insecure IoT devices running ancient software" are even able to run IPv6 ?) source : https://lafibre.info/ipv6/ipv6-le-firewall/msg704095/#msg704095 https://lafibre.info/ipv6/ipv6-le-firewall/msg704095/#msg704... (fr) Incidentally, one of the "big 4" French ISPs "Free" didn't even have an IPv6 firewall on its customers routers between 2008 and 2019, and it's probably still opt-in : 4 months ago : https://fr.answers.yahoo.com/question/index?qid=20200812110733AA8WakU https://fr.answers.yahoo.com/question/index?qid=202008121107... (fr) So I guess that we're going to see in practice the problems that having no IPv6 firewall causes (most customers not having any idea about what even is a firewall) as it gets more popular... and since Free this summer boasted about reaching 99% IPv6 coverage, and is enabled by default, and can NOT be disabled...
        deadbunny 6y ago
  - therealx 6y ago
    I'm well aware it's not a security feature and I know there are ways to punch holes, but in practice, a lot of machines are still relying on it. The number of IoT devices alone that would be screwed if they were public is massive. Yes, everyone should have a hardware firewall, but we both know most people just buy the cheapest thing, and by bad large, real firewall features are mostly targeted toward higher end devices.
- CKN23-ARIN 6y ago
  I think we'll still see some people doing NAT66, unfortunately.
- deadbunny 6y ago
  20+ years isn't enough? More seriously; for 99% of people their ISP router handles NAT and firewall duties. Adding DENY ALL inbound and ALLOW ALL outbound isn't a great stretch for them on ipv6.
  - therealx 6y ago
    Of course it's more than enough, but it's still barely done. We should have co2 emissions under control too, but we don't.

mifreewil 6y ago

Most of those devices only have a private IP address and use NAT to be able to communicate via the Internet. Only servers that need to be publicly accessed directly like a web server actually need a public IP.

bamboleo 6y ago

Sadly this means that the poorer countries give the same IP to multiple users. I’ve received a “you’re doing that too much” error after the first google search of the day on my phone in South East Asia. I don’t remember which country

nucleardog 6y ago
That's not exclusive to poorer countries. Cellular carriers in first world countries aren't assigning a public IPv4 address to every cell phone.
- mdtusz 6y ago
  I've never really considered this before but it's interesting. Does this happen randomly or is there some geographic/tower based IP sharing?
- Scoundreller 6y ago
  My guess is that providers allow higher rate limits on developed country ISP IPs for this reason.
jayflux 6y ago
I’ve had that happen in Europe so I don’t think it’s just poor countries doing that.
- magicalhippo 6y ago
  My buddy living in the country side here in Norway switched ISP and ended up behind carrier-grade NAT. Speed is so much better with new ISP though so he just set up Wireguard to the VPS server he rents to get "his own" IP.

balola 6y ago

ISPs in China is almost exclusively NAT now, you have to specifically ask for "public network IP" and provide a reason.

JoshGlazebrook 6y ago

ipv6 is heavily used in the mobile network space.

zokier 6y ago

We are out of ipv4 addresses. That is why amazons stockpile is worth $2B, that's how we are reduced to trading the existing addresses at ever increasing prices instead of getting new fresh ones essentially for free

mqus 6y ago

When i read the title, I first thought to myself that those 2 billion dollars will be pretty much worthless once everyone uses ipv6. But as soon as more ipv6 adresses are used (or CG-NAT), ipv4 adresses will become cheaper, so there seems to be a natural balance which will keep the state of "There are IPv4 adresses left" and "IPv4 adresses will run out sometime soon"

bluGill 6y ago
For a while, but eventually we will hit a tipping point where nobody cares about IPv4 anymore.
BlueTemplar 6y ago
Well, at some point the governments will actually start doing their jobs and ban IPv4 compatible hardware for sale, just like they did for obsolete analog/digital TV tuners and incandescent light bulbs.
- _alex_ 6y ago
  What are you talking about?
  - BlueTemplar 6y ago
    IPv4-compatible equipment is bad because it slows down the transition from IPv4 (aka ARPANET) to IPv6 (aka Internet). Since the free market seems to have trouble to find incentives to do it itself, the governments should force it, in the same way that they forced the transitions from obsolete TV tuners and incandescent light bulbs.

jlokier 6y ago

If you believe the Android screen Settings > About > Status, my phone is assigned only an IPv6 address, no IPv4. Despite this, it's able to connect to IPv4 web servers just fine. All connections from the IPv6-only phone to IPv4-only web are automatically NAT'd to IPv4 by the cell service provider. I've tested this recently and it uses a different ephemeral source IPv4 after a few minutes when doing this. Tested with HTTP, HTTPS and ICMP ECHO. It is definitely NAT. At the same time, my connections from the phone to IPv6-only web are not using NAT. The server sees the same source IPv6 as the phone reports as its own. When I enable tethering on my phone, it creates a local IPv4 wireless LAN. Devices on that LAN such as my laptop access the web using IPv4, which is NAT'd twice: Once on the phone when crossing from the WLAN to the cell network, then by the cell service provider to get an ephemeral source IPv4. This is double NAT. When the Linux VM on my laptop connects to an internet service and I'm using the Wifi hotspot on my phone, there's yet another NAT in the way, on the laptop itself. This is triple NAT. All this NAT means it doesn't matter so much that we are out of IPv4 addresses for phones. They can connect to both IPv4-only and IPv6-only services while assigned only a public IPv6. In fact phones don't need a public IPv6 either. They don't need any public address. Those NAT'd IPv4 connections don't go over the IPv6 link. They are not being translated to IPv6 and back. Rather, they go over what is effectively a private IPv4 tunnel to the cell provider. Just as IPv4 connections can work like that, so could IPv6 so there's no real need for the phone to report that it has any public IPv6 or IPv4 address at all. However, mine is currently reporting a public IPv6 and no IPv4, while able to make connections to both.

superkuh 6y ago

Most new devices on the internet are wireless phones and most wireless telcos do not give out an ipv4 addresses. They use carrier NAT to share some aspects of ipv4 connectivity but not the important things like being able to use ports.