19 ms·

Reasons for servers to support IPv6

266 points by pingiun 5y ago

baggy_trough 5y ago
Still waiting for Google Cloud Platform to support IPv6 to the box...
- uji 5y ago
  It is already supported. https://cloud.google.com/compute/docs/ip-addresses/configure-ipv6-address https://cloud.google.com/compute/docs/ip-addresses/configure...
  - baggy_trough 5y ago
    Still waiting in my region (they only support asia-east1, asia-south1, europe-west2, us-west2). Hopefully some year.
johnklos 5y ago
It's good to wonder publicly and have a discussion! I set up IPv6 on all my servers in 2001 and thought we'd all be on IPv6 in just a couple of years :P What's interesting is how much resistance there is to adding IPv6 which comes from entrenched IT. People who never learned (much) about IPv6 seem to be afraid of it and often respond with some variant or another of "don't fix it if it ain't broke", or "it's extra work for no return", or "we'll have to pay licensing to add IPv6 because we bought crap routers, so let's not", et cetera. My favorite is, "we have no record of people trying to use IPv6" - yes, that's real :D It just shows their ignorance. Adding IPv6 has myriad advantages - no need for NAT, proxies or port forwards to share addresses, no need to renumber networks if allocations or upstream change, redundancy, valid security-through-obscurity (imagine port scanning a /64 looking for open ssh ports)... What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit.
- otabdeveloper4 5y ago
  - fishtacos 5y ago
    Default deny from external access isn't an IPV4 NAT-only feature, but it does come out of the box. The same would need to be set up for IPv6 and move on past that. It's a firewall issue, not a protocol issue.
    - BenjiWiebe 5y ago
      The devices I've seen have default deny for IPv6 as well.
  - tyingq 5y ago
    I'll admit to not understanding this position. Without NAT, you could do the same sort of firewalling, where the inbound allow list is driven dynamically. The only thing I can think of is that not using NAT exposes more detail about an internal network. Is that the reason you're hinting at, or is the reason something else?
    - 300bps 5y ago
      Not OP but that’s how I think of it. If my internal network is 10.0.0.0/8 and I have 100,000 hosts and a single IPV4 address that they all appear to be to the public Internet, I’ll sleep a lot better than if I had all 100,000 hosts with public routable IPV6 IP addresses attached to them. Yes, you can depend on a firewall to protect you but at the very least it exposes information about your internal network and at worst opens you up to future firewall flaws. I remember the days when people used to have every system have it’s own public IP address. People would scan for broadcast addresses of their networks and we got Smurf attacks as a result. Obviously those wouldn’t work with properly firewalled hosts but it still scares me.
      - fishtacos 5y ago
iqanq 5y ago
ClumsyPilot 5y ago
IPv6 is a 'tragedy of the commons' issue just like recycling: you get no benefits to you individually from addressing the issue. However the day the issue is solved, and ee can forget IPv4, a myriad issues dissapear - routing, port forwarding, P2P software for torrents and calls, multiplayer games, etc.
- cm2187 5y ago
  There is one individual incentive though: the increasing cost of v4 addresses.
  - baq 5y ago
    another reason why folks holding large chunks of ipv4 address space don't want ipv6 - they don't want to see their asset drop in value.
  - netr0ute 5y ago
    Why do IPv4 addresses even cost money? They're no better than NFTs and don't even have a "token" of their own.
    - Nextgrid 5y ago
      They're a scarce commodity, and unlike NFTs, have a real use-case. Until everyone moves to IPv6, if you want people to be able to reach your service, you need an IPv4 address. If you're an ISP or cloud provider, you need those so your customers can still communicate with v4-only peers.
    - fishtacos 5y ago
      Not sure how they're even comparable on any aspect. IPV4 addresses are scarce due to lack of foresight and useful. NFTs are scarce by design and useless.
      - ignoramous 5y ago
        > NFTs are scarce by design and useless. So, I know of one real-world usecase that's not useless: Some startups have begun legally selling properties (homes, ranches, plots) via NFTs.
cm2187 5y ago
Joining the other thread about ipmi/iLO interface being exposed to the WAN: make your server non discoverable by the different services that scan the entire internet address space. It is security by obscurity and you must have other layers of security but it’s not an insignificant layer.
ugjka 5y ago
> A few people mentioned that it’s much easier to use IPv6 with home servers – instead of having to do port forwarding through your router, you can just give every server a unique IPv6 address and then access it directly. My ISP firewalls IPV6 addresses on their end, so no ssh to my IPV6 Machines from the outside, not even ping works. I don't know why they do this
- dspillett 5y ago
  A lot of residential ISPs block certain incoming traffic (any that doesn't seem to be part of a stream originated at the user side in some cases) by default because many home users who have something open did not open it intentionally themselves so it could be an insured attack vector.
- davidmurdoch 5y ago
  They likely still sell static ipv4 addresses, which made sense back in the day, but ipv6 doesn't work with the existing monetization model. I had the same sort of issue and when I called about it they tried to upsell me to a business account.
- kijin 5y ago
  Unless you have a gazillion servers at home, port forwarding through a router is fairly simple and has the additional benefit of a rudimentary firewall. So there isn't a clearly visible benefit for most people. Most people can't even tell whether they're behind carrier-grade NAT. It makes no tangible difference in their lives. Techies like you and I can appreciate the technical arguments, but if we want to convince anybody else who can actually make decisions for large numbers of ordinary people, we're going to need better arguments.
  - zekica 5y ago
    But this is only because everything mainstream that is P2P uses some kind of a centralized relay server. P2P would be much much cheaper for everyone if everyone used IPv6, so it makes a difference.
vardagsnytt 5y ago
The perspective on this one is rather important I'd say. To run a service and buying a few IPv4 addresses is quite feasible. But operating an ISP and maintaining either large numbers of prefixes or costly CGNAT hardware at that scale puts it way more into focus. Of course I'm not implying that IPv6 isn't nice to run inside your infrastructure but I guess it isnt at the top of ones expenses.
zokier 5y ago
What I haven't quite fathomed with IPv6 is that as a home user without my own AS, am I supposed to use my ISP provided addresses in my internal network? ISP provided addresses that I have no control over and could change at any time? With IPv4, I just use RFC1918 addresses as I like and I have full control over the addresses and their allocation and I can then very easily set up iptables rules, dhcp pools, dns records etc. Then I just NAT at the edge of my network, and the configuration is practically completely isolated from my ISP and whatever addressing they do.
- BitPirate 5y ago
  If you don't have a static subnet, you can still use ULAs.
  - BenjiWiebe 5y ago
    Exactly. With IPv6 you are expected to have multiple addresses. Some to access the internet with that may change, some that don't change and aren't globally routable to access your own stuff with. Though you can also (if your router supports it) assign hostnames to your devices so you can access them via their non-static global addresses.
    - nicolas314 5y ago
      If I understood correctly, the link between ULA-based address and host name is done through a DUID. This is assuming that DUID values do not change over time and can easily be harvested from everything you want to connect to the local network. What guarantees that DUIDs are fixed and easily collectable? What are the solutions if they aren't?
- benttoothpaste 5y ago
