19 ms·

460M Indian Internet Users Are Now on IPv6

264 points by anthropodie 4y ago

russellbeattie 4y ago
I have AT&T Fiber at home and have IPv6 turned off at the router because I don't believe consumer grade firewalls are as good as plain ol' NAT traversal for basic security. IPv6 seems to want everything directly connected to the Internet which I find crazy. Update me - am I crazy? Is this old info or a bad take?
- rie_t 4y ago
  NAT is not a security feature, nor is everything publicly exposed to the internet on IPv6. With most routers you would have to explicitly forward a port in the router to expose that to the client anyways.
- deleted 4y ago
  [deleted]
- zamadatix 4y ago
  The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical, NAT itself is not actually the security layer it just forces having the concept of tracking what is outbound initiated to work. In pure academic sense you can have NAT without disallowing inbound initiated sessions to internal addresses but that's insecure because it's just hiding the routing information not actually blocking inbound sessions. The only thing to worry about with the gateway they give you for AT&T fiber is if you have the crap model that has an extremely limited session table (4k) and if so you should ask for the new one (16k). This applies regardless of IP version preference.
  - russellbeattie 4y ago
    > an extremely limited session table Interesting. You're right - I just found a reddit thread from a few months ago and ATT fiber seems to still have horrible IPv6 support, for that reason and others. I think I'll leave it off. https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att_2git_plan_too_bad_ipv6_is_broken/ https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att...
    - zamadatix 4y ago
      The conntrack table on the BG320 is 8k regardless if it's doing NAT with v4 or plain session tracking with IPv6. You just want to make sure you don't have the older model with the 2k limit as that'll cause problems for even light usage households. The way the IPv6 rollout is broken on ATT is the same as their IPv4 rollout is broken, they don't support bridge mode. Passthrough IP doesn't quite work the same as traditional bridge mode and still hits the conntrack limits. DHCPv6 and PD work fine though, I have it configured right now.
  - autoexec 4y ago
    > The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical Except that not translating your IP address means allowing certain types of tracking that NAT prevented. One unique IP address per device means that with nothing more than a list of IP addresses and timestamps servers can identify the number of devices you used on your network to connect to them, and can track which device was in use at which time. NAT prevents that scenario very well.
    - zamadatix 4y ago
      IPv6 has some features around this, most commonly implemented on devices (even more than just grabbing an assignment and sticking with it) is using temporary address assignments which change over time. Neither NAT or IPv6 randomization really do much for tracking prevention though. Servers get to see a lot more than just source port (~2 bytes of fingerprinting info) and source node (~0-2 bytes depending on the number of devices in the network) e.g. even just a TCP handshake has a larger fingerprinting signature and that's before you've even gotten to the application level protocol you're talking to the server with or the data in the connection itself.
      - autoexec 4y ago
        With enough effort you probably could enumerate the devices on a remote network using NAT, but the amount of effort matters too. NAT is easy for most end user's needs, works with a huge number of devices/gateways and somehow does a decent enough job at keeping the internet from passively learning about each of the devices on your network and tracking them over time that it's foiled the plans of many site operators and nosy organizations looking to do just that. Granted, there are other ways to track devices and as long as an application can be installed on a device and communicate to the outside world it can share whatever data it wants, but the last time I looked into it IPv6 made the situation worse not better, and there were multiple flaws found in its privacy extensions. It's admittedly been a few years and so maybe things have changed and it's time to give it another look.
- throw0101a 4y ago
  > Is this old info or a bad take? Yes. With IPv6 there are still stateful firewalls on routers. An app/service still generally needs to do firewall hole punching via UPnP or PCP. The main thing that goes away is the rigamarole of figuring out the public IP address: * https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ With my Asus RT-AC68U I can ping my IPv6 address: * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php https://www.subnetonline.com/pages/ipv6-network-tools/online... But cannot connect to SSH from the Internet (but localhost works), or port 80 (if I launch 'nc -6 -l 80'): * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-port-scanner.php https://www.subnetonline.com/pages/ipv6-network-tools/online... Firewalls do not stop working with IPv6.
- labcomputer 4y ago
  > Update me - am I crazy? Is this old info or a bad take? 1. NAT does nothing to prevent network egress. NAT is not a firewall--it monitors outgoing connection to remember how to re-write incoming packets. Any IoT shit or malware that wants to call home to a control server is free to do so. 2. Most consumer-NAT implementation have a facility for "inside" hosts to map "outside" ports to "inside" IP address-port combinations (for games). The facility has no authentication, other than (usually) ignoring packets from "outside". So a single infected device on your network can poke arbitrary holes in your "firewall". 3. Most modern IPv6 stacks create new auto-configured addresses and rotate them on a regular basis (the address space is big enough to do that). So "your address" is constantly in flux. Obscurity isn't good security, but at least it makes it harder for the bad guys to know where to send the packets. 4. The IPv6 packet structure is simpler, so, in theory, you might expect fewer vulnerabilities in your IP stack.
