8 ms·

Taken from a previous comment I’ve made re IPv6: IPv6 is fundamentally not ready for real world use within small/medium businesses and homes IMO. At least not

Taken from a previous comment I’ve made re IPv6: IPv6 is fundamentally not ready for real world use within small/medium businesses and homes IMO. At least not without NAT. Why? - Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. I’m not making this up- retail/gas/food industries often have a plethora of networks at a location, and the business/franchise owner is not tech literate, or even if they were, the equipment is managed by third party vendors and they don’t want to customise their IP network for each location. It makes for messy deployment and maintenance. - Can’t just simply open a firewall rule on the main site router to forward say HTTPS to an internal service. Why? Not all ISPs give static IPv6 prefixes, not all PCs/servers/devices support DHCP6 for static leases, and then there’s IPv6 privacy addresses. Yes, you can statically configure (only if ISP is static too!). No, I don’t want to open the port to all devices on the LAN and no I can’t rely on each device to be running their own firewall (let alone a properly configured one!). - WAN failover / multiple ISPs is hard. You have a fibre primary feed, and a secondary cellular/5G feed. Each has different IPv6 addresses. How do you ensure the right ISP is used at any given point? IPv6 shifts this decision to the client. This makes load balancing and policy based traffic routing (eg VoIP over fibre 1, FTP over fibre 2, etc). Also the cost of using a multi-homed IPv6 subnet & BGP in a SME/retail business is out of the question (plus the cellular ISP wouldn’t support it anyway). All the above works fine out of the box with IPv4 and NAT. It’s bread and butter easy. At the cost of not having dedicated unique public IPs but these places simply don’t need them. What IPv6 should have done to ensure a smooth migration is allowed for NAT from the very start. That would have let everyone who needed public IPs get them straight away, and those that didn’t to still migrate anyway with as little drama as possible. But it’s just not the case, NAT has been slowly added but it’s support is far from ubiquitous that IPv4 has.