  In addition IPv6 has this weird restrictions on which prefixes are valid. For example if your ISP gives you /64 prefix, most consumer routers will not recognize it as valid. And even if you have a very configurable router it will take lots of work to configure that - even though in theory you should have tons of addresses available. And if you get a /128 prefix, good luck that - NATs are apparently disallowed in IPV6 world.
dekhn 5y ago
I noticed that effectively all my home machines support dual stack right now. I decided to make an experiment and move to only IPv6. It was a huge mess (the autoconfig functionality, naming, routing) that all sort of failed in ways that involved deep hacking to debug. Ultimately I realized that since most sites on the net aren't ipv6, I'd need to NAT or proxy my traffic to them anyway. Let me know when we're ready to turn off IPv4.
buttocks 5y ago
Speaking of Twitter, follow @noipv6 for some great commentary and/or heckling of ISPs who make false claims about IPv6 to defend their lack of support.
js2 5y ago
> When I try to ping an IPv6 address (like example.com’s IP 2606:2800:220:1:248:1893:25c8:1946 for example) I get the error ping: connect: Network is unreachable. Why? (answer: it’s because my ISP doesn’t support IPv6 so my computer doesn’t have a public IPv6 address) $ ssh freenas.local freenas$ ping6 2606:2800:220:1:248:1893:25c8:1946 ping6: UDP connect: No route to host Crap I should fix that. Login to web-interface, click the "IPv6 Autoconfigure" checkbox, click test, click save. freenas$ ping6 2606:2800:220:1:248:1893:25c8:1946 PING6(56=40+8+8 bytes) 2600:1700:3d40:6300:6a05:caff:fe58:a370 --> 2606:2800:220:1:248:1893:25c8:1946 16 bytes from 2606:2800:220:1:248:1893:25c8:1946, icmp_seq=0 hlim=54 time=11.408 ms Wow, IPv6 _is_ easy! :-) (AT&T is my ISP and it took a bit of screwing around over a weekend with my router a couple years ago to get IPv6 working properly on my home network. But it's been painless ever since.)
- zamadatix 5y ago
  If you like tinkering and you've got the AT&T fiber service and don't use the voice/TV U-Verse stuff) you can get significantly better IPv4 and IPv6 performance not using their gateway (even if it's just in bridge mode with every service disabled). It's not officially supported and they actually 802.1x auth the modem but there are convenient scripts out there to proxy the auth packets allowing you to use your own router directly. Particularly helpful for maxing out their gig service or for drastically improving jitter at any service speed.
  - js2 5y ago
    Yup, this is me: https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy AT&T has transitioned to issuing a combined ONT/Router, where this will no longer be possible, but apparently the newer gear doesn't have any of the performance issues of the Pace 5268AC. BTW, I was annoyed that AT&T installed the ONT on the southern wall of my home where it was baking in full sun everyday, so I relocated it myself into my network closet. You can just unplug the ONT and extend the existing fiber with an optical coupler and an SC-APC to SC-APC single-mode patch cable.
    - 5y ago
spockz 5y ago
What is the best way to get ipv6 if your ISP doesn’t support it? I tried getting HurricaneElectric to work for tunnelling on my Ubiquity USG3 but couldn’t make it to work. What would be the best way to get ipv6?
- justincormack 5y ago
  Tunneling with HE is usually the easiest way...
  - xfer 5y ago
    Not if they already block icmp traffic.
  - withinboredom 5y ago
    Agree and would like to add that you may want to disable ipv6 tunneling for streaming services. (Google it) because they consider it a “vpn” thus you must be a copyright thief. (Yet any other “real” vpn will stream just fine lol)
yjftsjthsd-h 5y ago
A few of these reasons boil down to "it's faster to not NAT". That makes some intuitive sense, but does anyone know of any studies/tests so we can get numbers? Are we talking higher time to first connect? Slight increase in hops/latency on every packet?
- commandersaki 5y ago
  The "faster than NAT" argument made very little sense to me. A NAT adds like a few microseconds of latency, nothing to be perceptible for virtually all applications.
- bert64 5y ago
  According to linkedin it varies and is up to 40% in some cases they measured: https://www.linkedin.com/pulse/ipv6-measurements-zaid-ali-kahn/ https://www.linkedin.com/pulse/ipv6-measurements-zaid-ali-ka... A fast NAT gateway which is lightly loaded might make little difference, a heavily loaded one can make a big difference. Google stats also show slight latency improvements for IPv6: https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-... Of course these are generalised stats, there will be some users with tunnels which will impair IPv6 performance, while other users might be behind multiple layers of NAT.
kim0 5y ago
Does anyone have an explanation about "reason: to own your IP addresses" .. does that actually work?
- rmoriz 5y ago
  As a LIR you can request network address space tied to your organization. To my knowledge there are almost no cloud hosting providers that support "bring your own IP space". Vultr.com seems to be the sole exception.
tomsmeding 5y ago
> Apparently you can buy IPv6 addresses, use them for the servers on your home network, and then if you change your ISP, continue to use the same IP addresses? > I’m still not totally sure how this works but it sounds cool. Naively I would say this is completely impossible without some form of your home router (or ISP?) relaying your traffic, or perhaps telling the sender that I am now actually located in a different subnet somewhere. If anyone can have IP(v6) addresses and keep them and take them with you, then wouldn't that result in an unmanageably large lookup table at routing nodes to know where to route stuff to? How does that work?
- adamcharnock 5y ago
  So this is typically what BGP is for, but this is definitely not something that is typically offered to residential customers, nor even most business AFAIK. This is what you would typically get with a Direct Internet Access (DIA) connection. This is an uncontended connection where to setup a BGP peering with your provider. You then give the provider some documentation proving you own a range of addresses, and they agree to accept those routes from you via the BGP connection. They then advertise that to their upstream providers, and thus the routes propagate to the entire internet. There are a couple of gotchas though. Firstly, there is generally a minimum prefix size of routes that will be accepted into the global routing table. For IPv4 I think it is a /24, and for IPv6 I think it is a /32. You can get a /32 from regional IP registry (for free?) but you will probably need to become a member which – last time I checked - costs 3-4 figures a year. You can use a private-AS number though, as you'll only have one upstream provider. The other gotcha is cost. Depending where you are in the world, a DIA connection will cost in the very rough region of (EUR/USD/GBP) 1/megabit/month, although it becomes much cheaper when going from 1gb to 10gb. Now maybe there is some cool facility that some nice ISPs offer to bypass all this, if so then please let me know. I'm personally skeptical it would be worth their while for the 0.001% of residential customers that would want this service though. Source: I run a small ISP. I have some industry knowledge, but not loads.
- metalliqaz 5y ago
  its possible but it relies on your ISP being willing to route your traffic, and as the article notes, many won't bother
hippyup 5y ago
I'd love to read an honest post from somebody from Twitter (or GitHub or...) on why they don't support IPv6. Not a shaming thing, it's something I don't quite get. Like I get why an old school bank wouldn't: their infrastructure predates IPv6 and it's a project that has to be financially justified and I can understand how that can be hard. But presumably something like Twitter had an experienced networking team, who surely know all the advantages here and want to somewhat future-proof, build up their infrastructure and they decided not to support IPv6 and I would love to understand the reasoning. Is the extra cost really that high?
- yjftsjthsd-h 5y ago
