10 ms·

ELI5: Why does IPv6 adoption matter? What would happen if these sites don't migrate to IPv6?

by distalx 5y ago

TchoBeer 5y ago
We eventually run out of IPv4 addresses and have to switch anyway
- zinekeller 5y ago
  That doesn't work as an explanation. NAT was developed. CGNAT was developed. HTTP Host differentiation was developed. SNI was developed. STUN was developed. TURN was developed. The main problem with IPv4 to IPv6 migration is the, frankly, overzealous utopia that "they will migrate anyway". Worse, it's very different that doesn't allow for a simple upgrade option of "IPv4, but longer addresses" because IPv6 is designed to be fundamentally different. Which is more insulting considering that BGP was seamlessly upgraded from 65536 ASes to more than a million because they only changed the bits in an AS and nothing more. As a router developer, you only need to do the relatively minute changes of extended ASes than the (relative) mess that is IPv6.
  - neurostimulant 5y ago
    And now the internet got worse because you're no longer have technical freedom due to these NAT popping up everywhere. For example, previously if you want to release a video/voice chat app, you just release it and be done with it. Now it won't work like that due to NAT, so you'll have to maintain some STUN and TURN servers just to make your app usable to general public. Think about how many potential innovation got stifled because of added costs and complexity turned some people away before they even started.
    - Sunspark 5y ago
      I agree. It makes things much harder than it should be. I wanted to try installing the module into my router so it would pass the WebRTC test for STUN/TURN and perhaps make video even more efficient to allow point to point connection instead of having everything be relayed through a tertiary server, but there was no documentation and having never set up a STUN/TURN server before I couldn't get it to work. So I am dependent on what a third party has set up to facilitate connectivity. In the old days, you'd just connect to an IP address and that was it.
  - wbl 5y ago
    IPv6 implementations are everywhere so the extra changes don't really impact networks.
    - zinekeller 5y ago
      Regardless of monentary charges (and I'm very aware of them, APNIC is even considering grants to help in IPv6 because it's in limbo for so long), even if we activate IPv6 synchronously there's still many, many problems with it, even when you permanently dual-stack it. One is connectivity. Even theoretically we should have the same network connectivity (so to speak), you can feel the pettiness when Hurricane-Electric and Cogent fought exclusively on IPv6 (https://www.theregister.com/2018/08/28/ipv6_peering_squabbles/ https://www.theregister.com/2018/08/28/ipv6_peering_squabble...) I can't believe I'm saying this, but IPv6 isn't free (or at least costs the same as IPv4). Second is security. Yes, the world is no longer scannable, but consumer routers are a dud when it comes to IPv6 security. This router (https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0d...) has serious problems at IPv6 security, and because it's suffix is always at ::0000:0000:0000:0001 and you've eliminate around 18 bits more because of how networks are laid, you've got yourself an IPv6 botnet, which speaking by, how do you block them? A /64 would be a good start, but OVH provides a single address per server (https://www.ovhcloud.com/vps/compare/ https://www.ovhcloud.com/vps/compare/). That's it. Don't forget that fiasco with MAC addresses (https://datatracker.ietf.org/doc/html/rfc8981 https://datatracker.ietf.org/doc/html/rfc8981), but at least that's solved. Third, IPv6 should just work as you said. I wish that's true, but embedded devices will trip you up badly. Some don't fallback to IPv4 and instead try and try again using IPv6. This would be a concern while transitioning, but even after that, some would be still stuck because their servers are only operating on IPv4! Implementing IPv6 is not free lunch if you know the gritty details.
  - pixl97 5y ago
    >NAT was developed. CGNAT was developed. HTTP Host differentiation was developed. SNI was developed. STUN was developed. TURN was developed And every one of those has introduced its own security flaws and implementation bugs increasing the complexity of applications.
    - zinekeller 5y ago
