86 ms·

Tell HN: IPv6-only still pretty much unusable

• allanrbo 4y ago
  I believe a lot of mobile traffic to services like facebook/netflix/youtube use IPv6. That's a large percentage of internet traffic. And that allows telcos to NAT more customers onto fewer ipv4 addresses.
• noipv6 4y ago
• xlmnxp 4y ago
  Hetzner should provide free CGNAT IPv4 Addresses (IPv4 Gateway) for IPv6-Only VMs
  • onli 4y ago
    Just to specify the kind of "should": But they don't, do they? Same with vultr, their ipv6 boxes have no outgoing IPv4 connection route.
  • manfre 4y ago
    Communal ipv4 is very problematic for certain services due to bad neighbors causing it to be blacklisted.
    • detaro 4y ago
      Not for hosting services, but for things like accessing Github.
      • vladvasiliu 4y ago
        That's GP's point. Service providers will block the IPs of abusive clients. If those clients are your cg-nat neighbours, you're blocked with them.
      • jeroenhd 4y ago
        Try accessing the web through TOR and you see why public, shared IP addresses are quite a hassle in practice. Exit nodes don't host anything either, after all. Actually, that's not even that bad a way to get IPv4 on any IPv6-only host: route it all through TOR!
    • noipv6 4y ago
      this sounds like a valid argument for deploying ipv6 wherever you can, tbqh cgnat is only going to get MORE common, globally
  • NelsonMinar 4y ago
    A whole lot of ISPs are doing CGNAT for IPv4 now, mostly in Asia. Starlink does it. It's mostly OK but has a lot of drawbacks, particularly IP-based geolocation. (Starlink does not support IPv6 although they seem to be rolling it out this month.)
    • heywire 4y ago
      My ISP (Metronet, Ohio, US) uses CGNAT. I’ve had their service for about 15 months now, and it has been pretty much uneventful. Maybe a handful of times I’ve gotten a captcha on something, but for the most part, it’s just fine. I also don’t see thousands of blocked connection attempts a day either, so there is a plus side. I just use Tailscale should I need to access anything at home while I’m away.
    • mort96 4y ago
      Being behind CGNAT has downsides yes, for example being unable to ever host anything; you become relegated to a consumer who's dependent on the big hosting companies to ever have an Internet presence. But geolocation? I don't want everyone to be able to get my location! Breaking IP-based geolocation is a benefit of CGNAT, not a drawback.
      • NelsonMinar 4y ago
        It's a huge PITA though. I'm near Sacramento but my IP looks like it's in Los Angeles. It screws up a surprising number of things, particularly local TV streaming services. IP geolocation is a bad idea for lots of reasons. Unfortunately it's also a reality of how services work.
    • noipv6 4y ago
      47.57% of observed requests coming out of as14593 is ipv6, as of two days ago: https://twitter.com/noIPv6/status/1600527249282895879 https://twitter.com/noIPv6/status/1600527249282895879 & to be clear, that is CRAZY growth! edit: that's traffic to monitoring resources, not in general, sorry /facepalm
    • deleted 4y ago
      [deleted]
• api 4y ago
  The biggest problem remains cloud and CDN companies with poor to nonexistent IPv6 support. Most ISPs, especially on mobile, have it now or are adding it very soon. I've wondered whether some might be dragging their feet because they see an advantage in IP address scarcity to sell cloud gateways, CDNs, and other middle box type services. But the most likely explanation remains that not enough customers are asking for it so it's not the highest priority. I happen to know that Google Cloud started moving on IPv6 seriously only when they lost some big telecom customers to AWS because they didn't have it.
  • dboreham 4y ago
    > Most ISPs, especially on mobile, have it now or are adding it very soon. Except Charter/Spectrum in the US.
    • JshWright 4y ago
      Maybe it's because we're in the former Time Warner Cable/Road Runner part of Spectrum's territory, but we've had IPv6 for years now.
      • cloudwalk9 4y ago
        I'm in original Charter territory and have v6
      • AnIdiotOnTheNet 4y ago
        Sure, as long as you're ok with having a constantly changing prefix. At least that's how it is for home connections and it nullifies nearly all the benefits of v6.
        • Dagger2 4y ago
          You don't need a fixed prefix to get most of the benefits of v6. DNS is a thing.
          • 4y ago
• candiddevmike 4y ago
  I think IPv6 internal-only is viable with some kind of NAT64 setup, maybe not at scale though. What is everyone using for NAT64?
  • noipv6 4y ago
    afaik jool is the currently-recommended foss nat64 (since tayga is apparently unmaintained) alot of commercial vendors have mature nat64 implementations tho
    • rnhmjoj 4y ago
      Jool also has the best documentation I've ever seen. It does not only explain how to configure the software but it also has illustrated explanations that do a far better job than the actual RFCs in describing the motivation and use cases of the many protocols it supports.
  • noipv6 4y ago
    & for "at scale" - how about 100,000,000 users? https://twitter.com/iPv4depletion/status/1584376525427978240 https://twitter.com/iPv4depletion/status/1584376525427978240
  • gurrone 4y ago
    Would use OpenBSD + unbound to get NAT64 + DNS64. I'd prefer a dual-stack setup with RFC1918 IPv4 internally + a NAT44 gateway and IPv6 "just" on top. Drawback: if you find yourself to have to do a lot of firewalling it essentially doubles your work.
• dboreham 4y ago
  > The GitHub API and its code load endpoints are not reachable via IPv6 This is quite strange given the period around 2010 where there were government edicts that IPv6 must be supported. Perhaps GitHub wasn't mission critical back then.
  • bombcar 4y ago
    There are a number of companies (not naming names) that do NOT support IPv6 for commoners but if you are on a government account/contract you have different government endpoints that ... work over IPv6. Infuriating, but perhaps understandable; they're willing to support the government over IPv6 because it's required and they pay more. But I wish there was a "I know what I'm doing and understand you'll make fun of me if I ask for support on this" option.
    • bryanlarsen 4y ago
      There's probably a ddos service in front of the public facing commercial service that isn't there on the government service.
