12 ms·

The world in which IPv6 was a good design (2017)

120 points by sytelus 6y ago

xiwenc 6y ago
The article is way too long for the message it tried to convey. Whatever that message was, I didn't get it. Related to this topic: IF IPv6 was a drop-in replacement for IPv4 then I think the adoption would be much better today. For instance from an end-user (residential use-case), I should be able to upgrade my network equipment (modem, switches, routers) over time and each one of them should work with IPv6 when possible transparently independently. It's possible that one might not reap the benefits on ipv6 immediately but over time (gradually) we should.
- JoBrad 6y ago
  Counterpoint: Stephen Fry’s voice suddenly began narrating this entire for me around the third sentence. This probably biased everything else for me, but in my opinion, it’s exceedingly rare to find ~a complex~ any topic in IT discussed ~in depth~ at all in such well-written language as this post contains. I honestly don’t care if they were completely wrong; their tone invited thought and discussion (which is probably one reason it’s been posted several times, with decent discussion, to boot).
- ignoramous 6y ago
  > Whatever that message was, I didn't get it. You might want to read this (rather long) follow up: https://tailscale.com/blog/two-internets-both-flakey/ https://tailscale.com/blog/two-internets-both-flakey/ Important bits (paraphrased): > Avery’s Laws of Wifi Reliability (mostly a paraphrasing of a trivial subset of CAP theorem): > Rule #1 ("a OR b", success compounds and failure rates drop): if you have two wifi router brands that work with 90% of client devices, and your device has a problem with one of them, replacing the wifi router brand will fix the problem 90% of the time. Thus, an ISP offering both wifi routers has a [1 - (10% x 10%)] = 99% chance of eventual success* > Rule #2 ("a AND b", failure compounds and success drops): if you’re running two wifi routers at once (say, a primary router and an extender), and both of them work “correctly” for about 90% of the time each day, the chance that your network has no problems all day is 81%. > My claim is that the "choose between two internets [IPv4, IPv6]" problem is the same as the "choose between two flakey wifi routers on the same SSID" problem (Rule #2). We should not be surprised that the combined system is less reliable. > The World in Which IPv6 was a Good Design: mobile IP. That is, the ability for your connections to keep going even if you hop between IP addresses. If you had IP mobility, then you could migrate connections between your two internets in real time, based on live quality feedback. You could send the same packets over both links and see which ones work better. If you picked one link and it suddenly stopped, you could retransmit packets on the other link and pick up where you left off. Your precise heuristic wouldn’t even matter that much, as long as it tries both ways eventually. > If you had IP mobility, then you could convert the “a AND b” scenario (failure compounds) into the “a OR b” scenario (success compounds).
- fulafel 6y ago
  > I should be able to upgrade my network equipment (modem, switches, routers) over time and each one of them should work with IPv6 when possible transparently independently. Good news: this describes current reality. (Your ISP needs to do their bit of course too)
yamrzou 6y ago
Previous discussions: 2019 https://news.ycombinator.com/item?id=20167686 https://news.ycombinator.com/item?id=20167686 2017 https://news.ycombinator.com/item?id=14986324 https://news.ycombinator.com/item?id=14986324
tgv 6y ago
Well written. He had me at > Wouldn't it be better if it had just been IPv4 with more address bits? But it's not, oh goodness, is it ever not.
- fulafel 6y ago
  But v6 works fine as a "v4 with more bits" - Maybe some of the new features are underused, but they don't get in the way either or hinder deployment.
  - EarthLaunch 6y ago
    > just
    - fulafel 6y ago
      Well, nobody knew which new features would work out. I think looking back the bet on features that would pay off in saner network architectures are still quite defensible and some will likely pay off in the future when we move on from the dual stack norm.
  - magicalhippo 6y ago
    No, it really doesn't. The whole point of v6 was no more NAT. The consequence is that a prefix change is a major event. The original designers imagined the prefix to be eternal. Reality, predictably, turned out to be quite different. Sure there are ways to deal with this, but it's far from "v4 with more bits".
    - avian 6y ago
      This. ISP treating delegated prefixes the same way as a dynamic IP in IPv4 (as in, change it often and randomly) is one of my major pains as a user of IPv6. The whole network stack is very bad at handling this - it results in a very annoying, semi-broken network where things kind of work, but not really: hosts on local network might be reachable or not, depending on when they get the prefix change and adjust their global addresses accordingly. Hosts further uplink might be reachable or not, depending on when and in what sequence the ISP's routers get notified of the change. It's a nightmare if you want to have any kind of reliable connectivity.
alisonkisk 6y ago
> If, instead, we had identified sessions using only layer 4 data, then mobile IP would have worked perfectly. Remember kids, never use semantic data as a database primary key.
fulafel 6y ago
