19 ms·

It's good to wonder publicly and have a discussion! I set up IPv6 on all my servers in 2001 and thought we'd all be on IPv6 in just a couple of years :P What'

It's good to wonder publicly and have a discussion! I set up IPv6 on all my servers in 2001 and thought we'd all be on IPv6 in just a couple of years :P What's interesting is how much resistance there is to adding IPv6 which comes from entrenched IT. People who never learned (much) about IPv6 seem to be afraid of it and often respond with some variant or another of "don't fix it if it ain't broke", or "it's extra work for no return", or "we'll have to pay licensing to add IPv6 because we bought crap routers, so let's not", et cetera. My favorite is, "we have no record of people trying to use IPv6" - yes, that's real :D It just shows their ignorance. Adding IPv6 has myriad advantages - no need for NAT, proxies or port forwards to share addresses, no need to renumber networks if allocations or upstream change, redundancy, valid security-through-obscurity (imagine port scanning a /64 looking for open ssh ports)... What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit.

otabdeveloper4 5y ago
- fishtacos 5y ago
  Default deny from external access isn't an IPV4 NAT-only feature, but it does come out of the box. The same would need to be set up for IPv6 and move on past that. It's a firewall issue, not a protocol issue.
  - BenjiWiebe 5y ago
    The devices I've seen have default deny for IPv6 as well.
- tyingq 5y ago
  I'll admit to not understanding this position. Without NAT, you could do the same sort of firewalling, where the inbound allow list is driven dynamically. The only thing I can think of is that not using NAT exposes more detail about an internal network. Is that the reason you're hinting at, or is the reason something else?
  - 300bps 5y ago
    Not OP but that’s how I think of it. If my internal network is 10.0.0.0/8 and I have 100,000 hosts and a single IPV4 address that they all appear to be to the public Internet, I’ll sleep a lot better than if I had all 100,000 hosts with public routable IPV6 IP addresses attached to them. Yes, you can depend on a firewall to protect you but at the very least it exposes information about your internal network and at worst opens you up to future firewall flaws. I remember the days when people used to have every system have it’s own public IP address. People would scan for broadcast addresses of their networks and we got Smurf attacks as a result. Obviously those wouldn’t work with properly firewalled hosts but it still scares me.
    - fishtacos 5y ago
      This is why we have firewalls. My pfSense router e.g. blocks external access by virtue of it being a firewall with sensible defaults. All routers w/ firewalls will/should have them.
      - pm90 5y ago
        Firewalls are fine but having the ability to make machines unroutable is even more powerful, no? While I get that firewalls are probably safe like 99.99% of the time… I’ve gotta say, I just don’t trust software to not have vulns of some sort that someone important already knows how to break. So eg for a corporate network I would be hesitant to do this, for my personal network not so much (unlikely that a 3 letter agency gives a shit about what I do). Additionally. Firewall changes can sometimes fail for whatever reasons so you might have accidentally exposed a node publicly for some time. Making those nodes not reachable from the internet seems prudent. It’s like your office building has a public address but your office assignments don’t need to be public.
        mrkurt 5y ago
        Anything smaller than a IPv6 /48 is effectively unroutable. Your ISP has to route smaller blocks, like /64s, privately (because only /48s hit public bgp). And then you have to route the /64 they assign you privately once again.
- justsomehnguy 5y ago
  Do you know you can have DENY FROM ALL by default in any IPv4 firewall? Do you know what you would be hardly pressed to find a router without firewall not only in the year 2022, but in the year 2012 too, when there was 10G *switches* capable of routing AND firewalling traffic almost at the line rate?
  - otabdeveloper4 5y ago
    Firewall and NAT are orthogonal. You need both. Exposing your LAN configuration for the whole world to see is insanity. (Yes, we sometimes do this, but only because we still don't have sane VPN solutions here in the year 2022.)
    - justsomehnguy 5y ago
      > You need both. No you don't. You can have the public IPs on everything in your LAN... and still it would be completely inaccessible to the outside world. Because you know, firewalls exists. > Exposing your LAN configuration for the whole world to see is insanity Bullshit. BGP doesn't 'expose' your internal routing configuration and there is absolutely no other way for someone to see how exactly the things in your network. OSPF could be used for it, but it requires: 1) being right next to your router 2) be configured to send on the external interface.
- deleted 5y ago
  [deleted]
- mrkurt 5y ago
  I mean, the original purpose of NAT was to let you move hosts between networks without renumbering them. No one really does that though, your laptop or phone happily renumber themselves when you move networks. No one's going to use NAT for keeping IPv6 between networks.
red_trumpet 5y ago
> What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit. Not true on my german mobile carrier O2. They only provide IPv4 behind a CGNAT.
- jess-sch 5y ago
  Telekom is v6-only (464XLAT), Vodafone and o2 are dualstacking (with CGNAT for v4). You might need need to manually update your APN settings if your phone was set up before they enabled it though.
Alekhine 5y ago
Wait, if my phone is IPv6, then what does it mean that a site 'supports' v6? I can get on HN just fine.
- deleted 5y ago
  [deleted]
- jakub_g 5y ago