  • rwmj 4y ago
    This seems to be the github ticket / request for IPv6: https://github.com/community/community/discussions/10539 https://github.com/community/community/discussions/10539 Apparently github are working on it as of Oct 2022 ... https://twitter.com/AS36459/status/1582728252199964672 https://twitter.com/AS36459/status/1582728252199964672
• RijilV 4y ago
  It's been a quarter of a century since IPv6 launch. There's some really good lessons learned here. IPv6 requires everyone, everywhere, needs to change their configuration to add IPv6 addresses and network connectivity to every node/endpoint. The madness of course is that all the underlying infrastructure software (routers, OS, standard libraries) all support IPv6. It would seem, at a large enough scale, that software is the easy part, configuration is the hard part. DJB wrote this up two decades ago[0] and it remains relevant. In particular the comparison between IPv6 and MX records. It took me a little while to wrap my brain around just extending existing software to support sometimes 32bit and sometimes 128. Ultimately it wasn't hard to dream up a few solutions for how that would work. The other thing, FWIW, which has been slowing IPv6 adoption is business owners not asking for it as a high priority item from their providers. I've seen this happen way more often that I would like where provider asks a customer what they want and the customer never mentions IPv6, and when prompted shrugs it off because they don't see it as a business critical (and in fairness, it hasn't been). Yes provider isn't asking the 'nerds' at their customer's businesses, but those folks also aren't the ones paying the bills so... 0: https://cr.yp.to/djbdns/ipv6mess.html https://cr.yp.to/djbdns/ipv6mess.html
  • noipv6 4y ago
    anyone who thinks "ipv6mess" is still relevant in 2022, doesn't understand the problem space it describes. part 1, interoperability failure/incompatibility: nat64+dns64 has been viable since 2008 part 2, incoherence: dual-stack was the transition plan, & was clearly communicated from the start (to anyone who listened). that turned out to not be so effective since so many ppl ignored the realities of legacy ip depletion. at this juncture ipv6-only (w/ nat64) is becoming a more preferable approach, since you only need to maintain a single protocol in the majority of your environment (as evidenced by org's like tmobile us, facebook, etc). part 3, distractions: one could argue that rants like "ipv6mess" are the biggest distractions to ipv6 deployment. "no one is asking for ipv6" is a lie writ large in the provider space; i've seen plenty of examples where a provider has told multiple customers "you're the first person to ask for ipv6 support!" - the problem being is that most org's don't actually keep track of such requests in a unified place, & so every customer is pushing for it alone, so far as the provider is concerned.
• buildbuildbuild 4y ago
  This problem led us to self-hosting Gitlab four years ago, I can't believe it's still an issue in 2022. It's appalling that a "developer product" like Github remains such a blocker to IPv6 adoption, especially for highly Github-reliant communities like the Golang ecosystem. Launch an IPv6-only VM and try to build a mainstream Go project.
  • mappu 4y ago
    Most of Go dependencies these days come from your $GOPROXY, which by default (proxy.golang.org) is available over IPv6 just fine.
    • remram 4y ago
      Go grabs GitHub repos over a proxy hosted by the Go project? How comes?
• deleted 4y ago
  [deleted]
• justin_oaks 4y ago
  Having "grown up" with IPv4, I'm slow to learn everything necessary to set up an IPv6 infrastructure. The times I did look into it, IPv6 seemed so much more complicated than IPv4, but maybe that's just because I'm just not familiar with it. Are there any good resources on setting up IPv6 support from first principles? I still get confused as to the "right" way to set up internal networks for IPv6, especially when DHCPv6 isn't universally supported (I'm looking at you Android).
  • argulane 4y ago
    Everything should get its IPv6 configuration via SLAAC. DHCPv6 is only useful when you plan to provide prefix delegation for extra routers or network boot information.
    • stevefan1999 4y ago
      just a funny joke: what about using IBGP/OSPF for prefix delegation?
      • justin_oaks 4y ago
        How does that work you have more than one ISP giving you an IPv6 prefix?
        • justin_oaks 4y ago
          Oops. Meant to reply to parent. Now I can't delete the comment.
    • tjoff 4y ago
      So how do you do DNS then? Not sure if this is a good source but it had some history to recap, and it doesn't look pretty... https://www.reddit.com/r/networking/comments/ajb2ec/comment/eex3d2c/?utm_source=reddit&utm_medium=web2x&context=3 https://www.reddit.com/r/networking/comments/ajb2ec/comment/... [...] To be honest because of this hot mess if you want to reliably support any possible client you'll need to do both DHCPv6 and RDNSS for DNS information. [...]
• KomoD 4y ago
  > Our Hosting provider, Hetzner, has recently started charging for public IPv4 addresses Well actually, they were charging for IPv4 addresses for a while, but just changed pricing... to outrageous pricing. The setup fees are actually insane! And yeah IPv6-only is quite a terrible experience, I tried out a few days ago. I suggest just using nat64.net if you want to access IPv4 sites over IPv6. One quite funny thing, I recently asked my ISP if they were ever going to add IPv6, they told me no, there's "not enough demand"... well there's "not enough demand" because there's barely any IPv6 websites, and then websites refuse to add support for IPv6 because... you guessed it, "not enough demand".
  • Tempest1981 4y ago
    Pricing, fyi: https://docs.hetzner.com/general/others/ipv4-pricing/ https://docs.hetzner.com/general/others/ipv4-pricing/ Around €19.00 setup per IP.
    • Sesse__ 4y ago
      That's not insane, that's pretty cheap. If you buy IPv4 addresses in bulk (e.g. an entire /18 or so), they're ~$40 a piece these days. When you buy cloud services from AWS or GCE, you're still paying for those IPv4 addresses, it's just baked into the price. Hetzner makes paying for it optional, which makes it so much more visible.
      • counttheforks 4y ago
        It is an insane price for renting an IP address. It's not like you get to keep the IP address when you move elsewhere.
      • KomoD 4y ago
        This isn't buying, this is renting. You are paying that setup fee + the monthly fee. As a comparison, I pay ~$1.60/ip/mo (no setup fee) for my IPs.
    • terom 4y ago
      My guess would be that you need to let used IPv4 addresses age out for a while before you can reassign them to a new customer, and they need to reduce churn - and avoid people intentionally burning IPv4 addresses by rotating through new, clean addresses.
• tristor 4y ago
  Unfortunately this is true. I've been running IPv4/IPv6 dual stack since 2014 for most of my infrastructure and since 2016 for all of it. The company I work for now is a major AWS customer, and we managed to pressure them into enabling IPv6 for Global Accelerator, and have just recently launched full IPv4/IPv6 dual stack for our endpoints... in 2022. I think that the primary root cause of this is economics, if we're being perfectly blunt. The countries/regions of the world that got most of the IPv4 address space are also the places where most of the money is, so businesses, especially businesses serving businesses, are not heavily driven to support IPv6 other than as a "checkbox", because their customers all have IPv4 and are not asking for it. Meanwhile in APJC/BRIC IPv6 is the dominant mode of connectivity, and many major businesses are IPv6 only or IPv6 primary w/ IPv4 CGNAT. When you enter into this market, IPv6 quickly becomes a requirement, however in EU/NA, it's just not required. I am seeing this shift though, because of mobile-first consumer-oriented businesses. Globally, pretty much all mobile providers issue only IPv6 addresses that are globally routed to their subscriber devices and utilize CGNAT to get IPv4 connectivity. This is true even in North America. The problem is that CGNAT is /really/ good as far as "working", so from the perspective of endpoints they communicate with, it may not be obvious that IPv6 would actually benefit them. For mobile applications, IPv6 has a significant performance advantage because it skips CGNAT, and so at least in that space businesses are doing more to support it directly.
  • kevin_nisbet 4y ago
    That's really cool that global accelerator got support, I was about to bash AWS. It's one of those things when trying to optimize product market fit and quick launches, that we needed global accelerator, but not IPv6 on a project I worked on. So when major AWS / cloud services don't have the ability to just turn it on, is one part of the chicken and egg that contributes to the lack of adoption. Thanks for pressuring for that support.
    • tristor 4y ago
      Yep, there are unfortunately some other AWS services that still don't support IPv6, but at least with Global Accelerator and ALB support, we can hide that from end-customers that require IPv6 endpoints. https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-global-accelerator-ipv6/ https://aws.amazon.com/blogs/networking-and-content-delivery... ALB/ELB/NLB support for IPv6 is fairly recent as well, November 2021: https://aws.amazon.com/about-aws/whats-new/2021/11/application-load-balancer-network-load-balancer-end-to-end-ipv6-support/ https://aws.amazon.com/about-aws/whats-new/2021/11/applicati...