      I'm advocating and helping networks to migrate to IPv6, but I'll say that IPv6 was rather a rats-nest design that shot itself in the foot. It's elegant sure, but as Torvalds would say to critics about his frequent use of goto, it's theoretically good but not sound engineering practice. The thing is we would be addressing in 128-bit IP already if it was done the BGP way: just minimising the necessary changes to implement it. Look at the effectiveness of Itanium versus AMD64 at migrating customers: IPv6 feels like Itanium, while extended ASes work more like AMD64. Whoever designed IPv6 was focused too much at the theoreticals, than looking at what the real world is and then designing around it.
      - ksec 5y ago
        Do we have anything for IPv4 similar to AMD64? Or are we forever stuck with either going all in to IPv6 or the current hybrid?
        zinekeller 5y ago
        Nope, but we're deep in IPv6 anyways so the best course of action is to finish that, just be careful of the pitfalls and not devolving into silliness like this peering fight: https://www.theregister.com/2018/08/28/ipv6_peering_squabbles/ https://www.theregister.com/2018/08/28/ipv6_peering_squabble...
      - Dagger2 5y ago
        Can you suggest a way of extending v4's address space that works like BGP or AMD64 do? I've asked a lot of people this question, and the only answers I've ever gotten are either impossible or already implemented by v6. Perhaps you will be the person to finally explain how to do it -- but as far as I can tell, it's just not possible, and I don't think it's fair to criticise v6 for not doing the impossible.
  - ikiris 5y ago
    tell me you're bad at math without telling me you're bad at math.
throw0101a 5y ago
Because there are 'only' 2^32, roughly four billion, IPv4 addresses. There are also over eight billion people on this planet, and many of them have multiple computers (smartphones, tablets, laptops, desktops, etc). As a 'temporary' measure, Network Address Translation (NAT) was introduced so people could get one public IPv4 address and have multiple machines on the Internet behind it. The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet. This isn't a big deal for most consumption-based computing (fetching mail, watching videos), but there are use cases where you want to be able to talk to the other system, so yet another set of technologies had to be invented to allow punching holes through NAT (UPnP, NAT-PMP, PCP, STUN). But we're at the point in some place where there aren't even enough IPv4 addresses to give to ISP customers even if they're using NAT. So you have a private IP address for your home system, and then your router gets a private IP address on its "public" WAN connection, and you end up going two layers of NAT. There is an entire segment of IPv4 addresses (100.64.0.0/10) reserved for telco use and doubel-NATing: * https://en.wikipedia.org/wiki/Private_network#Dedicated_space_for_carrier-grade_NAT_deployment https://en.wikipedia.org/wiki/Private_network#Dedicated_spac... * https://en.wikipedia.org/wiki/IPv4_shared_address_space https://en.wikipedia.org/wiki/IPv4_shared_address_space We can continue this NAT-upon-NAT(-upon-NAT) silliness, or we can simply make the up-front investment and start pushing out IPv6 in more places. Your router still provides firewall protection, but reachability is a lot more straight-forward because the (potentially double) address translation goes away. Edit: fix a bunch of typos.
- osrec 5y ago
  In your first line, I guess you mean to say ipv4 not ipv6.
- ugjka 5y ago
  there's also NAT64, 464XLAT that do ipv6 to ipv4 sorcery
  - throw0101a 5y ago
    Beyond an ELI5, but correct. If you are on an IPv4-only or IPv6-only network, you can reach the other through various mechanisms. A lot of mobile/cell networks are IPv6-only, and so the telcos need a way to allow clients to reach IPv4-only systems.
norenh 5y ago
I would argue that the main reason is that we are stuck with a centralized Internet with a somewhat large initial step to start a new service. If everyone get IPv6 we are all able to be a first class citizen on the Internet, meaning I can run a webserver or whatever from home. Once I am ready I can move on to a hosting provider with all the extra costs and hassle it comes with. Without IPv6, we are stuck with a two tier system of Internet users. Basically consumers and providers where the step to become a provider is larger than when you can simply start from home with whatever scrap you have in your garage. IPv6 will also simplify a lot of things (being able to scrap NAT (note, you will still need a firewall) and avoid protocol issues for End-to-End services) but that is just a bonus.
darzu 5y ago
From a game developer/player perspective: there’s a crazy amount of complexity in connecting between two computers that wouldn’t need to be there in an ipv6 world. See all the NAT, TURN, STUN nonsense that webrtc has to deal with: https://developer.mozilla.org/en-US/docs/Web/API/WebRTC_API/Protocols https://developer.mozilla.org/en-US/docs/Web/API/WebRTC_API/... Today to use webrtc, u need a neutral server to help establish the connection like PeerJS does. This wouldn’t be needed in an ipv6 world. It’s nearly impossible to do pure peer to peer connections today.
