3 ms·
IPv4 with nat is effectively routing your 100,000 hosts through one of 4,294,967,296 possible IP prefixes (a /32). IPv6 with a /64 routes one of 18,889,465,931
by mrkurt 5y ago
IPv4 with nat is effectively routing your 100,000 hosts through one of 4,294,967,296 possible IP prefixes (a /32).
IPv6 with a /64 routes one of 18,889,465,931,478,580,854,783 possible IP prefixes to your router. Everything that happens behind that is opaque. There are so many IPs in that prefix that people can't even guess which ones you're using. It's easier to guess internal IPv4 NAT addresses.
The internet can't see your IPs. "Publicly routable" doesn't mean much when you're talking about prefixes.
- otabdeveloper4 5y agoUnless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing. And anyways, when you have a NAT you're probably routing traffic through a level 4 balancer or jumphost or using a VPN somewhere in your LAN.
- blibble 5y ago> Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing. SLAAC
- Dylan16807 5y agoSLAAC has an option to randomize, but it's a lot slower than per-connection.
- mrkurt 5y agoWe assign IPv6 deterministically. Incrementing them is the most boring way to use IPv6 space. You can also just start in the middle of a block and make a sequence of 10,000 IPs effectively unguessable. I don't buy that keeping addresses private has much value, but IPv6 still isn't worse than NAT in that respect.
- doubleunplussed 5y agoAs soon as one of the computers in the subnet initiates traffic outside the network, its IP address becomes public knowledge though, right? Doesn't matter how large the space is, that information leaks, whereas with NAT it doesn't.
- Plasmoid 5y agoModern OS change their outgoing IPv6 address fairly often. They could grab 10,000 from the pool and rotate between them every second.
- doubleunplussed 5y agoIPv6 addresses can be ephemeral? What, DHCP is assigning a whole range to each client? Didn't know that. Pretty weird. For internal stuff I would be using IP addresses to identify peers. Ephemeral IP addresses in logs aren't very useful.