4 ms·

Does it really matter for the adoption if at the end you are using an ELB with an IPv4 anyways?

X-Istence 5y ago
Right now you have a choice in how you configure your network: 1. IPv4 private with NAT gateway and ELB dual stack providing IPv4/IPv6 for clients 2. IPv4 private with 1:1 ephemeral IP (avoids the NAT gateway tax, but now every VM gets a public IPv4 address) and ELB dual stack providing IPv4/IPv6 for clients 3. IPv6 globally unique with no IPv4 and ELB dual stack providing IPv4/IPv6 for clients With option 1 you end up paying money for the NAT gateway for any outbound traffic instantiated from the instance (not return traffic through the ELB), this costs you 2 IPv4 addresses (1 for NAT gateway, one for the ELB, ignore AZ's and HA for now) With option 2 you end up not paying for the NAT gateway, but get a free IPv4 address per VM, so N VM's + 1 ELB IPv4 address is N + 1 IPv4 addresses. (NAT Gateways are expensive, even if you have one sitting mostly idle, and don't forget cross AZ traffic if you have only one NAT gateway but instances in multiple AZ's, or you need to spin up multiple NAT gateways). With option 3 you end up not paying for the NAT gateway, nor do you use a public IPv4 address. This might not work if your instance needs to reach IPv4 parts of the internet, but if its just API servers that communicate internally, they likely don't need to and can use IPv6 for the remaining traffic. Now you have just 1 IPv4 address on the ELB. If AWS were able to incentivize its customers to deploy their systems in an IPv6 only configuration this would put pressure on the publishers of software to make sure their systems are IPv6 enabled so that their customers could download it, and it would reduce the amount of public IPv4 addresses that are required across AWS as a whole. Running an IPv6 only core is entirely possible, and makes sense. No more worrying about overlapping IP space (having worked at two companies where they ran out of RFC1918 space and you had to deal with multiple hops to get into various networks, which is no fun), thus simplifying network management.
- mschuster91 5y ago
  > having worked at two companies where they ran out of RFC1918 space I get running out of 192.168.0.0/16, that is easy enough if you have a lot of locations and one /24 per location. But how in earth does one run out of 10.0.0.0/8 IPs, outside of a company merger?!
  - dekhn 5y ago
    Often things are allocated and remain unused, but cannot be reallocated. So companies end up with large parts of 10/8 reserved. I recently had to start using some weird 100 addresses (some reserved router protocol) for this reason. It doesn't help that a lot of AWS stuff wants to consume an IPv4 for no good reason (IE, the machine gets an IPv4 but isn't reachable from the internet).
    - zrail 5y ago
      100.64.0.0/10 is reserved for CGNAT providers to assign to CPE. If you don't connect to a CGNAT then there's nothing stopping you from using it, however. Tailscale hands out addresses in 100.100 for that reason (deconflict with customer private networks) https://en.m.wikipedia.org/wiki/IPv4_shared_address_space https://en.m.wikipedia.org/wiki/IPv4_shared_address_space
  - LogonType10 5y ago
    > But how in earth does one run out of 10.0.0.0/8 IPs, outside of a company merger?! Twenty company acquisitions.
  - Dagger2 5y ago
    10/8 isn't actually that much space. It's only 256 /16s. Either way, mergers are common and it only takes one VPN to another company also using 10/8 to have a problem.
    - nobody9999 5y ago
      >10/8 isn't actually that much space. It's only 256 /16s. Either way, mergers are common and it only takes one VPN to another company also using 10/8 to have a problem. I've had to address that with partners/service providers. It just requires a double NAT to make it work. Which is a pain, but necessity is the mother of invention after all.
      - Dagger2 5y ago
- merb 5y ago
  Btw Often a nat gateway makes sense even for ipv6 because its Easier to firewall
  - merb 5y ago
    could not edit, but probably a lot of people did not understand my comment. our company often deals with very strict rules so that most services in the internet are blocked. we use gcp/gke with surge updates, thus we would loose our static access ip. however now since they explictly need to enable our services we need a static ip and it is way easier to do that with nat gateway. basically we have a service that connects to http to their external ip which is firewall'd and thus if our client ip's will change it's a headache
  - X-Istence 5y ago
    No, NAT gateway for IPv6 does not make sense.