• cadence- 4y ago
  I’m still waiting for Amazon to start supporting Elastic IPv6 in their AWS.
  • miyuru 4y ago
    You can remove the address(/128) from old instance and assign it in the new instance and it will works just as EIP.
  • ArchOversight 4y ago
    Why? What are you using EIP's for and the ability to float them?
  • gurrone 4y ago
    That just made me look at Google Cloud again, and it's depressing to see. At least some types of load balancer do support dual-stack setups, but not if you configure them via GKE with the k8s ingress controller. If you use that one you're out of luck and they maybe now implement it for the new gateway API controller. So if you use GKE and ingress you can configure two of them. One with a static v4 address and another one with a static v6 address. Of course you pay twice then.
• a-dub 4y ago
  they don't offer free private ipv4 with nat? these are all outbound reachability issues. the bigger concern i'd have would be inbound reachability for public services. you don't need routable ipv4 addresses on every host to hit public ipv4 internet services!
• can16358p 4y ago
  My whole country of 80 million people with very high Internet usage is still not supporting IPv6 at all (and residential connections are behind CGNAT). I'm pretty sure there are many more. IPv6 might be a thing in US or Europe, but definitely not in the world.
  • scarmig 4y ago
    IPv6 penetration: 1. France 72.63% 2. India 66.47% 3. Germany 65.45% 4. Greece 62.13% 5. Malaysia 60.03% ... 15. United Arab Emirates 48.69% 16. United States 47.99%
  • noipv6 4y ago
    is "not supporting IPv6 at all" a data-backed statement? https://stats.labs.apnic.net/ipv6/ https://stats.labs.apnic.net/ipv6/ fwiw
    • jeroenhd 4y ago
      Going by the "80 million" comment and the map you've linked, the countries that come closest are Germany (±60%), Iran (0.34%), and Turkey (1.79%). Iran has an oppressive government with severe internet restrictions, so I'm not surprised they're not making IPv6 a priority. I'd assume their traffic interception devices don't work all that well without IPv4, they never seem to. With 1.79% being IPv6 capable (not even configured), I'd say availability is effectively 0%. It's technically 2%, but I'd imagine those 2% are mostly hosting services and such. Reverse sort the availability table and lots of countries have availability below even 5%. Nigeria, the 7th most populated country in the world, is at 0.38%. Lithuania, part of the EU and its economic bloc, is at 0.16%.
• arcade79 4y ago
  I was thinking about ipv6 the other day. I concluded in my head that adoption was just around 5-10%. Luckily I went to verify that with statistics. https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html While price of ipv4 addresses are increasing, the world has slowly been adopting ipv6. From the graph above, I'd say we cross over 50% in about 2-3 years time. At some point the "dash" to adopt ipv6 starts, and brave folks will drop support for ipv4. Then it'll probably evaporate between 2030-2035.
  • bombcar 4y ago
    I'd love for some way to measure how much of my network's traffic outbound and inbound is IPv6. I assume there's some way to "count" it on the router, but Mikrotik doesn't seem to expose it directly.
    • yusyusyus 4y ago
      iirc mikrotik supports netflow. that's how i account for proto balance. FWIW, owing to the nature of residential traffic, I've typically seen high (60-70% of traffic) as v6.
      • bombcar 4y ago
        Yeah, if the stream platform CDNs support IPv6 (Do they? is there a site that lists it?) then the vast majority of residential traffic will be IPv6.
        • lzaaz 4y ago
          This is exactly why this isn't a good way to measure ipv6 adoption. For example, youtube supports ipv6; if you spend all day watching youtube, 80%+ of your traffic will be ipv6.
    • jrmg 4y ago
      I don’t know if this corresponds to traffic, but my local DNS server shows that it’s returning more AAAA results that A results (_just_) nowadays. This is a home cable connection in the Bay Area.
• redox99 4y ago
  IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.1.2.3.4). Not having two sets of firewall rules and two sets of everything. I always disable IPv6 because it can bite you so hard when you don't realize that you are wide open to IPv6 connections because of different firewalls. Edit: To make everything a bit clearer, the idea with this "ipv4+" is that you don't need the complexity of running both ipv4 and ipv6 as you do now. And regarding compatibility, with ipv4+ if you have a 0.0.0.0.x.x.x.x ip address you would be able to talk to both ipv4+ aware and legacy ipv4 devices natively without any tunneling (because you also own the legacy, non quad 0 ip address). If you don't have such "quad 0 ip" (you are 1.1.1.1.x.x.x.x), only ipv4+ aware devices would be able to to connect to you, and for you to connect to non ipv4+ aware devices you would need either tunneling, or having a secondary, cgnat, "quad 0 ip".
  • fleventynine 4y ago
    How is a host with a 32-bit address supposed to communicate with a host with a 128-bit address when it can only send packets with a 32-bit address?
    • jk_i_am_a_robot 4y ago
      That's a solved problem whose solution is called ipv4 over ipv6 tunneling.
      • stevefan1999 4y ago
        that will cause state and can hurt performance since it needs extra memory. one of the main selling point of IPv6 is try to be stateless as much as possible to ease up on routers and switches
        • 4y ago
• xmddmx 4y ago
  Many small business routers and firewalls still don't have reasonable IPv6 support, for example https://forum.peplink.com/t/ipv6-support/3675/54 https://forum.peplink.com/t/ipv6-support/3675/54 (from 2015) says they are working on it. People are asking "what's the status" now in 2022.
• bombcar 4y ago
  Setting a website to be available over IPv6 is relatively easy, yet we see: ;; QUESTION SECTION: ;news.ycombinator.com. IN AAAA Why? Because it's not quite as simple as making Apache respond over IPv6; any website of any size has various protections in place to prevent DDoS, spam, etc, and those tools are almost universally basic and at the root is the "ban by IPv4 address". Without that tooling supporting IPv6, it remains a side note not worth supporting. Solutions? You can make an IPv6 version available that is read-only; or requires you to login via an IPv4-only gateway first (and protect that) and then ban by username as necessary. And outbound? You have to IPv4 NAT which maybe Hetzner offers? If not there are things like https://nat64.net https://nat64.net
  • miyuru 4y ago
    Actually HN is available via IPv6 over Cloudflare. You have to add a CF IPv6 it to the hosts file. In fact I am posting this comment over IPv6.
    • cryptonector 4y ago
      > hosts file 1986 wants a word.
      • miyuru 4y ago
        I actually run a separate DNS proxy that does it automatically for me. (HN and lot of other sites) I only mentioned hosts file because it is the easiest way to spoof the domain.
        • cryptonector 4y ago
          That's still the same thing: you're manually adding a mapping where you shouldn't have to. HN should just publish the AAAA RRs and be done.
    • trynewideas 4y ago
      > You have to add a CF IPv6 it to the hosts file. That's worse, yeah? You do see how that's worse?