> All this wonderfulness depended on the ability to start over and throw away the legacy cruft we had built up. And that is, unfortunately, pretty much impossible. Even if IPv6 hits 99% penetration, that doesn't mean we'll be rid of IPv4. This bout of pessimism seems unfounded in the article. Of course most services and networks will get rid of v4 when a sufficiently high percentage of users and devices have moved, just like they do with other protocols. It won't disappear off the face of the earth, just like other old protocols didn't, you'll just find that you can't use it on most networks.
- konjin 6y ago
  When? IPv6 has been around since before I have coherent memories and IPv4 will be around until my children form theirs at the very least.
  - gogopuppygogo 6y ago
    Exactly. Technically ipv6 is designed to solve a real problem. Except the people who are charged with using/delivering service with IP addresses hate it with a passion. The majority of network folks I have interacted with joke about it. IPv6 is a terrible solution because ipv4 is so much easier for people to write down, remember, and actually use. An ipv6 address is more like a MAC address in that it exists and it’s supposed to be unique but no one is reciting their MAC address every day. Phone numbers, mailing addresses, and email addresses are all memorable. IPv6 is not and will not succeed as a result. Yes, I’m acutely aware it’s being forced on the industry because ipv4 is running out and there is no other option. However, the price of ipv4 blocks shows how badly people don’t want to switch to this miserable standard.
    - iam-TJ 6y ago
      The same was said about IP (IPv4). The original solution was a static hostname<>IP address table, "hosts.txt", centrally administered, that all hosts copied via FTP until that became too large. That led to the development of the Domain Name System (DNS) in 1983 [0]. DNS AAAA records do for IPv6 what A records do for IPv4. PTR records (for reverse look-ups) work for both. For zero configuration (no DNS server) we have multicast DNS (mDNS) [1]. [0] https://tools.ietf.org/html/rfc882.html https://tools.ietf.org/html/rfc882.html [1] https://tools.ietf.org/html/rfc6762.html https://tools.ietf.org/html/rfc6762.html
odc 6y ago
So what? Just because IPv6 does does not solve all the problems in networking it's trash and we should abandon it? No thanks. Where I live, ISPs are starting to share IPv4 addresses between several customers, which creates many problems. And QUIC over IPv6 is still a lot better than QUIC over IPv4.
- Hnrobert42 6y ago
  Where did this abandonment strawman come from? The article was just lamenting the mess.
- Triv888 6y ago
  Here Comcast started giving out "static" IPv4 addresses to dynamic IP customers, which is the opposite of sharing IPs... I can change it by spoofing my router's MAC address though.
  - zrail 6y ago
    When we moved recently Comcast rotated our IP to one that geolocates to two states away. Which is fine until every single big box store geolocates us to the wrong store.
    - Hnrobert42 6y ago
      I wonder if that is Comcast’s fault or the geolocation service’s.
      - csharptwdec19 6y ago
        Blaming Comcast is a very safe default.
  - tenebrisalietum 6y ago
    What do you mean? Just because Comcast leases you the same IP for years doesn't mean they're obligated to give you the same IP on your router's next DHCP request.
hartator 6y ago
IPv6 was over engineered. The fact that you need several hours to understand it while you get IPv4 in 5 minutes doesn’t push for adoption.
- tenebrisalietum 6y ago
  Explain. IPv4 takes time to understand too (e.g. subnetting) but it's more common so people deal with it much more.
  - Hnrobert42 6y ago
    Understanding how to read/write an IPv6 address is WAY more complicated than for IPv4. That barrier to entry alone likely prevents a lot of casual adoption. You can come back that IPv6 isn’t all that bad, but the real world adoption rate amongst individuals, even skilled hobbyists, speaks for itself.
    - capitol_ 6y ago
      I'm not that sure on how an adoption rate of 30-35% speaks for itself? https://www.google.com/intl/ru/ipv6/statistics.html#tab=ipv6-adoption https://www.google.com/intl/ru/ipv6/statistics.html#tab=ipv6... Maybe you mean that the increase in adoption is too slow, and I agree to that, but change always takes more time than we want, specially when there isn't clear financial incentives.
      - konjin 6y ago
        ipv6 is today older than the internet was when it was invented.
      - Hnrobert42 6y ago
        That’s why I said among individuals, specifically hobbyists. Sure, companies that consume vast quantities of IPv4 addresses have an economic incentive to use IPv6, so you will see some adoption. But the reason there is such a long tail is because the cost of adoption (learning it) is higher than the supposed benefits for most individuals and small corporations.
xaduha 6y ago
Don't miss a followup https://tailscale.com/blog/two-internets-both-flakey/ https://tailscale.com/blog/two-internets-both-flakey/
- ryanianian 6y ago
  Tailscale continues to delight me every day. I wish I could pay them for them my modest little use-case of remotely-accessing my ham radio and my rpis. Before tailscale I relied on flaky upnp or "configuring my router" and trying to bust through nats. Not sure IPv6 would have helped this at all given how hostile ISPs are.
  - cassianoleal 6y ago
    I'm not sure about the specifics of your setup, but it sounds like ZeroTier could help you there. I run it on my router as a Layer 2 bridge, and a client on each "road warrior" device (laptop, phone, etc). For my laptop, I even rely on self-hosted services for many things, including DNS and I have no noticeable latency even when on a crappy network. For context, all of that is running behind CGNAT for IPv4, which is very impressive.
  - breatheoften 6y ago
