8 ms·

IPv6 implementors are inconsistent in what they support. Eg Android and it not supporting DHCPv6 [1]. Also NAT in IPv6 is not as widely supported as it is in I

IPv6 implementors are inconsistent in what they support. Eg Android and it not supporting DHCPv6 [1]. Also NAT in IPv6 is not as widely supported as it is in IPv4 (and yes NAT can and is used for reasons other than security, such as policy based routing and routers with multiple disparate WANs like Fibre and Cellular). Plus there will always be someone somewhere with a middlebox, be it IPv4 or IPv6. 1. https://lostintransit.se/2020/05/22/its-2020-and-androids-ipv6-is-still-broken/ https://lostintransit.se/2020/05/22/its-2020-and-androids-ip...

dcbadacd 5y ago
Not implementing DHCPv6 is not "inconsistent" it's from the start a thing you should NOT rely on existing.
0xbeefbeefbeef 5y ago
NAT is not security. [1] Why would you want to do NAT in IPv6? You can do all the things you mentioned with IPv6 without NAT. 1. https://samy.pl/slipstream/ https://samy.pl/slipstream/
- yardstick 5y ago
  I never said NAT was security. No, the things I mentioned cannot be done easily with IPv6. You cannot easily switch a router from using one WAN to another (with different IPs) without requiring IPv6 clients having to obtain new addresses via SLAAC (and hence downtime), or use NAT (which is what IPv4 does, but not well supported in IPv6). You cannot easily have 2-3 levels of networks where router3 is attached to the lan of router2 which is attached to the lan of router1, which has internet access. This is because DHCP-PD is not well supported (see Comcast) or the prefix delegated is insufficiently sized (a /56 minimum should be standard but some will give a /60 or worse, just a /64!). This is bread and butter to do in IPv4.
  - admax88qqq 5y ago
    > You cannot easily switch a router from using one WAN to another. You cannot easily do that with NAT either. Every single one of your TCP sessions will die, and likely every session going over UDP as well. Unless you're talking some special protocol specifically designed to handle clients changing IPs. Your machine may not notice, but the machines responding to your packets sure will.
    - yardstick 5y ago
      Yes you can if you are using a SD-WAN solution running on top of those WANs.
  - anthropodie 5y ago
    Isn't it possible to have IPs from both WANs assigned to devices on your network? In that case you don't even have to switch.
    - kaliszad 5y ago
      Problem is, the device doesn't have to know, which address is the working one - e.g. which prefix is working on the upstream. It might break connections etc. A solution of course could be to have NAT66 and I really mean address translation not masquerading/ port translation here - as such, much easier to do as it is a 1:1 mapping or to get provider independent space or become a LIR and have two providers announce your space with respective BGP configuration for failover. It is a solvable problem but isn't much guidance and experience with this at smaller companies that might not want to run BGP or go through hoops to get PI space etc.
      - yardstick 5y ago
        Exactly this. And you are right BGP is a non-starter for smaller sites, especially where cellular is involved. Often small site businesses just need a backup internet connection to access the web and emails, which doesn’t need the overhead of BGP. Also there is a non-trivial cost to using BGP (equipment, expertise, and ISP will charge more for the privilege) which for smaller business doesn’t make economic sense.
  - dijit 5y ago
    You sound like you know what you're talking about, which makes me a bit confused because you appear to be misinformed here. Your router will advertise new routes immediately when it's given a new WAN address, there's no downtime incurred explicitly from IPv6 in that scenario: local connections will still route until the timeout anyway. SLAAC issues (and can issue) more than a single IP per device, leading to interesting bugs like the ones Sam Bowne talks about in windows.[0] Changing a WAN interface _does_ incur downtime on ipv4 too, unless you're assigning virtual NICs and then failing over: which IPv6 would support in identical ways. [0]: https://youtu.be/YOglp0m35D8?t=1362 https://youtu.be/YOglp0m35D8?t=1362
    - yardstick 5y ago
      Yes sorry I should have been clearer, it’s the connections from clients having to timeout and re-establish upon IP change that is the issue. Specifically where those packets might be going over a SD-WAN type solution where a WAN change is non-disruptive to SD-WAN destine traffic. It relies on clients having NAT addresses and using those addresses for Internet destination addresses (not just private space). Another issue with SLAAC/lack of NAT on the LAN clients is you can’t do policy based routing on the router, eg I’ve got a fast fibre but it’s costly to use, I’ve also got a cheap and cheerful cable/DSL line that I use for backups and FTP. I want to route all requests to my backup service (which has a domain that resolves to a public IPv6 address) via the cable/DSL and everything else via Fibre. Easy to do on IPv4.