  I have no special insight, but it's probably something like "we're working on it, but there are lots of legacy things that expect v4 (including non-obvious like anti-abuse systems) and since all our users have some sort of v4 connectivity it's not urgent".
- tw611345 5y ago
  Why would they? - IPv6 is basically an abandoned standard. I wouldn't expect them to support gopher either. - Residential ISP support for ipv6 is spotty, and anyone who does offer ipv6 offers ipv4 as well. - When it is supported, ipv6 tends to be substantially slower than ipv4 in practice. - The addresses are a pain to look at and work with. - You now have twice as many things to fail.
  - throwaway2048 5y ago
    ipv6 is hardly an abandoned standard, 35% of google users access google over ipv6, and it continues to grow every year. https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html IPv6 is also usually faster than ipv4 these days, because the overhead of fragmented ipv4 routing is large. In the past it was slower because of lack of understanding/support for it from larger ISPs, and consequently poor routes, or really suboptimal tunneling setups.
- boris 5y ago
  I am guessing the reasoning goes like this: if we only support IPv4, then it's on all these ISPs with IPv6-to-IPv4 CGNAT to make sure their stuff works properly (and chances are they will notice if it doesn't). But if we support IPv6, it will be on us to make sure people behind those ISPs can still reach us (because hardly anyone goes via this IPv6 route and if it doesn't work it's likely nobody at the ISP will notice).
yjftsjthsd-h 5y ago
This seems like a good place to mention a neat trick: If you're behind cloudflare or such, you can probably trivially go pure IPv6 on your servers and not even have to worry about NAT because cloudflare will provide v4 to users that use it. So you end up with (your server) -v6-> (cloudflare) -v4/v6-> (users). (Which I admit is a sort of NAT, just not at the IP level)
withinboredom 5y ago
A personal bane of my existence is WSL’s lack of ipv6 support. You can’t even use WireGuard and ipv6 because it’s missing some kernel options.
rmoriz 5y ago
Running containers dual-stacked is still surprisingly difficult or annoying.
amluto 5y ago
I’ll add one: for servers accessed only via private networks, IPv6 still allows easy use of globally unique addresses. The finance world is full of IPv4 systems using 10.x.y.z, and there aren’t enough of those addresses to go around.
tolien 5y ago
There’s already a lot of FUD around IPv6 and I’m not sure that an article which seems to amount to a survey on Twitter really moves the conversation forward much. Clearly there’s pain points to rolling out v6 (although I’d question how many of them are still an issue outside the glacial pace of Enterprise IT) and we’d be better trying to address that than re-hash the same old arguments. Edit: not much more than 2 weeks ago we had this chestnut [1] where Nintendo was telling you to forward thousands of UDP ports to a Switch in order to play online but still we hear “but NAT works fine for me”. 1: https://news.ycombinator.com/item?id=29919228 https://news.ycombinator.com/item?id=29919228
- zamadatix 5y ago
  I think the decades of dominance of UDP/TCP over IPv4 over Ethernet (which comes with the pre-existing knowledge in everyone, the years of experience working with it for any IT person, the additional workarounds like NAT and UPnP and so on, and even the oldest hardware still reasonably running having full support) has made people think it was all just always easy and obvious from the get-go. Where some of these protocol assumptions and ingrained history didn't exist, like the mobile carrier space, we see by far the most adoption of IPv6 out of any area and even a few non-dual stack players. The truth is like most topics in computing after 20 or 30 years of using one protocol/interface the baggage, limitations, or cost of the old keep piling up and eventually the new thing is going to seem like less work/cost/baggage than the old. The thing that seems to be moving it forward the most nowadays is cost and baggage (= complexity = long way around to more cost). The direct cost is per IPv4 prices going from ~$25/per to ~$45/per in the last year alone. The baggage/complexity cost is particularly on the carrier or large enterprise side where ever growing device counts and ever growing public address costs combine to make NAT needs larger and sometimes multi-staged (e.g. CG-NAT). I think the breaking point will be when we start to see most hosting providers and carriers continue to either push consumers to more IPv6 to reduce NAT load or cost incentivize hosted services to do the same. There are limited instances of this now, an occasional hosting provider offering IPv6 only for a lower monthly cost or a mobile carrier that migrates all of it's users to IPv6 transparently, but there are still more providers/carriers that don't do anything IPv6 than there are that incentivize IPv6. Definitely moving in that direction these last few years though. What I don't think we'll see is a sudden "aha" moment where people give up IPv4 and stop being uncertain about v6 just because they read about it more or were told some detail.
dopa42365 5y ago
My ISPs v4 is down sometimes (Vodafone in Germany), while v6 continues working just fine. Severe loss of legacy internet services in those situations (no twitter, reddit, pornhub, battle.net, twitch...)
- gtirloni 5y ago
  Here it's the opposite. My ISP's IPv6 network is so bad I've had to request them to disable IPv6 at my router.
- she46BiOmUerPVj 5y ago
  I have the same with Comcast in south east US. Browsing the internet IPv6 only is depressing unless you only use Google :/
jlokier 5y ago
My office ISP is a mobile phone running a wifi hotspot. (Don't judge, it's faster than the last ADSL connection at about 80Mbit/s on a good day, much cheaper, and the office goes through about 40GB/month no problem.) The phone has an IPv6 address but no IPv4 address. Ironic, then, that the hotspot only provides IPv4 to all connected devices, not IPv6. As a result, all connected devices in the office can only use IPv4. My home ISP is a mobile 4G router providing wifi. The router doesn't get an IPv6 from upstream, just IPv4, so it only provides IPv4 to connected devices at home. I have no idea if it would provide IPv6 service if it got one from upstream. It is a little strange that it doesn't get IPv6 from upstream, because it's exactly the same type of mobile data contract as the office phone-router is using. It's 2022. I've had IPv6 on my servers since about 2003. But aside from my actual phone, I've never had IPv6 on any device I'm using, living at numerous homes, using many and varied ISPs, working at numerous offices, or anywhere else. Not even when travelling. I had to turn off IPv6 on my mail server, because gmail.com was rejecting mail from it when sent over IPv6, but not when sent over IPv4. I use LXD and Docker on some of my servers for containers, and libvirt/KVM for VMs. In theory they support IPv6 but in practice it's easier to work with IPv4 address or port forwarding with them. That means the containers and VMs are only reachable from the internet over IPv4, even when the host servers have IPv6. All together, anything I do to support IPv6 ends up poorly tested because it's not really used, and everything has to be done with IPv4 in parallel anyway. I still have IPv6 on my servers, and DNS configured appropriately. But as it virtually never gets used, it seems a bit pointless. Sometimes I don't set up IPv6 on a new server straight away, and nothing is missed.
- bert64 5y ago
  Depends on the phone and carrier, if i enable tethering (iphone 8) then my connected devices get IPv6 addresses. Some android tethering implementations use CLAT and only give you legacy IP. Some old routers might do the same, or might do so by default until you reconfigure them. Here at least the mobile network uses cgnat for ipv4, but fully routable ipv6 - so the only way i can get inbound connections over the mobile network is to use ipv6.
l0b0 5y ago
By now I'm semi-convinced ISPs are deliberately holding back IPv6 in order to make a buck selling static IPs. They charge a good chunk of money per month for an IPv4 address (at least in Switzerland, the UK, and New Zealand), which is basically just rent extraction from artificial scarcity. And it's pretty obvious that once they transition to IPv6 there is no good reason not to give every single customer enough static IPs for a lifetime of devices.