    I'm looking for a solution to the problem of exposing a port on my laptop port to the internet (let's say for example purposes: ssh server port) from whatever network my laptop happens to be connected to ... I want to be able to initiate connections back to my laptop from random devices which are connected to the internet via network infrastructure that I don't control ... Can tailscale give me that without me having to setup my own network infra somewhere? I loved these two articles and feel some amount of trust for the author's company based on the communication style and knowledge sharing -- just wondering before I dive in whether this tech offers a good solution to my problem?
    - ryanianian 6y ago
      If you can install tailscale on it you can join your private tailscale mesh network from it.
Havoc 6y ago
Yup. I can see that roughly half my traffic now flows over v6 but can’t for the life of me wrap my head around how any of it works. Barely managed to get the v6 traffic pihole filtered
- Dagger2 6y ago
  It doesn't really work any differently to v4. Most of your v4 knowledge still applies to v6's behavior. Subnetting and routing works no differently, and neither do the addresses themselves (other than being longer). It's passing packets around in exactly the same way v4 does. There are a few differences, e.g. default routes, IPs and maybe DNS come from RAs rather than DHCP. You also won't be using NAT, but that removes complexity so it should make things easier to understand.
the8472 6y ago
> There's only one catch: that's not how UDP and TCP work, and it's too late to update them. At least TCP is being worked on, MPTCP already is in iOS and is getting integrated into linux. As part of its ability to switch paths it will also have an endpoint-independent identifier, i.e. mobility.
- lights0123 6y ago
  "getting integrated into linux" meaning has been for a few weeks in a stable, LTS kernel
Already__Taken 6y ago
I've done what learning I can about ipv6 whilst not getting to use it in operation. (wasn't a work priority, can't use at home). Why wasn't it a perfect fit for kubernetes to be using instead of all the proxy and cluster-ip nating right out the gate?
- Dagger2 6y ago
  It was. Kubernetes should have been native v6-only from the start, with inbound v4 connections being handled by reverse proxies. Would've simplified the whole thing a bunch.
magicalhippo 6y ago
To me it feels like the IPv6 dream of a fully peer-to-peer connected network was the wrong turn. Instead I think they should have rolled with NAT. NAT is great because it acts as an abstraction layer for the external network, in that the nodes on the local network can talk to each other and be blissfully ignorant of the details of the external network. And for the majority of local networks there's a fundamental asymmetry between the local and external network. The majority of nodes on local networks only ever need to connect _out_ to the external network, they don't need incoming connections. Going to 128bit addresses essentially makes DNS required. And when using DNS nobody really cares about the address of the host. They just want to be able to talk to the host on the other end, whatever it is. Being fully peer-to-peer is a pipe dream. Nobody wants their entire local network exposed to the entire internet without a firewall. And with a firewall comes the exact same hole-punching problem that NAT has. So that's the problem they should have tried to solve better, I think. They should have embraced NAT and the inherent network asymmetry, and found ways to make it better rather than trying to abolish it. Embraced that DNS needs to play a more central role than it does today, because nobody really cares about addresses.
- marcosdumay 6y ago
  > The majority of nodes on local networks only ever need to connect _out_ to the external network, they don't need incoming connections. And that's how we can't transfer large files from one computer to another, and why audio and video calls over the internet are only done through well founded companies, so there's nearly no competition.
  - magicalhippo 6y ago
    If I give you the IPv6 address to my desktop computer, you still can't transfer a large file to me or try to video call me. The reason is I haven't configured my firewall to let any of those things through. IPv6 or IPv4 NAT is in the same boat.
    - aflag 6y ago
      I think the point is that NAT is not necessary in IPv6, whereas it is in IPv4 due to address shortage. You can still have a firewall without NAT, btw.
mikewarot 6y ago
I thought I knew how it all worked, because after all I once used ebtables and ipchains to build a dual-homed linux gateway back before that was a thing (marking packets was key to everything)...but nope. Thanks for sharing this!
deleted 6y ago
[deleted]
waynesonfire 6y ago
Would be great if my ISP would give me IPv6 addresses; until then, why bother?
xaduha 6y ago
IPv6 is basically on mobile providers shoulders right now, in my opinion. At some point it will go from opt-in to required, and later from required to the only option. And while it's not like mobile users use old sites much, but if you want them to have the ability to access yours, then you'll make sure it has IPv6 as well.
- WorldMaker 6y ago
  Several mobile providers have already gone past the "required" to the "only option" stage. There hasn't been major outages because the mobile OSes adapted just fine and NAT64 seems to work alright. We've crossed the point that most of the consumer internet is IPv6 by default. It's enterprise and other similar VPN adoption that has lagged behind, generally intentionally as businesses worry that IPv6 is harder to secure and have cultural momentum behind years of IPv4 security knowledge.

