4 ms·

Genuine question, what do we get out of adopting IPv6? I remember being told for years that we'd run out of IP addresses (which hasn't happened thanks to NAT).

Genuine question, what do we get out of adopting IPv6? I remember being told for years that we'd run out of IP addresses (which hasn't happened thanks to NAT). What are the advantages of IPv6 from a practical standpoint?

josephcsible 5y ago
That you don't have to use NAT, especially carrier grade NAT, anymore.
nobody9999 5y ago
>What are the advantages of IPv6 from a practical standpoint? There are a whole raft of advantages: 1. NAT/CGNAT[0] becomes irrelevant (although you can still use local/non-routable prefixes if you wish), eliminating many of the issues around port forwarding and reachability of services; 2. While IPSec is broadly available for IPv4, encryption and authentication are baked into IPv6; 3. The enormous size of the IPv6 addresses would allow every location to have their own 16 bits (or more, if necessary) of routable address space; 4. Despite NAT, we have already run out of IPv4 address space[1] across all regions. There are other good reasons for IPv6 too, but those are the most important IMHO. [0] https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT [1] https://en.wikipedia.org/wiki/IPv4_address_exhaustion https://en.wikipedia.org/wiki/IPv4_address_exhaustion
vlmutolo 5y ago
- You pay less money for a single public IP. A single IPv4 costs $40 nowadays [0]. A whole /64 of IPv6 addresses usually comes free when you buy your internet access. - You get extra bits to play with for addressing. Fly.io has done some cool stuff with their "6PN" addresses, built on top of IPv6 and Wireguard. They encode information in the address itself and use eBPF to route on it. - As a result of everyone essentially having infinite public addresses to assign for themselves, we can get rid of NAT, which would enable peer-to-peer apps. See Tailscale's "How NAT Traversal Works" post for a great survey of the techniques used to connect devices behind NATs. (Note that getting rid of NATs does not mean getting rid of private networks or block-all-inbound firewalls. IPv6 allows both of these security measures.) - Some more points here [2] I hadn't seen, particularly around better routing efficiency by getting rid of IP checksums and allowing for smaller routing tables. [0] https://ipv4marketgroup.com/ipv4-pricing/ https://ipv4marketgroup.com/ipv4-pricing/ [1] https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ [2] https://www.networkcomputing.com/networking/six-benefits-ipv6 https://www.networkcomputing.com/networking/six-benefits-ipv...
DandyDev 5y ago
We _are_ running out of public IPv4 addresses. I routinely see articles shared on HN about companies buying or selling blocks of IPv4 addresses for increasingly insane prices. I think the market rate is now $40 for a single IP address?
jimrandomh 5y ago
IPv4 addresses are easily enumerable, and this is a security problem; people looking for instances of vulnerable software will routinely try every IPv4 address (or search Shodan, a search engine for what-services-are-running-on-each-IP-address). With IPv6, you can't really find random devices that aren't hooked up to DNS or otherwise trying to be found; guessing IPv6 addresses is more akin to guessing passwords.

josephcsible 5y ago

That you don't have to use NAT, especially carrier grade NAT, anymore.

nobody9999 5y ago

>What are the advantages of IPv6 from a practical standpoint? There are a whole raft of advantages: 1. NAT/CGNAT[0] becomes irrelevant (although you can still use local/non-routable prefixes if you wish), eliminating many of the issues around port forwarding and reachability of services; 2. While IPSec is broadly available for IPv4, encryption and authentication are baked into IPv6; 3. The enormous size of the IPv6 addresses would allow every location to have their own 16 bits (or more, if necessary) of routable address space; 4. Despite NAT, we have already run out of IPv4 address space[1] across all regions. There are other good reasons for IPv6 too, but those are the most important IMHO. [0] https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT [1] https://en.wikipedia.org/wiki/IPv4_address_exhaustion https://en.wikipedia.org/wiki/IPv4_address_exhaustion

vlmutolo 5y ago

- You pay less money for a single public IP. A single IPv4 costs $40 nowadays [0]. A whole /64 of IPv6 addresses usually comes free when you buy your internet access. - You get extra bits to play with for addressing. Fly.io has done some cool stuff with their "6PN" addresses, built on top of IPv6 and Wireguard. They encode information in the address itself and use eBPF to route on it. - As a result of everyone essentially having infinite public addresses to assign for themselves, we can get rid of NAT, which would enable peer-to-peer apps. See Tailscale's "How NAT Traversal Works" post for a great survey of the techniques used to connect devices behind NATs. (Note that getting rid of NATs does not mean getting rid of private networks or block-all-inbound firewalls. IPv6 allows both of these security measures.) - Some more points here [2] I hadn't seen, particularly around better routing efficiency by getting rid of IP checksums and allowing for smaller routing tables. [0] https://ipv4marketgroup.com/ipv4-pricing/ https://ipv4marketgroup.com/ipv4-pricing/ [1] https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ [2] https://www.networkcomputing.com/networking/six-benefits-ipv6 https://www.networkcomputing.com/networking/six-benefits-ipv...

DandyDev 5y ago

We _are_ running out of public IPv4 addresses. I routinely see articles shared on HN about companies buying or selling blocks of IPv4 addresses for increasingly insane prices. I think the market rate is now $40 for a single IP address?

jimrandomh 5y ago

IPv4 addresses are easily enumerable, and this is a security problem; people looking for instances of vulnerable software will routinely try every IPv4 address (or search Shodan, a search engine for what-services-are-running-on-each-IP-address). With IPv6, you can't really find random devices that aren't hooked up to DNS or otherwise trying to be found; guessing IPv6 addresses is more akin to guessing passwords.