- nsizx 5y ago
  Letting machines connect directly to each other in any context, and especially in the context of an online game, is a massive security and privacy risk.
  - rjsw 5y ago
    You can (and should) still have a firewall that only allows connections to specific ports when using IPv6.
    - nsizx 5y ago
      Still you are revealing your IP address to the other parties, which will be more than happy to DoS you to force you to disconnect, exploit 0-days in the game networking code to crash your game or get your private info, know where you are located by IP geolocation... The idea of P2P in competitive videogames strikes me as absolutely insane
      - onei 5y ago
        When using NAT, you're revealing the IP address of your router. I don't know about you, but I don't have so many devices running on my home network that would drown out what I'm doing. With NAT, you can still receive DoS attacks, still have your game networking exploited, and still be geolocated. The only remotely security-related benefit is that instead of your ports being exposed to the wild internet, they're exposed to your router which is more of a side-effect rather than an actual benefit. Its not a reason to not bother having a firewall.
toast0 5y ago
NAT and especially CGNAT has a tendancy to cause problems. I vividly recall an incident where Jio's CGNAT was dropping idle TCP connections after 10 seconds of idle. (They fixed it, but I don't know if they fixed it for all destinations or only special destinations). And, of course, I say dropping, rather than closing, because NAT usually doesn't send FINs to close sessions when they're dropped. So you only find out when you try to send more data. Some NATs don't even send RST when you send data on a connection it dropped, so you have to wait for a timeout. There's also a capacity issue. If you're serving your website via a single IP (common with load balancers), you can only have 65535 connections from each client IP (assuming https on port 443 only, using non default ports is often a non-starter); if the user's ISP is sharing a very limited pool of IPs with a large number of users, it's conceivable that all the connections to your site could fill up.
- deleted 5y ago
  [deleted]
- kortilla 5y ago
  > if the user's ISP is sharing a very limited pool of IPs with a large number of users, it's conceivable that all the connections to your site could fill up. Unless each of your users is establishing 600 connections to your site, this isn’t a realistic issue. I don’t know of ISPs that go beyond 1000:1 over-subscription.
betterunix2 5y ago
IPv4 address space exhaustion. NAT breaks end-to-end connectivity, making entire classes of applications difficult to deploy, and this is made worse when the NAT gateway is not under a user's control. NAT gateway deployed by ISPs represent a violation of the end-to-end principle and have to be even more complex and stateful than the NAT gateways users often deploy. If you are looking for a specific problem NAT introduces, one good one is that NAT forces users and application developers to use protocols that the NAT gateway properly supports (e.g. TCP, UDP) and to only use those protocols in ways that are "NAT-friendly" (e.g. easy-to-track client-server sessions that are initiated from the private side the gateway) or else to use some NAT-specific protocol as a crutch (UPnP/IGD, STUN, etc.). When both ends of a two-party protocol are behind NAT gateways it can become even more painful and possibly require a third party to be introduced to an application that is otherwise unnecessary for the application. So at a minimum IPv6 gets us back to the end-to-end principle where Internet peers connect directly to each other without having to negotiate with the network itself. There are a few other advantages, like the fact that users can get large, publicly-routed addresses spaces for their own use (e.g. ISPs giving users a /56 prefix), simplified bridging of private networks (very low probability of collisions in the private IPv6 range), simplified router configuration (link-local addresses are always available so there is no need to assign numbers to every link), and other assorted niche benefits. In theory IPv6 should mean routers become more efficient because it is easier to aggregate prefixes, which should generally benefit Internet users by reducing latency (though at this point there is not much room left for improvement there).