  Websites have separate DNS records for ipv6 (AAAA record) and ipv4 (A record). Since ipv6 is not universally supported, the de facto expectation is that if website has ipv6 DNS record, it should also have an ipv4 one for the users who can't talk ipv6. Your device's network stack first learns if your mobile ISP supports ipv6 or not, and based on that and DNS reply decides how to connect to a given website.
- throw0101a 5y ago
  > Wait, if my phone is IPv6, then what does it mean that a site 'supports' v6? I can get on HN just fine. It means that the phone doesn't have to talk through a network-translation box, which may add latency. For some things (gaming?) this may be important, while for others it may not be. Further, the price of each IPv4 address is going up, and so having your hosts on IPv6 may allow for the lowering of your costs, which you can pass onto your customers or add to your margin. About a year ago they were US$ 30/IPv4, and they now seem to be in the $50 range: * https://auctions.ipv4.global https://auctions.ipv4.global * https://auctions.ipv4.global/prior-sales https://auctions.ipv4.global/prior-sales
  - _0w8t 5y ago
    We use VPS from tilaa.com and they charge 2 Euro per extra IPv4 and for the third etc. address per server one needs to submit a technical reason for doing that that they manually review.
- tolien 5y ago
  Does your phone only have a v6 address though? If it did, you would need some kind of proxy (6to4 [1], the most likely example) connecting to HN's IPv4 address on your behalf. As the sibling points out, if both site and device support v6 the intermediate translation isn't required. 1: https://en.wikipedia.org/wiki/6to4 https://en.wikipedia.org/wiki/6to4
ipaddr 5y ago
The benefit of switching doesn't outweigh the costs yet. The switch to ssl was largely over google rankings vs greater security. What is going to be the reason people switch? Many think cost of ip4 addresses but that hasn't panned out with solutions like NAT.
- IgorPartola 5y ago
  So basically if Google added IPv6 support into its ranking algorithm we would get adoption virtually overnight.
  - eppp 5y ago
    No, because isps dont care about page rank. I have to operate a small isp. IPv6 solves nothing for us and just makes even more problems. The comments in here keep saying that ipv6 will fix everything but it is hogwash. It just means I have to support two things instead of one. IPv4 on the internet will not go away even if I do the ipv6 transition perfectly. It is one of the more frustrating parts of trying to explain why we don't all just jump to do this.
    - IgorPartola 5y ago
      That’s fair. My ISP not only doesn’t provide IPv6 but actively blocks using 6to4/6in4. They claim they don’t but I can clearly see that they do. It’s bad.
      - vetinari 5y ago
        Cable modem? Some Intel Puma 6 modems have a bug, where traffic over protocol 41 (6in4) is very slow.
        IgorPartola 5y ago
        No modem. I have fiber with Frontier and my router (OPNSense) is connected directly to their ONT.
quaintdev 5y ago
Some big nation should decide to switch off IPv4 over a course of maybe a month and maybe we will start seeing servers deploying IPv6 then.
- yjftsjthsd-h 5y ago
  Why and how would they even do that?
tyingq 5y ago
There's a fair amount of "who goes first" or "who sees that it works end-to-end". My personal experience has been several situations where some piece of software that doesn't work, or is slow, suddenly works when I disable ipv6. That includes vpn client software I had to use for a job, dns configuration at another job, a mesh network for some hobby thing, etc. Had I spent the time to dig into it, I'm sure I'd have found the issue. And it probably wouldn't have been directly a true ipv6 problem. But I had more important things to deal with, so it moved to number 11 on my "top 10 list". I'm guessing I'm not alone in that. So while individual teams and products might be working to support it, end users often see that it doesn't, because of some peripheral thing that's misconfigured, doesn't have support, etc. So they give up, which reduces perceived demand.
- withinboredom 5y ago
  If you don’t have AAAA records and you don’t have Interfaces listening to those addresses. You won’t “see” ANY “demand.” So since they don’t see ipv6 traffic, they think there’s no demand for it. It’s a self-fulfilling statistic.
  - zamadatix 5y ago
    It's far more likely the statement refers to a lack of user tickets, project requests, or compliance requirements as that's normally how IT finds out what to do next. I've never seen an IT staff with so little to do they are monitoring the network looking for packets for ideas of what they should implement next instead of implementing things they've been trying to get time for for the last 5 years. Link utilization maybe but that's a completely different beast. Not to mention it's extremely hard to know how to check the statistic you described without becoming aware you don't have the things needed to generate the statistics so this reasoning kind of rules itself out with the exception of AAAA records - you'll actually see those requests even if all you have is A records on an IPv4 only DNS server.
- alar44 5y ago
  Well of course your VPN won't work if the firewall isn't routing IPv6. That's a configuration problem and has nothing to do with IPv6 itself.
throw0101a 5y ago
> What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit. For example see the video "T-Mobile’s path to IPv6 Only": * https://www.youtube.com/watch?v=nNMNglk_CvE https://www.youtube.com/watch?v=nNMNglk_CvE
- Tijdreiziger 5y ago
  Wow, interesting to see such a video coming from T-Mobile. We have a DSL connection with T-Mobile Netherlands and they still don't support IPv6. Any inquiries about this on their community forums are met with a reply of 'there are currently no plans for IPv6 support'.
  - floatboth 5y ago
    Different countries' T-Mobiles are quite different, especially the US one..
  - X-Istence 5y ago
