12 ms·
Hello IPv6: a minimal tutorial for IPv4 users
- max1truc 5y ago> In IPv4, multicast addresses are used, there is no concept of broadcast address I think there's a typo there, and the author meant IPv6, right ?
- Steltek 5y agoCan someone forward this to Verizon? They can't seem to find the "Enable IPv6" button with their head so far up their... Ahem, I'm quite frustrated with my provider :). But sanctioned monopolies are a serious drag on moving tech forward. Even if IPv6 isn't a panacea, things need to be more agile than this if we're going to really innovate.
- creativeembassy 5y agoI've been looking for a summary like this for years. I'm quite comfortable with IPv4, but haven't understood IPv6 well enough to start using it in my home network. Thanks for sharing, going to read this over a few times to make sure I understand everything completely.
- psim1 5y agoJust my experience: The funny thing about IPv6 is that you see a lot of curmudgeonly rhetoric about it here and elsewhere, but once you dig in a little, it snaps and you think "hey, this really makes sense!" And then you wonder why others are grumbling so much. The main thing to do is to stop thinking about IPv4. Just put the IPv4 concepts aside and start thinking about it as if IPv6 just showed up on the scene as the L3 protocol. Forget about crusty concepts like NAT, because NAT was a kludge anyway. Just think about the big address space. Understand that firewalls examine traffic going from one side to the other and that NAT is not part of that equation (people frequently argue that NAT is valuable for network security - nonsense). Just start fresh with it and resist the urge to hug your old IPv4 teddy bear.
- akersten 5y ago> (people frequently argue that NAT is valuable for network security - nonsense). Most of the devices on my home network should never be routable from the Internet. Without NAT, they suddenly are, and I have to go out of my way to configure a firewall (either on the device or an intermediary appliance) just to get back to that baseline. That is more configuration to get right and is a worse experience than when they were just impossible routes under NAT. So, I get it, NAT was not "designed" with security as a primary consideration, but when thousands of Grandma's printers are suddenly pwn'd because their 2.6.x kernels wind up answering traffic from the public Internet, it's quite devilish to say "gosh, well, they should never have relied on things continuing to work the way they always have, because it was philosophically never meant to be that way." It's quite possible I'm missing something (because I haven't bothered to learn much about v6 yet) and consumer routers are smart enough to drop unsolicited traffic to "private" addresses (however that is determined). If that's the case I cede a little.
- bombela 5y agoNetwork Address Translation (NAT) has the side effect of ignoring incoming connections that do not match an explicit port mapping. A firewall will block any incoming connections unless explicitly allowed. Basically the NAT happens to overlap a bit the job of the firewall as a side effect of how it works. In practice NAT and firewall are implemented by the same system. For example look at iptables on Linux.
- foxfluff 5y agoI don't agree with this argument at all. If routers can enable NAT by default, they have a stateful firewall by default. The printer won't be on the internet unless you punch a hole in NAT, it won't be on the internet unless you punch a hole in that firewall. You can have that firewall without NAT.
- IshKebab 5y agoThis is true but there is still a difference. How do you know if that protection is working? With NAT, if it's online then basically the only way is if NAT was used. With a firewall then I have no idea. I guess you have to check on the router, and maybe do some kind of online test? Can't imagine grandma doing that. I do think a firewall is a cleaner solution but it's definitely true that NAT is way more foolproof.
- IshKebab 5y agoMe too, this was very good. The only thing missing is how it interoperates with IPv4. Can you represent IPv4 addresses as IPv6 addresses? If so what happens when you communicate with them?
- idiotsecant 5y agoThis is very digestible, thanks so much for this. I'm going to set up a little test IPv6 network this weekend and play around!
- candiddevmike 5y agoIMO, IPv6 sucks for home users and labs. Prefix delegation means your routable IP scheme could change underneath you, and firewalling connections using PD addresses is really hard (unpredictable prefixes, privacy extensions change suffixes constantly), though some routers make it easier, like Google Wifi. I think most will end up NATing a single external IPv6 with a private IPv6 network behind it. I wish IANA and friends would let home users and other smaller entities request global /56 address blocks and force ISPs to peer/announce (nothing crazy, just a default route). EDIT: end users should be able to request static blocks from their ISPs for free, not IANA.
- psim1 5y agoI have done PD of a /60 from Comcast for three years and my prefix never changed. I can't imagine why it would or should.
- bombcar 5y agoMine is pretty stable but anytime the cable modem gets fried by lightning the new one gets a new prefix. I wish it was tied to my account somehow.
- d00bianista 5y agoThat's because the DHCPv6 client in the modem generates a unique DUID for itself and the new one cannot know the fried modems DUID.
- ac29 5y agoIf your cable modem is regularly getting fried by lightning, you can get lightning arrestors inline on the coax connection.
- bombcar 5y agoI have one now but I suspect the lightning shall … resist arrest.
- 5y ago
- recursive 5y agoAnyone have any recommendations for a beginner who would also like to learn what's meant by ARP, NDP, ethernet, and basically everything. I've been a developer for decades, and I understand the top level of http[s] well enough, but networking is basically a mystery to me.
- ithrow 5y agoRead a CCNA book for the fundamentals and basics.
- stusmall 5y agoComputer Networking: A Top-Down Approach is a great text book on this. It is a huge text book but written in a way where you can drop in on the parts of the stack where you need to.