120 points by sytelus 6y ago

The article is way too long for the message it tried to convey. Whatever that message was, I didn't get it. Related to this topic: IF IPv6 was a drop-in replacement for IPv4 then I think the adoption would be much better today. For instance from an end-user (residential use-case), I should be able to upgrade my network equipment (modem, switches, routers) over time and each one of them should work with IPv6 when possible transparently independently. It's possible that one might not reap the benefits on ipv6 immediately but over time (gradually) we should.

JoBrad 6y ago
Counterpoint: Stephen Fry’s voice suddenly began narrating this entire for me around the third sentence. This probably biased everything else for me, but in my opinion, it’s exceedingly rare to find ~a complex~ any topic in IT discussed ~in depth~ at all in such well-written language as this post contains. I honestly don’t care if they were completely wrong; their tone invited thought and discussion (which is probably one reason it’s been posted several times, with decent discussion, to boot).
ignoramous 6y ago
> Whatever that message was, I didn't get it. You might want to read this (rather long) follow up: https://tailscale.com/blog/two-internets-both-flakey/ https://tailscale.com/blog/two-internets-both-flakey/ Important bits (paraphrased): > Avery’s Laws of Wifi Reliability (mostly a paraphrasing of a trivial subset of CAP theorem): > Rule #1 ("a OR b", success compounds and failure rates drop): if you have two wifi router brands that work with 90% of client devices, and your device has a problem with one of them, replacing the wifi router brand will fix the problem 90% of the time. Thus, an ISP offering both wifi routers has a [1 - (10% x 10%)] = 99% chance of eventual success* > Rule #2 ("a AND b", failure compounds and success drops): if you’re running two wifi routers at once (say, a primary router and an extender), and both of them work “correctly” for about 90% of the time each day, the chance that your network has no problems all day is 81%. > My claim is that the "choose between two internets [IPv4, IPv6]" problem is the same as the "choose between two flakey wifi routers on the same SSID" problem (Rule #2). We should not be surprised that the combined system is less reliable. > The World in Which IPv6 was a Good Design: mobile IP. That is, the ability for your connections to keep going even if you hop between IP addresses. If you had IP mobility, then you could migrate connections between your two internets in real time, based on live quality feedback. You could send the same packets over both links and see which ones work better. If you picked one link and it suddenly stopped, you could retransmit packets on the other link and pick up where you left off. Your precise heuristic wouldn’t even matter that much, as long as it tries both ways eventually. > If you had IP mobility, then you could convert the “a AND b” scenario (failure compounds) into the “a OR b” scenario (success compounds).
fulafel 6y ago
> I should be able to upgrade my network equipment (modem, switches, routers) over time and each one of them should work with IPv6 when possible transparently independently. Good news: this describes current reality. (Your ISP needs to do their bit of course too)

