7 ms·

> Anything extending the life of IPv4 is actively harmful. +1 > Yes you can traverse NAT Not always. My ISP uses CGNAT, which means I have absolutely no stra

> Anything extending the life of IPv4 is actively harmful. +1 > Yes you can traverse NAT Not always. My ISP uses CGNAT, which means I have absolutely no straightforward way to break out. I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed.

yarosv 5y ago
I'm not a network engineer. But I've yet to see a good way to protect ipv6 network. I don't want my local webserver develop on to be exposed to the internet. It's my understanding that default router configuration will do just that. I don't see a good way to deal with privacy issues. Ipv6 essentially gives a unique identifier for every computer in the household by default.
- kazen44 5y ago
  protecting ipv6 Networks works just the same as ipv4 networks. by using firewalling. NAT is not a security mechanism. most consumer routers seem to block any incoming traffic from the outside world by default anyways.
  - yarosv 5y ago
    I'm not trying to be aggressive here. But what's the actual end user difference between NAT and firewalled ipv6 for me and my local network then? I assume I could route now than one addresses for a specific port. On the other hand I have to pay for domain record to access my local resource without a struggle. Should I use ipv6 at home when my doesn't have one? I honestly struggle to find good information on the protocol that's decades old. It's either to deep for me to care for my needs or too shallow to understand why and how should I just it. Scaremongering is what I find on the internet. And no real benefits for me to update my hardware or find ISP that has ipv6.
    - api 5y ago
      The difference is that traversal protocols like UDP hole punching work deterministically almost 100% of the time in an IPv6 environment but are flaky in an IPv4 NAT environment. It also means that you never experience port exhaustion on large networks, which is a problem for large IPv4 NAT deployments.
    - nezgar 5y ago
      I can kind of relate to the feeling of IPv6 being "new and scary" to back in 1995 when I barely grasped IPv4 routing... everything becomes clear eventually with experience and exposure... hopefully eventually I'll understand more IPv6 concepts with time. I "want to believe". :) But I do fully get that firewall without NAT is perfectly fine (great) in an IPv6 world - but may be necessary in simpler multi-ISP routing scenarios...
- merlyn 5y ago
  You'd setup your firewall to protect your IPv6 network. This policy says do this, firewall defaults to no traffic pass. Same as you have now. IPv6 privacy extension (been around for many many years, and default on at least MacOS and others for many iterations), gives you a new IPv6 address every time period, and rotates through them transparently.
  - mercora 5y ago
    just want to make it clear, usually you are assigned a prefix which you can announce to your network and then nodes will pick random addresses from that prefix. its still easy to determine the packets came from your network just not clear from which device exactly much like current NAT setups lets say...
    - ale42 5y ago
      ... unless your ISP would change your prefix regularly (like every day), like it's now the case for those who have a public dynamic IPv4. If they give you a static IPv6 prefix, it's like giving you a static IPv4 now, i.e. something ISPs would probably want to monetize as a premium service. So I'm pretty sure we'll end up with regularly changing prefixes... which is probably good for privacy.
      - kaliszad 5y ago
        In most countries, the ISP is legally obliged to keep records at which point in time has a customer had an address. Usually a court can order an ISP to hand over those records. In other cases, the police, secret service, copyright lawyers etc. can talk directly to the ISP.
        ale42 5y ago
        Sure, but keeping logs for legal reasons doesn't mean transmitting those logs to all the web sites you visit. I think the point here was untrackability by websites rather than pure anonymity.
- deleted 5y ago
  [deleted]
- jagger27 5y ago
  I haven't seen a single IPv6 network configured to behave like that by default. Just because it has a globally unique address doesn't mean it's reachable.
- p_l 5y ago
  New home routers (the kind that ISPs give out to clients) with IPv6 support include default deny firewall on externally-initiated connections, precisely for that reason. If you think NAT gave you any privacy benefits... at best it made for easy "household mapping" of people.
po1nt 5y ago
> I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed As you can see, It's because not many people understand IPv6. Also there are many devices that would stop working. There is no clear path for adoption, everything is "switch and let's see if it breaks". Many systems are legacy systems. Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. ISP's are unwilling to implement it as there are not so many qualified workers that even understand IPv6, big companies like Google straight refuse to fully implement DHCPv6 and so on. IPv6 is IT's esperanto.
- po1nt 5y ago
  Also IPv6 was officially ratified 2 years after all IPv4s were exhausted. IPv6 was designed in 1998 when total number of internet connected devices is estimated to be equal roughly our daily increase of internet connected devices.
- dijit 5y ago
  > Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. Mainframes are a _lot_ more maintained than you think they are, but overall this is a bit of a weird statement as Mainframes talk TCP/IP for compatability reasons anyway, Mainframes talk amongst themselves using a protocol called SNA/APPN. (Which, can be encapsulated in arbitrary IP frames, but is not required and doesn't require support of the mainframe)
- p_l 5y ago
  IBM Mainframes, for various reasons including how IBM structured the pricing tend to run pretty recent versions of software. In case of IPv6, all supported OS versions work with v6, the limits involved are also somewhat no longer valid outside of very locked down intranet-only setups.

