12 ms·

For me it's a few things that keep me from fully embracing it, & largely the problem is perception, as others have noted. 1. I'm a small-time self hoster. I ne

For me it's a few things that keep me from fully embracing it, & largely the problem is perception, as others have noted. 1. I'm a small-time self hoster. I need/want to control access to geographic locations and using IPv4 makes that pretty easy. Last time I checked, IPv6 was just so wrong that it's no good to use at all, and most IPv6 addresses were "unknown" in origin. 2. I'm used to the pseudo security that a NAT gives. I hear (ad nausea) about how NAT gives you no security. The simple truth is that obscurity does give yet another layer of protection, especially for machines that you're busily configuring to become secure. Of course, a real sysadmin here will be able to scoff and laugh, but for this homebrew old timer it's true. But also, there's the obfuscation of your IP address when you're behind a NAT. This is pretty important in these ad tracking days. AFAIK (which is almost zero), doesn't IPv6 give adware companies a very good fingerprint on you? 3. All those ICMPv6 messages sniffing (and snooping?) really don't fill me with joy joy happiness. The only recourse is to read some dead boring RFC that my poor overloaded brain doesn't really want to have anything to do with. With IPv4, if you don't want PING, you turn it off, with IPv6.... it's subtle. 4. Firewalls require two sets of independent entries for the same service. So, IPv4 is an address space that's understood. IPv6 really does feel like a Godzillian monstrosity and a chore to type in: double colons between every number and it's in Hex? At least with IPv4 you can type the numbers in pretty rapidly on a numpad. So, I know this answer will be unpopular, especially to professionals, but for everyone I've encountered that's turned it off, the above list is pretty accurate. Every few years I search around for a true "IPv4 to IPv6 for noobs" and every time I only find "It's the same... with these gajillion subtle differences". So, yeah, perception is definitely an issue, but scoffing at NAT doesn't help uptake at all. I really do try to be a good netizen, but it's hard. (that said, I do have a mail server set up to use ipv6 and all is good... except for the lists of unknown sources who hammer away at its security all day, every day)