• valerij 4y ago
  i for one am also extremely frustrated with the state of ipv6 some time ago i tried to selfhost a personal website and run into all kinds of problems, most frustrating being - my website not opening when having only AAAA record set (ended up using v4-frontend.netiter.com as a proxy) - my linux box not handling the ipv6 prefix broadcast from my router and binding to some random address the latter thing was main reason for frustration as i could find any information how to diagnose and all the message boards/ chat rooms just told me to install random stuff in hope it will then magically work. (i know its a misconfiguration on my linux machine as my windows 10 one can host the website no problem)
• UI_at_80x24 4y ago
  And this is where government regulation would have helped. It's a shame nobody listened to me back in the 90's: (it's a joke. I'm a nobody, there is nobody listening.) All cell-phones should have been ipv6 from the get-go. Now if we could just go back in time and warn everybody about IPv4 address space being exhausted. And maybe the climate too while we are at it. Seriously though, cell-phone adoption would make that a game changer. Hey Apple, sell it as an exclusive feature!
  • bombcar 4y ago
    Cellphones are the main driver of IPv6 adoption as it is; many countries you're behind CGNAT if you hit an IPv4 endpoint, but you go direct if they support IPv6.
  • withinboredom 4y ago
    It’s not that ipv4 space is exhausted, there’s plenty of it available. It’s that early on it was mismanaged to the point that people / companies were able to buy entire /8’s for basically nothing and hold them forever.
    • gfaster 4y ago
      Related anecdote, my (small) school had acquired a /16 way back and so today, every single device on the network gets its own public ipv4. It was an absolute mess for security (imagine a small army of first year CS majors setting up each a Raspberry Pi) but it was kinda fun being able to experiment with servers without having to worry about NAT.
      • ehPReth 4y ago
        they could just firewall inbound connections and have some sort of request/interface to allow certain/all ports whilst keeping everything lovely about public v4 though, yeah?
      • mark-wagner 4y ago
        A long, long time ago my (large) school had 2 /16s and a bunch of /24s and every device--including those in the medical center--got a public, internet accessible IP address. https://itconnect.uw.edu/tools-services-support/networks-connectivity/domains-network-addresses/private-address-routing/ https://itconnect.uw.edu/tools-services-support/networks-con...
• withinboredom 4y ago
  Still no ipv6 support with WSL2 in windows. So, if you’re a Microsoft Windows dev in an ipv6 environment, you won’t make it too far.
  • jeroenhd 4y ago
    Quite a strange limitation in my opinion. I understand that dealing with subnetting/host network rebinding to allow full IPv6 can be a challenge (especially if you're on DHCPv6 or some other manually managed thing instead of normal SLAAC) but surely Microsoft could use whatever NAT solution they use for IPv4 to work on IPv6 as well? Apparently support for the protocol can already be enabled (https://github.com/nathanchance/WSL2-Linux-Kernel/issues/25 https://github.com/nathanchance/WSL2-Linux-Kernel/issues/25). This makes it technically possible to use a WireGuard tunnel for IPv6 support, at least...
    • withinboredom 4y ago
      Heh, yeah, I opened that issue. Nathan is awesome for maintaining that kernel.
      • jeroenhd 4y ago
        Haha, I didn't even notice. I should clean my glasses!
  • kavalg 4y ago
    got bitten by this recently. Another nail in the Microsoft Windows' coffin. It is such a fundamental thing and the fact that the issue has been open for ~2years is nothing short of pure shame.
• gurrone 4y ago
  20 years ago it was the lack of IPv6 support on the CPE holding IPv6 on the server side back, nowadays it's a lack of IPv6 at major SaaS providers causing issues. In most of the scenarios I was involved in we made sure that the CDN in front of the product was able to terminate IPv6 and left everything behind it v4 only. About 1/3 to 1/2 of the traffic received was sent via IPv6 on those setups. Maybe time to turn that around and use the CDN to make the product also available via v4? Leaves you with maintaining a NAT gateway for your own infrastructure. BTW also only one of the office networks I had to deal with in the past 20 years hat experimental IPv6 support, and that was at a small local hosting company. Everything bigger than that also sticks to IPv4 only for now. :( Strange how things change but still stay the same.
• ArchOversight 4y ago
  Yes, I use IPv6 in production, alongside IPv4 (dual-stack). I've got an IPv6 only EKS cluster that has IPv4 on the local instance that NAT's any IPv4 outgoing connections, but the entire cluster and all communications inside the cluster/between pods is IPv6 only. IPv6 stand-alone without IPv4 dual stack is not yet an option, but it is getting closer. If you can mirror content and deploy from your mirrors it is entirely possible to do everything over IPv6 alone. About 30% of my production traffic is IPv6, referring to outside traffic coming in to the systems. Internally almost 90% of the traffic is IPv6 due to the k8s cluster being IPv6 only, and preferring that over IPv4. Interestingly enough at home on my home connection about 60% of my traffic is IPv6, which has been increasing steadily over the years as other companies have started bringing on-line IPv6 for their services.
• sph 4y ago
  Yearly reminder that Hacker News still is IPv4 only.
• geraldcombs 4y ago
  Is there an "awesome"-style list of things that are slowing server-side IPv6 adoption? If not, these would be a good start.
• mococa 4y ago
  I had to disable IPv6 on my macOS in order to download packages from GitHub that brew uses, it took me days to figure out the problem.
• CGamesPlay 4y ago
  To use GitHub on an IPv6-only Hetzner instance, you'll need to use a NAT64 gateway. There's a list of public ones here: https://nat64.xyz/ https://nat64.xyz/ This can just go into your /etc/hosts: 2a01:4f8:c2c:123f:64::140.82.121.3 github.com www.github.com
  • 9dev 4y ago
    That’s what I ended up doing, but it’s a major turn-off to learn this by trial and error, after setup scripts fail with seemingly unrelated messages.
    • CGamesPlay 4y ago
      Yeah, if any Hetzner reps are reading this thread, it would be great to put up a support page talking about NAT64, and link to it from the dashboard when creating IPv6-only instances.
      • ddalex 4y ago
        And if any Github reps are reading this thread, put together a presence on IPv6. If Google can do it, so can Microsoft.
  • gnfargbl 4y ago
    Huh, so I can effectively use a NAT64 gateway as an unauthenticated open proxy? Let's try it. First look up the IPv4 for a site that reads back your IP address: $ dig +short a icanhazip.com 104.18.115.97 104.18.114.97 (Those are Cloudflare IP; icanhazip.com is hosted on CF.) Next, try connecting to the IP-readback site via a NAT64 gateway, but presenting the correct Host header so that Cloudflare knows what to do with the request: $ curl -6 -k -H 'Host: icanhazip.com' https://[2001:67c:2960:6464::104.18.115.97]/ 141.98.136.43 OK, it reads back an IPv4... $ dig +short -x 141.98.136.43 de-fra2-nat641.level66.network. ...with a PTR record associated with level66.network, which was the NAT64 gateway we chose. How does this not see more abuse by bad actors? I guess it probably does, which is why there are so few of these public gateways?
