15 ms·

IPv6-only subnets and EC2 instances

159 points by miyuru 5y ago

CaliforniaKarl 5y ago
This is cool! Though I'm wondering why it's Nitro-only. Are there plans to roll this out to all of EC2?
- paulfurtado 5y ago
  At this point you can consider all non-nitro instance types to be legacy: it's been years now since all new instance types have been nitro and pretty much every instance family has a nitro replacement that is both faster and cheaper than its predecessor (except in the odd case where the sizes don't line up nicely). So it's very possible they've just stopped letting legacy instance types get new features as an incentive. However, nitro instances use their own network hardware which includes the ENA NICS and possibly the switches, where it seems like they may have pushed their virtual network stack into hardware, in which case it makes sense that they'd not bother implementing features separately for non-nitro. Another random network feature nitro instances get is transparent end-to-end encryption for any traffic flowing between two nitro instances in a VPC. There used to also be Network Load Balancer features that only worked for nitro backends/clients.
crummy 5y ago
I wonder if Amazon could make a significant impact on ipv6 uptake if they offered a very generous ipv6 only tier.
- jeroenhd 5y ago
  If Amazon will make an impact, I think it'll be because IPv6 addresses follow the standard rates and IPv4 addresses will get more expensive. Cannibalising reserved address space like 127.0.0.0/8 will only get the IPv4 internet so far. Eventually, the scarcity of IP addresses will make IPv6 the more business-conscious choice for many applications (like API endpoints and other services that you call from your own infrastructure where you can ensure IPv6 availability). Maybe the free tier will eventually stop coming with an IPv4 address, that might also push them over the edge.
  - ayushnix 5y ago
    > Cannibalising reserved address space like 127.0.0.0/8 will only get the IPv4 internet so far. Eventually, the scarcity of IP addresses will make IPv6 the more business-conscious choice for many applications The decision to consume loopback address space has made me even more cynical about IPv6 ever becoming mainstream within my lifetime. Using IPv4 is like using fossil fuels — we know that they are going to run out/cause us harm and yet we keep using them. I don't know of a single ISP in my country which offers functional IPv6. All they do is offer CGNAT IPv4 addresses, which offers a crippled experience of the Internet.
    - 1ris 5y ago
      I don't know what you mean by "mainstream", but what I understand by it ipv6 is mainstream since quite a while. It has an adoption rate of around 50% in the western world and signifiant places outside of it (SA,India, Thailand, Vietnam, Japan, Brazil)
      - ayushnix 5y ago
        I don't know of a single ISP in India which offers functional IPv6 in broadband connections. I won't consider 4G because it's almost useless (at least in India) for doing anything serious.
        unmole 5y ago
        Jio Fibre does. ACT used to in some places but it's inconsistent.
        ayushnix 5y ago
        Last I checked, IPv6 on JioFibre was broken and I couldn't get a publicly discoverable IPv6 address. Have things changed?
        maccolgan 5y ago
- k8sToGo 5y ago
  Does it really matter for the adoption if at the end you are using an ELB with an IPv4 anyways?
  - X-Istence 5y ago
    Right now you have a choice in how you configure your network: 1. IPv4 private with NAT gateway and ELB dual stack providing IPv4/IPv6 for clients 2. IPv4 private with 1:1 ephemeral IP (avoids the NAT gateway tax, but now every VM gets a public IPv4 address) and ELB dual stack providing IPv4/IPv6 for clients 3. IPv6 globally unique with no IPv4 and ELB dual stack providing IPv4/IPv6 for clients With option 1 you end up paying money for the NAT gateway for any outbound traffic instantiated from the instance (not return traffic through the ELB), this costs you 2 IPv4 addresses (1 for NAT gateway, one for the ELB, ignore AZ's and HA for now) With option 2 you end up not paying for the NAT gateway, but get a free IPv4 address per VM, so N VM's + 1 ELB IPv4 address is N + 1 IPv4 addresses. (NAT Gateways are expensive, even if you have one sitting mostly idle, and don't forget cross AZ traffic if you have only one NAT gateway but instances in multiple AZ's, or you need to spin up multiple NAT gateways). With option 3 you end up not paying for the NAT gateway, nor do you use a public IPv4 address. This might not work if your instance needs to reach IPv4 parts of the internet, but if its just API servers that communicate internally, they likely don't need to and can use IPv6 for the remaining traffic. Now you have just 1 IPv4 address on the ELB. If AWS were able to incentivize its customers to deploy their systems in an IPv6 only configuration this would put pressure on the publishers of software to make sure their systems are IPv6 enabled so that their customers could download it, and it would reduce the amount of public IPv4 addresses that are required across AWS as a whole. Running an IPv6 only core is entirely possible, and makes sense. No more worrying about overlapping IP space (having worked at two companies where they ran out of RFC1918 space and you had to deal with multiple hops to get into various networks, which is no fun), thus simplifying network management.