ELI5: Why does IPv6 adoption matter? What would happen if these sites don't migrate to IPv6?

TchoBeer 5y ago

We eventually run out of IPv4 addresses and have to switch anyway

zinekeller 5y ago
That doesn't work as an explanation. NAT was developed. CGNAT was developed. HTTP Host differentiation was developed. SNI was developed. STUN was developed. TURN was developed. The main problem with IPv4 to IPv6 migration is the, frankly, overzealous utopia that "they will migrate anyway". Worse, it's very different that doesn't allow for a simple upgrade option of "IPv4, but longer addresses" because IPv6 is designed to be fundamentally different. Which is more insulting considering that BGP was seamlessly upgraded from 65536 ASes to more than a million because they only changed the bits in an AS and nothing more. As a router developer, you only need to do the relatively minute changes of extended ASes than the (relative) mess that is IPv6.
- neurostimulant 5y ago
  And now the internet got worse because you're no longer have technical freedom due to these NAT popping up everywhere. For example, previously if you want to release a video/voice chat app, you just release it and be done with it. Now it won't work like that due to NAT, so you'll have to maintain some STUN and TURN servers just to make your app usable to general public. Think about how many potential innovation got stifled because of added costs and complexity turned some people away before they even started.
  - Sunspark 5y ago
    I agree. It makes things much harder than it should be. I wanted to try installing the module into my router so it would pass the WebRTC test for STUN/TURN and perhaps make video even more efficient to allow point to point connection instead of having everything be relayed through a tertiary server, but there was no documentation and having never set up a STUN/TURN server before I couldn't get it to work. So I am dependent on what a third party has set up to facilitate connectivity. In the old days, you'd just connect to an IP address and that was it.
- wbl 5y ago
  IPv6 implementations are everywhere so the extra changes don't really impact networks.
  - zinekeller 5y ago
    Regardless of monentary charges (and I'm very aware of them, APNIC is even considering grants to help in IPv6 because it's in limbo for so long), even if we activate IPv6 synchronously there's still many, many problems with it, even when you permanently dual-stack it. One is connectivity. Even theoretically we should have the same network connectivity (so to speak), you can feel the pettiness when Hurricane-Electric and Cogent fought exclusively on IPv6 (https://www.theregister.com/2018/08/28/ipv6_peering_squabbles/ https://www.theregister.com/2018/08/28/ipv6_peering_squabble...) I can't believe I'm saying this, but IPv6 isn't free (or at least costs the same as IPv4). Second is security. Yes, the world is no longer scannable, but consumer routers are a dud when it comes to IPv6 security. This router (https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0d...) has serious problems at IPv6 security, and because it's suffix is always at ::0000:0000:0000:0001 and you've eliminate around 18 bits more because of how networks are laid, you've got yourself an IPv6 botnet, which speaking by, how do you block them? A /64 would be a good start, but OVH provides a single address per server (https://www.ovhcloud.com/vps/compare/ https://www.ovhcloud.com/vps/compare/). That's it. Don't forget that fiasco with MAC addresses (https://datatracker.ietf.org/doc/html/rfc8981 https://datatracker.ietf.org/doc/html/rfc8981), but at least that's solved. Third, IPv6 should just work as you said. I wish that's true, but embedded devices will trip you up badly. Some don't fallback to IPv4 and instead try and try again using IPv6. This would be a concern while transitioning, but even after that, some would be still stuck because their servers are only operating on IPv4! Implementing IPv6 is not free lunch if you know the gritty details.
- pixl97 5y ago
  >NAT was developed. CGNAT was developed. HTTP Host differentiation was developed. SNI was developed. STUN was developed. TURN was developed And every one of those has introduced its own security flaws and implementation bugs increasing the complexity of applications.
  - zinekeller 5y ago
    I'm advocating and helping networks to migrate to IPv6, but I'll say that IPv6 was rather a rats-nest design that shot itself in the foot. It's elegant sure, but as Torvalds would say to critics about his frequent use of goto, it's theoretically good but not sound engineering practice. The thing is we would be addressing in 128-bit IP already if it was done the BGP way: just minimising the necessary changes to implement it. Look at the effectiveness of Itanium versus AMD64 at migrating customers: IPv6 feels like Itanium, while extended ASes work more like AMD64. Whoever designed IPv6 was focused too much at the theoreticals, than looking at what the real world is and then designing around it.
    - ksec 5y ago
      Do we have anything for IPv4 similar to AMD64? Or are we forever stuck with either going all in to IPv6 or the current hybrid?
      - zinekeller 5y ago
        Nope, but we're deep in IPv6 anyways so the best course of action is to finish that, just be careful of the pitfalls and not devolving into silliness like this peering fight: https://www.theregister.com/2018/08/28/ipv6_peering_squabbles/ https://www.theregister.com/2018/08/28/ipv6_peering_squabble...
    - Dagger2 5y ago
      Can you suggest a way of extending v4's address space that works like BGP or AMD64 do? I've asked a lot of people this question, and the only answers I've ever gotten are either impossible or already implemented by v6. Perhaps you will be the person to finally explain how to do it -- but as far as I can tell, it's just not possible, and I don't think it's fair to criticise v6 for not doing the impossible.
- ikiris 5y ago
  tell me you're bad at math without telling me you're bad at math.