yamrzou 6y ago

Previous discussions: 2019 https://news.ycombinator.com/item?id=20167686 https://news.ycombinator.com/item?id=20167686 2017 https://news.ycombinator.com/item?id=14986324 https://news.ycombinator.com/item?id=14986324

tgv 6y ago

Well written. He had me at > Wouldn't it be better if it had just been IPv4 with more address bits? But it's not, oh goodness, is it ever not.

fulafel 6y ago
But v6 works fine as a "v4 with more bits" - Maybe some of the new features are underused, but they don't get in the way either or hinder deployment.
- EarthLaunch 6y ago
  > just
  - fulafel 6y ago
    Well, nobody knew which new features would work out. I think looking back the bet on features that would pay off in saner network architectures are still quite defensible and some will likely pay off in the future when we move on from the dual stack norm.
- magicalhippo 6y ago
  No, it really doesn't. The whole point of v6 was no more NAT. The consequence is that a prefix change is a major event. The original designers imagined the prefix to be eternal. Reality, predictably, turned out to be quite different. Sure there are ways to deal with this, but it's far from "v4 with more bits".
  - avian 6y ago
    This. ISP treating delegated prefixes the same way as a dynamic IP in IPv4 (as in, change it often and randomly) is one of my major pains as a user of IPv6. The whole network stack is very bad at handling this - it results in a very annoying, semi-broken network where things kind of work, but not really: hosts on local network might be reachable or not, depending on when they get the prefix change and adjust their global addresses accordingly. Hosts further uplink might be reachable or not, depending on when and in what sequence the ISP's routers get notified of the change. It's a nightmare if you want to have any kind of reliable connectivity.

alisonkisk 6y ago

> If, instead, we had identified sessions using only layer 4 data, then mobile IP would have worked perfectly. Remember kids, never use semantic data as a database primary key.

fulafel 6y ago

> All this wonderfulness depended on the ability to start over and throw away the legacy cruft we had built up. And that is, unfortunately, pretty much impossible. Even if IPv6 hits 99% penetration, that doesn't mean we'll be rid of IPv4. This bout of pessimism seems unfounded in the article. Of course most services and networks will get rid of v4 when a sufficiently high percentage of users and devices have moved, just like they do with other protocols. It won't disappear off the face of the earth, just like other old protocols didn't, you'll just find that you can't use it on most networks.

konjin 6y ago
When? IPv6 has been around since before I have coherent memories and IPv4 will be around until my children form theirs at the very least.
- gogopuppygogo 6y ago
  Exactly. Technically ipv6 is designed to solve a real problem. Except the people who are charged with using/delivering service with IP addresses hate it with a passion. The majority of network folks I have interacted with joke about it. IPv6 is a terrible solution because ipv4 is so much easier for people to write down, remember, and actually use. An ipv6 address is more like a MAC address in that it exists and it’s supposed to be unique but no one is reciting their MAC address every day. Phone numbers, mailing addresses, and email addresses are all memorable. IPv6 is not and will not succeed as a result. Yes, I’m acutely aware it’s being forced on the industry because ipv4 is running out and there is no other option. However, the price of ipv4 blocks shows how badly people don’t want to switch to this miserable standard.
  - iam-TJ 6y ago
    The same was said about IP (IPv4). The original solution was a static hostname<>IP address table, "hosts.txt", centrally administered, that all hosts copied via FTP until that became too large. That led to the development of the Domain Name System (DNS) in 1983 [0]. DNS AAAA records do for IPv6 what A records do for IPv4. PTR records (for reverse look-ups) work for both. For zero configuration (no DNS server) we have multicast DNS (mDNS) [1]. [0] https://tools.ietf.org/html/rfc882.html https://tools.ietf.org/html/rfc882.html [1] https://tools.ietf.org/html/rfc6762.html https://tools.ietf.org/html/rfc6762.html

odc 6y ago

So what? Just because IPv6 does does not solve all the problems in networking it's trash and we should abandon it? No thanks. Where I live, ISPs are starting to share IPv4 addresses between several customers, which creates many problems. And QUIC over IPv6 is still a lot better than QUIC over IPv4.

