5 ms·

What would you do with all those addresses? Could you please elaborate about each one?

by WesolyKubeczek 5y ago

edm0nd 5y ago
First thing I can think of is spam and abuse
- formerly_proven 5y ago
  Good luck sending emails with IPv6.
  - profmonocle 5y ago
    It works fine with Gmail. And since G Suite is so widely used, tons of domains can send/receive mail over IPv6 just fine.
  - vaylian 5y ago
    Why should that be an issue?
    - erinnh 5y ago
      Some mail-admins will downgrade IPv6-only MX servers reputation-wise, due to the limiting/cost-increasing factor of IPv4 Addresses.
  - BenjiWiebe 5y ago
    I do it already. Well, both IPv4 and IPv6. There's a decent number of IPv6 capable MX's out there, the most prominent being GMail. If you were meaning IPv6-only then yes that would be pretty bad.
- profmonocle 5y ago
  If an IPv6 spam filter is working on a per-address basis, it's never going to work. The smallest allocation you can get from a RIR is a /48. Even residential ISPs give at least a /64. You could use a different address for every email and never run out.
fuzzy2 5y ago
A /56 + prefix delegation would enable IPv6 VMs without any dirty hacks.
- detaro 5y ago
  ... giving each VM one IP out of the /64 is not a "dirty hack". I guess if you want to do complex networks between the VMs it'd help a bit? Still, /64 is IMHO a good default for single machines.
  - fuzzy2 5y ago
    Traffic for any of the addresses in the /64 arrives at your server’s "external" network interface. Is there any non-hacky way to forward this traffic to an internal virtual network?
    - profmonocle 5y ago
      You just create a route for it, same as you would with any size network. Linux allows you to create routes for IPv6 prefixes longer than /64 without any issue. On AWS I have a VM with a /80 routed to it, which I have divided into multiple /96's internally. It works fine.
profmonocle 5y ago
Typically, a /64 in IPv6 is one subnet. You're not really supposed to subdivide networks beyond that point. The first 64 bits identify the network, the last 64 bits identify the host. Under this design, if you only assign a /64 per server, that would mean you couldn't have multiple networks on that VM (which you'd want for something like Docker.) However, this principle isn't really enforced on a technical level. Only some standards such as SLAAC actually require the network to be a /64, and since SLAAC isn't really relevant for servers, most cloud providers have been relatively stingy with their IPv6 allocations - at least compared to what RFCs actually recommend. (Which would probably be a /48 per customer, per region.)
- mindslight 5y ago
  I appreciate the push to expand address allocations a bit, so that providers aren't charging a monthly fee for every /128 and the like. But /64 seems like ridiculous overkill. Even for a premises network connected to an ISP, the optimal thing to do is to continue NATting to hide information about your network. Privacy wise I'd rather have 2^16 separate /128's scattered throughout a provider's address space, than a single /64, which will inevitably be treated as a single address by the surveillance industry. Ultimately discrete public addresses are really only needed for services, and the services I want to share are few and enumerable. At this point I do more work making sure individual nodes aren't fully connected (eg Internet of Shit) than making services reachable.
  - profmonocle 5y ago
    > /64 seems like ridiculous overkill The idea behind the /64 minimum was to make auto-configuration easier - you could just stick the layer 2 ID (i.e. the MAC address) in the second half and not have to worry about collisions or stateful assignment system like DHCP. Remember that IPv6 was designed in the mid-90's, so both of these decisions seem silly now - using the MAC would be a serious privacy issue (modern operating systems use a random ID which changes frequently) and DHCP is very mature.
    - mindslight 5y ago
sumtechguy 5y ago
I know you are being funny. However, it does make me think hmmm... Is there any advantage/disadvantage to not handing out something like a /120? Or is there something else at play like in the way auto discovery is working? I am not familiar enough with it to say.
- detaro 5y ago
  Yes, various pieces kind of assume that smaller networks than /64 are not a thing, e.g. SLAAC, one of the mechanisms to distribute IPs.
davidmurdoch 5y ago
I have a /64 from my ISP and I want to run a few VLANs on my home network but I can't subdivide the /64 any further using my business class (TP-Link omada) router's controller. Maybe there are similar limitations in place here?