throw0101a 5y ago

Because there are 'only' 2^32, roughly four billion, IPv4 addresses. There are also over eight billion people on this planet, and many of them have multiple computers (smartphones, tablets, laptops, desktops, etc). As a 'temporary' measure, Network Address Translation (NAT) was introduced so people could get one public IPv4 address and have multiple machines on the Internet behind it. The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet. This isn't a big deal for most consumption-based computing (fetching mail, watching videos), but there are use cases where you want to be able to talk to the other system, so yet another set of technologies had to be invented to allow punching holes through NAT (UPnP, NAT-PMP, PCP, STUN). But we're at the point in some place where there aren't even enough IPv4 addresses to give to ISP customers even if they're using NAT. So you have a private IP address for your home system, and then your router gets a private IP address on its "public" WAN connection, and you end up going two layers of NAT. There is an entire segment of IPv4 addresses (100.64.0.0/10) reserved for telco use and doubel-NATing: * https://en.wikipedia.org/wiki/Private_network#Dedicated_space_for_carrier-grade_NAT_deployment https://en.wikipedia.org/wiki/Private_network#Dedicated_spac... * https://en.wikipedia.org/wiki/IPv4_shared_address_space https://en.wikipedia.org/wiki/IPv4_shared_address_space We can continue this NAT-upon-NAT(-upon-NAT) silliness, or we can simply make the up-front investment and start pushing out IPv6 in more places. Your router still provides firewall protection, but reachability is a lot more straight-forward because the (potentially double) address translation goes away. Edit: fix a bunch of typos.

osrec 5y ago
In your first line, I guess you mean to say ipv4 not ipv6.
ugjka 5y ago
there's also NAT64, 464XLAT that do ipv6 to ipv4 sorcery
- throw0101a 5y ago
  Beyond an ELI5, but correct. If you are on an IPv4-only or IPv6-only network, you can reach the other through various mechanisms. A lot of mobile/cell networks are IPv6-only, and so the telcos need a way to allow clients to reach IPv4-only systems.

norenh 5y ago

I would argue that the main reason is that we are stuck with a centralized Internet with a somewhat large initial step to start a new service. If everyone get IPv6 we are all able to be a first class citizen on the Internet, meaning I can run a webserver or whatever from home. Once I am ready I can move on to a hosting provider with all the extra costs and hassle it comes with. Without IPv6, we are stuck with a two tier system of Internet users. Basically consumers and providers where the step to become a provider is larger than when you can simply start from home with whatever scrap you have in your garage. IPv6 will also simplify a lot of things (being able to scrap NAT (note, you will still need a firewall) and avoid protocol issues for End-to-End services) but that is just a bonus.

