4 ms·

Was IPv6 needed at all? What problems would occur if we were just nat-ing everyone behind those 4 billion IPv4 addresses? I run a popular website and I have n

• mishafb 5y ago
  With IPv6, you don't have CG-NAT, or double NATting, at the ISP level. If both sides are behind CG-NAT, then direct peer-to-peer communication is impossible or at least unstable to establish.
• TacticalCoder 5y ago
  > What problems would occur if we were just nat-ing everyone behind those 4 billion IPv4 addresses? Even with NAT'ing we're running out of IPv4 addresses. Now I NAT on IPv4 at home, even though my router/ISP supports IPv6. First thing I do on any Linux install at home is get rid of IPv6. I don't see where the problem is. I really don't see why my home machines should have an IPv6 IP: the outside world sees my router's IP and that's it. Now I'm certainly misunderstanding all the benefits and security that IPv6 would bring me at home but meanwhile I'll stay on IPv4 and I really don't see what the problem is either.
  • tadfisher 5y ago
    Not a networking expert by any means, but having built out a home network, my understanding is as follows: Benefits-wise, your devices are addressable on the Internet, so it becomes simpler to create peer-to-peer connections, firewall traffic, and create segregated subnets. Security-wise, your devices are addressable on the Internet, so all the workarounds to punch through NAT with terrible security implications aren't needed (I'm thinking UPnP mostly, but STUN/TURN/ICE are easy to get wrong). Essentially, under IPv4+NAT, your devices are already "addressable" via a combination of your router's IP and some form of session token, but securing such traffic depends on the successful implementation of a NAT-traversal protocol by a third party.
    • throw0101a 5y ago
      > Security-wise, your devices are addressable on the Internet Nope. By default home routers (e.g., Asus) will block incoming connections just like with IPv4. It may allow pings (ICMP) in, but that's usually it. You have to manually go in and tell the router to allow new connections in (either generally, or per service/port), just like the "DMZ" functionality with IPv4 many routers have.
      • spookthesunset 5y ago
        And to open up those incoming connections on IPv6, we'll invent some other variant of UPnP so users don't have to manually go punch holes into their firewall to allow peer to peer connections. IPv6 doesn't solve the problem of everything in the internal network being unable to accept incoming connections. With a NAT you need to set up port forwarding. With IPv6 you need to punch a hole into your firewall. Either way, home users will not be doing it by hand... we'll invent some protocol to do it and that protocol will have security issues.
        • viraptor 5y ago
          > we'll invent some other variant of UPnP We don't have to. UPnP works just fine with ipv6 already. (upnp v1.1, appendix A)
        • throw0101a 5y ago
          "UPnP Device Architecture V1.0 Annex A – IP Version 6 Support": * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf
      • lokedhs 5y ago
        > It may allow pings (ICMP) in, but that's usually it. I sure hope it does. Blocking ICMP can cause TCP connections to hang due to inability to do MTU size detection. With IPv4 this is usually not as visible, but with IPv6 if you block ICMP your connections will block as soon as you try to transfer a large block of data.
  • p1mrx 5y ago
    > the outside world sees my router's IP and that's it. At some point, that will go away due to CGNAT. A lot of people have to share their public IPv4 address these days, which means no inbound port forwarding, and potentially getting banned from services if their "neighbors" misbehave. On the other hand, CGNAT does improve privacy to some extent.
  • lmm 5y ago
    If it's working for you then great. NAT adds latency, makes the router more complex, and breaks peer-to-peer stuff (e.g. there's a game I like to play where you can have games on a LAN or over the internet, but what you can't do is have a game between two people who are behind a single IP address and other people on the internet, which became a problem when two of my friends moved in together); even in systems that have workarounds for NAT those workarounds generally add latency (e.g. your video chats might have to be routed through a central server rather than directly to friends). As IPv4 addresses become more scarce, you'll probably get put behind CGNAT (or have to pay extra to avoid it) which again adds more latency and cost. But sure the reality is that using IPv4 from behind NAT is tolerable for most people, so there's not a huge impetus to migrate.
• throw0101a 5y ago
  > What problems would occur if we were just nat-ing everyone behind those 4 billion IPv4 addresses? Because we're running out of IPs even with NAT, so entire ISPs have to implement it: * https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT There are entire swaths of IPv4 addresses (100.64.0.0/10) reserved just for ISPs to assign to their customers' WAN interface which will not interfere with the RFC 1918 addresses people use on their home networks: * https://datatracker.ietf.org/doc/html/rfc6598 https://datatracker.ietf.org/doc/html/rfc6598 We're doing NAT-upon-NAT. Good luck doing hole punching on your personal firewall to allow connections in for games or VoIP.
  • Gigachad 5y ago
    The easiest and most reliable way to expose a computer on the internet now is those services which work something like a VPN where they have an ip address and route everything sent to it over to you via WireGuard or similar. That way you don't have to worry about dynamic addresses, ISP blocked ports, buggy router firmware. It all just works. Things like ngrok can do it really easily for http traffic.
    • lmm 5y ago
      > The easiest and most reliable way to expose a computer on the internet now is those services which work something like a VPN where they have an ip address and route everything sent to it over to you via WireGuard or similar. Right, but that only works if the other end has an address, and they're increasingly scarce/expensive.
    • throw0101a 5y ago
      > […] something like a VPN where they have an ip address and route everything sent to it over to you via WireGuard or similar. You can implement one of those kludges. Or you can make the effort to restore the end-to-end principal originally envisioned for the Internet. I'd prefer if people try to work towards the latter over the long term.
      • Gigachad 5y ago
• viraptor 5y ago
  > What problems would occur if we were just nat-ing everyone behind those 4 billion IPv4 addresses? 1. Extra latency in voice/video calls which have to go through the TURN-like endpoint rather than directly between the callers. 2. Extra cost of hosting your services, because even on the hosting side we're running out of cheap addresses. 3. P2P networks dying - which means we'd be stuck with centralised providers. (Or at most "effectively federated" networks)