    T-Mobile here in the US is a mobile provider, they don't have any landline service.
    - Tijdreiziger 5y ago
      They used to be just a mobile provider here, but a number of years ago they acquired Vodafone's DSL division. They don't actually own any DSL lines though, they just rent line access from KPN (the country's incumbent telco).
throwoutway 5y ago
It’s easy to blame IT, but usually they have either business objectives assigned to them or they need to justify it to the business. So I see the “if it ain’t broke don’t fix it” more of a business problem and not an IT problem. I worked at one organization where for any networking work, you had to bill that time to a business project (which was usually a customer contract). proponents of IPv6 inside a business probably seem to the business like they’ve got excited over pointless science projects with nothing to ‘bill’ their time against
zokier 5y ago
> Adding IPv6 has myriad advantages - no need for NAT, proxies or port forwards to share addresses, no need to renumber networks if allocations or upstream change, redundancy, valid security-through-obscurity (imagine port scanning a /64 looking for open ssh ports)... problem is that adding ipv6 gives none of those. Removing ipv4 would do so, but realistically most people are going to run dual-stack of some sort for a while, and as long as that is the case then adding ipv6 is mostly just additive effort.
- stingraycharles 5y ago
  I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway. The number one complaint I hear (and have myself) is that maybe I don’t _want_ all devices on my LAN to have public IP addresses. NAT makes security a lot easier to reason about.
  - NavinF 5y ago
    NAT doesn’t improve security if port numbers are easy to guess, which is usually the case. If you wanna block inbound connections, just drop them with your firewall. Most home routers already do this by default and if yours doesn’t, you better enable it for IPv4 too.
    - thrashh 5y ago
      NAT sucks but is harder to misconfigure. I’ve never accidentally let something through NAT. But accidentally not configuring a firewall? Everyone does that and has done that and will forever do it.
      - BenjiWiebe 5y ago
        I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.
rr808 5y ago
NAT is a very simple idea that works very well. In fact for my private network with 20 odd devices I'd prefer to keep it.
- xibo9 5y ago
  The problem is, it is NOT a simple idea, but one that requires a lot of relative heavy lifting with deep packet inspection for a lot of protocols that have to deal with the spaghetti that is NAT.
  - spookthesunset 5y ago
    Yeah but even if it isn't simple it is mostly a solved problem at this point. NAT has been around for, what, 15 years now? And quite honestly the default configurations for IPv6 on consumer routers is "wide the fuck open"--which is not at all what I want. But if they don't make it "wide the fuck open" suddenly you are asking normal people to learn how to punch holes in their firewall.
    - fsh 5y ago
      I have never seen a consumer IPv6 router without a restrictive firewall enabled by default. Could you give some examples where this is not the case?
    - spc476 5y ago
      Pv6 and NAT were developed in the mid-90s. They've both been around for far longer than just 15 years.
    - Hikikomori 5y ago
      More like almost 30 years.
    - Dagger2 5y ago
      NAT has fundamental flaws that simply can't be solved, and even when it can be made to work it's still an extra layer of completely unnecessary complexity. It does work surprisingly well despite all that, but it's not something to build the entire future of the internet around. The default config for most routers is to deny inbound connections, for both v4 and v6. I'm certain you can find routers that don't do that, but it's not common.
yjftsjthsd-h 5y ago
> What's interesting is how much resistance there is to adding IPv6 which comes from entrenched IT. People who never learned (much) about IPv6 seem to be afraid of it Right, you're only suggesting that they change out a fundamental part of the network for no benefit that they can see; why would they possibly object except out of fear and ignorance? After all, their fears are totally unfounded; most, probably all, of the random breakage and slowdowns that happened last time they tried to enable v6 have been fixed now. I mean, yes, plenty of people don't want to learn new things for bad reasons, but plenty of people have insufficient time and have to make cost/benefit decisions - and you not liking their conclusion doesn't make them wrong - and there are a fair number of people who were all on board with upgrading a decade ago and got bitten by the then very real problems with IPv6 (which mostly boiled down to "not everything supports it properly, and lots of things fail ungracefully and create weird breakage").
- FullyFunctional 5y ago
  Well put. I’ve been shocked by the elitist attitude by many commenter who don’t see the issue IPv6 has for _most_ non-IT professionals. Facts are these: IPv6 is a failure; it didn’t provide a way to conexist with IPv4 [1] and it did _not_ have a _compelling_ benefit to most people. The benefits cited makes no difference to most. [1] https://cr.yp.to/djbdns/ipv6mess.html https://cr.yp.to/djbdns/ipv6mess.html
  - Dagger2 5y ago
    I wonder if people will ever stop bringing that article up... v6 provides lots of ways to coexist with v4. There's dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how can you argue it doesn't?
pm90 5y ago
> My favorite is, "we have no record of people trying to use IPv6" - yes, that's real :D Have you ever worked at a IT department for a medium to large company? It’s usually a total shit show. IT gets blamed (justly or unjustly) for any issue with computers. As a result they become rather thick skinned and incredibly conservative in the projects they undertake. So it’s not surprising that folks are unwilling to spend time on something they don’t have prior art for, haven’t operated before, and doesn’t offer significant benefits over what they already have.