Hnrobert42 6y ago
Where did this abandonment strawman come from? The article was just lamenting the mess.
Triv888 6y ago
Here Comcast started giving out "static" IPv4 addresses to dynamic IP customers, which is the opposite of sharing IPs... I can change it by spoofing my router's MAC address though.
- zrail 6y ago
  When we moved recently Comcast rotated our IP to one that geolocates to two states away. Which is fine until every single big box store geolocates us to the wrong store.
  - Hnrobert42 6y ago
    I wonder if that is Comcast’s fault or the geolocation service’s.
    - csharptwdec19 6y ago
      Blaming Comcast is a very safe default.
- tenebrisalietum 6y ago
  What do you mean? Just because Comcast leases you the same IP for years doesn't mean they're obligated to give you the same IP on your router's next DHCP request.

hartator 6y ago

IPv6 was over engineered. The fact that you need several hours to understand it while you get IPv4 in 5 minutes doesn’t push for adoption.

tenebrisalietum 6y ago
Explain. IPv4 takes time to understand too (e.g. subnetting) but it's more common so people deal with it much more.
- Hnrobert42 6y ago
  Understanding how to read/write an IPv6 address is WAY more complicated than for IPv4. That barrier to entry alone likely prevents a lot of casual adoption. You can come back that IPv6 isn’t all that bad, but the real world adoption rate amongst individuals, even skilled hobbyists, speaks for itself.
  - capitol_ 6y ago
    I'm not that sure on how an adoption rate of 30-35% speaks for itself? https://www.google.com/intl/ru/ipv6/statistics.html#tab=ipv6-adoption https://www.google.com/intl/ru/ipv6/statistics.html#tab=ipv6... Maybe you mean that the increase in adoption is too slow, and I agree to that, but change always takes more time than we want, specially when there isn't clear financial incentives.
    - konjin 6y ago
      ipv6 is today older than the internet was when it was invented.
    - Hnrobert42 6y ago
      That’s why I said among individuals, specifically hobbyists. Sure, companies that consume vast quantities of IPv4 addresses have an economic incentive to use IPv6, so you will see some adoption. But the reason there is such a long tail is because the cost of adoption (learning it) is higher than the supposed benefits for most individuals and small corporations.

xaduha 6y ago

Don't miss a followup https://tailscale.com/blog/two-internets-both-flakey/ https://tailscale.com/blog/two-internets-both-flakey/

ryanianian 6y ago
Tailscale continues to delight me every day. I wish I could pay them for them my modest little use-case of remotely-accessing my ham radio and my rpis. Before tailscale I relied on flaky upnp or "configuring my router" and trying to bust through nats. Not sure IPv6 would have helped this at all given how hostile ISPs are.
- cassianoleal 6y ago
  I'm not sure about the specifics of your setup, but it sounds like ZeroTier could help you there. I run it on my router as a Layer 2 bridge, and a client on each "road warrior" device (laptop, phone, etc). For my laptop, I even rely on self-hosted services for many things, including DNS and I have no noticeable latency even when on a crappy network. For context, all of that is running behind CGNAT for IPv4, which is very impressive.
- breatheoften 6y ago
  I'm looking for a solution to the problem of exposing a port on my laptop port to the internet (let's say for example purposes: ssh server port) from whatever network my laptop happens to be connected to ... I want to be able to initiate connections back to my laptop from random devices which are connected to the internet via network infrastructure that I don't control ... Can tailscale give me that without me having to setup my own network infra somewhere? I loved these two articles and feel some amount of trust for the author's company based on the communication style and knowledge sharing -- just wondering before I dive in whether this tech offers a good solution to my problem?
  - ryanianian 6y ago
    If you can install tailscale on it you can join your private tailscale mesh network from it.