deleted 4y ago
[deleted]
Vladimof 4y ago
I block IPv6 on my router, it simplifies the firewall rules a bit... and I don't think that it prevented me from accessing a resource yet
tamrix 4y ago
So that's why I had to disable ipv6 this morning.
known 4y ago
Brajeshwar 4y ago
I believe we should thank Jio[1] for this one. I get IPv6 on my Jio connection, but neither with ActFibernet[2] nor Airtel[3] (another major ISP in India). 1. https://www.jio.com https://www.jio.com 2. https://www.actcorp.in https://www.actcorp.in 3. https://www.airtel.in https://www.airtel.in
- kburman 4y ago
  I’m using act fiber and got ipv6 address
- toast0 4y ago
  Yep, Jio launched their network in 2016ish, and didn't get many IPv4 addresses (probably didn't want to spend the significant amount of money to aquire addresses, maybe couldn't find large enough blocks for sale), as a result they require their branded devices to work with IPv6 and pressure their partners to do IPv6 as well. I have no stats, but I wouldn't be surprised if it was the largest single action driving v6 adoption ever.
- eager_noob 4y ago
  We can expect IPv6 adoption to improve among all wireline providers in coming few years. https://dot.gov.in/sites/default/files/Revision%20in%20IPV6%20Transition%20timelines.pdf https://dot.gov.in/sites/default/files/Revision%20in%20IPV6%...
- anthropodie 4y ago
  I get IPv6 on both Jio and Airtel. Have you updated APN settings in your phone?
  - Brajeshwar 4y ago
    Hmmm! I had to searched up and read up on "APN settings". I had absolutely no idea prior to this. I looked up in my iOS Preferences, could don't find them and honestly I don't want to touch those.
    - 4y ago
dncornholio 4y ago
I disabled ipv6 on my router because I prefer having a static IP.
- bush-bby 4y ago
  Isn’t it a lot cheaper to pay for a static ipv6 address?
  - hypothesis 4y ago
    Why would you pay for a static IPv6 address? It’s harder to memorize and if you’re using dynamic dns, then not much point in a static IP, is there?
    - nybble41 4y ago
      The point of having a static IPv6 address would be that you can use regular DNS, not dynamic DNS. With dynamic DNS you have to use a short TTL, increasing the load on the DNS server, and even then it will break occasionally due to caching when the IP address changes. Ease of memorization is a non-issue since you should be using DNS anyway, whether for IPv4 or IPv6.
    - bush-bby 4y ago
      Well, I would say it depends on the use case? Maybe for accessing a couple services I would be okay w dynamic dns, but if I’m trying to host something where I’d prefer less points of failure and prioritize stability and uptime I probably would rather have a static address. (Please correct me if I’m wrong)
    - 0xbadcafebee 4y ago
      A lot of people/companies still rely on IP filtering
    - WorldMaker 4y ago
      Static IPv6 isn't that much harder to memorize. Admittedly I'm often numerically dyslexic, but I even sometimes have a harder time with memorizing IPv4 addresses than IPv6. Particularly with the big trick that you can elide all the zeroes you want with double colon (::). At that point you just have to remember your subnet prefix and then all of your statically addressed devices you can think of as just {subnet}::N. Your web server can be thought of only as "::1" to you and your database server as "::2" and your combination printer and coffee maker can be "::3" to you, and you just have to remember to include your prefix up front (or copy and paste that part). Even a paltry /64 is just 16 hex numbers to memorize in nice 4 groups of 4 in the worst case that your ISP can't give you a bunch of trailing zeroes in your /64 request. (A /56 which is what most ISPs should give you per convention if you request a static subnet is 14 hex numbers in 3 and a half groups of 4.)
deleted 4y ago
[deleted]
Pidaymou 4y ago
Ipv6 was long ago became the internet standard and India being home to 1.6 billion people it should be based on Ipv6.
- rg111 4y ago
  > home to 1.6 billion people Where did you get that number?
  - busyboy 4y ago
    He counted them.
- BlueTemplar 4y ago
  It took a while to finalize the standard - only happened in 2017, a decade and a half after deployment started !
  - pantalaimon 4y ago
    What happened in 2017? I’m pretty sure I had IPv6 before that.
    - LeonM 4y ago
      Internet standards are not created by a single organization or person (well, not anymore). Everybody can help design the standards. I'm greatly simplifying, but roughly it goes like this: 1. Someone proposes a change. 2. If there is enough interest in the proposed change, an RFC (Request for Comments) is created, in draft stage. 3. Stakeholders can comment, if agreed upon the changes are placed in the RFC. Rinse and repeat. 4. Once enough stakeholders are happy, the RFC is accepted and it becomes an internet standard. An RFC in step 3 may already be mature enough to be used in production, though just not yet finalized (step 4). Before 2017, IPv6 was already being deployed because the RFC was already quite mature. However, with IP being such an important protocol for the internet, it took a long time before the RFC was finalized, though not much was being changed. In 2017, the RFC was finalized and thus it was set in stone (until a new RFC is created) that that is how the protocol must work. [0] https://en.wikipedia.org/wiki/Request_for_Comments https://en.wikipedia.org/wiki/Request_for_Comments
deleted 4y ago
[deleted]
baybal2 4y ago
China is an odd case, all ISPs (really there is no choice it's either China Telecom, or Unicom) use IPV6 internally, but often don't give you V6 address depending on the region.
makkesk8 4y ago
My isp don't offer ipv6 either but I've worked around the issue using tunnelbroker.com from hurricane electric (free) to get a /64, it works really great. Route48 is another such free service.
- nybble41 4y ago