• exabrial 4y ago
  ipv6 would be completely unnecessary. Only a handful of things on the internet actually need to be publicly addressable. Even something as simple as SRV record support in browsers would solve 99% of the invented ipv4 "crisis". Furthermore if people could come up with actual technical reasons why NAT is bad, rather than "I don't like it"... because guess what? It's here, it's now, and it's been working just fine for 30+ years. That being said ipv6 offers some really nice features around flow-ids and getting rid of dumb and dangerous ipv4 flags. Credit is due where credit is due and these debugging features of ipv6 are worth mentioning as they really did get it right. Despite this, in my opinion, we simply don't have a use case for ipv6. ipv4 + NAT + BGP (and maybe some SRV records) is all humanity needs, forever. I will continue to disable ipv6 on all the networks and devices I manage, as it's an unnecessary and useless attack surface that ultimately offers me 0 benefit, just downsides.
  • zekica 4y ago
    NAT is not working fine. Have you ever needed to set up STUN + TURN?
    • deathanatos 4y ago
      I think many people are oblivious to STUN/TURN, and the amount it happens in alleged "peer-to-peer" stuff like <insert "Show HN: I built X on top of WebRTC" article here>. Or setting up port-forwarding. Or having to deal with "hairpin NAT". Or having to deal with trying to route two networks together over VPN without having their address spaces collide because literally everyone uses the low end of 10/8. Or the amount of money being siphoned off for the privilege of having an IPv4 address.
    • exabrial 4y ago
      Never actually once in 30 years.
• MindTooth 4y ago
  In Norway, it's required[0] for all public sectors to have IPv6. We are not there yet, but I believe the push will only increase with time. Especially all new internal networks must be IPv6, and IPv4 is optional. [0]: https://lovdata.no/dokument/SF/forskrift/2013-04-05-959?q=ipv6 https://lovdata.no/dokument/SF/forskrift/2013-04-05-959?q=ip... (Sorry that it's in Norwegian.)
  • sybercecurity 4y ago
    There is a current effort to fully transition the US government internal networks to IPv6 only: https://www.gsa.gov/technology/technology-products-services/it-security/internet-protocol-version-6-ipv6 https://www.gsa.gov/technology/technology-products-services/... Considering how many old, IPv4 based management and security tools are probably in use, it will be an exciting time.
  • AdrianB1 4y ago
    Norway is not big enough on Internet scale to make a difference. Equipment and software companies will put in balance the cost vs the benefit and may decide to ignore that market.
    • Dagger2 4y ago
      Perhaps not by themselves, but every country that does this adds to the weight of the argument.
• nathanaldensr 4y ago
  I disabled IPv6 on my home network completely because it interferes with my use of my Raspberry Pi as a DNS blocker. I was never able to get DNS working properly, which, apparently, is intentional with regards to the IPv6 protocol. Meh.
  • jeroenhd 4y ago
    It's not supposed to. My pihole blocks IPv6 just fine, whether it's being reached from an IPv4 or an IPv6 address. IPv6 has very little to do with DNS.
  • Dagger2 4y ago
    It definitely doesn't do any of that. Your problem was having a non-Pi-hole DNS server configured. If you want to run all of your DNS queries through Pi-hole, don't configure a DNS server that's not the Pi-hole server (or which doesn't forward its queries to it).
• cletus 4y ago
  IPv6 is a case study in the second sytem effect [1]. Realizing you need to make breaking changes and it being rare that you get to do so you decide to make all the changes. The truth is IPv4 only had 2 real problems: 1. Lack of address space due to 32 bit addresses; and 2. Lack of a solution for roaming since your IP address is a core part of connection identity (between the source and destination address and port). IPv6 managed to only solve one of these problems and it did so in a way that removed functionality. Yes there are more addresses but now address blocks are non-portable. I guess 25 years ago they thought that routing protocols like BGP4 were considered a problem and decided to remove that with hierarchical address spaces and massively expanded those address spaces to do it. Somehow ports were also considered a problem so we got /64 addresses. Part of the motivation for this was to use (mostly) unique MAC addresses (48 bits) as your identifier and that fits in 64 bits. Of course this became a massive PII leak and a tracker's dream so it never happened but we're still stuck with /64 blocks that we absoultely do not need. It's an object lesson in solving actual problems and not solving imagined problems. [1]: https://en.wikipedia.org/wiki/Second-system_effect https://en.wikipedia.org/wiki/Second-system_effect
  • noipv6 4y ago
    > Part of the motivation for this was to use (mostly) unique MAC addresses (48 bits) as your identifier and that fits in 64 bits. Of course this became a massive PII leak and a tracker's dream so it never happened but we're still stuck with /64 blocks that we absoultely do not need. please read about rfc4941 privacy extensions & how prevalent their use is before continuing to regurgitate decade-old, outdated privacy alarmism about MaC aDdReSsEs.
  • fulafel 4y ago
    You can get PI v6 space, and if you are somewhere where a RIR won't give it to you, that's not the protocol's fault. Also ports weren't removed, they work just like in v4. The long addresses with subnettable space for everyone is very valuable and useful and doesn't remove any functionality.
  • cryptonector 4y ago
    Finally, a great comment in this thread. Arguably lack of IP address block portability is not that big a deal [now that we're well used to it]. But IPv6 did not solve the CIDR route table size issues, and that's a big failure. I have long thought that IP packets should have a source and destination ASNs as well as actual addresses. That would mean that we'd need more DNS (or similar) lookups, and a bootstrapping system for that. A scheme like this would greatly reduce router table sizes and would allow for IP address block portability.
• myself248 4y ago
  I propose a real simple solution: Major providers pledge to take this seriously. They toss a rule in their routers that just drops all ipv4, for 1 minute, starting at noon UTC. At 12:01 UTC, revert the change and ipv4 works again. Do this every day. The following week, up it to 2 minutes. The incentive will happen.
  • jl6 4y ago
    Of course it’s simple if you have the capability to compel coordinated action across a globally-distributed disparate-and-not-easily-definable group of stakeholders whose incentives typically do not align.
  • rhacker 4y ago
    While I think this would effectively move the needle, as soon as they announce that this is going to happen, I am guessing heart monitors, ankle brace companies (people in home jail) and a slew of weird other use cases will pop up as major problems and the effort will fail.
    • myself248 4y ago
      All of those things should be able to cope with a 1-minute loss of connectivity already. To do otherwise would be astonishingly negligent.
  • hanche 4y ago
    Or as a friend of mine suggested, more than ten years ago and only half in jest, I think: just block all porn sites on IPv4 (but not on IPv6). The demand for IPv6 will soon be overwhelming.
    • temp2022acc 4y ago
      That's a novel tactic, love it!
• _8j50 4y ago
  My take is that they should have used alphanumeric addressing. You could have addresses like company:office:laptop and it shouldn't have reinvented arp and dhcp or added more complex routing like anycast or link local. It tried to solve too many problems at once.
  • notdonspaulding 4y ago
    How would alphanumeric addressing help anything? You currently have an address hierarchy like <AS Number>:<Network Allocation>:<Subnet>:<Host>. That hierarchy is conveniently conveyed in a single 128 bit number. With an alphanumeric address, 128 bits of ASCII would get you `company:office:l` and your net/subnet/host would require more CPU horsepower to compute.
    • _8j50 4y ago
      The ascii is for presenting to the user not for hardware processing. It is not a wire format. Onlh when logging or parsing a config (human interfacing) is an ascii conversion required and a modern protocol that wants adoption should prioritize human friendliess at the human interface of the protocol. Right now the hex lets you mental model the wire bytes nicely but it is unpleasant to use. V4 used decimal which is pleasant to use. UX trumps all.