woile 5y ago
What is a good resource to learn about ipv6? some course or book?
- zamadatix 5y ago
  I've read many an IPv6 book and led many an IPv6 projects/in person training classes and, as lame as it may sound, the Wikipedia page is an amazing resource to get the background needed to understand home and homelab setups. https://en.wikipedia.org/wiki/IPv6 https://en.wikipedia.org/wiki/IPv6 I'd recommend diving into the more detailed articles it links on SLAAC (alternative to DHCP, most common way to dynamically assign addresses) and NDP (replaced ARP) for a full understanding. If you want to go all in for v6 only setups with access to the v4 internet NAT64 is worth reading as well. Obviously it doesn't cover how to configure/implement for your specific scenario but it gives a solid background that lets you better understand what guides for doing it with Linux or prosumer hardware or typical consumer hardware are actually talking about.
nunez 5y ago
IPv6 is cool in theory and the idea of literally everything having its own directly-reachable IP address is extremely compelling, but I never use it because so many services STILL don't support it or don't support it correctly. (As Julia pointed out, some HUGE websites don't have quad-A records, so good luck dealing with NXDOMAIN for like everything.) Shoot, Kubernetes _just_ got support for IPv6 in 1.23 (it was in beta since 1.20). I know that 6to4 exists and many kernels can do it out of the box, but that comes with problems, as Julia rightfully pointed out here, and at that point, you might as well just NAT over IPv4.
- she46BiOmUerPVj 5y ago
  You mean you explicitly disable it? Or you never use sites like Google or Netflix? Why would you get NXDOMAIN for anything with IPv6 enabled? No ISP would only offer IPv6 without IPv4 as well.
EVa5I7bHFq9mnYK 5y ago
I think ipv6 enables easier surveillance and censorship.
- Dagger2 5y ago
  It doesn't. Not any worse than the internet already does, anyway.
  - EVa5I7bHFq9mnYK 5y ago
    The NATs work as VPNs to a large extent. To quote Steven Wilson from Europol: "The issues relating to CGN, specifically the non-attribution of malicious groups and individuals, should be resolved." And the way to "resolve" it is IPv6.
oofabz 5y ago
>reason: to avoid NAT issues with home servers Home servers are not quite as easy as the article makes it sound. Home routers block incoming IPv6 packets, the same as they do for IPv4. To make a home server accessible, you need to explicitly allow that incoming IPv6 traffic in your router's firewall. This is analogous to adding a port forward rule in IPv4 NAT. The only benefit IPv6 has here is you can use the same port (e.g. SSH) for multiple home servers.
- Dagger2 5y ago
  It's not the only benefit, although it is a nice one. Consider how well creating a port forward rule would work if you're behind CGNAT.
teddyh 5y ago
The Case for IPv6 (1999): https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv6-06 https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv... (EDIT: Updated to non-archive link provided by cesarb)
- cesarb 5y ago
  Non-archive link: https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv6-06 https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv...
  - teddyh 5y ago
    Thank you! (I have edited my link to use yours.) The link I originally had went bad due to the renaming from “draft-ietf-iab-case” to “draft-iab-case”, so I assumed that the document had somehow vanished, and changed to an archive.org link. Thank you for pointing me to the correct link again!
curious_cat_163 5y ago
I tend to think that a lot of issues on the global internet are not technical problems. They tend to be economics problems. v6 is a mechanism like container ships. It will dominate when the incentives and disincentives make sense for the participants.
hexo 5y ago
my ISP uses IPv6. actually with some sort of 4-in-6. i can access v4 and v6 world with no artificial problems.
spc476 5y ago
I read all the time about how great the latest technology like Docker and Kubernetes is, and how one should always update every 20 minutes or else you'll have your entire life, much less your identity, stolen by hackers, and besides, who wants to use software that's an entire six months old? And yet, trying to get anyone to upgrade to IPv6 and suddenly the entire world gets super conservative and "hey now! Let's not get too hasty here!" I can't quite square this circle.
- Spivak 5y ago
  I think because the only thing IPv6 really has going for it is the larger address space and the bigger number in the name. That’s not nothing but if IPv6 had been literally just IPv4 but with 8 octets then adoption would have been a lot faster. And it doesn’t help that IPv6rs want to change the internet architecture as well so even if you port you still run into the flame war that is IPv6 NAT that was only begrudgingly was implemented in Linux in 2012. You can’t upgrade to IPv6 you have to port your code to IPv6. There’s no concept of broadcast domains, IPSec built in for some reason — sorry WireGuard. And because IPv6 is fundamentally different it’s not enough to just be like okay all my shit is IPv6 capable turn it on, you also have to rearchitect your network since everyone builds their network with the concept of public and private addresses and IPv6 is/was openly hostile to it. TLDR IPv6 made it really god damn hard to just turn it on. Would it have been so bad to just support the way of the IPv4 world for compatibility and then say “hey there’s this cool new thing that’s better” which is an easier sell once you’re already using IPv6.
  - Plasmoid 5y ago
    > IPv4 but with 8 octets then adoption would have been a lot faster. > You can’t upgrade to IPv6 you have to port your code to IPv6. There is no physical way to increase the address space without requiring code changes. People having making the same complaint for 20 years and it's even more hollow now then it was then. 99% of the time, you will use your OS standard library functions and completely ignore the networking underneath. Literally, all the libraries will transparently handle IPv4 or IPv6 with no problem. If you're in the 1% of software that has coding in some implicit assumption of field size for IPv4 then you are the 2020 equivalent of the Y2K problem. Grow your field sizes, fix your regexes, and use the platform support as much as possible. Finally, you can literally just turn on IPv6. Everything will work just fine. IPv6 has private addresses, you can do all the dumb stuff from IPv4 in v6. Unsurprisingly though, most major vendors don't want to spend a lot of energy supporting those hacks.
jrmg 5y ago
I’m surprised at all the people here saying that they can’t get IPv6 to ‘work’ on their home internet connection. In my experience, in the Bay Area, with Comcast cable and AT&T DSL connections in the last few years (5 or 10), it’s ‘just worked’ for any device connected to the router they provide, no configuration required. I kind of assumed that this was true nowadays for most home ISPs.
- deathanatos 5y ago
  I was in the Bay Area when Comcast (finally) rolled it out; it wasn't that long ago; it might have been >5 years now, but definitely it was within the last 10. Now I'm in the Boston MSA (a very rural place, I know /s); the ISP here, Verizon, does not offer IPv6. (They state they are "rolling it out", but this year will be the fifth anniversary of that.)
stevefan1999 5y ago
in case you didn't know you can either try Tunnel Broker project or 6to4 [1] relay, both proudly presented by Hurricane Electric [1]: https://en.wikipedia.org/wiki/6to4?wprov=sfla1 https://en.wikipedia.org/wiki/6to4?wprov=sfla1
coredog64 5y ago
If everyone moved to IPv6, Amazon couldn’t charge AWS customers for NAT gateways. Won’t someone think of the $AMZN shareholders?
cpeterso 5y ago
You can use the Firefox add-on "SixIndicator" to see which websites support IPv6 and which don't (assuming your client supports IPv6). The add-on shows a 4 or 6 icon in your address bar. https://addons.mozilla.org/en-US/firefox/addon/sixindicator/ https://addons.mozilla.org/en-US/firefox/addon/sixindicator/
gerdesj 5y ago
Multiple internet connections. Discuss.