jiggawatts 5y ago
The only "problem" here that is caused by IPv6 is the SD-WAN / multi-provider scenario. Even that is solvable. There are so many IPv6 addresses that your local router can have a unique routable range that it can hand out to the local network, "masking" the external internet provider addresses in the same way that IPv4 routing does it. That's not NAT, that's just routing. E.g. I have a customer that uses a non-RFC1918 public range internally and they have 5 ISP uplinks. They don't need to renumber their internal range just to fail over to another link. ALL of the other issues are caused by vendors selling garbage products that have IPv6 as a "checkbox" tick without real support. The real problem is that network engineers around the world let them get away with it, because they avoid IPv6 because of this perception that it isn't mature. The protocol is over two decades old! It's been fully supported since Windows 2000! My phone is IPv6. My fibre LAN is IPv6. It just works. What doesn't work is this attitude where people just like you continue to pay for products that only pay lip service to the future. I've gone on rants here before about enormous service providers like AWS and Azure providing IPv6 "support" that is an absolute garbage fire. Totally worthless. Useless beyond belief. Literally counterproductive in the case of Azure, where turning on IPv6 anywhere will break unrelated IPv4 functionality! Nobody ever chimes in to say: "Yes, we agree, this is bad." Nobody ever says "Microsoft should fix this!" Nobody has a problem. So now we have situations like the one you just described, where people are still buying routers in 2021 that that can't handle the most basic IPv6 functionality. IPv4 addresses are now USD $40 each and rising exponentially. I really do hope the COVID case number graphs taught some of you in a visceral sense what the world "exponential" means. Hint: it doesn't mean that it'll cost $60 in a decade. Try $40000, each. My ISP uses carrier-grade NAT on IPv4, breaking sites all over the place. I had to call them to enable a dedicated IPv4 address. Their annual investor report says that they will run out within a couple of years. Get one now while you can is the message. Do you have any idea how much code is required for two PCs to communicate directly now, with up to 4 NAT layers as a common scenario? It's a huge library you have to integrate in your code and then you need a cloud service to assist it. This is madness, and network engineers around the world are perpetuating it.
- yardstick 5y ago
  > The only "problem" here that is caused by IPv6 is the SD-WAN / multi-provider scenario. Even that is solvable. There are so many IPv6 addresses that your local router can have a unique routable range that it can hand out to the local network, "masking" the external internet provider addresses in the same way that IPv4 routing does it. That's not NAT, that's just routing. E.g. I have a customer that uses a non-RFC1918 public range internally and they have 5 ISP uplinks. They don't need to renumber their internal range just to fail over to another link. Neither does anyone using IPv4. Does your customer use BGP for that public IPv6 range? Do they have cellular links? Can they load balance some traffic over two/three links? Can they direct certain protocols over different carriers?
- hansel_der 5y ago
  y u so mad? > Literally counterproductive in the case of Azure, where turning on IPv6 anywhere will break unrelated IPv4 functionality! not just on azure; smartphones seem to be the only environment were v6 is doing its job (lots of smartphones need lots of addresses. ipv6 has a lot of addresses, problem solved) and i guess it's because they are most user-centric client-device imaginable, the actual users don't care at all and most importantly; expect things to occasionally fail.
  - jiggawatts 5y ago
    I'm mad because network "engineers" use that word without realising what it entails to earn that title. The painting has been on the wall for decades. IPv4 exhaustion was predicted to the week. Did anyone do anything about it? No. There are people talking about how Kubernetes is the "future" on this very forum, yet it simply does not work with IPv6. Instead, it uses NAT and RFC1918 ranges... but you've got to be careful not to accidentally overlap those subnets with the rest of your network! I have a customer that screwed this up and now they're facing a rebuild of 3 out of 4 of their clusters. Fun times. I have another customer undergoing mergers, where renumbering their IPv4 RFC1918 ranges is going to cost them on the order of $10M. IPv4 is the legacy, and its costing real money to keep it going decades after its expiry.
rnhmjoj 5y ago
> Not all IPv6 routers support DHCP-PD I my experience, they all did. I'm not even sure how you could possibly deploy IPv6 without it, manually handing out prefixes? > you could have 2-3-4 levels of routers/firewalls at a business. It seems just a bad design, but I still don't see how IPv6 would not allow it. > Why? Not all ISPs give static IPv6 prefixes, not all PCs/servers/devices support DHCP6 for static leases, and then there’s IPv6 privacy addresses 1. you don't need a static prefix to write a firewall rule: you can simply remove the dynamic prefix with a mask and match the EUI-64 suffix. For example with ip6tables it's something like this `::e2ab:8fff:fe12:3b6b/-64`. 2. All IPv6 devices do support SLAAC with a stable address mechanism, either EUI-64 or stable privacy address and you can use that in the firewall rule. 3. IPv6 privacy extensions, when enabled, don't preclude listening and accepting connection on the EUI-64 address. So, an inbound traffic firewall rule will just use the stable address: you shouldn't listen on a privacy address, they are for outbound connections. > Each has different IPv6 addresses. How do you ensure the right ISP is used at any given point? IPv6 shifts this decision to the client. I honestly don't understand the difference with IPv4. You can have multiple addresses and do load balancing on the router with both. > IPv6 shifts this decision to the client. This makes load balancing and policy based traffic routing I can't comment on this because I never tried it, either on IPv4 or IPv6. On top of my head, I'd say it would be possible by updating the routes priorities with an RA, if you don't want or can't do a NAT66 with a ULA prefix. > At the cost of not having dedicated unique public IPs but these places simply don’t need them. Wrong! Everyone needs routable addresses, even if they don't know it because they need VoIP, video calls on webRTC, FTP, p2p file sharing, online games, etc. All of these barely manage to work in a NAT by using workarounds like ALGs, UpnP, NAT-PMP, relay servers and other atrocities that greatly complicate the network design and are a security nightmare.
- yardstick 5y ago
  Sorry I could have stated the DHCP-PD issue more clearly. Comcast doesn’t support it. [1] > I honestly don't understand the difference with IPv4. You can have multiple addresses and do load balancing on the router with both. A PC cannot easily have 2 different IPv4 subnets in the same NIC, which is what IPv6 permits with RA. Even if a PC did have 2 networks, how does the router tell the PC to use fibre for everything except backups, and cable for backups, and cellular only if the others fail? These decisions are best made by the router, not an arbitrary client device connected behind it. With IPv6 and no NAT, how does the client PC know what IP to use as its source at any given time? Yes NAT66 works- and for a very very long time the IPv6 community has resisted any NAT, which has resulted in poor NAT support in IPv6 stacks across many vendors. > Wrong! Everyone needs routable addresses, even if they don't know it because they need VoIP, video calls on webRTC, FTP, p2p file sharing, online games, etc. All of these barely manage to work in a NAT by using workarounds like ALGs, UpnP, NAT-PMP, relay servers and other atrocities that greatly complicate the network design and are a security nightmare. I didn’t say a routable IP isn’t required. I said a dedicated unique public IP is not required. A gas station or fast food business doesn’t need online games or p2p file sharing. Their VoIP is done over VPN or uses NAT ALG in the firewall. Their web browser and payment systems are happy with a NAT’d IP on a LAN behind their router (which may or may not have a public static IPv4). 1. https://forums.businesshelp.comcast.com/conversations/ipv6/ipv6-delegations-dhcppd/5fe0a64ac5375f08cd9a2ba7 https://forums.businesshelp.comcast.com/conversations/ipv6/i...
ivlad 5y ago
Before I start I must say, I built IPv6 only datacenters and enterprise networks. I am saying from experience. > Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. You cannot do this with IPv4 either. Routing has to work. It works for both IPv4 and In But if you are saying, you add 2-3-4 layers of NAT, this is just crazy. > Can’t just simply open a firewall rule on the main site router to forward say HTTPS to an internal service. Why? Not all ISPs give static IPv6 prefixes, not all PCs/servers/devices support DHCP6 for static leases, and then there’s IPv6 privacy addresses. ISPs not providing static prefixes is a particular ISP problem, not an IPv6 problem. If your ISP cannot hand out static IPv4, you have a similar problem and tge workaround would be what? Dynamic DNS? Admittedly we had /32 and own ASN, but in remote offices where you don’t buy transit, you live on PA addresses (and of course they are static). From what I know, some ISPs don’t issue static prefixes to residential customers, but if you want to serve services from your prefix, use a stable prefix and a decent ISP. Privacy addresses are intended for client-initiated traffic, so no matter how many privacy addresses your server has, the stable one is still there. > WAN failover / multiple ISPs is hard. You have a fibre primary feed, and a secondary cellular/5G feed. Each has different IPv6 addresses. How do you ensure the right ISP is used at any given point? By sending RA and expiring the old prefix on the failover. I admit, this is not an obvious solution and it may not be suitable for some edge cases.
- ksidn 5y ago
  >You cannot do this with IPv4 either. Routing has to work. It works for both IPv4 and In But if you are saying, you add 2-3-4 layers of NAT, this is just crazy. Is it? I'm behind two layers of nat and everything works fine.
  - WelcomeShorty 5y ago
    That NAT "does not work" is an old myth that certain people love to use. If you show it does work, their final reply is always: but inbound connections are hard. I do not know who needs inbound connections to all of their devices in a corporate network, nor at home, since we solved that shit long time ago.
elktea 5y ago
router that do BGP are cheap, especially if you're only taking a default route which is all you're going to need for using multiple ISPs for redundancy.
- yardstick 5y ago
  It’s not the router that is the problem with BGP, it’s the ISPs. Will your cheap as chips cellular carrier support BGP? Will your local cable provider? Probably not.