chippiewill 5y ago
Your arguments regarding NAT only make sense when considering carrier grade NAT. With IPv6 you can set up your machine to use "temporary" addresses which will use random addresses from your router's subnet instead of a fixed one (based off of the NIC's mac address) and for a limited duration. The duration is normally some number of hours, but you could make it 10 seconds if you preferred.
Slix 5y ago
> I'm used to the pseudo security that a NAT gives. In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? On my Netgear R6700, I can't figure it out from the UI or from forum posts/help content. And without being certain, I don't want to turn on IPv6. Even though I'm technical enough to understand IPv6. Because my printer or my light bulb being exposed to the internet is a huge risk that my router is supposed to stop.
- jiggawatts 5y ago
  IPv6 firewalls work the same as IPv4 firewalls. You just remove the NAT from the equation. The default is deny. You have to explicitly enable inbound ports. The difference is that you connect to the device address, not the NAT gateway address. No more port conflicts. No more split DNS. Etc...
- throw0101a 5y ago
  > In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? Copy-pasting from a previous discussion a little while ago: --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table/s it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it. The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 address/port, rewriting is not done. Only state tables are updated and checked. New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through. There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. The security comes from the state checking. […] I have a printer with an IPv6 stack. I also have IPv6 addresses from my ISP. Yet somehow my Asus AC-68U prevents the public Internet from reaching my printer. --- * https://news.ycombinator.com/item?id=28390634 https://news.ycombinator.com/item?id=28390634 IPv6 firewall on my Asus: * https://www.asus.com/us/support/FAQ/1013638/ https://www.asus.com/us/support/FAQ/1013638/ If you want to test, find the IPv6 address of your printer and try pinging it: * https://tools.keycdn.com/ipv6-ping https://tools.keycdn.com/ipv6-ping
throw0101a 5y ago
> 2. I'm used to the pseudo security that a NAT gives. If you wish to do this with IPv6 you can with ULA and NPTv6: * https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address * https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Translation https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr... > 3. All those ICMPv6 messages sniffing (and snooping?) really don't fill me with joy joy happiness. For those wondering: ping works by sending ICMP(v4) echo request packets. If you wish to block v4 ping you block echo requests (Type 8) and echo replies (Type 0): * https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol https://en.wikipedia.org/wiki/Internet_Control_Message_Proto... ping6 works by sending ICMP(v6) echo request packets. In IPv6-land block Types 128 and 129: * https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol_for_IPv6 https://en.wikipedia.org/wiki/Internet_Control_Message_Proto... To block traceroute block Types 11 (v4) and 3 (v6): TTL/hop exceeded notifications. > IPv6 really does feel like a Godzillian monstrosity and a chore to type in: double colons between every number and it's in Hex? At least with IPv4 you can type the numbers in pretty rapidly on a numpad. We've run out of IPv4 addresses. We need a larger address space with more bits. More bits mean more typing. Get over it? ¯\_(ツ)_/¯
- BenjiWiebe 5y ago
  Please don't block ttl exceeded packets... It will cause some very hard to troubleshoot network issues for someone somewhere sometime.
  - kjs3 5y ago
    Amen, brother. Someone like your CEO at somewhere like his lake house at the end of a dodgy DSL line from Cletus's ISP and Bait Shop. I kid, I kid...they didn't sell bait. There are a lot of unpleasant failure modes to blocking ICMP without completely understanding the implications.
  - throw0101a 5y ago
    I agree… but some folks seem to think blocking ping and traceroute give you some kind of extra security.
psim1 5y ago
> Last time I checked, IPv6 was just so wrong... > I'm used to the pseudo security that a NAT gives > my poor overloaded brain doesn't really want to have anything to do with You've certainly made the point that you are too lazy to learn. Otherwise, you haven't made a case against IPv6 at all.
- dx034 5y ago
  The point is that many people are too lazy to learn a more complicated alternative to something simple they've used for a long time. And that's why ipv6 still hasn't taken off in many areas.
kalleboo 5y ago
I've adopted IPv6 for a small business network I run and it's been great being able to punch small holes in the firewall for certain services without dealing with NAT, port conflicts for software that makes it hard to configure ports, etc. I have a bunch of services that I access there that are configured IPv6-only just because it's so much easier to configure than NAT. 2. MacOS and Windows use IPv6 Privacy Extensions to randomize your address https://en.wikipedia.org/wiki/IPv6_address#Temporary_addresses https://en.wikipedia.org/wiki/IPv6_address#Temporary_address... 3. They work great though, I always had weird MTU issues with IPv4 and had to hard-code one in my router, with IPv6 Path-MTU just works. It really annoys me when people turn off ping, stop doing that. 4. Poor UI for firewalls/routers that is not optimized for dual-stack IPv4/IPv6 is indeed a problem. And not just that, home or small business routers often have no IPv6 UI at all for stuff like firewall. With IPv4 I always had trouble remember exactly what number was what device, with IPv6 it kind of forced my hand to set up DNS entries for everything and that short-term pain (what, 15 minutes?) paid back every time I had to connect to some printer I couldn't remember if it was .218 or .215
5e92cb50239222b 5y ago
> 4. Firewalls require two sets of independent entries for the same service. Depends on the exact rule you're writing, but nftables can remove a lot of duplication. Many rules cover both IPv4 and IPv6. It's the default since Debian 11.
floatboth 5y ago
Don't touch ICMP, just don't. http://shouldiblockicmp.com http://shouldiblockicmp.com https://rachelbythebay.com/w/2015/05/15/pmtud/ https://rachelbythebay.com/w/2015/05/15/pmtud/ > sniffing (and snooping?) Nothing is new here. ND is basically what ARP was. You don't disable ARP, do you?
- kazen44 5y ago
  technically, you cannot even disable ARP because of it inherent reliance on ethernet... Atleast ND is a proper layer 3 seperation of link-layer discovery..
ksec 5y ago
Agree with every single point. I guess that is the difference from user perspective to engineering perspective. I often wished there was just a simple IPv5.

chippiewill 5y ago

Your arguments regarding NAT only make sense when considering carrier grade NAT. With IPv6 you can set up your machine to use "temporary" addresses which will use random addresses from your router's subnet instead of a fixed one (based off of the NIC's mac address) and for a limited duration. The duration is normally some number of hours, but you could make it 10 seconds if you preferred.

Slix 5y ago

> I'm used to the pseudo security that a NAT gives. In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? On my Netgear R6700, I can't figure it out from the UI or from forum posts/help content. And without being certain, I don't want to turn on IPv6. Even though I'm technical enough to understand IPv6. Because my printer or my light bulb being exposed to the internet is a huge risk that my router is supposed to stop.