  • Dagger2 4y ago
    You're thinking of DNS, which... we already have. v6 actually changed very little from v4. It more or less works in exactly the same way v4 does.
    • _8j50 4y ago
      No, ipv6. Could have eliminated the need for DNS in a LAN. There is no reason to use hex other than maybe it would be easier for control planes to translate config to bytes/asic? But that's only when a config changes. Routing and forwarding uses bits and bytes, the hex is just one of many ways they could have chosen to represent the bytes. Defining prefixes in alphanumeric and how that translates to bytes could have been worked out. It could be something like 2601:hchsh:eevbo::home/64 for example
• noipv6 4y ago
• Aissen 4y ago
  One interesting thing is the asymmetry making it slower for all those backend services to move, as opposed to, say, a brand new ISP. Cloud/hosting services only need one IPv4 per machine, making them relatively cheap, and easy to include in pricing. ISPs need one IPv4 per customer, or resort to CGNAT or IPv4-sharing. This often means that customers might have better IPv6 than IPv4 performance. All of this does not apply to oldest ISPs that all have a war-chest of IPv4 they got for cheap (free). Where I'm getting at is that the usecase you're testing is basically worst-case scenario. Fun that Hetzner does not even have AAAA records for their API. Do they have at least RFC1918 (private) IPv4 addresses ?
• anticristi 4y ago
  15 years ago I connected 1000s of computers natively to the IPv6 Internet. Today, I don't have IPv6 at home. DJB was right, I'm afraid.
• trey-jones 4y ago
  The furthest I ever got was creating firewall rules for ipv6 that mostly corresponded to our ipv4 rules. These were never used, but they were tested and ready. This was around "ipv6 day" (2014? 2015?) I've thought about it on and off since then and wondered whether I should be doing more with ipv6, but haven't actually taken any action in that direction. I wonder if there's a relatively simple solution to at least most of the OPs list, all having to do with outgoing ipv6 requests, which would be proxying such (or all) requests through another computer on the network that has both ipv4 and ipv6 interfaces. Maybe that is an oversimplification. Anyway, ipv4 definitely has a problem, and something is going to have to be done eventually. Edit regarding World IPv6 day. I must be thinking of June 6, 2012: "This time, it's for real."
  • noipv6 4y ago
    > Edit regarding World IPv6 day. I must be thinking of June 6, 2012: "This time, it's for real." world ipv6 day (24 hours) was in 2011. world ipv6 launch (turn it on & leave it on) was in 2012. (ppl mix the two up all the time, understandably!)
  • jeroenhd 4y ago
    > I wonder if there's a relatively simple solution to at least most of the OPs list, all having to do with outgoing ipv6 requests, which would be proxying such (or all) requests through another computer on the network that has both ipv4 and ipv6 interfaces. Maybe that is an oversimplification. If you have an IPv4+IPv6 capable server around, you can set it up yourself if your ISP hasn't made a proxy available. There are various NAT64 implementations you can use; running them and setting up a DNS64 server is all you need to make such a feature available. You'd probably also want to add a firewall/whitelist to prevent other abusing your NAT64 gateway, though.
• maximaximal 4y ago
  We are IPv6-only on our institute-internal CPU compute cluster based on slurm. Only the head node has an IPv4 address, so that it can be reached from IPv4 only clients (sadly, there are still quite a lot). All nodes inside the cluster talk over IPv6. And all other computers with IPv6 access use that to communicate to the head node. We are transitioning to IPv6-only for internal services and try to avoid using IPv4 addresses, only going back to it when something needs to be accessed from the outside. Sadly, our local ISP is still IPv4-only, meaning we cannot even access our IPv6 hosts while at home, so we need to fall-back to IPv4 quite a lot. Also, the Cisco VPN is still IPv4 only (because of lacking resources to add IPv6 support), so not even the VPN helps. We need to jump over some dual-stack host then. When speaking to the local ISP, they just reply that it's not planned soon, they don't have resources for it, and "they evaluated IPv6 and don't have a reason to support it". Me/us giving them reasons was not enough it seems.
  • marinesebastian 4y ago
    With all these limitations, why did you prefer IPv6 over IPv4?
    • maximaximal 4y ago
      Because we don't want to use 20 IPv4 addresses for the cluster of 20 nodes, when we only have so much addresses assigned to our institute. We could have gone the NAT route, but then we'd need to have some router. And if we designate the head node as router, all traffic would not go through the switch directly, but first through the head node and then out. This would mean that the nodes are less independent, as they have this one additional choke-point. Our university gave us a /64 for this network, so we just used that and it worked flawlessly, also for university-internal distro-package fetching and host-cluster connections. Also, research software is usually working nicely with IPv6. If we encounter something that would really need IPv4, we could update the thing and give it some local subnet - but currently we were lucky.
      • remram 4y ago
        But you still need NAT right? To support outbound connections from the worker nodes?
• LinuxBender 4y ago
  I have not seen a practical way to go IPv6-Only. If I made my DNS, Web, Chat, Time and other servers IPv6-Only I would only be able to access them from a few mobile networks, most VPS providers and a handful of ISP's. One might be tricked into thinking adoption is high, but the VPS and mobile providers really throw off the statistics. Mobile providers due to sheer numbers of clients and being late to the allocation game did not have much choice but to go IPv6 and set up IPv4 gateways/tunnels. I could see doing IPv6+IPv4 in a corporation and terminate everything on load balancers, allowing anything behind the LB to be any combination of IPv4/IPv6. But IPv6 only? I don't see any big companies doing that in my lifetime. My ISP obtained some IPv6 space but have not deployed it yet as they are still trying to decide how to subnet and bill for it so I currently have some static IPv4 addresses. I am on a tiny ISP, so tiny all their C-Levels phone numbers and email addresses are still in whois. Most of the US ISP's doing IPv6 also do IPv4 even if sometimes it is CG-Nat.
  • noipv6 4y ago
    > I could see doing IPv6+IPv4 in a corporation and terminate everything on load balancers, allowing anything behind the LB to be any combination of IPv4/IPv6. But IPv6 only? I don't see any big companies doing that in my lifetime. facebook started migrating to ipv6-only datacenters in 2014 or so. i think all of them are converted at this point. they only support legacy ip at their network edge, & use siit (iirc) to facilitate access.
    • LinuxBender 4y ago
      The legacy IP at their edge is what I meant by terminating IPv4+IPv6 at the load balancers. The tricky part is that almost all datacenters today need to talk out to other datacenters. Not all of them use IPv6 which means they will still need some way to speak IPv4 until all their 3rd party data processors are also doing IPv6 and for Facebook I happen to know that is a lot of 3rd parties. If they are truly IPv6-only in the datacenter then they would have to forward-proxy all outbound connections through something with an IPv4 address on the edge as well and that can not go away until all their partners and vendors are also purely IPv6.
• 0xbadcafebee 4y ago
  The industry doesn't give a shit. Everyone follows the path of least resistance, which is: don't change, apply crappy hacks, try to prevent any work you don't want to do. IPv6 was never going to be adopted quickly because nobody was forced to.