    - mschuster91 5y ago
      > having worked at two companies where they ran out of RFC1918 space I get running out of 192.168.0.0/16, that is easy enough if you have a lot of locations and one /24 per location. But how in earth does one run out of 10.0.0.0/8 IPs, outside of a company merger?!
- austincheney 5y ago
  Not likely. Greater adoption of IPv6 generally comes down to only one thing: replacing physical equipment. The only thing likely to force that is greater demand from consumer applications, which has not yet occurred.
  - kazen44 5y ago
    what? IPv6 has been supported by major telecomunication equipment manufacturers for nearly 2 and a half decades by now. It is just a matter of getting an inet6 prefix from your RIR/LIR, and configuring it in your network. IPv6 is not hard nor is it difficult to implement, and its nitty gritty details are actually far more logically sound then IPv4. (ARP is a major paint point for instance in large networks, so is IP broadcast traffic). Most large WAN networks have a core which is either label switched (MPLS) and this doesn't care about anything in regards to the protocol which it is transporting, or is doing dual stack already.
    - austincheney 5y ago
      How many residences are IPv6 first? How many countries prioritize IPv6 in their consumer electronics? My house is IPv6 first only because my ISP mandates such.
    - daper 5y ago
      Generally agree, for basic configuration it just works. But I was planning to use IPv6 in some network segments in my company. Providing proper VPN (road warrior style) for employees to access such network isn't simple with IPv6 where every address is routable over internet. Morver Fortigate devices we have don't have such functionality.
    - nobody9999 5y ago
      >It is just a matter of getting an inet6 prefix from your RIR/LIR, and configuring it in your network Which is easier said than done. Since my ISP won't provide me with IPv6, requesting a block from my RIR is my only option. However, I don't meet the requirements[0] for getting a block directly from an RIR (in my case, ARIN). In fact, unless you have a fairly large internet-facing presence, RIR's won't even give you the time of day: Have an IPv4 assignment from ARIN or one of its predecessors Intend to immediately be IPv6 multi-homed Have 13 end sites (offices, data centers, etc.) within one year Use 2,000 IPv6 addresses within one year Use 200 /64 subnets within one year [0] https://www.arin.net/resources/guide/ipv6/first_request/#enduser https://www.arin.net/resources/guide/ipv6/first_request/#end... Edit: Note that the requirements listed above are for end users not service providers.
- vbezhenar 5y ago
  Amazon buys lots of IPv4 addresses. That's like land: they're not produced anymore. They have all the incentives to keep IPv4 alive to protect their investments.
  - dodobirdlord 5y ago
    They don’t need to do any work to keep IPv4 alive, the rest of the world will happily do that for them. Amazon couldn’t kill IPv4 if they tried.
  - theneworc 5y ago
    IPv4 isn't an "investment" for Amazon. They didn't buy them up with the hope that the price will increase and they'll make a profit. They buy more IPv4 addresses because they need those addresses to continue serving customers. They will likely never, ever sell those IPv4 addresses. And what's more, they will need to continue to buy more IPv4 addresses as they grow and their customers needs for address space grow. Amazon actually has an incentive for IPv4 to become less expensive so that further purchases of addresses are less costly to their business. And the best two ways to do that are: 1) encourage adoption to IPv6 so that IPv4 becomes less expensive and 2) encourage adoption of IPv6 so that Amazon needs to buy less IPv4 addresses.
    - fomine3 5y ago
      It's like real estates, they rent services build upon IPv4 addresses.
- 2ion 5y ago
  Where I work now, not likely, because we have hundreds of AWS accounts, VPC peering and private VPC access only over VPN, which can to my knowledge only route IPv4...
  - zozbot234 5y ago