- alar44 5y ago
  100%. Anytime something happens to a PC it's either the sever, internet, or the network is down! Or all 3! Right. Our entire network is down and IT has no idea, thanks for the help Karen. You learn to keep things simple and make as few changes as possible so you can't be blamed for other departments mistakes. "Network is up, haven't made a single change to infra in a month. Find someone else to blame."
dheera 5y ago
> no need for NAT Yeah everyone says this but I can't access any ports on my IPv6 address from outside my home network. Back to IPv4 + NAT + port forwarding, I guess. I have bigger problems I need to solve in my life right now. When one day I can just ssh <my-ipv6-address> from the outside I'll do that. Thanks. Also, there's the DNS problem. I can remember 10.0.0.3, 10.0.0.20, etc. pretty damn easily. I can't remember 8cef::fasd:8000:c00a:::99aa:::::81/42:8fe that easily. Which is an issue when things like 'foobar.local' don't work half the time. I have the IPv4 addresses of all my internal machines memorized thanks to the the fact that .local just doesn't work, period.
- zekica 5y ago
  You are using it wrong. You can't access a service on a server on your local network using your router's global IP. You should use server's global IP address (and open the port for that IP on the firewall). If your server uses SLAAC, it will always use the same local address (whether using EUI-64 or stable privacy), or you can configure it manually. In either case the address won't change. NAT made you think in a different way, but if you started with IPv4 before there was NAT, this setup is exactly the same as it was with IPv4 a long time ago.
  - dheera 5y ago
    Too much work. If I type ifconfig on my machine I only have one 'inet6' address and it isn't reachable from the outside. The relevant people who want to popularize IPv6 should make that "just work". Until then IPv4 works for me, and a port forward is easy to understand, I don't need to google what SLAAC and EU-64. They advertise it as "oh you don't need a NAT" but in reality IPv4+NAT is easier to deal with. Most of us have actual jobs and don't have time to also be devops people. I realize this sounds like a shitpost, but this UX is exactly why IPv6 isn't popular yet. If you want something to be popular, you need to make it easier not harder than the current thing everyone uses.
    - Symbiote 5y ago
      Half the discussion is FUD that a consumer router wouldn't have an IPv6 firewall. Your router, like every other, has a default deny firewall for IPv6. You'll find the settings near to where you set up IPv4 port forwarding. My router calls it "pinholing" or something. Then you can SSH directly to the servers you allow access to, using port 22 for all of them if you wish.
twistedpair 5y ago
If I provided users with an IPv6 block to allowlist for my apps, I think most IT directors' heads would explode, but _everything_ works with 32 bit CIDR ranges. I certainly support it, but I'm not sure we'll see an end to NAT for some time, even with an IPv6 option.
belter 5y ago
"Comparison of IPv6 support in common applications" https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_common_applications https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_...
iso1631 5y ago
I can't go v6 only, so why double my workload by supporting ipv4 and ipv6.
- Dagger2 5y ago
  You wouldn't be doubling your workload. Most of your work applies equally well to both protocols without any additional effort, and even if you can't remove v4 completely you can often ignore it for some things, which saves you some workload.
  - iso1631 5y ago
    If I want to communicate with v4 hosts I have to support v4. If I want my v4 clients to talk to me I have to support v4. What can I drop? I still need an IP, distributed by DHCP, I still need the subnets, I still need to manage the routing internally, I still need to have boundary nat, both out and in, I still need to have A records in DNS. I have to do all of that in v6 land (perhaps my user interface will allow me to manage the firewall rules together, but I'm still doubling my testing). On top of that, if I change my ISP, I have to renumber my entire internal network rather than just change the public IPs. It's not even common practice to have a v6 only network and nat from v4 to v6 at the edge, and more crucially it seems from this thread that v6 removed it's v4 compatability layer (so I can't type "ping 1.2.3.4" and have it translate that to "ping -6 ::ffff:1.2.3.4", with my 6:4 gateway handling the nat Until people start using v6 only, where's the benefit in increasing my workload?
MrStonedOne 5y ago
jl6 5y ago
> "we fear change" Regardless of the IPv6 situation, IT departments take this position for a reason. It might be obvious to individual engineers how to safely deploy IPv6 on their home network if they fully understand all the moving parts. But large corporations with deep legacy to maintain don’t have the luxury of running a fully understood system. Isn’t that a big risk? Hell yeah, and of course they’ve all got modernization projects running. But in the meantime, they fear change - legitimately.
roamerz 5y ago
Calling people ignorant because you don’t agree with their opinions or reasons is a non starter for constructive discussions. Using IPV4 has never ever caused me a problem and I will never ever run out of addresses. I prefer to focus my time on real issues that actually affect end users and improve their experiences.
ksec 5y ago
> "we fear change" IT people don't realize they're already using IPv6 on their phones every day, Is that US specific? Because as far as I am aware only 5G "purposed" ( I am not sure if it mandatory ) the use of IPv6. 5G requires the support of IPv6, but not usage.