• jedberg 4y ago
  Every couple of months, I enable dual-stack on my home network, to see if it works. And inevitably I get a terrible experience. Some sites fail to load, others load after a huge delay (presumably because we're waiting for an ip6 timeout of some sort) and some things just don't work right. I'm always too lazy to figure out why these things don't work, but I turn off dual stack and everything works fine again. I'm a network engineer and I can't make ip6 work seamlessly in my house -- what chance do regular consumers have?
  • deathanatos 4y ago
    Your experience, and your home network, is absolutely exceptional then. > what chance do regular consumers have? Clearly, quite a good deal, since dual-stack is the default. Nearly half the Internet[1] is using IPv6 using dual-stack just fine, and the other half is using dual stack with a LL v6 because their ISP sucks. Like many others, my laptop routinely travels, and visits a variety of dual-stack and IPv4 only networks, just as VRBO rentals, café WiFi, airports, etc. I've never had an issue connecting to those networks that case caused by dual-stack. Far more often do some form of captive portals (from misconfigured DHCP servers to MitMs wreaking havoc) cause more failures. > others load after a huge delay (presumably because we're waiting for an ip6 timeout of some sort) This isn't how v6 works. It isn't impossible that there's some site out there somewhere with a broken AAAA record, but again, it is the exception given the amount of Internet-connected dual stacks. Most v4-only sites aren't going to have a AAAA. [1]: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
    • tumetab1 4y ago
      > Your experience, and your home network, is absolutely exceptional then. Actually, it's not. Just check google for "ipv6 slow internet" and check it's not exceptional. It's normal because many sites/games/software isn't that tested/optimized for IPv6. Even the basic step of having setup Google/Cloudflare DNS for you forget that you have not set it up for IPv6 might make your experience of IPv6 really bad.
  • Dagger2 4y ago
• bravetraveler 4y ago
  Indeed, I've had similar difficulties... and my needs are rather low! Basically get to the distribution-provided repositories. This doesn't reliably work. If I get lucky and get a mirror with AAAA, all's well. If not, I may get stuck in an annoying retry loop. I resorted to making a dumb router VM. It has v4 that everything else uses to route public traffic through
• ps0ps 4y ago
  Totally viable.. Been IPv6-only since Fall 2014 https://www.internetsociety.org/blog/2014/06/facebook-moving-to-an-ipv6-only-internal-network/ https://www.internetsociety.org/blog/2014/06/facebook-moving...
• ufmace 4y ago
  I was rather dissuaded from trying to keep it working on any of my servers when, after much head-scratching and wrangling, I eventually traced a bunch of weird network issues on my desktop system to IPv6. Seems that any web requests to sites that supported v6 natively were randomly flaky and slow, causing terrible video streaming performance. Only fixed when I shut off v6 at the network adapter level. Guess I'll try and turn it back on in a year or two and see if it's still terrible. If it's not, maybe I'll think about turning it on for some of my servers again.
  • Dagger2 4y ago
    If you're on Fios, there's an issue between checksum offloading on Intel NICs and the ONTs that Fios uses. The workaround is to disable checksum offloading. If not, perhaps you forgot to apply TCP MSS clamping on v6. (An easy test for this is to set the MTU on your client machine to 1280.)
• nikanj 4y ago
  I can trivially remember a bunch of ipv4 addressed, and recognize them at a glance (”oh that’s just our office vpn endpoint, that traffic is benign”). No hope of that with ipv6.
  • ju-st 4y ago
    If your office has a /48 you could surely memorize the subnet itself and/or give your important endpoint the shortest possible IP address like: 2001:db8:a0b0::1 or even something funny like 2001:db8:a0b0::0ff1:ce
    • Dagger2 4y ago
      Yeah, just pick <prefix>::200 instead of <WAN IP>+<RFC 1918>.200. Forget "no hope", that actually looks easier than the v4 case to me... especially if you have any RFC1918 clashes going on, which many companies do.
• telmich 4y ago
  We are running a lot of IPv6 only clusters and don't have any issues. The key solution is to have a NAT64 gateway somewhere at the edge.
• Yuyudo_Comiketo 4y ago
  All ipv6 shortcomings discussion aside; What I think is the more vital problem to focus on is that the governments clearly don't want us mere mortals to expose our own servers running on our own hardware to the outside world (most often justifying that with "it's for your own security" mantra, for we're all deemed too dumb to figure that out for ourselves). ISP-imposed ipv4 double NAT (imposed on ISPs by the governments, I am pretty sure about that) reduces our devices to all but dumb receivers which are scarcely superior to TV sets. And no amount of STUNning and TURNing, or buying VPSes can realistically fix this situation, when we can't simply connect our devices directly without resorting to some service provided by some Men in the Middle. And it gets worse, 10 years ago I could buy a static public IP from my ISP for some affordable extra - all ports open unless blocked manually in my firewall - nowadays there remain no ISP around to sell those to the general public. Just no such option anymore. Too much freedom it gave, I guess. So this begs the question: can ipv6 fix that? Will ipv6 fix that? I'm afraid not.
  • Dagger2 4y ago
    CGNAT isn't imposed by governments, it's imposed by address space exhaustion in v4. v6 fixes it by having enough address space that NAT isn't needed. Governments share some responsibility here for not mandating a move to v6, leaving everybody in "wait for other people to go first" mode, and one might ask why they've done that but the answer is mostly that governments don't usually get involved in the Internet at that level. I've not seen an ISP do CGNAT on v6, even when they're doing CGNAT on v4. This makes sense because CGNAT is expensive and doesn't have any benefits for the ISP except for dealing with address space exhaustion. If they wanted to prevent inbound connections then all they would need to do is firewall them.
    • yyyk 4y ago
      >If they wanted to prevent inbound connections then all they would need to do is firewall them. Note that this already happens to an extent. Some ISPs try to protect their users from UPNP attacks and block certain inbound ports. On the outbound side, many ISPs ban port 25. ISPs could have easily claimed security and limit inbound connections far more - but the reasons for these limits are apparently money+security and not a secret government mandate, so they didn't limit everything.
• eestrada 4y ago
  > Our Hosting provider, Hetzner, has recently started charging for public IPv4 addresses - as they should! Those numbers started getting expensive. This prompted me to try and set up a new server cluster using IPv6 exclusively... I think what OP went thru is what will make the transition happen. Market forces are ultimately going to be the thing that drives wider adoption: IPv4 addresses getting so expensive that it drives people to try IPv6, and when that fails they complain in posts like this and directly to their service providers. The fact that OP names names of services failing to offer IPv6 is a good thing. Ideally it will start creating pressure on those services/corporations to fully support IPv6. If complaining doesn't work to motivate them, users moving away from their services to providers who do offer IPv6 support will motivate them.
• n4jm4 4y ago
  Sounds like IPv6 isn't broken, GitHub and Ubuntu and BitBucket are broken.
• topspin 4y ago
  > The GitHub API and its code load endpoints are not reachable via IPv6 Should it matter that GitHub or whatever doesn't support IPv6? I understood that it is possible to bridge the divide through an IPv6<->IPv4 gateway. IPv6 is designed to incorporate the IPv4 32 bit address space as a segment of the IPv6 address space and automatically translating between the two is relatively straightforward. At least that what I believe. The next time someone asks me about supporting IPv6 will be the first, so I've been able to avoid the matter for a couple decades now.