jiggawatts 5y ago

The only "problem" here that is caused by IPv6 is the SD-WAN / multi-provider scenario. Even that is solvable. There are so many IPv6 addresses that your local router can have a unique routable range that it can hand out to the local network, "masking" the external internet provider addresses in the same way that IPv4 routing does it. That's not NAT, that's just routing. E.g. I have a customer that uses a non-RFC1918 public range internally and they have 5 ISP uplinks. They don't need to renumber their internal range just to fail over to another link. ALL of the other issues are caused by vendors selling garbage products that have IPv6 as a "checkbox" tick without real support. The real problem is that network engineers around the world let them get away with it, because they avoid IPv6 because of this perception that it isn't mature. The protocol is over two decades old! It's been fully supported since Windows 2000! My phone is IPv6. My fibre LAN is IPv6. It just works. What doesn't work is this attitude where people just like you continue to pay for products that only pay lip service to the future. I've gone on rants here before about enormous service providers like AWS and Azure providing IPv6 "support" that is an absolute garbage fire. Totally worthless. Useless beyond belief. Literally counterproductive in the case of Azure, where turning on IPv6 anywhere will break unrelated IPv4 functionality! Nobody ever chimes in to say: "Yes, we agree, this is bad." Nobody ever says "Microsoft should fix this!" Nobody has a problem. So now we have situations like the one you just described, where people are still buying routers in 2021 that that can't handle the most basic IPv6 functionality. IPv4 addresses are now USD $40 each and rising exponentially. I really do hope the COVID case number graphs taught some of you in a visceral sense what the world "exponential" means. Hint: it doesn't mean that it'll cost $60 in a decade. Try $40000, each. My ISP uses carrier-grade NAT on IPv4, breaking sites all over the place. I had to call them to enable a dedicated IPv4 address. Their annual investor report says that they will run out within a couple of years. Get one now while you can is the message. Do you have any idea how much code is required for two PCs to communicate directly now, with up to 4 NAT layers as a common scenario? It's a huge library you have to integrate in your code and then you need a cloud service to assist it. This is madness, and network engineers around the world are perpetuating it.