What would you do with all those addresses? Could you please elaborate about each one?

edm0nd 5y ago

First thing I can think of is spam and abuse

formerly_proven 5y ago
Good luck sending emails with IPv6.
- profmonocle 5y ago
  It works fine with Gmail. And since G Suite is so widely used, tons of domains can send/receive mail over IPv6 just fine.
- vaylian 5y ago
  Why should that be an issue?
  - erinnh 5y ago
    Some mail-admins will downgrade IPv6-only MX servers reputation-wise, due to the limiting/cost-increasing factor of IPv4 Addresses.
- BenjiWiebe 5y ago
  I do it already. Well, both IPv4 and IPv6. There's a decent number of IPv6 capable MX's out there, the most prominent being GMail. If you were meaning IPv6-only then yes that would be pretty bad.
profmonocle 5y ago
If an IPv6 spam filter is working on a per-address basis, it's never going to work. The smallest allocation you can get from a RIR is a /48. Even residential ISPs give at least a /64. You could use a different address for every email and never run out.

fuzzy2 5y ago

A /56 + prefix delegation would enable IPv6 VMs without any dirty hacks.

detaro 5y ago
... giving each VM one IP out of the /64 is not a "dirty hack". I guess if you want to do complex networks between the VMs it'd help a bit? Still, /64 is IMHO a good default for single machines.
- fuzzy2 5y ago
  Traffic for any of the addresses in the /64 arrives at your server’s "external" network interface. Is there any non-hacky way to forward this traffic to an internal virtual network?
  - profmonocle 5y ago
    You just create a route for it, same as you would with any size network. Linux allows you to create routes for IPv6 prefixes longer than /64 without any issue. On AWS I have a VM with a /80 routed to it, which I have divided into multiple /96's internally. It works fine.

profmonocle 5y ago

Typically, a /64 in IPv6 is one subnet. You're not really supposed to subdivide networks beyond that point. The first 64 bits identify the network, the last 64 bits identify the host. Under this design, if you only assign a /64 per server, that would mean you couldn't have multiple networks on that VM (which you'd want for something like Docker.) However, this principle isn't really enforced on a technical level. Only some standards such as SLAAC actually require the network to be a /64, and since SLAAC isn't really relevant for servers, most cloud providers have been relatively stingy with their IPv6 allocations - at least compared to what RFCs actually recommend. (Which would probably be a /48 per customer, per region.)

mindslight 5y ago
I appreciate the push to expand address allocations a bit, so that providers aren't charging a monthly fee for every /128 and the like. But /64 seems like ridiculous overkill. Even for a premises network connected to an ISP, the optimal thing to do is to continue NATting to hide information about your network. Privacy wise I'd rather have 2^16 separate /128's scattered throughout a provider's address space, than a single /64, which will inevitably be treated as a single address by the surveillance industry. Ultimately discrete public addresses are really only needed for services, and the services I want to share are few and enumerable. At this point I do more work making sure individual nodes aren't fully connected (eg Internet of Shit) than making services reachable.
- profmonocle 5y ago
  > /64 seems like ridiculous overkill The idea behind the /64 minimum was to make auto-configuration easier - you could just stick the layer 2 ID (i.e. the MAC address) in the second half and not have to worry about collisions or stateful assignment system like DHCP. Remember that IPv6 was designed in the mid-90's, so both of these decisions seem silly now - using the MAC would be a serious privacy issue (modern operating systems use a random ID which changes frequently) and DHCP is very mature.
  - mindslight 5y ago

sumtechguy 5y ago

I know you are being funny. However, it does make me think hmmm... Is there any advantage/disadvantage to not handing out something like a /120? Or is there something else at play like in the way auto discovery is working? I am not familiar enough with it to say.

detaro 5y ago
Yes, various pieces kind of assume that smaller networks than /64 are not a thing, e.g. SLAAC, one of the mechanisms to distribute IPs.

davidmurdoch 5y ago

I have a /64 from my ISP and I want to run a few VLANs on my home network but I can't subdivide the /64 any further using my business class (TP-Link omada) router's controller. Maybe there are similar limitations in place here?