266 points by pingiun 5y ago

baggy_trough 5y ago

Still waiting for Google Cloud Platform to support IPv6 to the box...

uji 5y ago
It is already supported. https://cloud.google.com/compute/docs/ip-addresses/configure-ipv6-address https://cloud.google.com/compute/docs/ip-addresses/configure...
- baggy_trough 5y ago
  Still waiting in my region (they only support asia-east1, asia-south1, europe-west2, us-west2). Hopefully some year.

johnklos 5y ago

It's good to wonder publicly and have a discussion! I set up IPv6 on all my servers in 2001 and thought we'd all be on IPv6 in just a couple of years :P What's interesting is how much resistance there is to adding IPv6 which comes from entrenched IT. People who never learned (much) about IPv6 seem to be afraid of it and often respond with some variant or another of "don't fix it if it ain't broke", or "it's extra work for no return", or "we'll have to pay licensing to add IPv6 because we bought crap routers, so let's not", et cetera. My favorite is, "we have no record of people trying to use IPv6" - yes, that's real :D It just shows their ignorance. Adding IPv6 has myriad advantages - no need for NAT, proxies or port forwards to share addresses, no need to renumber networks if allocations or upstream change, redundancy, valid security-through-obscurity (imagine port scanning a /64 looking for open ssh ports)... What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit.

otabdeveloper4 5y ago
- fishtacos 5y ago
  Default deny from external access isn't an IPV4 NAT-only feature, but it does come out of the box. The same would need to be set up for IPv6 and move on past that. It's a firewall issue, not a protocol issue.
  - BenjiWiebe 5y ago
    The devices I've seen have default deny for IPv6 as well.
- tyingq 5y ago
  I'll admit to not understanding this position. Without NAT, you could do the same sort of firewalling, where the inbound allow list is driven dynamically. The only thing I can think of is that not using NAT exposes more detail about an internal network. Is that the reason you're hinting at, or is the reason something else?
  - 300bps 5y ago
    Not OP but that’s how I think of it. If my internal network is 10.0.0.0/8 and I have 100,000 hosts and a single IPV4 address that they all appear to be to the public Internet, I’ll sleep a lot better than if I had all 100,000 hosts with public routable IPV6 IP addresses attached to them. Yes, you can depend on a firewall to protect you but at the very least it exposes information about your internal network and at worst opens you up to future firewall flaws. I remember the days when people used to have every system have it’s own public IP address. People would scan for broadcast addresses of their networks and we got Smurf attacks as a result. Obviously those wouldn’t work with properly firewalled hosts but it still scares me.
    - fishtacos 5y ago

iqanq 5y ago

ClumsyPilot 5y ago

IPv6 is a 'tragedy of the commons' issue just like recycling: you get no benefits to you individually from addressing the issue. However the day the issue is solved, and ee can forget IPv4, a myriad issues dissapear - routing, port forwarding, P2P software for torrents and calls, multiplayer games, etc.

cm2187 5y ago
There is one individual incentive though: the increasing cost of v4 addresses.
- baq 5y ago
  another reason why folks holding large chunks of ipv4 address space don't want ipv6 - they don't want to see their asset drop in value.
- netr0ute 5y ago
  Why do IPv4 addresses even cost money? They're no better than NFTs and don't even have a "token" of their own.
  - Nextgrid 5y ago
    They're a scarce commodity, and unlike NFTs, have a real use-case. Until everyone moves to IPv6, if you want people to be able to reach your service, you need an IPv4 address. If you're an ISP or cloud provider, you need those so your customers can still communicate with v4-only peers.
  - fishtacos 5y ago
    Not sure how they're even comparable on any aspect. IPV4 addresses are scarce due to lack of foresight and useful. NFTs are scarce by design and useless.
    - ignoramous 5y ago
      > NFTs are scarce by design and useless. So, I know of one real-world usecase that's not useless: Some startups have begun legally selling properties (homes, ranches, plots) via NFTs.

cm2187 5y ago

Joining the other thread about ipmi/iLO interface being exposed to the WAN: make your server non discoverable by the different services that scan the entire internet address space. It is security by obscurity and you must have other layers of security but it’s not an insignificant layer.

ugjka 5y ago

> A few people mentioned that it’s much easier to use IPv6 with home servers – instead of having to do port forwarding through your router, you can just give every server a unique IPv6 address and then access it directly. My ISP firewalls IPV6 addresses on their end, so no ssh to my IPV6 Machines from the outside, not even ping works. I don't know why they do this

dspillett 5y ago
A lot of residential ISPs block certain incoming traffic (any that doesn't seem to be part of a stream originated at the user side in some cases) by default because many home users who have something open did not open it intentionally themselves so it could be an insured attack vector.
davidmurdoch 5y ago
They likely still sell static ipv4 addresses, which made sense back in the day, but ipv6 doesn't work with the existing monetization model. I had the same sort of issue and when I called about it they tried to upsell me to a business account.
kijin 5y ago
Unless you have a gazillion servers at home, port forwarding through a router is fairly simple and has the additional benefit of a rudimentary firewall. So there isn't a clearly visible benefit for most people. Most people can't even tell whether they're behind carrier-grade NAT. It makes no tangible difference in their lives. Techies like you and I can appreciate the technical arguments, but if we want to convince anybody else who can actually make decisions for large numbers of ordinary people, we're going to need better arguments.
- zekica 5y ago
  But this is only because everything mainstream that is P2P uses some kind of a centralized relay server. P2P would be much much cheaper for everyone if everyone used IPv6, so it makes a difference.

vardagsnytt 5y ago

The perspective on this one is rather important I'd say. To run a service and buying a few IPv4 addresses is quite feasible. But operating an ISP and maintaining either large numbers of prefixes or costly CGNAT hardware at that scale puts it way more into focus. Of course I'm not implying that IPv6 isn't nice to run inside your infrastructure but I guess it isnt at the top of ones expenses.

zokier 5y ago

What I haven't quite fathomed with IPv6 is that as a home user without my own AS, am I supposed to use my ISP provided addresses in my internal network? ISP provided addresses that I have no control over and could change at any time? With IPv4, I just use RFC1918 addresses as I like and I have full control over the addresses and their allocation and I can then very easily set up iptables rules, dhcp pools, dns records etc. Then I just NAT at the edge of my network, and the configuration is practically completely isolated from my ISP and whatever addressing they do.