yardstick 5y ago
> The only "problem" here that is caused by IPv6 is the SD-WAN / multi-provider scenario. Even that is solvable. There are so many IPv6 addresses that your local router can have a unique routable range that it can hand out to the local network, "masking" the external internet provider addresses in the same way that IPv4 routing does it. That's not NAT, that's just routing. E.g. I have a customer that uses a non-RFC1918 public range internally and they have 5 ISP uplinks. They don't need to renumber their internal range just to fail over to another link. Neither does anyone using IPv4. Does your customer use BGP for that public IPv6 range? Do they have cellular links? Can they load balance some traffic over two/three links? Can they direct certain protocols over different carriers?
hansel_der 5y ago
y u so mad? > Literally counterproductive in the case of Azure, where turning on IPv6 anywhere will break unrelated IPv4 functionality! not just on azure; smartphones seem to be the only environment were v6 is doing its job (lots of smartphones need lots of addresses. ipv6 has a lot of addresses, problem solved) and i guess it's because they are most user-centric client-device imaginable, the actual users don't care at all and most importantly; expect things to occasionally fail.
- jiggawatts 5y ago
  I'm mad because network "engineers" use that word without realising what it entails to earn that title. The painting has been on the wall for decades. IPv4 exhaustion was predicted to the week. Did anyone do anything about it? No. There are people talking about how Kubernetes is the "future" on this very forum, yet it simply does not work with IPv6. Instead, it uses NAT and RFC1918 ranges... but you've got to be careful not to accidentally overlap those subnets with the rest of your network! I have a customer that screwed this up and now they're facing a rebuild of 3 out of 4 of their clusters. Fun times. I have another customer undergoing mergers, where renumbering their IPv4 RFC1918 ranges is going to cost them on the order of $10M. IPv4 is the legacy, and its costing real money to keep it going decades after its expiry.

rnhmjoj 5y ago

> Not all IPv6 routers support DHCP-PD I my experience, they all did. I'm not even sure how you could possibly deploy IPv6 without it, manually handing out prefixes? > you could have 2-3-4 levels of routers/firewalls at a business. It seems just a bad design, but I still don't see how IPv6 would not allow it. > Why? Not all ISPs give static IPv6 prefixes, not all PCs/servers/devices support DHCP6 for static leases, and then there’s IPv6 privacy addresses 1. you don't need a static prefix to write a firewall rule: you can simply remove the dynamic prefix with a mask and match the EUI-64 suffix. For example with ip6tables it's something like this `::e2ab:8fff:fe12:3b6b/-64`. 2. All IPv6 devices do support SLAAC with a stable address mechanism, either EUI-64 or stable privacy address and you can use that in the firewall rule. 3. IPv6 privacy extensions, when enabled, don't preclude listening and accepting connection on the EUI-64 address. So, an inbound traffic firewall rule will just use the stable address: you shouldn't listen on a privacy address, they are for outbound connections. > Each has different IPv6 addresses. How do you ensure the right ISP is used at any given point? IPv6 shifts this decision to the client. I honestly don't understand the difference with IPv4. You can have multiple addresses and do load balancing on the router with both. > IPv6 shifts this decision to the client. This makes load balancing and policy based traffic routing I can't comment on this because I never tried it, either on IPv4 or IPv6. On top of my head, I'd say it would be possible by updating the routes priorities with an RA, if you don't want or can't do a NAT66 with a ULA prefix. > At the cost of not having dedicated unique public IPs but these places simply don’t need them. Wrong! Everyone needs routable addresses, even if they don't know it because they need VoIP, video calls on webRTC, FTP, p2p file sharing, online games, etc. All of these barely manage to work in a NAT by using workarounds like ALGs, UpnP, NAT-PMP, relay servers and other atrocities that greatly complicate the network design and are a security nightmare.