      - dijit 5y ago
        But, nothing you said is inherent to NAT, you should read up a bit more on iBPF for the latter and the former works exactly the same way on v6 as v4. Static routing is not really a thing unless you’re a really bad network admin- for sure your ISP wont be doing static routing to your home.
        yardstick 5y ago
        Can you talk about this some more? Also do you mean eBPF or iBPF or iBGP? If it's BGP that's just too complicated/expensive for a lot of the small businesses I deal with.
  - whoknowswhat11 5y ago
    Finally someone who get's it. First - you can't actually get static IPv6 despite the claims that there is plenty of it as a home user in the US. This static IPv6 for everyone is basically a total lie. It's super simple with IPv4 to setup an internal network with known hosts / DHCP lease reservations if needed / dns etc, and have all that stay totally unchanged as the WAN link bounces around. If you are supporting a bunch of users (who yes, will configure a printer using the printers IP etc) then this makes like simple. You can do this at home too easily etc. There is a weird myopia in the IPv6 world about use cases for IP. It's like they just ignored what people need and want, and went a totally different direction. We need IPv4+ with another octet and be done with this :) I'm serious, anyone interested in trying to push this. Keep everything the same except with another octet at the front?
    - BenjiWiebe 5y ago
      For your local DNS names, etc, you could use the link-local IPv6 address.
      - whoknowswhat11 5y ago
        For some reason these change endlessly on my network. RFC4941 or similar privacy extension stuff might explain this.
    - p1mrx 5y ago
      Let's keep the IPv4 header, but start counting packets from byte -2 instead of 0.
- bandie91 5y ago
  i need ipv6 nat because isp gives me only 1 ip.
TavsiE9s 5y ago
At this point Google's refusal to implement DHCPv6 is well documented and is being brought up in a lot of arguments. Easy solution: if you need DHCPv6 you don't deploy Android devices and move on.
- yardstick 5y ago
  It’s only easy if you don’t have to support Android devices. Often it’s not possible to do so.
  - deleted 5y ago
    [deleted]
- selfhoster11 5y ago
  That's not how it works. For BYOD or home use, the device is always more important than the network. You can't just tell somebody "lol, Android not supported". Most of the phones out there are Androids, and not everyone prefers iOS even without the extra cost attached to an Apple phone.
- maccolgan 5y ago
  DHCPv6 isn't mandatory to use IPv6, and SLAAC works fine in those cases (and neither are mandatory actually, can't be). This isn't related to IPv6 overall.
- unionpivo 5y ago
  Android devices are not optional in some parts of world with low iPhone adaption. In my previous company of 250+ people only 2 had iphones.
anthropodie 5y ago
NAT is the worst thing that could have happened to Internet. Without NAT people would have been able to host their own blogs, pages, photos decades ago from their home. We could have had far more decentralized applications than we have today and would have prevented this walled garden mess of Internet. The ability to address any system on the Internet with it's unique IP is what original Internet was supposed to be. NAT was temporary solution to address the issue of limited IPs but now that is single protocol that is preventing the migration to IPv6
- majidazimi 5y ago
  I don't know why this is being down voted. The entire modern bullshit Internet exists because of NAT. We can't host stuff ourselves and have to use some central system. Since nothing is free, the provider has to inject more and more ads everywhere.
  - api 5y ago
    I bet the actual cost of NAT when all things are considered is well into the trillions of dollars. Any attempt to keep IPv4 alive is not a net win. It's another few trillion down the drain.
  - rand49an 5y ago
    Because it implies that it is the single reason that people don't host their own sites anymore, when in reality people don't because it is generally too difficult, expensive, unreliable and redundant to do so. Almost nobody wants to host their own social media or messenger site and if you did your friends wouldn't use it too. Besides, anyone who currently wants to do so can get a cheap VPS for dollars a month.
    - 6510 5y ago
      There is no telling what would happen. It is only difficult, expensive, unreliable because no one does it? I think there is proof of the opposite in how people host giant torrents without much issues, some buy seed boxes, their friends use it too.

dcbadacd 5y ago

Not implementing DHCPv6 is not "inconsistent" it's from the start a thing you should NOT rely on existing.