BitPirate 5y ago
If you don't have a static subnet, you can still use ULAs.
- BenjiWiebe 5y ago
  Exactly. With IPv6 you are expected to have multiple addresses. Some to access the internet with that may change, some that don't change and aren't globally routable to access your own stuff with. Though you can also (if your router supports it) assign hostnames to your devices so you can access them via their non-static global addresses.
  - nicolas314 5y ago
    If I understood correctly, the link between ULA-based address and host name is done through a DUID. This is assuming that DUID values do not change over time and can easily be harvested from everything you want to connect to the local network. What guarantees that DUIDs are fixed and easily collectable? What are the solutions if they aren't?
benttoothpaste 5y ago
In addition IPv6 has this weird restrictions on which prefixes are valid. For example if your ISP gives you /64 prefix, most consumer routers will not recognize it as valid. And even if you have a very configurable router it will take lots of work to configure that - even though in theory you should have tons of addresses available. And if you get a /128 prefix, good luck that - NATs are apparently disallowed in IPV6 world.

dekhn 5y ago

I noticed that effectively all my home machines support dual stack right now. I decided to make an experiment and move to only IPv6. It was a huge mess (the autoconfig functionality, naming, routing) that all sort of failed in ways that involved deep hacking to debug. Ultimately I realized that since most sites on the net aren't ipv6, I'd need to NAT or proxy my traffic to them anyway. Let me know when we're ready to turn off IPv4.

buttocks 5y ago

Speaking of Twitter, follow @noipv6 for some great commentary and/or heckling of ISPs who make false claims about IPv6 to defend their lack of support.

js2 5y ago

> When I try to ping an IPv6 address (like example.com’s IP 2606:2800:220:1:248:1893:25c8:1946 for example) I get the error ping: connect: Network is unreachable. Why? (answer: it’s because my ISP doesn’t support IPv6 so my computer doesn’t have a public IPv6 address) $ ssh freenas.local freenas$ ping6 2606:2800:220:1:248:1893:25c8:1946 ping6: UDP connect: No route to host Crap I should fix that. Login to web-interface, click the "IPv6 Autoconfigure" checkbox, click test, click save. freenas$ ping6 2606:2800:220:1:248:1893:25c8:1946 PING6(56=40+8+8 bytes) 2600:1700:3d40:6300:6a05:caff:fe58:a370 --> 2606:2800:220:1:248:1893:25c8:1946 16 bytes from 2606:2800:220:1:248:1893:25c8:1946, icmp_seq=0 hlim=54 time=11.408 ms Wow, IPv6 _is_ easy! :-) (AT&T is my ISP and it took a bit of screwing around over a weekend with my router a couple years ago to get IPv6 working properly on my home network. But it's been painless ever since.)

zamadatix 5y ago
If you like tinkering and you've got the AT&T fiber service and don't use the voice/TV U-Verse stuff) you can get significantly better IPv4 and IPv6 performance not using their gateway (even if it's just in bridge mode with every service disabled). It's not officially supported and they actually 802.1x auth the modem but there are convenient scripts out there to proxy the auth packets allowing you to use your own router directly. Particularly helpful for maxing out their gig service or for drastically improving jitter at any service speed.
- js2 5y ago
  Yup, this is me: https://github.com/jaysoffian/eap_proxy https://github.com/jaysoffian/eap_proxy AT&T has transitioned to issuing a combined ONT/Router, where this will no longer be possible, but apparently the newer gear doesn't have any of the performance issues of the Pace 5268AC. BTW, I was annoyed that AT&T installed the ONT on the southern wall of my home where it was baking in full sun everyday, so I relocated it myself into my network closet. You can just unplug the ONT and extend the existing fiber with an optical coupler and an SC-APC to SC-APC single-mode patch cable.
  - 5y ago

spockz 5y ago

What is the best way to get ipv6 if your ISP doesn’t support it? I tried getting HurricaneElectric to work for tunnelling on my Ubiquity USG3 but couldn’t make it to work. What would be the best way to get ipv6?

justincormack 5y ago
Tunneling with HE is usually the easiest way...
- xfer 5y ago
  Not if they already block icmp traffic.
- withinboredom 5y ago
  Agree and would like to add that you may want to disable ipv6 tunneling for streaming services. (Google it) because they consider it a “vpn” thus you must be a copyright thief. (Yet any other “real” vpn will stream just fine lol)

yjftsjthsd-h 5y ago

A few of these reasons boil down to "it's faster to not NAT". That makes some intuitive sense, but does anyone know of any studies/tests so we can get numbers? Are we talking higher time to first connect? Slight increase in hops/latency on every packet?

commandersaki 5y ago
The "faster than NAT" argument made very little sense to me. A NAT adds like a few microseconds of latency, nothing to be perceptible for virtually all applications.
bert64 5y ago
According to linkedin it varies and is up to 40% in some cases they measured: https://www.linkedin.com/pulse/ipv6-measurements-zaid-ali-kahn/ https://www.linkedin.com/pulse/ipv6-measurements-zaid-ali-ka... A fast NAT gateway which is lightly loaded might make little difference, a heavily loaded one can make a big difference. Google stats also show slight latency improvements for IPv6: https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-... Of course these are generalised stats, there will be some users with tunnels which will impair IPv6 performance, while other users might be behind multiple layers of NAT.

kim0 5y ago

Does anyone have an explanation about "reason: to own your IP addresses" .. does that actually work?

rmoriz 5y ago
As a LIR you can request network address space tied to your organization. To my knowledge there are almost no cloud hosting providers that support "bring your own IP space". Vultr.com seems to be the sole exception.

tomsmeding 5y ago

> Apparently you can buy IPv6 addresses, use them for the servers on your home network, and then if you change your ISP, continue to use the same IP addresses? > I’m still not totally sure how this works but it sounds cool. Naively I would say this is completely impossible without some form of your home router (or ISP?) relaying your traffic, or perhaps telling the sender that I am now actually located in a different subnet somewhere. If anyone can have IP(v6) addresses and keep them and take them with you, then wouldn't that result in an unmanageably large lookup table at routing nodes to know where to route stuff to? How does that work?

adamcharnock 5y ago
So this is typically what BGP is for, but this is definitely not something that is typically offered to residential customers, nor even most business AFAIK. This is what you would typically get with a Direct Internet Access (DIA) connection. This is an uncontended connection where to setup a BGP peering with your provider. You then give the provider some documentation proving you own a range of addresses, and they agree to accept those routes from you via the BGP connection. They then advertise that to their upstream providers, and thus the routes propagate to the entire internet. There are a couple of gotchas though. Firstly, there is generally a minimum prefix size of routes that will be accepted into the global routing table. For IPv4 I think it is a /24, and for IPv6 I think it is a /32. You can get a /32 from regional IP registry (for free?) but you will probably need to become a member which – last time I checked - costs 3-4 figures a year. You can use a private-AS number though, as you'll only have one upstream provider. The other gotcha is cost. Depending where you are in the world, a DIA connection will cost in the very rough region of (EUR/USD/GBP) 1/megabit/month, although it becomes much cheaper when going from 1gb to 10gb. Now maybe there is some cool facility that some nice ISPs offer to bypass all this, if so then please let me know. I'm personally skeptical it would be worth their while for the 0.001% of residential customers that would want this service though. Source: I run a small ISP. I have some industry knowledge, but not loads.
metalliqaz 5y ago
its possible but it relies on your ISP being willing to route your traffic, and as the article notes, many won't bother

hippyup 5y ago

I'd love to read an honest post from somebody from Twitter (or GitHub or...) on why they don't support IPv6. Not a shaming thing, it's something I don't quite get. Like I get why an old school bank wouldn't: their infrastructure predates IPv6 and it's a project that has to be financially justified and I can understand how that can be hard. But presumably something like Twitter had an experienced networking team, who surely know all the advantages here and want to somewhat future-proof, build up their infrastructure and they decided not to support IPv6 and I would love to understand the reasoning. Is the extra cost really that high?