    You only need a single public IPv4 address to bridge connections to your VPC, though. Everything else can now be IPv6 only.
- Navarr 5y ago
  I think for a long time the only thing that will push IPv6 uptake will be legislation. ISPs don't want to implement it because their customers aren't pushing them to, because websites aren't typically IPv6-only, because that's a terrible business model. So unless we force or incentivize ISPs to implement IPv6 access through law, it's going to be a long time before we hit the breaking point where something HAS to be done by ISPs
  - count 5y ago
    LOL. IPv6 usage has been mandated by legislation for years for the Federal Govt. in the US. And yet....mostly no adoption.
  - ramshanker 5y ago
    India has mandated IPv6 for all existing or new internet connection by Dec 2022.
  - nanis 5y ago
    > I think for a long time the only thing that will push IPv6 uptake will be legislation. Is it really such a great idea to force every single device on the internet to be globally uniquely identifiable?
    - kd913 5y ago
      Yes it is. We have run out of ipv4 addresses, CGNATs cause problems with self-hosting, ipv4 allocations are not fair and are driving up the cost of infrastructure/access. Particularly problematic in developing Countries. Security is not an argument, ipv6 firewalls have existed for a long period now. If we want to make the internet to scale then we need to encourage the use of ipv6.
    - acdha 5y ago
      Is that really what's happening? It gives each device an address which is unique at the time but those devices get new addresses periodically when the network configuration changes, they roam networks, etc. and there's no global registry linking addresses to people or even the same device. From another angle, most people are walking around with a globally-unique identifier (IMEI) in their pocket with all kinds of sensors. Does using IPv6 materially change the situation for any attacker?
- Hamuko 5y ago
  So you get a discount on your AWS resources and the only downside is that two out of three people cannot reach your services? https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
- Shadonototra 5y ago
  EC2 ipv6 SHOULD be cheaper, ipv4 cost a lot because they are becoming scarce ipv6 much cheaper if they don't then they should be ashamed
rsmets 5y ago
Does GPC support ipv6 only subnets? Some cursory pokes around I can not tell. (I really only work with AWS). Azure? Any other notable services providers have done this yet? I can not tell if this is long overdue or actually something to take note of.
- X-Istence 5y ago
  GCP has support for IPv6 dual stack in only 4 or so regions: https://cloud.google.com/vpc/docs/vpc#ipv6-regions https://cloud.google.com/vpc/docs/vpc#ipv6-regions not only that but enabling IPv6 is not as simple as it is in AWS and requires a lot of manual fiddling with the subnets. Once enabled it does give you a prefix that is automatically assigned to each VM in the subnet which you can use for containers and the like. Azure's IPv6 support is terrible, and does not support IPv6 only networks: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview https://docs.microsoft.com/en-us/azure/virtual-network/ip-se... including limitations on the prefix size you can get for your VM's: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-address-prefix https://docs.microsoft.com/en-us/azure/virtual-network/ip-se... no /56 like you can get in AWS that you can then slice /64's out of for subnets and no prefix delegation for running container workloads on their own GUA. Where Azure was ahead was that its load balancers supported targeting IPv6 addresses and thus didn't require IPv4 for forwarding traffic. AWS fixed that today. AWS should be lauded, and while it is long overdue (IPv6 core, with IPv4 only on the edge makes so much sense) AWS is the first hyperscaler to do so.
- jiggawatts 5y ago
  In Azure, enabling IPv6 in any way is a terrible mistake that will break your IPv4 network. There is zero benefit to enabling IPv6 in Azure, because they carefully prevent any use of the beneficial features of IPv6 that make it worthwhile over IPv4. A key purpose of IPv6 is no longer needing NAT to the point that IPv6 implementation typically do not support NAT at all -- so Azure engineers developed their own custom IPv6 NAT to force NAT on all of their IPv6 users. Another key purpose of IPv6 is the enormous address space, which means you no longer need to carefully "carve up" and manually allocate addresses in a stateful way -- Azure engineers restricted IPv6 public address prefixes to blocks of just 16 addresses. Not /16 or anything like that. No. Sixteen. To assist migration, IPv6 is designed to be dual stack and coexist side-by-side with