yarosv 5y ago

I'm not a network engineer. But I've yet to see a good way to protect ipv6 network. I don't want my local webserver develop on to be exposed to the internet. It's my understanding that default router configuration will do just that. I don't see a good way to deal with privacy issues. Ipv6 essentially gives a unique identifier for every computer in the household by default.

kazen44 5y ago
protecting ipv6 Networks works just the same as ipv4 networks. by using firewalling. NAT is not a security mechanism. most consumer routers seem to block any incoming traffic from the outside world by default anyways.
- yarosv 5y ago
  I'm not trying to be aggressive here. But what's the actual end user difference between NAT and firewalled ipv6 for me and my local network then? I assume I could route now than one addresses for a specific port. On the other hand I have to pay for domain record to access my local resource without a struggle. Should I use ipv6 at home when my doesn't have one? I honestly struggle to find good information on the protocol that's decades old. It's either to deep for me to care for my needs or too shallow to understand why and how should I just it. Scaremongering is what I find on the internet. And no real benefits for me to update my hardware or find ISP that has ipv6.
  - api 5y ago
    The difference is that traversal protocols like UDP hole punching work deterministically almost 100% of the time in an IPv6 environment but are flaky in an IPv4 NAT environment. It also means that you never experience port exhaustion on large networks, which is a problem for large IPv4 NAT deployments.
  - nezgar 5y ago
    I can kind of relate to the feeling of IPv6 being "new and scary" to back in 1995 when I barely grasped IPv4 routing... everything becomes clear eventually with experience and exposure... hopefully eventually I'll understand more IPv6 concepts with time. I "want to believe". :) But I do fully get that firewall without NAT is perfectly fine (great) in an IPv6 world - but may be necessary in simpler multi-ISP routing scenarios...
merlyn 5y ago
You'd setup your firewall to protect your IPv6 network. This policy says do this, firewall defaults to no traffic pass. Same as you have now. IPv6 privacy extension (been around for many many years, and default on at least MacOS and others for many iterations), gives you a new IPv6 address every time period, and rotates through them transparently.
- mercora 5y ago
  just want to make it clear, usually you are assigned a prefix which you can announce to your network and then nodes will pick random addresses from that prefix. its still easy to determine the packets came from your network just not clear from which device exactly much like current NAT setups lets say...
  - ale42 5y ago
    ... unless your ISP would change your prefix regularly (like every day), like it's now the case for those who have a public dynamic IPv4. If they give you a static IPv6 prefix, it's like giving you a static IPv4 now, i.e. something ISPs would probably want to monetize as a premium service. So I'm pretty sure we'll end up with regularly changing prefixes... which is probably good for privacy.
    - kaliszad 5y ago
      In most countries, the ISP is legally obliged to keep records at which point in time has a customer had an address. Usually a court can order an ISP to hand over those records. In other cases, the police, secret service, copyright lawyers etc. can talk directly to the ISP.
      - ale42 5y ago
        Sure, but keeping logs for legal reasons doesn't mean transmitting those logs to all the web sites you visit. I think the point here was untrackability by websites rather than pure anonymity.
deleted 5y ago
[deleted]
jagger27 5y ago
I haven't seen a single IPv6 network configured to behave like that by default. Just because it has a globally unique address doesn't mean it's reachable.
p_l 5y ago
New home routers (the kind that ISPs give out to clients) with IPv6 support include default deny firewall on externally-initiated connections, precisely for that reason. If you think NAT gave you any privacy benefits... at best it made for easy "household mapping" of people.

po1nt 5y ago

> I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed As you can see, It's because not many people understand IPv6. Also there are many devices that would stop working. There is no clear path for adoption, everything is "switch and let's see if it breaks". Many systems are legacy systems. Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. ISP's are unwilling to implement it as there are not so many qualified workers that even understand IPv6, big companies like Google straight refuse to fully implement DHCPv6 and so on. IPv6 is IT's esperanto.

po1nt 5y ago
Also IPv6 was officially ratified 2 years after all IPv4s were exhausted. IPv6 was designed in 1998 when total number of internet connected devices is estimated to be equal roughly our daily increase of internet connected devices.
dijit 5y ago
> Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. Mainframes are a _lot_ more maintained than you think they are, but overall this is a bit of a weird statement as Mainframes talk TCP/IP for compatability reasons anyway, Mainframes talk amongst themselves using a protocol called SNA/APPN. (Which, can be encapsulated in arbitrary IP frames, but is not required and doesn't require support of the mainframe)
p_l 5y ago
IBM Mainframes, for various reasons including how IBM structured the pricing tend to run pretty recent versions of software. In case of IPv6, all supported OS versions work with v6, the limits involved are also somewhat no longer valid outside of very locked down intranet-only setups.