otabdeveloper4 5y ago

fishtacos 5y ago
Default deny from external access isn't an IPV4 NAT-only feature, but it does come out of the box. The same would need to be set up for IPv6 and move on past that. It's a firewall issue, not a protocol issue.
- BenjiWiebe 5y ago
  The devices I've seen have default deny for IPv6 as well.
tyingq 5y ago
I'll admit to not understanding this position. Without NAT, you could do the same sort of firewalling, where the inbound allow list is driven dynamically. The only thing I can think of is that not using NAT exposes more detail about an internal network. Is that the reason you're hinting at, or is the reason something else?
- 300bps 5y ago
  Not OP but that’s how I think of it. If my internal network is 10.0.0.0/8 and I have 100,000 hosts and a single IPV4 address that they all appear to be to the public Internet, I’ll sleep a lot better than if I had all 100,000 hosts with public routable IPV6 IP addresses attached to them. Yes, you can depend on a firewall to protect you but at the very least it exposes information about your internal network and at worst opens you up to future firewall flaws. I remember the days when people used to have every system have it’s own public IP address. People would scan for broadcast addresses of their networks and we got Smurf attacks as a result. Obviously those wouldn’t work with properly firewalled hosts but it still scares me.
  - fishtacos 5y ago
    This is why we have firewalls. My pfSense router e.g. blocks external access by virtue of it being a firewall with sensible defaults. All routers w/ firewalls will/should have them.
    - pm90 5y ago
      Firewalls are fine but having the ability to make machines unroutable is even more powerful, no? While I get that firewalls are probably safe like 99.99% of the time… I’ve gotta say, I just don’t trust software to not have vulns of some sort that someone important already knows how to break. So eg for a corporate network I would be hesitant to do this, for my personal network not so much (unlikely that a 3 letter agency gives a shit about what I do). Additionally. Firewall changes can sometimes fail for whatever reasons so you might have accidentally exposed a node publicly for some time. Making those nodes not reachable from the internet seems prudent. It’s like your office building has a public address but your office assignments don’t need to be public.
      - mrkurt 5y ago
        Anything smaller than a IPv6 /48 is effectively unroutable. Your ISP has to route smaller blocks, like /64s, privately (because only /48s hit public bgp). And then you have to route the /64 they assign you privately once again.
justsomehnguy 5y ago
Do you know you can have DENY FROM ALL by default in any IPv4 firewall? Do you know what you would be hardly pressed to find a router without firewall not only in the year 2022, but in the year 2012 too, when there was 10G *switches* capable of routing AND firewalling traffic almost at the line rate?
- otabdeveloper4 5y ago
  Firewall and NAT are orthogonal. You need both. Exposing your LAN configuration for the whole world to see is insanity. (Yes, we sometimes do this, but only because we still don't have sane VPN solutions here in the year 2022.)
  - justsomehnguy 5y ago
    > You need both. No you don't. You can have the public IPs on everything in your LAN... and still it would be completely inaccessible to the outside world. Because you know, firewalls exists. > Exposing your LAN configuration for the whole world to see is insanity Bullshit. BGP doesn't 'expose' your internal routing configuration and there is absolutely no other way for someone to see how exactly the things in your network. OSPF could be used for it, but it requires: 1) being right next to your router 2) be configured to send on the external interface.
deleted 5y ago
[deleted]
mrkurt 5y ago
I mean, the original purpose of NAT was to let you move hosts between networks without renumbering them. No one really does that though, your laptop or phone happily renumber themselves when you move networks. No one's going to use NAT for keeping IPv6 between networks.

red_trumpet 5y ago

> What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit. Not true on my german mobile carrier O2. They only provide IPv4 behind a CGNAT.

jess-sch 5y ago
Telekom is v6-only (464XLAT), Vodafone and o2 are dualstacking (with CGNAT for v4). You might need need to manually update your APN settings if your phone was set up before they enabled it though.