  Hurricane Electric is great. These days my ISP offers IPv6 via 6rd, but since it's a dynamic prefix (tied to the dynamic IPv4 address) I still maintain the HE tunnel for a static IPv6 prefix while routing most traffic over 6rd. The routing tables get a bit complicated since I can't send packets with the HE source address through the ISP's 6rd tunnel or vice-versa, so I have to route based the source and not just the destination, but overall it works fairly well. I'm still hoping my ISP eventually offers native IPv6 with a static prefix but it doesn't seem to be a priority for them. On the other hand they haven't gone to CGNAT yet for IPv4—which would break the HE tunnel—so it's not as bad as it could be.
  - puffoflogic 4y ago
    Depending on what you're actually running at your IP, consider if dynv6.com will work for your dynamic IP. I switched and I've never noticed a difference really. Only one machine on the /64 (or /60 or whatever you have) has to actually ping dynv6 service; it automatically updates the prefix for all other AAAA records. Moreover I've got it set up with a dead simple shell script using curl, no service-specific binaries needed. Indeed, at this point my only problem is my ISP router will not route the WAN ipv4 address to the appropriate host when the source is on the LAN, meaning I have to use ipv6 to access my public facing server while at home.
    - nybble41 4y ago
      I have a custom system in place for IPv4 to update AWS Route53 based on this script[0] which I could easily extend to update my AAAA records at the same time, but I prefer a stable IP address. Dynamic DNS (v4 or v6) has a tendency to break down for a time whenever the IP address changes until the old records have expired from resolvers' caches. [0] https://willwarren.com/2014/07/03/roll-dynamic-dns-service-using-amazon-route53/ https://willwarren.com/2014/07/03/roll-dynamic-dns-service-u...
nomilk 4y ago
What is the practical significance? (please explain like I'm 5) Google says: > The main difference between IPv4 and IPv6 is the address size of IP addresses. What are the practical implications for internet users and infrastructure maintainers?
- dheera 4y ago
  It means that instead of "1.2.3.4" you now have to deal with "f0fd::8a8a:99:::://4::88ff::deca:dead:beef::/16" or something like that, and remember how many colons go where and you now have to remember hex numbers instead of decimal. What's the Google IPv4 DNS? 8.8.8.8. It's beautiful enough to be a decoration to frame and hang above a fireplace. What's the Google IPv6 DNS? Heck if I can remember, it has some 4's, 6's, 8's, 0's, 2's, and some colons and double-colons liberally sprinkled like a salt shaker that had its cap fall off as you were shaking it. I'm basically a walking DNS server of the company I work at, I know all the IPv4 addresses of pretty much every machine, and I couldn't do that with IPv6. I also know all the IPv4 addresses of every single IOT device in my home. It's really no wonder that the world is very slow to transition to IPv6.
- throw0101a 4y ago
  > What are the practical implications for internet users and infrastructure maintainers? You don't have to futz around with NAT and figuring out how to do connect P2P: * https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ You have your home router firewall, you punch a hole in it (UPnP, PCP) on an as-needed basis, do your P2P thing. When you're done, the firewall hole is closed. No magic/fancy protocols trying to figure out what your "real" address is. Instead of having to chat or talk your some provider's central server, the software on your device can talk directly to the software on the other person's.
- labcomputer 4y ago
  > What are the practical implications for internet users and infrastructure maintainers? If you want to talk to Indian web users, you'll probably want to upgrade your servers from Irix version 5.3 to at least 6.2 (but preferably 6.5.22, as it has some security fixes). Now, you might be saying to yourself "Self, Silicon Graphics went bankrupt in 2006. Where the hell am I going to find install media for Irix 6.5 in the middle of 2022?" The answer to that, my friend, is eBay. Or maybe you're thinking, "But labcomputer, I don't trust these modern computers with their instruction re-ordering mumbo-jumbo! I want them to interpret the binary as ~~god~~ the compiler intended! And besides, my VAX doubles as a space heater. What am I going to do?" Well, good news! You're still in luck because you can upgrade your VAX to OpenVMS 5.7 and take advantage of all 128 bits of IPv6 goodness as you gently fall asleep to the roar of your VAXCluster's fans. Windows users don't need to feel left out, either. Ole Billy-boy's got you covered. You can upgrade to Windows XP (on that powerful new Pentium II you just picked up) to access glorious <blink> tags on IPv6-hosted websites in 256 colors!
kuroguro 4y ago
The king is dead, long live the king! I used to be hyped about IPv6 but now that it's actually (slowly) getting adopted I'm going to miss the clunky old ways. No more sitting behind three badly configured NATs. No more scanning the entire internet in 5 minutes T__T
- marcosdumay 4y ago
  Don't despair. Your ISP will replace those with 3 badly configured firewalls.
  - greenicon 4y ago
    Even then, hole punching should get significantly easier, as you know the IPs and ports of both parties. Multi-layer NAT with port guessing is usually a nightmare when establishing a direct connection.
- zamadatix 4y ago
  I still get giddy whenever I use another PD assignment at home. You used to have to be BGP peered to have that ability!
- deleted 4y ago
  [deleted]
colinmhayes 4y ago
Does anyone know why they skipped IPv5?
- judge2020 4y ago
  > The Internet Stream Protocol (ST) is a family of experimental protocols first defined in Internet Experiment Note IEN-119 in 1979, and later substantially revised in RFC 1190 (ST-II) and RFC 1819 (ST2+). The protocol uses the version number 5 in the version field of the Internet Protocol header, but was never known as IPv5. The successor to IPv4 was thus named IPv6 to eliminate any possible confusion about the actual protocol in use. https://en.wikipedia.org/wiki/Internet_Stream_Protocol https://en.wikipedia.org/wiki/Internet_Stream_Protocol