yjftsjthsd-h 5y ago
I have no special insight, but it's probably something like "we're working on it, but there are lots of legacy things that expect v4 (including non-obvious like anti-abuse systems) and since all our users have some sort of v4 connectivity it's not urgent".
tw611345 5y ago
Why would they? - IPv6 is basically an abandoned standard. I wouldn't expect them to support gopher either. - Residential ISP support for ipv6 is spotty, and anyone who does offer ipv6 offers ipv4 as well. - When it is supported, ipv6 tends to be substantially slower than ipv4 in practice. - The addresses are a pain to look at and work with. - You now have twice as many things to fail.
- throwaway2048 5y ago
  ipv6 is hardly an abandoned standard, 35% of google users access google over ipv6, and it continues to grow every year. https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html IPv6 is also usually faster than ipv4 these days, because the overhead of fragmented ipv4 routing is large. In the past it was slower because of lack of understanding/support for it from larger ISPs, and consequently poor routes, or really suboptimal tunneling setups.
boris 5y ago
I am guessing the reasoning goes like this: if we only support IPv4, then it's on all these ISPs with IPv6-to-IPv4 CGNAT to make sure their stuff works properly (and chances are they will notice if it doesn't). But if we support IPv6, it will be on us to make sure people behind those ISPs can still reach us (because hardly anyone goes via this IPv6 route and if it doesn't work it's likely nobody at the ISP will notice).

yjftsjthsd-h 5y ago

This seems like a good place to mention a neat trick: If you're behind cloudflare or such, you can probably trivially go pure IPv6 on your servers and not even have to worry about NAT because cloudflare will provide v4 to users that use it. So you end up with (your server) -v6-> (cloudflare) -v4/v6-> (users). (Which I admit is a sort of NAT, just not at the IP level)

withinboredom 5y ago

A personal bane of my existence is WSL’s lack of ipv6 support. You can’t even use WireGuard and ipv6 because it’s missing some kernel options.

rmoriz 5y ago

Running containers dual-stacked is still surprisingly difficult or annoying.

amluto 5y ago

I’ll add one: for servers accessed only via private networks, IPv6 still allows easy use of globally unique addresses. The finance world is full of IPv4 systems using 10.x.y.z, and there aren’t enough of those addresses to go around.

tolien 5y ago

There’s already a lot of FUD around IPv6 and I’m not sure that an article which seems to amount to a survey on Twitter really moves the conversation forward much. Clearly there’s pain points to rolling out v6 (although I’d question how many of them are still an issue outside the glacial pace of Enterprise IT) and we’d be better trying to address that than re-hash the same old arguments. Edit: not much more than 2 weeks ago we had this chestnut [1] where Nintendo was telling you to forward thousands of UDP ports to a Switch in order to play online but still we hear “but NAT works fine for me”. 1: https://news.ycombinator.com/item?id=29919228 https://news.ycombinator.com/item?id=29919228

zamadatix 5y ago
I think the decades of dominance of UDP/TCP over IPv4 over Ethernet (which comes with the pre-existing knowledge in everyone, the years of experience working with it for any IT person, the additional workarounds like NAT and UPnP and so on, and even the oldest hardware still reasonably running having full support) has made people think it was all just always easy and obvious from the get-go. Where some of these protocol assumptions and ingrained history didn't exist, like the mobile carrier space, we see by far the most adoption of IPv6 out of any area and even a few non-dual stack players. The truth is like most topics in computing after 20 or 30 years of using one protocol/interface the baggage, limitations, or cost of the old keep piling up and eventually the new thing is going to seem like less work/cost/baggage than the old. The thing that seems to be moving it forward the most nowadays is cost and baggage (= complexity = long way around to more cost). The direct cost is per IPv4 prices going from ~$25/per to ~$45/per in the last year alone. The baggage/complexity cost is particularly on the carrier or large enterprise side where ever growing device counts and ever growing public address costs combine to make NAT needs larger and sometimes multi-staged (e.g. CG-NAT). I think the breaking point will be when we start to see most hosting providers and carriers continue to either push consumers to more IPv6 to reduce NAT load or cost incentivize hosted services to do the same. There are limited instances of this now, an occasional hosting provider offering IPv6 only for a lower monthly cost or a mobile carrier that migrates all of it's users to IPv6 transparently, but there are still more providers/carriers that don't do anything IPv6 than there are that incentivize IPv6. Definitely moving in that direction these last few years though. What I don't think we'll see is a sudden "aha" moment where people give up IPv4 and stop being uncertain about v6 just because they read about it more or were told some detail.

dopa42365 5y ago

My ISPs v4 is down sometimes (Vodafone in Germany), while v6 continues working just fine. Severe loss of legacy internet services in those situations (no twitter, reddit, pornhub, battle.net, twitch...)

gtirloni 5y ago
Here it's the opposite. My ISP's IPv6 network is so bad I've had to request them to disable IPv6 at my router.
she46BiOmUerPVj 5y ago
I have the same with Comcast in south east US. Browsing the internet IPv6 only is depressing unless you only use Google :/

jlokier 5y ago

My office ISP is a mobile phone running a wifi hotspot. (Don't judge, it's faster than the last ADSL connection at about 80Mbit/s on a good day, much cheaper, and the office goes through about 40GB/month no problem.) The phone has an IPv6 address but no IPv4 address. Ironic, then, that the hotspot only provides IPv4 to all connected devices, not IPv6. As a result, all connected devices in the office can only use IPv4. My home ISP is a mobile 4G router providing wifi. The router doesn't get an IPv6 from upstream, just IPv4, so it only provides IPv4 to connected devices at home. I have no idea if it would provide IPv6 service if it got one from upstream. It is a little strange that it doesn't get IPv6 from upstream, because it's exactly the same type of mobile data contract as the office phone-router is using. It's 2022. I've had IPv6 on my servers since about 2003. But aside from my actual phone, I've never had IPv6 on any device I'm using, living at numerous homes, using many and varied ISPs, working at numerous offices, or anywhere else. Not even when travelling. I had to turn off IPv6 on my mail server, because gmail.com was rejecting mail from it when sent over IPv6, but not when sent over IPv4. I use LXD and Docker on some of my servers for containers, and libvirt/KVM for VMs. In theory they support IPv6 but in practice it's easier to work with IPv4 address or port forwarding with them. That means the containers and VMs are only reachable from the internet over IPv4, even when the host servers have IPv6. All together, anything I do to support IPv6 ends up poorly tested because it's not really used, and everything has to be done with IPv4 in parallel anyway. I still have IPv6 on my servers, and DNS configured appropriately. But as it virtually never gets used, it seems a bit pointless. Sometimes I don't set up IPv6 on a new server straight away, and nothing is missed.

bert64 5y ago
Depends on the phone and carrier, if i enable tethering (iphone 8) then my connected devices get IPv6 addresses. Some android tethering implementations use CLAT and only give you legacy IP. Some old routers might do the same, or might do so by default until you reconfigure them. Here at least the mobile network uses cgnat for ipv4, but fully routable ipv6 - so the only way i can get inbound connections over the mobile network is to use ipv6.

l0b0 5y ago

By now I'm semi-convinced ISPs are deliberately holding back IPv6 in order to make a buck selling static IPs. They charge a good chunk of money per month for an IPv4 address (at least in Switzerland, the UK, and New Zealand), which is basically just rent extraction from artificial scarcity. And it's pretty obvious that once they transition to IPv6 there is no good reason not to give every single customer enough static IPs for a lifetime of devices.

woile 5y ago

What is a good resource to learn about ipv6? some course or book?