Havoc 6y ago

Yup. I can see that roughly half my traffic now flows over v6 but can’t for the life of me wrap my head around how any of it works. Barely managed to get the v6 traffic pihole filtered

Dagger2 6y ago
It doesn't really work any differently to v4. Most of your v4 knowledge still applies to v6's behavior. Subnetting and routing works no differently, and neither do the addresses themselves (other than being longer). It's passing packets around in exactly the same way v4 does. There are a few differences, e.g. default routes, IPs and maybe DNS come from RAs rather than DHCP. You also won't be using NAT, but that removes complexity so it should make things easier to understand.

the8472 6y ago

> There's only one catch: that's not how UDP and TCP work, and it's too late to update them. At least TCP is being worked on, MPTCP already is in iOS and is getting integrated into linux. As part of its ability to switch paths it will also have an endpoint-independent identifier, i.e. mobility.

lights0123 6y ago
"getting integrated into linux" meaning has been for a few weeks in a stable, LTS kernel

Already__Taken 6y ago

I've done what learning I can about ipv6 whilst not getting to use it in operation. (wasn't a work priority, can't use at home). Why wasn't it a perfect fit for kubernetes to be using instead of all the proxy and cluster-ip nating right out the gate?

Dagger2 6y ago
It was. Kubernetes should have been native v6-only from the start, with inbound v4 connections being handled by reverse proxies. Would've simplified the whole thing a bunch.

magicalhippo 6y ago

To me it feels like the IPv6 dream of a fully peer-to-peer connected network was the wrong turn. Instead I think they should have rolled with NAT. NAT is great because it acts as an abstraction layer for the external network, in that the nodes on the local network can talk to each other and be blissfully ignorant of the details of the external network. And for the majority of local networks there's a fundamental asymmetry between the local and external network. The majority of nodes on local networks only ever need to connect _out_ to the external network, they don't need incoming connections. Going to 128bit addresses essentially makes DNS required. And when using DNS nobody really cares about the address of the host. They just want to be able to talk to the host on the other end, whatever it is. Being fully peer-to-peer is a pipe dream. Nobody wants their entire local network exposed to the entire internet without a firewall. And with a firewall comes the exact same hole-punching problem that NAT has. So that's the problem they should have tried to solve better, I think. They should have embraced NAT and the inherent network asymmetry, and found ways to make it better rather than trying to abolish it. Embraced that DNS needs to play a more central role than it does today, because nobody really cares about addresses.

marcosdumay 6y ago
> The majority of nodes on local networks only ever need to connect _out_ to the external network, they don't need incoming connections. And that's how we can't transfer large files from one computer to another, and why audio and video calls over the internet are only done through well founded companies, so there's nearly no competition.
- magicalhippo 6y ago
  If I give you the IPv6 address to my desktop computer, you still can't transfer a large file to me or try to video call me. The reason is I haven't configured my firewall to let any of those things through. IPv6 or IPv4 NAT is in the same boat.
  - aflag 6y ago
    I think the point is that NAT is not necessary in IPv6, whereas it is in IPv4 due to address shortage. You can still have a firewall without NAT, btw.

mikewarot 6y ago

I thought I knew how it all worked, because after all I once used ebtables and ipchains to build a dual-homed linux gateway back before that was a thing (marking packets was key to everything)...but nope. Thanks for sharing this!

deleted 6y ago

[deleted]

waynesonfire 6y ago

Would be great if my ISP would give me IPv6 addresses; until then, why bother?

xaduha 6y ago

IPv6 is basically on mobile providers shoulders right now, in my opinion. At some point it will go from opt-in to required, and later from required to the only option. And while it's not like mobile users use old sites much, but if you want them to have the ability to access yours, then you'll make sure it has IPv6 as well.

WorldMaker 6y ago
Several mobile providers have already gone past the "required" to the "only option" stage. There hasn't been major outages because the mobile OSes adapted just fine and NAT64 seems to work alright. We've crossed the point that most of the consumer internet is IPv6 by default. It's enterprise and other similar VPN adoption that has lagged behind, generally intentionally as businesses worry that IPv6 is harder to secure and have cultural momentum behind years of IPv4 security knowledge.