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- WorldMaker 4y ago
  IPv5 was an experiment (by Apple, NeXT, and Sun) never intended for wide deployment. Known as "Internet Stream Protocol" or "ST" it was focused on a video/voice streaming network.
- deleted 4y ago
  [deleted]
BlueTemplar 4y ago
It would be interesting to know how many Internet users do not have IPv4 these days...
- zamadatix 4y ago
  Wired very few and unlikely to change quickly, mobile a good number and often changing without people knowing it happened. Mobile has a lot of NAT464 where the middle layer is the carrier and all v4 gets translated over v6 which is all that's assigned to the user and then out a gateway service. In wired you'd need to insure everyone had a device which understand to do that (CLAT in 464XLAT jargon) so carriers have been doing NAT444 where there are 2 layers of v4 NAT (home users then carriers) before the carrier's core does the final translation to a real v4. NAT444 is clunky and doesn't even help make sure users get to v6 but it's attractive to carriers because it works without having to have anything change from the customers perspective (beyond their external NAT IP being a 100.64.0.0/10 address instead of a public IP). Because of this the tail end of those who truly do not have any v4 on wired is going to be quite high.
  - BlueTemplar 4y ago
    I'm mostly thinking of all those landline ISPs in Asia that I hear never got any IPv4 IPs to start with..?
    - zamadatix 4y ago
      They got IPs but they missed out on the "Hi, I'd like 16.7 million IPs please" era and mostly on the "Hi, I'd like yet another 65k please" era as well. With NAT444 carriers can use a 1 public IP to serve all of the connections for somewhere between 100-1000 customers depending on the usage pattern of those customers. Right now an IPv4 address sells for about $40 so even on the low scale if they had 0 IP addresses that's a one time cost of less than 50 cents per customer. Without NAT444 it would have been 100-1000 times more expensive for newer ISPs to use IPv4 and you would have seen a lot more by now.
- bombcar 4y ago
webmobdev 4y ago
I guess I am that one indian still stuck on IPv4 ... why mess with something that works fine (aka feel lazy to study up on IPv6).
- junon 4y ago
  We're out of ipv4 WAN address space.
aj7 4y ago
Am I on ipv6? https://test-ipv6.com/ https://test-ipv6.com/
- mindcrime 4y ago
  10/10 here in Chapel Hill, on Spectrum.
- Guereric 4y ago
  Score of 0 in western Canada under Telus.
- tintedfireglass 4y ago
  In India WiFi network 0/10 Mobile data 10/10 Wierd isn't it?
- tngranados 4y ago
  10/10 on both Wi-Fi and Mobile connection in Spain
- js2 4y ago
  10/10 both with and without iCloud Private Relay enabled. I'd forgotten I was even using private relay. ISP is AT&T.
PhantomBKB 4y ago
Looks like BSNL is still on ipv4
gz5 4y ago
the benefits to management, automation and ubiquitous connectivity are well covered. with that, we get a different security paradigm. let's say i have basic needs - some IPv6 IoT devices on my home network, with a req for SSH and RDP into that network network to various servers. what are the secure-by-design type of recommendations for this new paradigm in which my devices are now default-reachable from the outside world?
- jaywalk 4y ago
  If your devices are behind a router, they are almost certainly not default-reachable.
  - gz5 4y ago
    I should have provided more detail. I am thinking about basic home users - who often rely on their default modem/router setup from their provider - let's say inbound 443 is open, at the very least (statically or can be opened dynamically) so that an attacker can scan my network and find my IPv6 devices. What would I recommend that person do instead (that is doable by the average person)?
    - zamadatix 4y ago
      For static inbound 443 should be dropped by the basic home user's default carrier modem setup, only outbound initiated should be allowed. I'm sure there are some bad home implementations that don't do this by default, as there are on IPv4, but as you say for most users it comes down to if the provider's default config is bad or not. For more advanced users they can check and correct the default config if it is bad. For dynamic it's not really any different than dynamically opening ports on IPv4, it's convenient for things like peer to peer communications and inconvenient for security but a lot more the former than the latter so most actually want it. For the static case then you get what you ask for, if it's static then you specifically put effort into making it reachable so if you don't want it to statically be reachable to everything then just don't statically make it reachable to everything.
    - viraptor 4y ago
deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
kringo 4y ago
That's because most of the people got online via mobile phone. It only grew significantly faster due to Covid and Indian market flooded with cheap smartphones made locally as well as from China.
- MisterSandman 4y ago
  "Made locally as well as from China" is a pretty misleading statement. The vast, vast majority of phones were made in China.
  - deleted 4y ago
    [deleted]
  - retrac 4y ago
    About half the mobile phones sold in India in the last decade or so were either assembled, or even substantially manufactured (i.e., including the semiconductors) in India. It's becoming one of their larger industries. More than a billion units in 2021, most very cheap models you won't encounter in the West. Certainly enough to satisfy the domestic market, and then some.
    - tintedfireglass 4y ago
      I don't think Qualcomm, Samsung and mediatek have foundries in India for manufacturing SOCs. It's mostly done in Taiwan and SK
    - sylware 4y ago
      Include the semiconductors? Hope they soon flood the world with their RISC-V performant mobile chips... ok I wish that, because I know this is one of the only ways to rid the world for some ISA toxic IPs...