yardstick 5y ago
Sorry I could have stated the DHCP-PD issue more clearly. Comcast doesn’t support it. [1] > I honestly don't understand the difference with IPv4. You can have multiple addresses and do load balancing on the router with both. A PC cannot easily have 2 different IPv4 subnets in the same NIC, which is what IPv6 permits with RA. Even if a PC did have 2 networks, how does the router tell the PC to use fibre for everything except backups, and cable for backups, and cellular only if the others fail? These decisions are best made by the router, not an arbitrary client device connected behind it. With IPv6 and no NAT, how does the client PC know what IP to use as its source at any given time? Yes NAT66 works- and for a very very long time the IPv6 community has resisted any NAT, which has resulted in poor NAT support in IPv6 stacks across many vendors. > Wrong! Everyone needs routable addresses, even if they don't know it because they need VoIP, video calls on webRTC, FTP, p2p file sharing, online games, etc. All of these barely manage to work in a NAT by using workarounds like ALGs, UpnP, NAT-PMP, relay servers and other atrocities that greatly complicate the network design and are a security nightmare. I didn’t say a routable IP isn’t required. I said a dedicated unique public IP is not required. A gas station or fast food business doesn’t need online games or p2p file sharing. Their VoIP is done over VPN or uses NAT ALG in the firewall. Their web browser and payment systems are happy with a NAT’d IP on a LAN behind their router (which may or may not have a public static IPv4). 1. https://forums.businesshelp.comcast.com/conversations/ipv6/ipv6-delegations-dhcppd/5fe0a64ac5375f08cd9a2ba7 https://forums.businesshelp.comcast.com/conversations/ipv6/i...

ivlad 5y ago

Before I start I must say, I built IPv6 only datacenters and enterprise networks. I am saying from experience. > Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. You cannot do this with IPv4 either. Routing has to work. It works for both IPv4 and In But if you are saying, you add 2-3-4 layers of NAT, this is just crazy. > Can’t just simply open a firewall rule on the main site router to forward say HTTPS to an internal service. Why? Not all ISPs give static IPv6 prefixes, not all PCs/servers/devices support DHCP6 for static leases, and then there’s IPv6 privacy addresses. ISPs not providing static prefixes is a particular ISP problem, not an IPv6 problem. If your ISP cannot hand out static IPv4, you have a similar problem and tge workaround would be what? Dynamic DNS? Admittedly we had /32 and own ASN, but in remote offices where you don’t buy transit, you live on PA addresses (and of course they are static). From what I know, some ISPs don’t issue static prefixes to residential customers, but if you want to serve services from your prefix, use a stable prefix and a decent ISP. Privacy addresses are intended for client-initiated traffic, so no matter how many privacy addresses your server has, the stable one is still there. > WAN failover / multiple ISPs is hard. You have a fibre primary feed, and a secondary cellular/5G feed. Each has different IPv6 addresses. How do you ensure the right ISP is used at any given point? By sending RA and expiring the old prefix on the failover. I admit, this is not an obvious solution and it may not be suitable for some edge cases.

ksidn 5y ago
>You cannot do this with IPv4 either. Routing has to work. It works for both IPv4 and In But if you are saying, you add 2-3-4 layers of NAT, this is just crazy. Is it? I'm behind two layers of nat and everything works fine.
- WelcomeShorty 5y ago
  That NAT "does not work" is an old myth that certain people love to use. If you show it does work, their final reply is always: but inbound connections are hard. I do not know who needs inbound connections to all of their devices in a corporate network, nor at home, since we solved that shit long time ago.

elktea 5y ago

router that do BGP are cheap, especially if you're only taking a default route which is all you're going to need for using multiple ISPs for redundancy.

yardstick 5y ago
It’s not the router that is the problem with BGP, it’s the ISPs. Will your cheap as chips cellular carrier support BGP? Will your local cable provider? Probably not.