IPv4 with no (or minimal) impact. Azure engineers made sure that if you turn it on, wildly unrelated IPv4 features will break. In other subnets. Even other virtual networks! Critical features are masked out, making this a non-starter for practically everybody. To enable layered systems to be migrated, IPv6 is sufficiently "compatible" with IPv4 to allow the use of relatively simple protocol-translating middle boxes. So you can have IPv6 on the outside and IPv4 on the inside, or vice-versa. Not on Azure! It's only IPv4-to-IPv4 or IPv6-to-IPv6. You can't have both, and you can't translate. PICK ONE, NOW. It's shameful. Seriously, if any Microsoft network engineers stumble upon this post, you should feel bad. It's 2021 when I'm writing this, mere days from 2022, and you've utterly failed to even begin to support the transition to IPv6 in the public cloud. Shame, shame.
mcbain 5y ago
It is a such tiny thing, but I really like that the metadata service is at fd00:ec2::254 On v4 it is 169.254.169.254 hence the final 254 (and other services like DNS at 253), but using the ULA range of ec2 is a simple, effective touch.
- CodesInChaos 5y ago
  I really hate that the metadata service is reachable via IP at all, and not just via a file based unix socket or a similar endpoint. Or even similar to procfs, instead of http based at all.
  - tedk-42 5y ago
    You'd rather mount a socket or file to a container that hit the endpoint directly over HTTP? I prefer the latter as it's far simpler.
    - johncolanduoni 5y ago
      The problem is the metadata endpoint gives any process on your VM that can make API calls to that address full AWS credentials for that instance’s role. That can turn out to be too simple to use.
      - nousermane 5y ago
        ...unless you use identity-aware firewall, such as iptables: iptables -A OUTPUT \ -d 169.254.0.0/16 \ -m owner -j REJECT \ '!' --uid-owner 0
        pabs3 5y ago
        Hmm, so root processes within the container can still access it?
        yebyen 5y ago
zz865 5y ago
Always thought going IPv6 only is a great way to avoid getting hit by script kiddies too.
thedougd 5y ago
Still waiting on AWS to implement referencing network security groups across Transit Gateway VPCs. Until then, I'm stuck with more IP references than I'd like, and wouldn't dare try to add IPv6 to that. The end to end IPv6 support for ELBs is welcome, and I try to add IPv6 to every externally facing service, however Global Accelerators and API gateways still do not offer support.
ghshephard 5y ago
This is great news. We really AWS IPv6 at a prior company I worked for that had about 25 million IPv6 nodes that needed to be addressable, and we had a super ugly back end - 26+ 64GB/8CPU servers (which was a lot back in 2008). We really could have used the flexibility of AWS back then - but, were completely blocked by Amazon's inability and absolute unwillingness to even consider supporting IPv6 on their internal network. Took them almost 8 years (around 2016sh) before they supported IPv6 on their internal networks.
- RKearney 5y ago
  Other cloud providers like GCP only just recently started to adopt IPv6. Today, you can only use IPv6 in asia-east1, asia-south1, europe-west1, and us-west2[0]. The cynic in me believes Google only did this due to the US Government's IPv6 only memorandum issued last year[1] requiring networks operate as IPv6-only. [0] https://cloud.google.com/vpc/docs/vpc#ipv6-regions https://cloud.google.com/vpc/docs/vpc#ipv6-regions [1] https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-0...
- selfhoster11 5y ago
  Just out of curiosity, what was your use case for so many IPv6 addresses at once?
  - ghshephard 5y ago
    Mesh Networking - Utility Devices. (Think electrical meters in homes) - Also bunch of streetlights.
mitchs 5y ago
I wonder how long it will take for CDK to support this stuff. I'm not sure how they will back themselves out of the corner of subnets having a required ipv4 CIDR property.
- dastbe 5y ago
  you make it an optional field. it’s converting an optional field to required that is effectively impossible
  - mitchs 5y ago
    Anyone with typescript code that references the non-optional field will get type errors if it is made optional. Though stuffing the string with the v6 subnet wouldn't be the worst thing in the world. Any code that is blindly using it expecting v4 addresses will already be broken if a v6 only subnet is passed in.
- fuy 5y ago
  Use it for IPv6 subnet prefix :)
nicoco 5y ago
Can Amazon Linux 2 repos be reached via IPv6? Last time I checked it was impossible, so this wasn't very practical to me. Someone else than me was annoyed by this: https://forums.aws.amazon.com/thread.jspa?messageID=987026 https://forums.aws.amazon.com/thread.jspa?messageID=987026