264 points by anthropodie 4y ago

I have AT&T Fiber at home and have IPv6 turned off at the router because I don't believe consumer grade firewalls are as good as plain ol' NAT traversal for basic security. IPv6 seems to want everything directly connected to the Internet which I find crazy. Update me - am I crazy? Is this old info or a bad take?

rie_t 4y ago
NAT is not a security feature, nor is everything publicly exposed to the internet on IPv6. With most routers you would have to explicitly forward a port in the router to expose that to the client anyways.
deleted 4y ago
[deleted]
zamadatix 4y ago
The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical, NAT itself is not actually the security layer it just forces having the concept of tracking what is outbound initiated to work. In pure academic sense you can have NAT without disallowing inbound initiated sessions to internal addresses but that's insecure because it's just hiding the routing information not actually blocking inbound sessions. The only thing to worry about with the gateway they give you for AT&T fiber is if you have the crap model that has an extremely limited session table (4k) and if so you should ask for the new one (16k). This applies regardless of IP version preference.
- russellbeattie 4y ago
  > an extremely limited session table Interesting. You're right - I just found a reddit thread from a few months ago and ATT fiber seems to still have horrible IPv6 support, for that reason and others. I think I'll leave it off. https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att_2git_plan_too_bad_ipv6_is_broken/ https://www.reddit.com/r/ATT/comments/stuzjy/switched_to_att...
  - zamadatix 4y ago
    The conntrack table on the BG320 is 8k regardless if it's doing NAT with v4 or plain session tracking with IPv6. You just want to make sure you don't have the older model with the 2k limit as that'll cause problems for even light usage households. The way the IPv6 rollout is broken on ATT is the same as their IPv4 rollout is broken, they don't support bridge mode. Passthrough IP doesn't quite work the same as traditional bridge mode and still hits the conntrack limits. DHCPv6 and PD work fine though, I have it configured right now.
- autoexec 4y ago
  > The only difference between NAT traversal and zone based state firewalling is whether you translate the address before you put it in the state table. The security functionality is roughly identical Except that not translating your IP address means allowing certain types of tracking that NAT prevented. One unique IP address per device means that with nothing more than a list of IP addresses and timestamps servers can identify the number of devices you used on your network to connect to them, and can track which device was in use at which time. NAT prevents that scenario very well.
  - zamadatix 4y ago
    IPv6 has some features around this, most commonly implemented on devices (even more than just grabbing an assignment and sticking with it) is using temporary address assignments which change over time. Neither NAT or IPv6 randomization really do much for tracking prevention though. Servers get to see a lot more than just source port (~2 bytes of fingerprinting info) and source node (~0-2 bytes depending on the number of devices in the network) e.g. even just a TCP handshake has a larger fingerprinting signature and that's before you've even gotten to the application level protocol you're talking to the server with or the data in the connection itself.
    - autoexec 4y ago
      With enough effort you probably could enumerate the devices on a remote network using NAT, but the amount of effort matters too. NAT is easy for most end user's needs, works with a huge number of devices/gateways and somehow does a decent enough job at keeping the internet from passively learning about each of the devices on your network and tracking them over time that it's foiled the plans of many site operators and nosy organizations looking to do just that. Granted, there are other ways to track devices and as long as an application can be installed on a device and communicate to the outside world it can share whatever data it wants, but the last time I looked into it IPv6 made the situation worse not better, and there were multiple flaws found in its privacy extensions. It's admittedly been a few years and so maybe things have changed and it's time to give it another look.
throw0101a 4y ago
> Is this old info or a bad take? Yes. With IPv6 there are still stateful firewalls on routers. An app/service still generally needs to do firewall hole punching via UPnP or PCP. The main thing that goes away is the rigamarole of figuring out the public IP address: * https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ With my Asus RT-AC68U I can ping my IPv6 address: * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-ping.php https://www.subnetonline.com/pages/ipv6-network-tools/online... But cannot connect to SSH from the Internet (but localhost works), or port 80 (if I launch 'nc -6 -l 80'): * https://www.subnetonline.com/pages/ipv6-network-tools/online-ipv6-port-scanner.php https://www.subnetonline.com/pages/ipv6-network-tools/online... Firewalls do not stop working with IPv6.
labcomputer 4y ago
> Update me - am I crazy? Is this old info or a bad take? 1. NAT does nothing to prevent network egress. NAT is not a firewall--it monitors outgoing connection to remember how to re-write incoming packets. Any IoT shit or malware that wants to call home to a control server is free to do so. 2. Most consumer-NAT implementation have a facility for "inside" hosts to map "outside" ports to "inside" IP address-port combinations (for games). The facility has no authentication, other than (usually) ignoring packets from "outside". So a single infected device on your network can poke arbitrary holes in your "firewall". 3. Most modern IPv6 stacks create new auto-configured addresses and rotate them on a regular basis (the address space is big enough to do that). So "your address" is constantly in flux. Obscurity isn't good security, but at least it makes it harder for the bad guys to know where to send the packets. 4. The IPv6 packet structure is simpler, so, in theory, you might expect fewer vulnerabilities in your IP stack.

deleted 4y ago

[deleted]

Vladimof 4y ago

I block IPv6 on my router, it simplifies the firewall rules a bit... and I don't think that it prevented me from accessing a resource yet

tamrix 4y ago

So that's why I had to disable ipv6 this morning.