0xbeefbeefbeef 5y ago

NAT is not security. [1] Why would you want to do NAT in IPv6? You can do all the things you mentioned with IPv6 without NAT. 1. https://samy.pl/slipstream/ https://samy.pl/slipstream/

yardstick 5y ago
I never said NAT was security. No, the things I mentioned cannot be done easily with IPv6. You cannot easily switch a router from using one WAN to another (with different IPs) without requiring IPv6 clients having to obtain new addresses via SLAAC (and hence downtime), or use NAT (which is what IPv4 does, but not well supported in IPv6). You cannot easily have 2-3 levels of networks where router3 is attached to the lan of router2 which is attached to the lan of router1, which has internet access. This is because DHCP-PD is not well supported (see Comcast) or the prefix delegated is insufficiently sized (a /56 minimum should be standard but some will give a /60 or worse, just a /64!). This is bread and butter to do in IPv4.
- admax88qqq 5y ago
  > You cannot easily switch a router from using one WAN to another. You cannot easily do that with NAT either. Every single one of your TCP sessions will die, and likely every session going over UDP as well. Unless you're talking some special protocol specifically designed to handle clients changing IPs. Your machine may not notice, but the machines responding to your packets sure will.
  - yardstick 5y ago
    Yes you can if you are using a SD-WAN solution running on top of those WANs.
- anthropodie 5y ago
  Isn't it possible to have IPs from both WANs assigned to devices on your network? In that case you don't even have to switch.
  - kaliszad 5y ago
    Problem is, the device doesn't have to know, which address is the working one - e.g. which prefix is working on the upstream. It might break connections etc. A solution of course could be to have NAT66 and I really mean address translation not masquerading/ port translation here - as such, much easier to do as it is a 1:1 mapping or to get provider independent space or become a LIR and have two providers announce your space with respective BGP configuration for failover. It is a solvable problem but isn't much guidance and experience with this at smaller companies that might not want to run BGP or go through hoops to get PI space etc.
    - yardstick 5y ago
      Exactly this. And you are right BGP is a non-starter for smaller sites, especially where cellular is involved. Often small site businesses just need a backup internet connection to access the web and emails, which doesn’t need the overhead of BGP. Also there is a non-trivial cost to using BGP (equipment, expertise, and ISP will charge more for the privilege) which for smaller business doesn’t make economic sense.
- dijit 5y ago
  You sound like you know what you're talking about, which makes me a bit confused because you appear to be misinformed here. Your router will advertise new routes immediately when it's given a new WAN address, there's no downtime incurred explicitly from IPv6 in that scenario: local connections will still route until the timeout anyway. SLAAC issues (and can issue) more than a single IP per device, leading to interesting bugs like the ones Sam Bowne talks about in windows.[0] Changing a WAN interface _does_ incur downtime on ipv4 too, unless you're assigning virtual NICs and then failing over: which IPv6 would support in identical ways. [0]: https://youtu.be/YOglp0m35D8?t=1362 https://youtu.be/YOglp0m35D8?t=1362
  - yardstick 5y ago
    Yes sorry I should have been clearer, it’s the connections from clients having to timeout and re-establish upon IP change that is the issue. Specifically where those packets might be going over a SD-WAN type solution where a WAN change is non-disruptive to SD-WAN destine traffic. It relies on clients having NAT addresses and using those addresses for Internet destination addresses (not just private space). Another issue with SLAAC/lack of NAT on the LAN clients is you can’t do policy based routing on the router, eg I’ve got a fast fibre but it’s costly to use, I’ve also got a cheap and cheerful cable/DSL line that I use for backups and FTP. I want to route all requests to my backup service (which has a domain that resolves to a public IPv6 address) via the cable/DSL and everything else via Fibre. Easy to do on IPv4.
    - dijit 5y ago
      But, nothing you said is inherent to NAT, you should read up a bit more on iBPF for the latter and the former works exactly the same way on v6 as v4. Static routing is not really a thing unless you’re a really bad network admin- for sure your ISP wont be doing static routing to your home.
      - yardstick 5y ago
        Can you talk about this some more? Also do you mean eBPF or iBPF or iBGP? If it's BGP that's just too complicated/expensive for a lot of the small businesses I deal with.
- whoknowswhat11 5y ago
  Finally someone who get's it. First - you can't actually get static IPv6 despite the claims that there is plenty of it as a home user in the US. This static IPv6 for everyone is basically a total lie. It's super simple with IPv4 to setup an internal network with known hosts / DHCP lease reservations if needed / dns etc, and have all that stay totally unchanged as the WAN link bounces around. If you are supporting a bunch of users (who yes, will configure a printer using the printers IP etc) then this makes like simple. You can do this at home too easily etc. There is a weird myopia in the IPv6 world about use cases for IP. It's like they just ignored what people need and want, and went a totally different direction. We need IPv4+ with another octet and be done with this :) I'm serious, anyone interested in trying to push this. Keep everything the same except with another octet at the front?
  - BenjiWiebe 5y ago
    For your local DNS names, etc, you could use the link-local IPv6 address.
    - whoknowswhat11 5y ago
      For some reason these change endlessly on my network. RFC4941 or similar privacy extension stuff might explain this.
  - p1mrx 5y ago
    Let's keep the IPv4 header, but start counting packets from byte -2 instead of 0.
bandie91 5y ago
i need ipv6 nat because isp gives me only 1 ip.