darzu 5y ago

From a game developer/player perspective: there’s a crazy amount of complexity in connecting between two computers that wouldn’t need to be there in an ipv6 world. See all the NAT, TURN, STUN nonsense that webrtc has to deal with: https://developer.mozilla.org/en-US/docs/Web/API/WebRTC_API/Protocols https://developer.mozilla.org/en-US/docs/Web/API/WebRTC_API/... Today to use webrtc, u need a neutral server to help establish the connection like PeerJS does. This wouldn’t be needed in an ipv6 world. It’s nearly impossible to do pure peer to peer connections today.

nsizx 5y ago
Letting machines connect directly to each other in any context, and especially in the context of an online game, is a massive security and privacy risk.
- rjsw 5y ago
  You can (and should) still have a firewall that only allows connections to specific ports when using IPv6.
  - nsizx 5y ago
    Still you are revealing your IP address to the other parties, which will be more than happy to DoS you to force you to disconnect, exploit 0-days in the game networking code to crash your game or get your private info, know where you are located by IP geolocation... The idea of P2P in competitive videogames strikes me as absolutely insane
    - onei 5y ago
      When using NAT, you're revealing the IP address of your router. I don't know about you, but I don't have so many devices running on my home network that would drown out what I'm doing. With NAT, you can still receive DoS attacks, still have your game networking exploited, and still be geolocated. The only remotely security-related benefit is that instead of your ports being exposed to the wild internet, they're exposed to your router which is more of a side-effect rather than an actual benefit. Its not a reason to not bother having a firewall.

toast0 5y ago

NAT and especially CGNAT has a tendancy to cause problems. I vividly recall an incident where Jio's CGNAT was dropping idle TCP connections after 10 seconds of idle. (They fixed it, but I don't know if they fixed it for all destinations or only special destinations). And, of course, I say dropping, rather than closing, because NAT usually doesn't send FINs to close sessions when they're dropped. So you only find out when you try to send more data. Some NATs don't even send RST when you send data on a connection it dropped, so you have to wait for a timeout. There's also a capacity issue. If you're serving your website via a single IP (common with load balancers), you can only have 65535 connections from each client IP (assuming https on port 443 only, using non default ports is often a non-starter); if the user's ISP is sharing a very limited pool of IPs with a large number of users, it's conceivable that all the connections to your site could fill up.

deleted 5y ago
[deleted]
kortilla 5y ago
> if the user's ISP is sharing a very limited pool of IPs with a large number of users, it's conceivable that all the connections to your site could fill up. Unless each of your users is establishing 600 connections to your site, this isn’t a realistic issue. I don’t know of ISPs that go beyond 1000:1 over-subscription.

betterunix2 5y ago

IPv4 address space exhaustion. NAT breaks end-to-end connectivity, making entire classes of applications difficult to deploy, and this is made worse when the NAT gateway is not under a user's control. NAT gateway deployed by ISPs represent a violation of the end-to-end principle and have to be even more complex and stateful than the NAT gateways users often deploy. If you are looking for a specific problem NAT introduces, one good one is that NAT forces users and application developers to use protocols that the NAT gateway properly supports (e.g. TCP, UDP) and to only use those protocols in ways that are "NAT-friendly" (e.g. easy-to-track client-server sessions that are initiated from the private side the gateway) or else to use some NAT-specific protocol as a crutch (UPnP/IGD, STUN, etc.). When both ends of a two-party protocol are behind NAT gateways it can become even more painful and possibly require a third party to be introduced to an application that is otherwise unnecessary for the application. So at a minimum IPv6 gets us back to the end-to-end principle where Internet peers connect directly to each other without having to negotiate with the network itself. There are a few other advantages, like the fact that users can get large, publicly-routed addresses spaces for their own use (e.g. ISPs giving users a /56 prefix), simplified bridging of private networks (very low probability of collisions in the private IPv6 range), simplified router configuration (link-local addresses are always available so there is no need to assign numbers to every link), and other assorted niche benefits. In theory IPv6 should mean routers become more efficient because it is easier to aggregate prefixes, which should generally benefit Internet users by reducing latency (though at this point there is not much room left for improvement there).