4 ms·

Question for the peanut gallery: Suppose I have a legacy ipv4 host which simply cannot do ipv6. Why couldn't I put some black box on my network connection in be

by kortex 4y ago

Question for the peanut gallery: Suppose I have a legacy ipv4 host which simply cannot do ipv6. Why couldn't I put some black box on my network connection in between my host and my uplink, which translates my host's IPv4 into a 4-over-6 IPv6 address? The black box can accept either v6 traffic and translate it for my host, or v4 and pass it straight through. The host only ever sees v4 traffic. V6-only clients can resolve an AAAA record against my host, and V4 clients can still resolve an A record. As long as there is sufficient penetration of these black boxes, virtually everything should be able to talk to everything over v6, and the v4 shim can be removed. I imagine this black box could be a relatively inexpensive ASIC or FPGA that could be a stand-alone widget, baked into hardware network adapters, or just built into routers, middleboxes, etc.

p1mrx 4y ago
You're basically describing Cloudflare. It is easy to make an IPv4 server accept IPv6 connections. It is relatively difficult to make an IPv4 client connect to IPv6 servers, because there aren't enough bits in the 'destination' field.
wmf 4y ago
That's basically NAT64+DNS64.
lmm 4y ago
> I imagine this black box could be a relatively inexpensive ASIC or FPGA that could be a stand-alone widget, baked into hardware network adapters, or just built into routers, middleboxes, etc. It's not that simple: - The box has to translate IPv6 address space into IPv4 address space, but it's too big to fit. So the box has to be some kind of stateful reverse NAT, with all the problems that that involves, and the hardware requirements go way up. - The IPv4-only host might make all sorts of assumptions about IPv4 addresses that are no longer valid. E.g. it might cut off addresses that it detects an attack from - but now as soon as two IPv6 addresess get mapped to the same IPv4 address you're going to block a legitimate user (in fact, since changing IPv6 address is easy, you're probably going to pretty quickly block the whole internet). E.g. it might expect to use an IPv4 geoIP database. E.g. it might be speaking a protocol like FTP where it's supposed to make an outbound connection to the client, so now your middlebox has to not only keep track of TCP streams but also the details of every protocol you want to be able to support.

by kortex 4y ago

p1mrx 4y ago

You're basically describing Cloudflare. It is easy to make an IPv4 server accept IPv6 connections. It is relatively difficult to make an IPv4 client connect to IPv6 servers, because there aren't enough bits in the 'destination' field.

wmf 4y ago

That's basically NAT64+DNS64.

lmm 4y ago

> I imagine this black box could be a relatively inexpensive ASIC or FPGA that could be a stand-alone widget, baked into hardware network adapters, or just built into routers, middleboxes, etc. It's not that simple: - The box has to translate IPv6 address space into IPv4 address space, but it's too big to fit. So the box has to be some kind of stateful reverse NAT, with all the problems that that involves, and the hardware requirements go way up. - The IPv4-only host might make all sorts of assumptions about IPv4 addresses that are no longer valid. E.g. it might cut off addresses that it detects an attack from - but now as soon as two IPv6 addresess get mapped to the same IPv4 address you're going to block a legitimate user (in fact, since changing IPv6 address is easy, you're probably going to pretty quickly block the whole internet). E.g. it might expect to use an IPv4 geoIP database. E.g. it might be speaking a protocol like FTP where it's supposed to make an outbound connection to the client, so now your middlebox has to not only keep track of TCP streams but also the details of every protocol you want to be able to support.