159 points by miyuru 5y ago

CaliforniaKarl 5y ago

This is cool! Though I'm wondering why it's Nitro-only. Are there plans to roll this out to all of EC2?

paulfurtado 5y ago
At this point you can consider all non-nitro instance types to be legacy: it's been years now since all new instance types have been nitro and pretty much every instance family has a nitro replacement that is both faster and cheaper than its predecessor (except in the odd case where the sizes don't line up nicely). So it's very possible they've just stopped letting legacy instance types get new features as an incentive. However, nitro instances use their own network hardware which includes the ENA NICS and possibly the switches, where it seems like they may have pushed their virtual network stack into hardware, in which case it makes sense that they'd not bother implementing features separately for non-nitro. Another random network feature nitro instances get is transparent end-to-end encryption for any traffic flowing between two nitro instances in a VPC. There used to also be Network Load Balancer features that only worked for nitro backends/clients.

crummy 5y ago

I wonder if Amazon could make a significant impact on ipv6 uptake if they offered a very generous ipv6 only tier.

jeroenhd 5y ago
If Amazon will make an impact, I think it'll be because IPv6 addresses follow the standard rates and IPv4 addresses will get more expensive. Cannibalising reserved address space like 127.0.0.0/8 will only get the IPv4 internet so far. Eventually, the scarcity of IP addresses will make IPv6 the more business-conscious choice for many applications (like API endpoints and other services that you call from your own infrastructure where you can ensure IPv6 availability). Maybe the free tier will eventually stop coming with an IPv4 address, that might also push them over the edge.
- ayushnix 5y ago
  > Cannibalising reserved address space like 127.0.0.0/8 will only get the IPv4 internet so far. Eventually, the scarcity of IP addresses will make IPv6 the more business-conscious choice for many applications The decision to consume loopback address space has made me even more cynical about IPv6 ever becoming mainstream within my lifetime. Using IPv4 is like using fossil fuels — we know that they are going to run out/cause us harm and yet we keep using them. I don't know of a single ISP in my country which offers functional IPv6. All they do is offer CGNAT IPv4 addresses, which offers a crippled experience of the Internet.
  - 1ris 5y ago
    I don't know what you mean by "mainstream", but what I understand by it ipv6 is mainstream since quite a while. It has an adoption rate of around 50% in the western world and signifiant places outside of it (SA,India, Thailand, Vietnam, Japan, Brazil)
    - ayushnix 5y ago
      I don't know of a single ISP in India which offers functional IPv6 in broadband connections. I won't consider 4G because it's almost useless (at least in India) for doing anything serious.
      - unmole 5y ago
        Jio Fibre does. ACT used to in some places but it's inconsistent.
        ayushnix 5y ago
        Last I checked, IPv6 on JioFibre was broken and I couldn't get a publicly discoverable IPv6 address. Have things changed?
        maccolgan 5y ago
k8sToGo 5y ago
Does it really matter for the adoption if at the end you are using an ELB with an IPv4 anyways?
- X-Istence 5y ago
  Right now you have a choice in how you configure your network: 1. IPv4 private with NAT gateway and ELB dual stack providing IPv4/IPv6 for clients 2. IPv4 private with 1:1 ephemeral IP (avoids the NAT gateway tax, but now every VM gets a public IPv4 address) and ELB dual stack providing IPv4/IPv6 for clients 3. IPv6 globally unique with no IPv4 and ELB dual stack providing IPv4/IPv6 for clients With option 1 you end up paying money for the NAT gateway for any outbound traffic instantiated from the instance (not return traffic through the ELB), this costs you 2 IPv4 addresses (1 for NAT gateway, one for the ELB, ignore AZ's and HA for now) With option 2 you end up not paying for the NAT gateway, but get a free IPv4 address per VM, so N VM's + 1 ELB IPv4 address is N + 1 IPv4 addresses. (NAT Gateways are expensive, even if you have one sitting mostly idle, and don't forget cross AZ traffic if you have only one NAT gateway but instances in multiple AZ's, or you need to spin up multiple NAT gateways). With option 3 you end up not paying for the NAT gateway, nor do you use a public IPv4 address. This might not work if your instance needs to reach IPv4 parts of the internet, but if its just API servers that communicate internally, they likely don't need to and can use IPv6 for the remaining traffic. Now you have just 1 IPv4 address on the ELB. If AWS were able to incentivize its customers to deploy their systems in an IPv6 only configuration this would put pressure on the publishers of software to make sure their systems are IPv6 enabled so that their customers could download it, and it would reduce the amount of public IPv4 addresses that are required across AWS as a whole. Running an IPv6 only core is entirely possible, and makes sense. No more worrying about overlapping IP space (having worked at two companies where they ran out of RFC1918 space and you had to deal with multiple hops to get into various networks, which is no fun), thus simplifying network management.
  - mschuster91 5y ago
    > having worked at two companies where they ran out of RFC1918 space I get running out of 192.168.0.0/16, that is easy enough if you have a lot of locations and one /24 per location. But how in earth does one run out of 10.0.0.0/8 IPs, outside of a company merger?!
austincheney 5y ago
Not likely. Greater adoption of IPv6 generally comes down to only one thing: replacing physical equipment. The only thing likely to force that is greater demand from consumer applications, which has not yet occurred.