known 4y ago

Brajeshwar 4y ago

I believe we should thank Jio[1] for this one. I get IPv6 on my Jio connection, but neither with ActFibernet[2] nor Airtel[3] (another major ISP in India). 1. https://www.jio.com https://www.jio.com 2. https://www.actcorp.in https://www.actcorp.in 3. https://www.airtel.in https://www.airtel.in

kburman 4y ago
I’m using act fiber and got ipv6 address
toast0 4y ago
Yep, Jio launched their network in 2016ish, and didn't get many IPv4 addresses (probably didn't want to spend the significant amount of money to aquire addresses, maybe couldn't find large enough blocks for sale), as a result they require their branded devices to work with IPv6 and pressure their partners to do IPv6 as well. I have no stats, but I wouldn't be surprised if it was the largest single action driving v6 adoption ever.
eager_noob 4y ago
We can expect IPv6 adoption to improve among all wireline providers in coming few years. https://dot.gov.in/sites/default/files/Revision%20in%20IPV6%20Transition%20timelines.pdf https://dot.gov.in/sites/default/files/Revision%20in%20IPV6%...
anthropodie 4y ago
I get IPv6 on both Jio and Airtel. Have you updated APN settings in your phone?
- Brajeshwar 4y ago
  Hmmm! I had to searched up and read up on "APN settings". I had absolutely no idea prior to this. I looked up in my iOS Preferences, could don't find them and honestly I don't want to touch those.
  - 4y ago

dncornholio 4y ago

I disabled ipv6 on my router because I prefer having a static IP.

bush-bby 4y ago
Isn’t it a lot cheaper to pay for a static ipv6 address?
- hypothesis 4y ago
  Why would you pay for a static IPv6 address? It’s harder to memorize and if you’re using dynamic dns, then not much point in a static IP, is there?
  - nybble41 4y ago
    The point of having a static IPv6 address would be that you can use regular DNS, not dynamic DNS. With dynamic DNS you have to use a short TTL, increasing the load on the DNS server, and even then it will break occasionally due to caching when the IP address changes. Ease of memorization is a non-issue since you should be using DNS anyway, whether for IPv4 or IPv6.
  - bush-bby 4y ago
    Well, I would say it depends on the use case? Maybe for accessing a couple services I would be okay w dynamic dns, but if I’m trying to host something where I’d prefer less points of failure and prioritize stability and uptime I probably would rather have a static address. (Please correct me if I’m wrong)
  - 0xbadcafebee 4y ago
    A lot of people/companies still rely on IP filtering
  - WorldMaker 4y ago
    Static IPv6 isn't that much harder to memorize. Admittedly I'm often numerically dyslexic, but I even sometimes have a harder time with memorizing IPv4 addresses than IPv6. Particularly with the big trick that you can elide all the zeroes you want with double colon (::). At that point you just have to remember your subnet prefix and then all of your statically addressed devices you can think of as just {subnet}::N. Your web server can be thought of only as "::1" to you and your database server as "::2" and your combination printer and coffee maker can be "::3" to you, and you just have to remember to include your prefix up front (or copy and paste that part). Even a paltry /64 is just 16 hex numbers to memorize in nice 4 groups of 4 in the worst case that your ISP can't give you a bunch of trailing zeroes in your /64 request. (A /56 which is what most ISPs should give you per convention if you request a static subnet is 14 hex numbers in 3 and a half groups of 4.)

deleted 4y ago

[deleted]

Pidaymou 4y ago

Ipv6 was long ago became the internet standard and India being home to 1.6 billion people it should be based on Ipv6.

rg111 4y ago
> home to 1.6 billion people Where did you get that number?
- busyboy 4y ago
  He counted them.
BlueTemplar 4y ago
It took a while to finalize the standard - only happened in 2017, a decade and a half after deployment started !
- pantalaimon 4y ago
  What happened in 2017? I’m pretty sure I had IPv6 before that.
  - LeonM 4y ago
    Internet standards are not created by a single organization or person (well, not anymore). Everybody can help design the standards. I'm greatly simplifying, but roughly it goes like this: 1. Someone proposes a change. 2. If there is enough interest in the proposed change, an RFC (Request for Comments) is created, in draft stage. 3. Stakeholders can comment, if agreed upon the changes are placed in the RFC. Rinse and repeat. 4. Once enough stakeholders are happy, the RFC is accepted and it becomes an internet standard. An RFC in step 3 may already be mature enough to be used in production, though just not yet finalized (step 4). Before 2017, IPv6 was already being deployed because the RFC was already quite mature. However, with IP being such an important protocol for the internet, it took a long time before the RFC was finalized, though not much was being changed. In 2017, the RFC was finalized and thus it was set in stone (until a new RFC is created) that that is how the protocol must work. [0] https://en.wikipedia.org/wiki/Request_for_Comments https://en.wikipedia.org/wiki/Request_for_Comments

deleted 4y ago

[deleted]

baybal2 4y ago

China is an odd case, all ISPs (really there is no choice it's either China Telecom, or Unicom) use IPV6 internally, but often don't give you V6 address depending on the region.

makkesk8 4y ago

My isp don't offer ipv6 either but I've worked around the issue using tunnelbroker.com from hurricane electric (free) to get a /64, it works really great. Route48 is another such free service.