Alekhine 5y ago

Wait, if my phone is IPv6, then what does it mean that a site 'supports' v6? I can get on HN just fine.

deleted 5y ago
[deleted]
jakub_g 5y ago
Websites have separate DNS records for ipv6 (AAAA record) and ipv4 (A record). Since ipv6 is not universally supported, the de facto expectation is that if website has ipv6 DNS record, it should also have an ipv4 one for the users who can't talk ipv6. Your device's network stack first learns if your mobile ISP supports ipv6 or not, and based on that and DNS reply decides how to connect to a given website.
throw0101a 5y ago
> Wait, if my phone is IPv6, then what does it mean that a site 'supports' v6? I can get on HN just fine. It means that the phone doesn't have to talk through a network-translation box, which may add latency. For some things (gaming?) this may be important, while for others it may not be. Further, the price of each IPv4 address is going up, and so having your hosts on IPv6 may allow for the lowering of your costs, which you can pass onto your customers or add to your margin. About a year ago they were US$ 30/IPv4, and they now seem to be in the $50 range: * https://auctions.ipv4.global https://auctions.ipv4.global * https://auctions.ipv4.global/prior-sales https://auctions.ipv4.global/prior-sales
- _0w8t 5y ago
  We use VPS from tilaa.com and they charge 2 Euro per extra IPv4 and for the third etc. address per server one needs to submit a technical reason for doing that that they manually review.
tolien 5y ago
Does your phone only have a v6 address though? If it did, you would need some kind of proxy (6to4 [1], the most likely example) connecting to HN's IPv4 address on your behalf. As the sibling points out, if both site and device support v6 the intermediate translation isn't required. 1: https://en.wikipedia.org/wiki/6to4 https://en.wikipedia.org/wiki/6to4

ipaddr 5y ago

The benefit of switching doesn't outweigh the costs yet. The switch to ssl was largely over google rankings vs greater security. What is going to be the reason people switch? Many think cost of ip4 addresses but that hasn't panned out with solutions like NAT.

IgorPartola 5y ago
So basically if Google added IPv6 support into its ranking algorithm we would get adoption virtually overnight.
- eppp 5y ago
  No, because isps dont care about page rank. I have to operate a small isp. IPv6 solves nothing for us and just makes even more problems. The comments in here keep saying that ipv6 will fix everything but it is hogwash. It just means I have to support two things instead of one. IPv4 on the internet will not go away even if I do the ipv6 transition perfectly. It is one of the more frustrating parts of trying to explain why we don't all just jump to do this.
  - IgorPartola 5y ago
    That’s fair. My ISP not only doesn’t provide IPv6 but actively blocks using 6to4/6in4. They claim they don’t but I can clearly see that they do. It’s bad.
    - vetinari 5y ago
      Cable modem? Some Intel Puma 6 modems have a bug, where traffic over protocol 41 (6in4) is very slow.
      - IgorPartola 5y ago
        No modem. I have fiber with Frontier and my router (OPNSense) is connected directly to their ONT.

quaintdev 5y ago

Some big nation should decide to switch off IPv4 over a course of maybe a month and maybe we will start seeing servers deploying IPv6 then.

yjftsjthsd-h 5y ago
Why and how would they even do that?

tyingq 5y ago

There's a fair amount of "who goes first" or "who sees that it works end-to-end". My personal experience has been several situations where some piece of software that doesn't work, or is slow, suddenly works when I disable ipv6. That includes vpn client software I had to use for a job, dns configuration at another job, a mesh network for some hobby thing, etc. Had I spent the time to dig into it, I'm sure I'd have found the issue. And it probably wouldn't have been directly a true ipv6 problem. But I had more important things to deal with, so it moved to number 11 on my "top 10 list". I'm guessing I'm not alone in that. So while individual teams and products might be working to support it, end users often see that it doesn't, because of some peripheral thing that's misconfigured, doesn't have support, etc. So they give up, which reduces perceived demand.

withinboredom 5y ago
If you don’t have AAAA records and you don’t have Interfaces listening to those addresses. You won’t “see” ANY “demand.” So since they don’t see ipv6 traffic, they think there’s no demand for it. It’s a self-fulfilling statistic.
- zamadatix 5y ago
  It's far more likely the statement refers to a lack of user tickets, project requests, or compliance requirements as that's normally how IT finds out what to do next. I've never seen an IT staff with so little to do they are monitoring the network looking for packets for ideas of what they should implement next instead of implementing things they've been trying to get time for for the last 5 years. Link utilization maybe but that's a completely different beast. Not to mention it's extremely hard to know how to check the statistic you described without becoming aware you don't have the things needed to generate the statistics so this reasoning kind of rules itself out with the exception of AAAA records - you'll actually see those requests even if all you have is A records on an IPv4 only DNS server.
alar44 5y ago
Well of course your VPN won't work if the firewall isn't routing IPv6. That's a configuration problem and has nothing to do with IPv6 itself.

throw0101a 5y ago

> What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit. For example see the video "T-Mobile’s path to IPv6 Only": * https://www.youtube.com/watch?v=nNMNglk_CvE https://www.youtube.com/watch?v=nNMNglk_CvE

Tijdreiziger 5y ago
Wow, interesting to see such a video coming from T-Mobile. We have a DSL connection with T-Mobile Netherlands and they still don't support IPv6. Any inquiries about this on their community forums are met with a reply of 'there are currently no plans for IPv6 support'.
- floatboth 5y ago
  Different countries' T-Mobiles are quite different, especially the US one..
- X-Istence 5y ago
  T-Mobile here in the US is a mobile provider, they don't have any landline service.
  - Tijdreiziger 5y ago
    They used to be just a mobile provider here, but a number of years ago they acquired Vodafone's DSL division. They don't actually own any DSL lines though, they just rent line access from KPN (the country's incumbent telco).