- kazen44 5y ago
  what? IPv6 has been supported by major telecomunication equipment manufacturers for nearly 2 and a half decades by now. It is just a matter of getting an inet6 prefix from your RIR/LIR, and configuring it in your network. IPv6 is not hard nor is it difficult to implement, and its nitty gritty details are actually far more logically sound then IPv4. (ARP is a major paint point for instance in large networks, so is IP broadcast traffic). Most large WAN networks have a core which is either label switched (MPLS) and this doesn't care about anything in regards to the protocol which it is transporting, or is doing dual stack already.
  - austincheney 5y ago
    How many residences are IPv6 first? How many countries prioritize IPv6 in their consumer electronics? My house is IPv6 first only because my ISP mandates such.
  - daper 5y ago
    Generally agree, for basic configuration it just works. But I was planning to use IPv6 in some network segments in my company. Providing proper VPN (road warrior style) for employees to access such network isn't simple with IPv6 where every address is routable over internet. Morver Fortigate devices we have don't have such functionality.
  - nobody9999 5y ago
    >It is just a matter of getting an inet6 prefix from your RIR/LIR, and configuring it in your network Which is easier said than done. Since my ISP won't provide me with IPv6, requesting a block from my RIR is my only option. However, I don't meet the requirements[0] for getting a block directly from an RIR (in my case, ARIN). In fact, unless you have a fairly large internet-facing presence, RIR's won't even give you the time of day: Have an IPv4 assignment from ARIN or one of its predecessors Intend to immediately be IPv6 multi-homed Have 13 end sites (offices, data centers, etc.) within one year Use 2,000 IPv6 addresses within one year Use 200 /64 subnets within one year [0] https://www.arin.net/resources/guide/ipv6/first_request/#enduser https://www.arin.net/resources/guide/ipv6/first_request/#end... Edit: Note that the requirements listed above are for end users not service providers.
vbezhenar 5y ago
Amazon buys lots of IPv4 addresses. That's like land: they're not produced anymore. They have all the incentives to keep IPv4 alive to protect their investments.
- dodobirdlord 5y ago
  They don’t need to do any work to keep IPv4 alive, the rest of the world will happily do that for them. Amazon couldn’t kill IPv4 if they tried.
- theneworc 5y ago
  IPv4 isn't an "investment" for Amazon. They didn't buy them up with the hope that the price will increase and they'll make a profit. They buy more IPv4 addresses because they need those addresses to continue serving customers. They will likely never, ever sell those IPv4 addresses. And what's more, they will need to continue to buy more IPv4 addresses as they grow and their customers needs for address space grow. Amazon actually has an incentive for IPv4 to become less expensive so that further purchases of addresses are less costly to their business. And the best two ways to do that are: 1) encourage adoption to IPv6 so that IPv4 becomes less expensive and 2) encourage adoption of IPv6 so that Amazon needs to buy less IPv4 addresses.
  - fomine3 5y ago
    It's like real estates, they rent services build upon IPv4 addresses.
2ion 5y ago
Where I work now, not likely, because we have hundreds of AWS accounts, VPC peering and private VPC access only over VPN, which can to my knowledge only route IPv4...
- zozbot234 5y ago
  You only need a single public IPv4 address to bridge connections to your VPC, though. Everything else can now be IPv6 only.
Navarr 5y ago
I think for a long time the only thing that will push IPv6 uptake will be legislation. ISPs don't want to implement it because their customers aren't pushing them to, because websites aren't typically IPv6-only, because that's a terrible business model. So unless we force or incentivize ISPs to implement IPv6 access through law, it's going to be a long time before we hit the breaking point where something HAS to be done by ISPs
- count 5y ago
  LOL. IPv6 usage has been mandated by legislation for years for the Federal Govt. in the US. And yet....mostly no adoption.
- ramshanker 5y ago
  India has mandated IPv6 for all existing or new internet connection by Dec 2022.
- nanis 5y ago
  > I think for a long time the only thing that will push IPv6 uptake will be legislation. Is it really such a great idea to force every single device on the internet to be globally uniquely identifiable?
  - kd913 5y ago
    Yes it is. We have run out of ipv4 addresses, CGNATs cause problems with self-hosting, ipv4 allocations are not fair and are driving up the cost of infrastructure/access. Particularly problematic in developing Countries. Security is not an argument, ipv6 firewalls have existed for a long period now. If we want to make the internet to scale then we need to encourage the use of ipv6.
  - acdha 5y ago
    Is that really what's happening? It gives each device an address which is unique at the time but those devices get new addresses periodically when the network configuration changes, they roam networks, etc. and there's no global registry linking addresses to people or even the same device. From another angle, most people are walking around with a globally-unique identifier (IMEI) in their pocket with all kinds of sensors. Does using IPv6 materially change the situation for any attacker?
Hamuko 5y ago
So you get a discount on your AWS resources and the only downside is that two out of three people cannot reach your services? https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
Shadonototra 5y ago
EC2 ipv6 SHOULD be cheaper, ipv4 cost a lot because they are becoming scarce ipv6 much cheaper if they don't then they should be ashamed