- rnhmjoj 5y agoI think a good way to learn networking is to set up your network from scratch: either build a router using a PC with some BSD, GNU/Linux or buy a router supported by OpenWRT. Start with something simple at first: a basic home network. You need to set up a firewall and NAT rules, a DHCP server, a DNS relay or maybe a recursive server. You'll learn a good deal about how the protocols works and why they work that way just by reading the manual pages and trying to configure the software. Also, read the RFCs, really, most are well written and do a better job at explaining how stuff works than a random tutorial. For more practical skills, you can also make your own cables by buying STP/UTP cables and connectors. Then try to build an IPv6-only network, this is especially fun if you don't have native IPv6 from your ISP (i.e. set up a 6in4 tunnel). With IPv6 you can try subnets and routing more easily, also configuring NAT64 and talking to old v4 devices from v6 is pretty fun. Finally you can experiment with more exotic stuff like IPSec encryption between your machines, hosting your email or authoritative DNS server, a VPN, etc.
- anthk 5y agoNetworking 101 ftp://vert.synchro.net/main/INTERNET/NETWK101.ZIP A text file. Yes, old. But it works. EDIT: damn, the file is wrong.
- 5y ago
- iptrans 5y agoCurrently only getting an SSL error. Hug of death? Edit: Google cache http://webcache.googleusercontent.com/search?q=cache:https://metebalci.com/blog/hello-ipv6/ http://webcache.googleusercontent.com/search?q=cache:https:/...
- zoomablemind 5y ago> ...This post is aimed for home and small office networks. So if you know about ARP, DHCP, and NAT, and if you wonder how these work in IPv6 networks, this post is perfect for you. Hardly a home user friendly introduction. An acronym soup begins right at the start, where the author describes his network setup. Not sure if users would feel convinced to adopt IPv6 on their networks without understanding the benefits first.
- jrochkind1 5y agoSo you're not the target audience, and you discovered that right at the start, from a clear statement. Sounds like the author succeeded to me.
- lowlevel 5y agoI agree with this statement. Even for those who know all the IPv4 related acronyms, the author spits out a bunch of new ones without any attempt to explain them. I just closed it, it's not at all readable for small office or home network users.
- hatch_q 5y agoSo in essence privacy extensions (hiding of internal network) are available, but disabled and unsupported by default. Another thing are incoming connections - first thing i do with new router is disable UPnP, so clients cannot drill ad-hoc holes into my private network. How to do that with ipv6 network?
- fulafel 5y agoThat's not correct. Privacy extensions are supported and on by default in Windows, macOS, mobile stuff and on generally in desktop Linux setups. Not sure what the author is running as they claim it's off by default in Ubuntu, as that's contrary to my experience. (Guessing they have a server install as they talk about netplan instead of NetworkManager?)
- jeroenhd 5y ago> So in essence privacy extensions (hiding of internal network) are available, but disabled and unsupported by default On Ubuntu Server: probably. Why would you want a randomized IP address on a server, anyway? Netplan doesn't seem to be designed for desktop, so I don't think it's a problem in most cases. Perhaps you want to add privacy to a raspberry Pi running a scraper or something, but there aren't many use cases I can think of that require privacy extensions in a headless system. On user-facing operating systems (Windows, Ubuntu, Manjaro, Android, probably macOS/iOS/ipadOS as well) privacy extensions are enabled by default AFAIK. They're also completely supported. In fact, I can find more posts online about people wanting to _disable_ the feature rather than how to enable it. > How to do that with ipv6 network? Any decent router will put a firewall between you and the internet, blocking incoming traffic. Your IP may be publicly routable, but it's not reachable by default in most consumer appliances. You shouldn't need to disable anything. Many people will confuse NAT with a firewall, but those are two entirely different things! NAT makes devices unreachable by breaking the internet, but there are many NAT loopholes (port knocking, NAT slipstreaming, etc.) that will bypass NAT if you can get a user to install software or even open a website from inside the network. In the IPv4 world the firewall and NAT setup are often combined, leading to a broken firewall in many cases because they automatically add the necessary firewall exceptions to make NAT work. UPnP generally does two things: it sets up NAT _and_ it adds a firewall exception. Reserving a port on the router's public IP address (NAT) is of little use if you don't accept traffic on that port (firewall), after all. On IPv6 there's no need to bother with NAT, but the firewall exception still needs to be added for a port to be reachable. Effectively, the difference is that if you have three smart lightbulbs that are all reachable on port 80, you don't need to forward port 80, 81 and 82 to different IP addresses to make them available to the internet; you need to add three firewall rules for port 80 and then just use their real IP addresses instead. That's exactly how IPv4 was always designed to work before the IP address shortage began and NAT became the standard. For rare exceptions, there are some forms of NAT available on IPv6, but they're only designed in circumstances where your network design is basically flawed (like for those ISPs that hand out a /128 address instead of a /48 or /56 like they're supposed to, forcing routers to do NAT for no good reason).
- deleted 5y ago[deleted]
- ChrisArchitect 5y ago(2020)
- Wazako 5y agothe difficult part with ipv6 is that we can't use it as a url, contrary to ipv4, so what's the use ?
- senden9 5y agoYou can use it in a URL. Just put square brackets around it. Like http://[::1]/ http://[::1]/
- bloopernova 5y agoAmusingly apropos: Visual Studio Code was hanging when opening a remote session on my Raspberry Pi. Turns out I had added "AddressFamily inet6" to the ssh config for connections from my laptop to the Pi. Once I changed that to "AddressFamily inet", it worked fine.
- alwaysanon 5y agoThis reminded me to re-check for the first time in a year or so which sites I frequent are now dual-stack IPv4 and IPv6. Surprisingly Hacker News is one of the few that isn't these days...