jiggawatts 5y ago
IPv6 firewalls work the same as IPv4 firewalls. You just remove the NAT from the equation. The default is deny. You have to explicitly enable inbound ports. The difference is that you connect to the device address, not the NAT gateway address. No more port conflicts. No more split DNS. Etc...
throw0101a 5y ago
> In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? Copy-pasting from a previous discussion a little while ago: --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table/s it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it. The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 address/port, rewriting is not done. Only state tables are updated and checked. New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through. There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. The security comes from the state checking. […] I have a printer with an IPv6 stack. I also have IPv6 addresses from my ISP. Yet somehow my Asus AC-68U prevents the public Internet from reaching my printer. --- * https://news.ycombinator.com/item?id=28390634 https://news.ycombinator.com/item?id=28390634 IPv6 firewall on my Asus: * https://www.asus.com/us/support/FAQ/1013638/ https://www.asus.com/us/support/FAQ/1013638/ If you want to test, find the IPv6 address of your printer and try pinging it: * https://tools.keycdn.com/ipv6-ping https://tools.keycdn.com/ipv6-ping

throw0101a 5y ago

> 2. I'm used to the pseudo security that a NAT gives. If you wish to do this with IPv6 you can with ULA and NPTv6: * https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address * https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Translation https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr... > 3. All those ICMPv6 messages sniffing (and snooping?) really don't fill me with joy joy happiness. For those wondering: ping works by sending ICMP(v4) echo request packets. If you wish to block v4 ping you block echo requests (Type 8) and echo replies (Type 0): * https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol https://en.wikipedia.org/wiki/Internet_Control_Message_Proto... ping6 works by sending ICMP(v6) echo request packets. In IPv6-land block Types 128 and 129: * https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol_for_IPv6 https://en.wikipedia.org/wiki/Internet_Control_Message_Proto... To block traceroute block Types 11 (v4) and 3 (v6): TTL/hop exceeded notifications. > IPv6 really does feel like a Godzillian monstrosity and a chore to type in: double colons between every number and it's in Hex? At least with IPv4 you can type the numbers in pretty rapidly on a numpad. We've run out of IPv4 addresses. We need a larger address space with more bits. More bits mean more typing. Get over it? ¯\_(ツ)_/¯

BenjiWiebe 5y ago
Please don't block ttl exceeded packets... It will cause some very hard to troubleshoot network issues for someone somewhere sometime.
- kjs3 5y ago
  Amen, brother. Someone like your CEO at somewhere like his lake house at the end of a dodgy DSL line from Cletus's ISP and Bait Shop. I kid, I kid...they didn't sell bait. There are a lot of unpleasant failure modes to blocking ICMP without completely understanding the implications.
- throw0101a 5y ago
  I agree… but some folks seem to think blocking ping and traceroute give you some kind of extra security.

psim1 5y ago

> Last time I checked, IPv6 was just so wrong... > I'm used to the pseudo security that a NAT gives > my poor overloaded brain doesn't really want to have anything to do with You've certainly made the point that you are too lazy to learn. Otherwise, you haven't made a case against IPv6 at all.

dx034 5y ago
The point is that many people are too lazy to learn a more complicated alternative to something simple they've used for a long time. And that's why ipv6 still hasn't taken off in many areas.

kalleboo 5y ago

I've adopted IPv6 for a small business network I run and it's been great being able to punch small holes in the firewall for certain services without dealing with NAT, port conflicts for software that makes it hard to configure ports, etc. I have a bunch of services that I access there that are configured IPv6-only just because it's so much easier to configure than NAT. 2. MacOS and Windows use IPv6 Privacy Extensions to randomize your address https://en.wikipedia.org/wiki/IPv6_address#Temporary_addresses https://en.wikipedia.org/wiki/IPv6_address#Temporary_address... 3. They work great though, I always had weird MTU issues with IPv4 and had to hard-code one in my router, with IPv6 Path-MTU just works. It really annoys me when people turn off ping, stop doing that. 4. Poor UI for firewalls/routers that is not optimized for dual-stack IPv4/IPv6 is indeed a problem. And not just that, home or small business routers often have no IPv6 UI at all for stuff like firewall. With IPv4 I always had trouble remember exactly what number was what device, with IPv6 it kind of forced my hand to set up DNS entries for everything and that short-term pain (what, 15 minutes?) paid back every time I had to connect to some printer I couldn't remember if it was .218 or .215

5e92cb50239222b 5y ago

> 4. Firewalls require two sets of independent entries for the same service. Depends on the exact rule you're writing, but nftables can remove a lot of duplication. Many rules cover both IPv4 and IPv6. It's the default since Debian 11.

floatboth 5y ago

Don't touch ICMP, just don't. http://shouldiblockicmp.com http://shouldiblockicmp.com https://rachelbythebay.com/w/2015/05/15/pmtud/ https://rachelbythebay.com/w/2015/05/15/pmtud/ > sniffing (and snooping?) Nothing is new here. ND is basically what ARP was. You don't disable ARP, do you?

kazen44 5y ago
technically, you cannot even disable ARP because of it inherent reliance on ethernet... Atleast ND is a proper layer 3 seperation of link-layer discovery..

ksec 5y ago

Agree with every single point. I guess that is the difference from user perspective to engineering perspective. I often wished there was just a simple IPv5.