rsmets 5y ago

Does GPC support ipv6 only subnets? Some cursory pokes around I can not tell. (I really only work with AWS). Azure? Any other notable services providers have done this yet? I can not tell if this is long overdue or actually something to take note of.

X-Istence 5y ago
GCP has support for IPv6 dual stack in only 4 or so regions: https://cloud.google.com/vpc/docs/vpc#ipv6-regions https://cloud.google.com/vpc/docs/vpc#ipv6-regions not only that but enabling IPv6 is not as simple as it is in AWS and requires a lot of manual fiddling with the subnets. Once enabled it does give you a prefix that is automatically assigned to each VM in the subnet which you can use for containers and the like. Azure's IPv6 support is terrible, and does not support IPv6 only networks: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview https://docs.microsoft.com/en-us/azure/virtual-network/ip-se... including limitations on the prefix size you can get for your VM's: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-address-prefix https://docs.microsoft.com/en-us/azure/virtual-network/ip-se... no /56 like you can get in AWS that you can then slice /64's out of for subnets and no prefix delegation for running container workloads on their own GUA. Where Azure was ahead was that its load balancers supported targeting IPv6 addresses and thus didn't require IPv4 for forwarding traffic. AWS fixed that today. AWS should be lauded, and while it is long overdue (IPv6 core, with IPv4 only on the edge makes so much sense) AWS is the first hyperscaler to do so.
jiggawatts 5y ago
In Azure, enabling IPv6 in any way is a terrible mistake that will break your IPv4 network. There is zero benefit to enabling IPv6 in Azure, because they carefully prevent any use of the beneficial features of IPv6 that make it worthwhile over IPv4. A key purpose of IPv6 is no longer needing NAT to the point that IPv6 implementation typically do not support NAT at all -- so Azure engineers developed their own custom IPv6 NAT to force NAT on all of their IPv6 users. Another key purpose of IPv6 is the enormous address space, which means you no longer need to carefully "carve up" and manually allocate addresses in a stateful way -- Azure engineers restricted IPv6 public address prefixes to blocks of just 16 addresses. Not /16 or anything like that. No. Sixteen. To assist migration, IPv6 is designed to be dual stack and coexist side-by-side with IPv4 with no (or minimal) impact. Azure engineers made sure that if you turn it on, wildly unrelated IPv4 features will break. In other subnets. Even other virtual networks! Critical features are masked out, making this a non-starter for practically everybody. To enable layered systems to be migrated, IPv6 is sufficiently "compatible" with IPv4 to allow the use of relatively simple protocol-translating middle boxes. So you can have IPv6 on the outside and IPv4 on the inside, or vice-versa. Not on Azure! It's only IPv4-to-IPv4 or IPv6-to-IPv6. You can't have both, and you can't translate. PICK ONE, NOW. It's shameful. Seriously, if any Microsoft network engineers stumble upon this post, you should feel bad. It's 2021 when I'm writing this, mere days from 2022, and you've utterly failed to even begin to support the transition to IPv6 in the public cloud. Shame, shame.