zamadatix 5y ago
I've read many an IPv6 book and led many an IPv6 projects/in person training classes and, as lame as it may sound, the Wikipedia page is an amazing resource to get the background needed to understand home and homelab setups. https://en.wikipedia.org/wiki/IPv6 https://en.wikipedia.org/wiki/IPv6 I'd recommend diving into the more detailed articles it links on SLAAC (alternative to DHCP, most common way to dynamically assign addresses) and NDP (replaced ARP) for a full understanding. If you want to go all in for v6 only setups with access to the v4 internet NAT64 is worth reading as well. Obviously it doesn't cover how to configure/implement for your specific scenario but it gives a solid background that lets you better understand what guides for doing it with Linux or prosumer hardware or typical consumer hardware are actually talking about.

nunez 5y ago

IPv6 is cool in theory and the idea of literally everything having its own directly-reachable IP address is extremely compelling, but I never use it because so many services STILL don't support it or don't support it correctly. (As Julia pointed out, some HUGE websites don't have quad-A records, so good luck dealing with NXDOMAIN for like everything.) Shoot, Kubernetes _just_ got support for IPv6 in 1.23 (it was in beta since 1.20). I know that 6to4 exists and many kernels can do it out of the box, but that comes with problems, as Julia rightfully pointed out here, and at that point, you might as well just NAT over IPv4.

she46BiOmUerPVj 5y ago
You mean you explicitly disable it? Or you never use sites like Google or Netflix? Why would you get NXDOMAIN for anything with IPv6 enabled? No ISP would only offer IPv6 without IPv4 as well.

EVa5I7bHFq9mnYK 5y ago

I think ipv6 enables easier surveillance and censorship.

Dagger2 5y ago
It doesn't. Not any worse than the internet already does, anyway.
- EVa5I7bHFq9mnYK 5y ago
  The NATs work as VPNs to a large extent. To quote Steven Wilson from Europol: "The issues relating to CGN, specifically the non-attribution of malicious groups and individuals, should be resolved." And the way to "resolve" it is IPv6.

oofabz 5y ago

>reason: to avoid NAT issues with home servers Home servers are not quite as easy as the article makes it sound. Home routers block incoming IPv6 packets, the same as they do for IPv4. To make a home server accessible, you need to explicitly allow that incoming IPv6 traffic in your router's firewall. This is analogous to adding a port forward rule in IPv4 NAT. The only benefit IPv6 has here is you can use the same port (e.g. SSH) for multiple home servers.

Dagger2 5y ago
It's not the only benefit, although it is a nice one. Consider how well creating a port forward rule would work if you're behind CGNAT.

teddyh 5y ago

The Case for IPv6 (1999): https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv6-06 https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv... (EDIT: Updated to non-archive link provided by cesarb)

cesarb 5y ago
Non-archive link: https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv6-06 https://datatracker.ietf.org/doc/html/draft-iab-case-for-ipv...
- teddyh 5y ago
  Thank you! (I have edited my link to use yours.) The link I originally had went bad due to the renaming from “draft-ietf-iab-case” to “draft-iab-case”, so I assumed that the document had somehow vanished, and changed to an archive.org link. Thank you for pointing me to the correct link again!

curious_cat_163 5y ago

I tend to think that a lot of issues on the global internet are not technical problems. They tend to be economics problems. v6 is a mechanism like container ships. It will dominate when the incentives and disincentives make sense for the participants.

hexo 5y ago

my ISP uses IPv6. actually with some sort of 4-in-6. i can access v4 and v6 world with no artificial problems.

spc476 5y ago

I read all the time about how great the latest technology like Docker and Kubernetes is, and how one should always update every 20 minutes or else you'll have your entire life, much less your identity, stolen by hackers, and besides, who wants to use software that's an entire six months old? And yet, trying to get anyone to upgrade to IPv6 and suddenly the entire world gets super conservative and "hey now! Let's not get too hasty here!" I can't quite square this circle.

Spivak 5y ago
I think because the only thing IPv6 really has going for it is the larger address space and the bigger number in the name. That’s not nothing but if IPv6 had been literally just IPv4 but with 8 octets then adoption would have been a lot faster. And it doesn’t help that IPv6rs want to change the internet architecture as well so even if you port you still run into the flame war that is IPv6 NAT that was only begrudgingly was implemented in Linux in 2012. You can’t upgrade to IPv6 you have to port your code to IPv6. There’s no concept of broadcast domains, IPSec built in for some reason — sorry WireGuard. And because IPv6 is fundamentally different it’s not enough to just be like okay all my shit is IPv6 capable turn it on, you also have to rearchitect your network since everyone builds their network with the concept of public and private addresses and IPv6 is/was openly hostile to it. TLDR IPv6 made it really god damn hard to just turn it on. Would it have been so bad to just support the way of the IPv4 world for compatibility and then say “hey there’s this cool new thing that’s better” which is an easier sell once you’re already using IPv6.
- Plasmoid 5y ago
  > IPv4 but with 8 octets then adoption would have been a lot faster. > You can’t upgrade to IPv6 you have to port your code to IPv6. There is no physical way to increase the address space without requiring code changes. People having making the same complaint for 20 years and it's even more hollow now then it was then. 99% of the time, you will use your OS standard library functions and completely ignore the networking underneath. Literally, all the libraries will transparently handle IPv4 or IPv6 with no problem. If you're in the 1% of software that has coding in some implicit assumption of field size for IPv4 then you are the 2020 equivalent of the Y2K problem. Grow your field sizes, fix your regexes, and use the platform support as much as possible. Finally, you can literally just turn on IPv6. Everything will work just fine. IPv6 has private addresses, you can do all the dumb stuff from IPv4 in v6. Unsurprisingly though, most major vendors don't want to spend a lot of energy supporting those hacks.

jrmg 5y ago

I’m surprised at all the people here saying that they can’t get IPv6 to ‘work’ on their home internet connection. In my experience, in the Bay Area, with Comcast cable and AT&T DSL connections in the last few years (5 or 10), it’s ‘just worked’ for any device connected to the router they provide, no configuration required. I kind of assumed that this was true nowadays for most home ISPs.

deathanatos 5y ago
I was in the Bay Area when Comcast (finally) rolled it out; it wasn't that long ago; it might have been >5 years now, but definitely it was within the last 10. Now I'm in the Boston MSA (a very rural place, I know /s); the ISP here, Verizon, does not offer IPv6. (They state they are "rolling it out", but this year will be the fifth anniversary of that.)

stevefan1999 5y ago

in case you didn't know you can either try Tunnel Broker project or 6to4 [1] relay, both proudly presented by Hurricane Electric [1]: https://en.wikipedia.org/wiki/6to4?wprov=sfla1 https://en.wikipedia.org/wiki/6to4?wprov=sfla1

coredog64 5y ago

If everyone moved to IPv6, Amazon couldn’t charge AWS customers for NAT gateways. Won’t someone think of the $AMZN shareholders?

cpeterso 5y ago

You can use the Firefox add-on "SixIndicator" to see which websites support IPv6 and which don't (assuming your client supports IPv6). The add-on shows a 4 or 6 icon in your address bar. https://addons.mozilla.org/en-US/firefox/addon/sixindicator/ https://addons.mozilla.org/en-US/firefox/addon/sixindicator/

gerdesj 5y ago

Multiple internet connections. Discuss.