Right now you have a choice in how you configure your network: 1. IPv4 private with NAT gateway and ELB dual stack providing IPv4/IPv6 for clients 2. IPv4 private with 1:1 ephemeral IP (avoids the NAT gateway tax, but now every VM gets a public IPv4 address) and ELB dual stack providing IPv4/IPv6 for clients 3. IPv6 globally unique with no IPv4 and ELB dual stack providing IPv4/IPv6 for clients With option 1 you end up paying money for the NAT gateway for any outbound traffic instantiated from the instance (not return traffic through the ELB), this costs you 2 IPv4 addresses (1 for NAT gateway, one for the ELB, ignore AZ's and HA for now) With option 2 you end up not paying for the NAT gateway, but get a free IPv4 address per VM, so N VM's + 1 ELB IPv4 address is N + 1 IPv4 addresses. (NAT Gateways are expensive, even if you have one sitting mostly idle, and don't forget cross AZ traffic if you have only one NAT gateway but instances in multiple AZ's, or you need to spin up multiple NAT gateways). With option 3 you end up not paying for the NAT gateway, nor do you use a public IPv4 address. This might not work if your instance needs to reach IPv4 parts of the internet, but if its just API servers that communicate internally, they likely don't need to and can use IPv6 for the remaining traffic. Now you have just 1 IPv4 address on the ELB. If AWS were able to incentivize its customers to deploy their systems in an IPv6 only configuration this would put pressure on the publishers of software to make sure their systems are IPv6 enabled so that their customers could download it, and it would reduce the amount of public IPv4 addresses that are required across AWS as a whole. Running an IPv6 only core is entirely possible, and makes sense. No more worrying about overlapping IP space (having worked at two companies where they ran out of RFC1918 space and you had to deal with multiple hops to get into various networks, which is no fun), thus simplifying network management.

mschuster91 5y ago
> having worked at two companies where they ran out of RFC1918 space I get running out of 192.168.0.0/16, that is easy enough if you have a lot of locations and one /24 per location. But how in earth does one run out of 10.0.0.0/8 IPs, outside of a company merger?!
- dekhn 5y ago
  Often things are allocated and remain unused, but cannot be reallocated. So companies end up with large parts of 10/8 reserved. I recently had to start using some weird 100 addresses (some reserved router protocol) for this reason. It doesn't help that a lot of AWS stuff wants to consume an IPv4 for no good reason (IE, the machine gets an IPv4 but isn't reachable from the internet).
  - zrail 5y ago
    100.64.0.0/10 is reserved for CGNAT providers to assign to CPE. If you don't connect to a CGNAT then there's nothing stopping you from using it, however. Tailscale hands out addresses in 100.100 for that reason (deconflict with customer private networks) https://en.m.wikipedia.org/wiki/IPv4_shared_address_space https://en.m.wikipedia.org/wiki/IPv4_shared_address_space
- LogonType10 5y ago
  > But how in earth does one run out of 10.0.0.0/8 IPs, outside of a company merger?! Twenty company acquisitions.
- Dagger2 5y ago
  10/8 isn't actually that much space. It's only 256 /16s. Either way, mergers are common and it only takes one VPN to another company also using 10/8 to have a problem.
  - nobody9999 5y ago
    >10/8 isn't actually that much space. It's only 256 /16s. Either way, mergers are common and it only takes one VPN to another company also using 10/8 to have a problem. I've had to address that with partners/service providers. It just requires a double NAT to make it work. Which is a pain, but necessity is the mother of invention after all.
    - Dagger2 5y ago
merb 5y ago
Btw Often a nat gateway makes sense even for ipv6 because its Easier to firewall
- merb 5y ago
  could not edit, but probably a lot of people did not understand my comment. our company often deals with very strict rules so that most services in the internet are blocked. we use gcp/gke with surge updates, thus we would loose our static access ip. however now since they explictly need to enable our services we need a static ip and it is way easier to do that with nat gateway. basically we have a service that connects to http to their external ip which is firewall'd and thus if our client ip's will change it's a headache
- X-Istence 5y ago
  No, NAT gateway for IPv6 does not make sense.