mcbain 5y ago

It is a such tiny thing, but I really like that the metadata service is at fd00:ec2::254 On v4 it is 169.254.169.254 hence the final 254 (and other services like DNS at 253), but using the ULA range of ec2 is a simple, effective touch.

CodesInChaos 5y ago
I really hate that the metadata service is reachable via IP at all, and not just via a file based unix socket or a similar endpoint. Or even similar to procfs, instead of http based at all.
- tedk-42 5y ago
  You'd rather mount a socket or file to a container that hit the endpoint directly over HTTP? I prefer the latter as it's far simpler.
  - johncolanduoni 5y ago
    The problem is the metadata endpoint gives any process on your VM that can make API calls to that address full AWS credentials for that instance’s role. That can turn out to be too simple to use.
    - nousermane 5y ago
      ...unless you use identity-aware firewall, such as iptables: iptables -A OUTPUT \ -d 169.254.0.0/16 \ -m owner -j REJECT \ '!' --uid-owner 0
      - pabs3 5y ago
        Hmm, so root processes within the container can still access it?
        yebyen 5y ago

zz865 5y ago

Always thought going IPv6 only is a great way to avoid getting hit by script kiddies too.

thedougd 5y ago

Still waiting on AWS to implement referencing network security groups across Transit Gateway VPCs. Until then, I'm stuck with more IP references than I'd like, and wouldn't dare try to add IPv6 to that. The end to end IPv6 support for ELBs is welcome, and I try to add IPv6 to every externally facing service, however Global Accelerators and API gateways still do not offer support.

ghshephard 5y ago

This is great news. We really AWS IPv6 at a prior company I worked for that had about 25 million IPv6 nodes that needed to be addressable, and we had a super ugly back end - 26+ 64GB/8CPU servers (which was a lot back in 2008). We really could have used the flexibility of AWS back then - but, were completely blocked by Amazon's inability and absolute unwillingness to even consider supporting IPv6 on their internal network. Took them almost 8 years (around 2016sh) before they supported IPv6 on their internal networks.

RKearney 5y ago
Other cloud providers like GCP only just recently started to adopt IPv6. Today, you can only use IPv6 in asia-east1, asia-south1, europe-west1, and us-west2[0]. The cynic in me believes Google only did this due to the US Government's IPv6 only memorandum issued last year[1] requiring networks operate as IPv6-only. [0] https://cloud.google.com/vpc/docs/vpc#ipv6-regions https://cloud.google.com/vpc/docs/vpc#ipv6-regions [1] https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-0...
selfhoster11 5y ago
Just out of curiosity, what was your use case for so many IPv6 addresses at once?
- ghshephard 5y ago
  Mesh Networking - Utility Devices. (Think electrical meters in homes) - Also bunch of streetlights.

mitchs 5y ago

I wonder how long it will take for CDK to support this stuff. I'm not sure how they will back themselves out of the corner of subnets having a required ipv4 CIDR property.

dastbe 5y ago
you make it an optional field. it’s converting an optional field to required that is effectively impossible
- mitchs 5y ago
  Anyone with typescript code that references the non-optional field will get type errors if it is made optional. Though stuffing the string with the v6 subnet wouldn't be the worst thing in the world. Any code that is blindly using it expecting v4 addresses will already be broken if a v6 only subnet is passed in.
fuy 5y ago
Use it for IPv6 subnet prefix :)

nicoco 5y ago

Can Amazon Linux 2 repos be reached via IPv6? Last time I checked it was impossible, so this wasn't very practical to me. Someone else than me was annoyed by this: https://forums.aws.amazon.com/thread.jspa?messageID=987026 https://forums.aws.amazon.com/thread.jspa?messageID=987026