nybble41 4y ago
Hurricane Electric is great. These days my ISP offers IPv6 via 6rd, but since it's a dynamic prefix (tied to the dynamic IPv4 address) I still maintain the HE tunnel for a static IPv6 prefix while routing most traffic over 6rd. The routing tables get a bit complicated since I can't send packets with the HE source address through the ISP's 6rd tunnel or vice-versa, so I have to route based the source and not just the destination, but overall it works fairly well. I'm still hoping my ISP eventually offers native IPv6 with a static prefix but it doesn't seem to be a priority for them. On the other hand they haven't gone to CGNAT yet for IPv4—which would break the HE tunnel—so it's not as bad as it could be.
- puffoflogic 4y ago
  Depending on what you're actually running at your IP, consider if dynv6.com will work for your dynamic IP. I switched and I've never noticed a difference really. Only one machine on the /64 (or /60 or whatever you have) has to actually ping dynv6 service; it automatically updates the prefix for all other AAAA records. Moreover I've got it set up with a dead simple shell script using curl, no service-specific binaries needed. Indeed, at this point my only problem is my ISP router will not route the WAN ipv4 address to the appropriate host when the source is on the LAN, meaning I have to use ipv6 to access my public facing server while at home.
  - nybble41 4y ago
    I have a custom system in place for IPv4 to update AWS Route53 based on this script[0] which I could easily extend to update my AAAA records at the same time, but I prefer a stable IP address. Dynamic DNS (v4 or v6) has a tendency to break down for a time whenever the IP address changes until the old records have expired from resolvers' caches. [0] https://willwarren.com/2014/07/03/roll-dynamic-dns-service-using-amazon-route53/ https://willwarren.com/2014/07/03/roll-dynamic-dns-service-u...

nomilk 4y ago

What is the practical significance? (please explain like I'm 5) Google says: > The main difference between IPv4 and IPv6 is the address size of IP addresses. What are the practical implications for internet users and infrastructure maintainers?

dheera 4y ago
It means that instead of "1.2.3.4" you now have to deal with "f0fd::8a8a:99:::://4::88ff::deca:dead:beef::/16" or something like that, and remember how many colons go where and you now have to remember hex numbers instead of decimal. What's the Google IPv4 DNS? 8.8.8.8. It's beautiful enough to be a decoration to frame and hang above a fireplace. What's the Google IPv6 DNS? Heck if I can remember, it has some 4's, 6's, 8's, 0's, 2's, and some colons and double-colons liberally sprinkled like a salt shaker that had its cap fall off as you were shaking it. I'm basically a walking DNS server of the company I work at, I know all the IPv4 addresses of pretty much every machine, and I couldn't do that with IPv6. I also know all the IPv4 addresses of every single IOT device in my home. It's really no wonder that the world is very slow to transition to IPv6.
throw0101a 4y ago
> What are the practical implications for internet users and infrastructure maintainers? You don't have to futz around with NAT and figuring out how to do connect P2P: * https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ You have your home router firewall, you punch a hole in it (UPnP, PCP) on an as-needed basis, do your P2P thing. When you're done, the firewall hole is closed. No magic/fancy protocols trying to figure out what your "real" address is. Instead of having to chat or talk your some provider's central server, the software on your device can talk directly to the software on the other person's.
labcomputer 4y ago
> What are the practical implications for internet users and infrastructure maintainers? If you want to talk to Indian web users, you'll probably want to upgrade your servers from Irix version 5.3 to at least 6.2 (but preferably 6.5.22, as it has some security fixes). Now, you might be saying to yourself "Self, Silicon Graphics went bankrupt in 2006. Where the hell am I going to find install media for Irix 6.5 in the middle of 2022?" The answer to that, my friend, is eBay. Or maybe you're thinking, "But labcomputer, I don't trust these modern computers with their instruction re-ordering mumbo-jumbo! I want them to interpret the binary as ~~god~~ the compiler intended! And besides, my VAX doubles as a space heater. What am I going to do?" Well, good news! You're still in luck because you can upgrade your VAX to OpenVMS 5.7 and take advantage of all 128 bits of IPv6 goodness as you gently fall asleep to the roar of your VAXCluster's fans. Windows users don't need to feel left out, either. Ole Billy-boy's got you covered. You can upgrade to Windows XP (on that powerful new Pentium II you just picked up) to access glorious <blink> tags on IPv6-hosted websites in 256 colors!

kuroguro 4y ago

The king is dead, long live the king! I used to be hyped about IPv6 but now that it's actually (slowly) getting adopted I'm going to miss the clunky old ways. No more sitting behind three badly configured NATs. No more scanning the entire internet in 5 minutes T__T

marcosdumay 4y ago
Don't despair. Your ISP will replace those with 3 badly configured firewalls.
- greenicon 4y ago
  Even then, hole punching should get significantly easier, as you know the IPs and ports of both parties. Multi-layer NAT with port guessing is usually a nightmare when establishing a direct connection.
zamadatix 4y ago
I still get giddy whenever I use another PD assignment at home. You used to have to be BGP peered to have that ability!
deleted 4y ago
[deleted]

colinmhayes 4y ago

Does anyone know why they skipped IPv5?

judge2020 4y ago
> The Internet Stream Protocol (ST) is a family of experimental protocols first defined in Internet Experiment Note IEN-119 in 1979, and later substantially revised in RFC 1190 (ST-II) and RFC 1819 (ST2+). The protocol uses the version number 5 in the version field of the Internet Protocol header, but was never known as IPv5. The successor to IPv4 was thus named IPv6 to eliminate any possible confusion about the actual protocol in use. https://en.wikipedia.org/wiki/Internet_Stream_Protocol https://en.wikipedia.org/wiki/Internet_Stream_Protocol
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
WorldMaker 4y ago
IPv5 was an experiment (by Apple, NeXT, and Sun) never intended for wide deployment. Known as "Internet Stream Protocol" or "ST" it was focused on a video/voice streaming network.
deleted 4y ago
[deleted]