throwoutway 5y ago

It’s easy to blame IT, but usually they have either business objectives assigned to them or they need to justify it to the business. So I see the “if it ain’t broke don’t fix it” more of a business problem and not an IT problem. I worked at one organization where for any networking work, you had to bill that time to a business project (which was usually a customer contract). proponents of IPv6 inside a business probably seem to the business like they’ve got excited over pointless science projects with nothing to ‘bill’ their time against

zokier 5y ago

> Adding IPv6 has myriad advantages - no need for NAT, proxies or port forwards to share addresses, no need to renumber networks if allocations or upstream change, redundancy, valid security-through-obscurity (imagine port scanning a /64 looking for open ssh ports)... problem is that adding ipv6 gives none of those. Removing ipv4 would do so, but realistically most people are going to run dual-stack of some sort for a while, and as long as that is the case then adding ipv6 is mostly just additive effort.

stingraycharles 5y ago
I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway. The number one complaint I hear (and have myself) is that maybe I don’t _want_ all devices on my LAN to have public IP addresses. NAT makes security a lot easier to reason about.
- NavinF 5y ago
  NAT doesn’t improve security if port numbers are easy to guess, which is usually the case. If you wanna block inbound connections, just drop them with your firewall. Most home routers already do this by default and if yours doesn’t, you better enable it for IPv4 too.
  - thrashh 5y ago
    NAT sucks but is harder to misconfigure. I’ve never accidentally let something through NAT. But accidentally not configuring a firewall? Everyone does that and has done that and will forever do it.
    - BenjiWiebe 5y ago
      I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.

rr808 5y ago

NAT is a very simple idea that works very well. In fact for my private network with 20 odd devices I'd prefer to keep it.

xibo9 5y ago
The problem is, it is NOT a simple idea, but one that requires a lot of relative heavy lifting with deep packet inspection for a lot of protocols that have to deal with the spaghetti that is NAT.
- spookthesunset 5y ago
  Yeah but even if it isn't simple it is mostly a solved problem at this point. NAT has been around for, what, 15 years now? And quite honestly the default configurations for IPv6 on consumer routers is "wide the fuck open"--which is not at all what I want. But if they don't make it "wide the fuck open" suddenly you are asking normal people to learn how to punch holes in their firewall.
  - fsh 5y ago
    I have never seen a consumer IPv6 router without a restrictive firewall enabled by default. Could you give some examples where this is not the case?
  - spc476 5y ago
    Pv6 and NAT were developed in the mid-90s. They've both been around for far longer than just 15 years.
  - Hikikomori 5y ago
    More like almost 30 years.
  - Dagger2 5y ago
    NAT has fundamental flaws that simply can't be solved, and even when it can be made to work it's still an extra layer of completely unnecessary complexity. It does work surprisingly well despite all that, but it's not something to build the entire future of the internet around. The default config for most routers is to deny inbound connections, for both v4 and v6. I'm certain you can find routers that don't do that, but it's not common.

yjftsjthsd-h 5y ago

> What's interesting is how much resistance there is to adding IPv6 which comes from entrenched IT. People who never learned (much) about IPv6 seem to be afraid of it Right, you're only suggesting that they change out a fundamental part of the network for no benefit that they can see; why would they possibly object except out of fear and ignorance? After all, their fears are totally unfounded; most, probably all, of the random breakage and slowdowns that happened last time they tried to enable v6 have been fixed now. I mean, yes, plenty of people don't want to learn new things for bad reasons, but plenty of people have insufficient time and have to make cost/benefit decisions - and you not liking their conclusion doesn't make them wrong - and there are a fair number of people who were all on board with upgrading a decade ago and got bitten by the then very real problems with IPv6 (which mostly boiled down to "not everything supports it properly, and lots of things fail ungracefully and create weird breakage").

FullyFunctional 5y ago
Well put. I’ve been shocked by the elitist attitude by many commenter who don’t see the issue IPv6 has for _most_ non-IT professionals. Facts are these: IPv6 is a failure; it didn’t provide a way to conexist with IPv4 [1] and it did _not_ have a _compelling_ benefit to most people. The benefits cited makes no difference to most. [1] https://cr.yp.to/djbdns/ipv6mess.html https://cr.yp.to/djbdns/ipv6mess.html
- Dagger2 5y ago
  I wonder if people will ever stop bringing that article up... v6 provides lots of ways to coexist with v4. There's dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how can you argue it doesn't?

pm90 5y ago

> My favorite is, "we have no record of people trying to use IPv6" - yes, that's real :D Have you ever worked at a IT department for a medium to large company? It’s usually a total shit show. IT gets blamed (justly or unjustly) for any issue with computers. As a result they become rather thick skinned and incredibly conservative in the projects they undertake. So it’s not surprising that folks are unwilling to spend time on something they don’t have prior art for, haven’t operated before, and doesn’t offer significant benefits over what they already have.