TavsiE9s 5y ago

At this point Google's refusal to implement DHCPv6 is well documented and is being brought up in a lot of arguments. Easy solution: if you need DHCPv6 you don't deploy Android devices and move on.

yardstick 5y ago
It’s only easy if you don’t have to support Android devices. Often it’s not possible to do so.
- deleted 5y ago
  [deleted]
selfhoster11 5y ago
That's not how it works. For BYOD or home use, the device is always more important than the network. You can't just tell somebody "lol, Android not supported". Most of the phones out there are Androids, and not everyone prefers iOS even without the extra cost attached to an Apple phone.
maccolgan 5y ago
DHCPv6 isn't mandatory to use IPv6, and SLAAC works fine in those cases (and neither are mandatory actually, can't be). This isn't related to IPv6 overall.
unionpivo 5y ago
Android devices are not optional in some parts of world with low iPhone adaption. In my previous company of 250+ people only 2 had iphones.

anthropodie 5y ago

NAT is the worst thing that could have happened to Internet. Without NAT people would have been able to host their own blogs, pages, photos decades ago from their home. We could have had far more decentralized applications than we have today and would have prevented this walled garden mess of Internet. The ability to address any system on the Internet with it's unique IP is what original Internet was supposed to be. NAT was temporary solution to address the issue of limited IPs but now that is single protocol that is preventing the migration to IPv6

majidazimi 5y ago
I don't know why this is being down voted. The entire modern bullshit Internet exists because of NAT. We can't host stuff ourselves and have to use some central system. Since nothing is free, the provider has to inject more and more ads everywhere.
- api 5y ago
  I bet the actual cost of NAT when all things are considered is well into the trillions of dollars. Any attempt to keep IPv4 alive is not a net win. It's another few trillion down the drain.
- rand49an 5y ago
  Because it implies that it is the single reason that people don't host their own sites anymore, when in reality people don't because it is generally too difficult, expensive, unreliable and redundant to do so. Almost nobody wants to host their own social media or messenger site and if you did your friends wouldn't use it too. Besides, anyone who currently wants to do so can get a cheap VPS for dollars a month.
  - 6510 5y ago
    There is no telling what would happen. It is only difficult, expensive, unreliable because no one does it? I think there is proof of the opposite in how people host giant torrents without much issues, some buy seed boxes, their friends use it too.