BlueTemplar 4y ago

It would be interesting to know how many Internet users do not have IPv4 these days...

zamadatix 4y ago
Wired very few and unlikely to change quickly, mobile a good number and often changing without people knowing it happened. Mobile has a lot of NAT464 where the middle layer is the carrier and all v4 gets translated over v6 which is all that's assigned to the user and then out a gateway service. In wired you'd need to insure everyone had a device which understand to do that (CLAT in 464XLAT jargon) so carriers have been doing NAT444 where there are 2 layers of v4 NAT (home users then carriers) before the carrier's core does the final translation to a real v4. NAT444 is clunky and doesn't even help make sure users get to v6 but it's attractive to carriers because it works without having to have anything change from the customers perspective (beyond their external NAT IP being a 100.64.0.0/10 address instead of a public IP). Because of this the tail end of those who truly do not have any v4 on wired is going to be quite high.
- BlueTemplar 4y ago
  I'm mostly thinking of all those landline ISPs in Asia that I hear never got any IPv4 IPs to start with..?
  - zamadatix 4y ago
    They got IPs but they missed out on the "Hi, I'd like 16.7 million IPs please" era and mostly on the "Hi, I'd like yet another 65k please" era as well. With NAT444 carriers can use a 1 public IP to serve all of the connections for somewhere between 100-1000 customers depending on the usage pattern of those customers. Right now an IPv4 address sells for about $40 so even on the low scale if they had 0 IP addresses that's a one time cost of less than 50 cents per customer. Without NAT444 it would have been 100-1000 times more expensive for newer ISPs to use IPv4 and you would have seen a lot more by now.
bombcar 4y ago

webmobdev 4y ago

I guess I am that one indian still stuck on IPv4 ... why mess with something that works fine (aka feel lazy to study up on IPv6).

junon 4y ago
We're out of ipv4 WAN address space.

aj7 4y ago

Am I on ipv6? https://test-ipv6.com/ https://test-ipv6.com/

mindcrime 4y ago
10/10 here in Chapel Hill, on Spectrum.
Guereric 4y ago
Score of 0 in western Canada under Telus.
tintedfireglass 4y ago
In India WiFi network 0/10 Mobile data 10/10 Wierd isn't it?
tngranados 4y ago
10/10 on both Wi-Fi and Mobile connection in Spain
js2 4y ago
10/10 both with and without iCloud Private Relay enabled. I'd forgotten I was even using private relay. ISP is AT&T.

PhantomBKB 4y ago

Looks like BSNL is still on ipv4

gz5 4y ago

the benefits to management, automation and ubiquitous connectivity are well covered. with that, we get a different security paradigm. let's say i have basic needs - some IPv6 IoT devices on my home network, with a req for SSH and RDP into that network network to various servers. what are the secure-by-design type of recommendations for this new paradigm in which my devices are now default-reachable from the outside world?

jaywalk 4y ago
If your devices are behind a router, they are almost certainly not default-reachable.
- gz5 4y ago
  I should have provided more detail. I am thinking about basic home users - who often rely on their default modem/router setup from their provider - let's say inbound 443 is open, at the very least (statically or can be opened dynamically) so that an attacker can scan my network and find my IPv6 devices. What would I recommend that person do instead (that is doable by the average person)?
  - zamadatix 4y ago
    For static inbound 443 should be dropped by the basic home user's default carrier modem setup, only outbound initiated should be allowed. I'm sure there are some bad home implementations that don't do this by default, as there are on IPv4, but as you say for most users it comes down to if the provider's default config is bad or not. For more advanced users they can check and correct the default config if it is bad. For dynamic it's not really any different than dynamically opening ports on IPv4, it's convenient for things like peer to peer communications and inconvenient for security but a lot more the former than the latter so most actually want it. For the static case then you get what you ask for, if it's static then you specifically put effort into making it reachable so if you don't want it to statically be reachable to everything then just don't statically make it reachable to everything.
  - viraptor 4y ago

deleted 4y ago

[deleted]

deleted 4y ago
[deleted]

kringo 4y ago

That's because most of the people got online via mobile phone. It only grew significantly faster due to Covid and Indian market flooded with cheap smartphones made locally as well as from China.

MisterSandman 4y ago
"Made locally as well as from China" is a pretty misleading statement. The vast, vast majority of phones were made in China.
- deleted 4y ago
  [deleted]
- retrac 4y ago
  About half the mobile phones sold in India in the last decade or so were either assembled, or even substantially manufactured (i.e., including the semiconductors) in India. It's becoming one of their larger industries. More than a billion units in 2021, most very cheap models you won't encounter in the West. Certainly enough to satisfy the domestic market, and then some.
  - tintedfireglass 4y ago
    I don't think Qualcomm, Samsung and mediatek have foundries in India for manufacturing SOCs. It's mostly done in Taiwan and SK
  - sylware 4y ago
    Include the semiconductors? Hope they soon flood the world with their RISC-V performant mobile chips... ok I wish that, because I know this is one of the only ways to rid the world for some ISA toxic IPs...