alar44 5y ago
100%. Anytime something happens to a PC it's either the sever, internet, or the network is down! Or all 3! Right. Our entire network is down and IT has no idea, thanks for the help Karen. You learn to keep things simple and make as few changes as possible so you can't be blamed for other departments mistakes. "Network is up, haven't made a single change to infra in a month. Find someone else to blame."

dheera 5y ago

> no need for NAT Yeah everyone says this but I can't access any ports on my IPv6 address from outside my home network. Back to IPv4 + NAT + port forwarding, I guess. I have bigger problems I need to solve in my life right now. When one day I can just ssh <my-ipv6-address> from the outside I'll do that. Thanks. Also, there's the DNS problem. I can remember 10.0.0.3, 10.0.0.20, etc. pretty damn easily. I can't remember 8cef::fasd:8000:c00a:::99aa:::::81/42:8fe that easily. Which is an issue when things like 'foobar.local' don't work half the time. I have the IPv4 addresses of all my internal machines memorized thanks to the the fact that .local just doesn't work, period.

zekica 5y ago
You are using it wrong. You can't access a service on a server on your local network using your router's global IP. You should use server's global IP address (and open the port for that IP on the firewall). If your server uses SLAAC, it will always use the same local address (whether using EUI-64 or stable privacy), or you can configure it manually. In either case the address won't change. NAT made you think in a different way, but if you started with IPv4 before there was NAT, this setup is exactly the same as it was with IPv4 a long time ago.
- dheera 5y ago
  Too much work. If I type ifconfig on my machine I only have one 'inet6' address and it isn't reachable from the outside. The relevant people who want to popularize IPv6 should make that "just work". Until then IPv4 works for me, and a port forward is easy to understand, I don't need to google what SLAAC and EU-64. They advertise it as "oh you don't need a NAT" but in reality IPv4+NAT is easier to deal with. Most of us have actual jobs and don't have time to also be devops people. I realize this sounds like a shitpost, but this UX is exactly why IPv6 isn't popular yet. If you want something to be popular, you need to make it easier not harder than the current thing everyone uses.
  - Symbiote 5y ago
    Half the discussion is FUD that a consumer router wouldn't have an IPv6 firewall. Your router, like every other, has a default deny firewall for IPv6. You'll find the settings near to where you set up IPv4 port forwarding. My router calls it "pinholing" or something. Then you can SSH directly to the servers you allow access to, using port 22 for all of them if you wish.

twistedpair 5y ago

If I provided users with an IPv6 block to allowlist for my apps, I think most IT directors' heads would explode, but _everything_ works with 32 bit CIDR ranges. I certainly support it, but I'm not sure we'll see an end to NAT for some time, even with an IPv6 option.

belter 5y ago

"Comparison of IPv6 support in common applications" https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_common_applications https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_...

iso1631 5y ago

I can't go v6 only, so why double my workload by supporting ipv4 and ipv6.

Dagger2 5y ago
You wouldn't be doubling your workload. Most of your work applies equally well to both protocols without any additional effort, and even if you can't remove v4 completely you can often ignore it for some things, which saves you some workload.
- iso1631 5y ago
  If I want to communicate with v4 hosts I have to support v4. If I want my v4 clients to talk to me I have to support v4. What can I drop? I still need an IP, distributed by DHCP, I still need the subnets, I still need to manage the routing internally, I still need to have boundary nat, both out and in, I still need to have A records in DNS. I have to do all of that in v6 land (perhaps my user interface will allow me to manage the firewall rules together, but I'm still doubling my testing). On top of that, if I change my ISP, I have to renumber my entire internal network rather than just change the public IPs. It's not even common practice to have a v6 only network and nat from v4 to v6 at the edge, and more crucially it seems from this thread that v6 removed it's v4 compatability layer (so I can't type "ping 1.2.3.4" and have it translate that to "ping -6 ::ffff:1.2.3.4", with my 6:4 gateway handling the nat Until people start using v6 only, where's the benefit in increasing my workload?

MrStonedOne 5y ago

jl6 5y ago

> "we fear change" Regardless of the IPv6 situation, IT departments take this position for a reason. It might be obvious to individual engineers how to safely deploy IPv6 on their home network if they fully understand all the moving parts. But large corporations with deep legacy to maintain don’t have the luxury of running a fully understood system. Isn’t that a big risk? Hell yeah, and of course they’ve all got modernization projects running. But in the meantime, they fear change - legitimately.

roamerz 5y ago

Calling people ignorant because you don’t agree with their opinions or reasons is a non starter for constructive discussions. Using IPV4 has never ever caused me a problem and I will never ever run out of addresses. I prefer to focus my time on real issues that actually affect end users and improve their experiences.

ksec 5y ago

> "we fear change" IT people don't realize they're already using IPv6 on their phones every day, Is that US specific? Because as far as I am aware only 5G "purposed" ( I am not sure if it mandatory ) the use of IPv6. 5G requires the support of IPv6, but not usage.