  • Dagger2 4y ago
    That's NAT64. It's something that Hetzner could and should be providing for their customers, but as far as I can see they aren't.
    • topspin 4y ago
      Well ok... the problem stops right there then. Why would anyone expect -- given the low adoption of IPv6 -- IPv6 sans NAT64 to be workable? Why even bother without it? I don't imagine it would be hard to locate any number of IPv6 zealots proselytizing a NAT64-less world, but here we have someone that made a legitimate effort to apply IPv6 and failed because it wasn't there. One fewer potential convert added to the pile...
      • Dagger2 4y ago
        It's workable if all of the machines you're going to talk to have v6, which is doable. Or you can run your own NAT64. It would also be very easy to suggest that maybe Hetzner want to encourage people to keep paying for v4.
        • deleted 4y ago
          [deleted]
• ipython 4y ago
  I have to say I’m super disappointed in the ignorance and negativity in the comments on this thread. Ignorance of both the difficulties inherent in upgrading a fixed size wire protocol designed for a research network fifty years ago, and the widespread adoption of ipv6 for real customer deployments. Heck most of you are probably using ipv6 through your mobile carrier and don’t even know it!
  • gnfargbl 4y ago
    I think you're being unfair to the audience. The main complaints here aren't about the consequences of those legacy problems, they're about the fact that IPv6 is just such a mediocre designed-by-committee protocol. Your point about mobile networks kind of illustrates this. There are all sorts of weird and wonderful protocols used in the mobile world, and it doesn't matter because 99.999% of us never have to deal with it, and the 0.001% that do have time and space to become experts. IPv6 isn't like that -- it needs to be a consumer grade protocol that people can understand and work with. It either fails that test, or perhaps at best scrapes a borderline pass. We deserved better.
    • zamadatix 4y ago
      IPv6 is very similar to IPv4 it's just IPv4 wasn't a consumer grade protocol either. The problem isn't the protocol it's that there is little incentive for the average user to switch to anything else on their own volition when most didn't even really set up what they are switching from (and already working on today) anyways.
      • gnfargbl 4y ago
        Again, this is kind of making my point. IPv4 had an excuse for being a bit crap, because it was designed in the early 1980s. IPv6 should have been much better than it is. Adoption was always going to be slow, but it never needed to be this slow. If the designers had thought a but more about usability and not done stupid stuff like making the address space contain twice as many bits as it actually needs, then we would have transitioned by now.
• maltris 4y ago
  Various software vendors who dont support IPv6 and render IPv6 only setups without any kind of tunneling useless. And for the worst part play it down with stupid reasons in 202x. My favs "Why you need IPv6, just use 6to4 tunnels", "what do you mean IPv6 only?", "We dont have the resources", "It will take some time die to major changes in the software" - jesus... I tried running IPv6 only with one machine (VPS in own hypervisor) but gave up after 2-3 hours of yak shaving and quickfixing things that should just work out, official Ubuntu repos not speaking v6 was one of them.
• AdamH12113 4y ago
  Given how long it's been since IPv6 was released, I'm surprised that there hasn't been a big proposal for an IPv7 that would fix the alleged problems with IPv6. Has anyone worked on anything like that?
  • Arnavion 4y ago
    The "alleged problems" are not with IPv6. They're with not-IPv4.
  • mprovost 4y ago
    It's more the case that the panic around IP space exhaustion turned out to be unfounded - or at least we've been able to work around it for much much longer than expected. Back in 1994 the IETF predicted that the internet would stop working in 3-7 years. Almost 30 years later we're still going. So there's no sense of urgency to invent something better. For the record I also believe that v6 will be abandoned and eventually replaced, most likely with a backwards-compatible protocol. Or something that provides a more compelling reason to upgrade than v6, which basically has nothing. Or at least nothing that people want - the lack of NAT is really an anti-feature. The history of tech is littered with "standards" that never achieved critical mass.
    • Dagger2 4y ago
      v6 already is backwards compatible. Pretty much every form of backwards compatibility that is possible with v4 is available in v6. The problem is that v4 isn't forwards compatible with larger address spaces, and that's a problem that any protocol with >32-bit addresses faces, because it's a problem with the design of v4, not the design of the new protocol. Replacing v6 will not help. > the lack of NAT is really an anti-feature. v6 doesn't lack NAT -- what it lacks is any sane reason to use NAT. That's a good thing.
• pm2222 4y ago
• rwky 4y ago
  We enable IPv6 on CDNs e.g. Cloudfront/Cloudflare and load balancers, never had an issue and I do see IPv6 traffic hitting them. Apart from that it doesn't see much use. Personally I don't use IPv6 since I've never had and ISP with at home or on mobile living in the UK.
• lee101 4y ago
  I just like to call out Starlink for not supporting ipv6, massive headache as calls to various ipv4 only sites fail in python then you need to set a timeout in your request to trick python into falling back to ipv4, also no public adresses on Starlink made self hosting https://text-generator.io https://text-generator.io a pain but CloudFlared tunnels helped
  • tinglymintyfrsh 4y ago
    Aside about AI text generation: Rule 34 will be tested when it comes to generating adulting text content.
  • Dagger2 4y ago
    Starlink are working on it; they've turned on v6 in lots of places over the past month or so. Although you shouldn't need to do any special handling for v4-only sites on v4-only networks. Your DNS results should be sorted to put v4 at the top in that case, so it should be tried first.
• alexfromapex 4y ago
  I think it's the format of the numbers that's not user-friendly enough. They can be too long to remember and my first thought is that there should be a clever algorithm to use "catchy names" or words and then map them to the numeric values. Could even down-sample the names/words that need remembering and then up-sample them to the full numeric range behind the scenes to help add a larger range of values.
• tinglymintyfrsh 4y ago
  There are large swaths at work that are IPv6 only. There is a proxy to work with things like Github that don't do it. Ideally, every OS and device should be able to do IPv[46] only and dual-stack. IoT stuff has the most problems where they're 2.4 GHz and IPv4 only.
• tobyhinloopen 4y ago
  Many of the services we work with are just broken with ipv6. Our own services are broken with ipv6. I just gave up and forced everything in ipv4 mode.
• jmbwell 4y ago
  All our internal systems use IPv6. Internal traffic is almost totally IPv6. Traffic to/from the public Internet on our networks is 30-40% IPv6. We just started treating it like a first class citizen and worked through the learning experiences, and it quit seeming like such a big deal. IPv6-only, when interfacing with the public internet or the public cloud (which we don't much use), does seem like a challenge, but only due to external factors. It's no more difficult to get a handle on it than any other technology, at which point it pretty much becomes routine.
• jlokier 4y ago
  It's 2022 and I've never yet seen an IPv6-capable internet connection at any home I've lived in, office I've worked at, coffee shop or library whose network I've used. And I've lived in a lot of places Phones have it. But when I connect my computers via my phone's hotspot, the computers only get IPv4. My data SIM at home enables IPv6 when used in a phone. But when installed in my 4G router, same contract, same provider, there is no IPv6 despite the router supporting it. That is, supporting in theory. Since I've never seen it enabled, I can't say if it works. My bare metal servers have IPv6. But my cloud VMs and containers only get IPv4. The last major network protocol I worked with, a P2P mesh protocol that needs to pass around IP addresses, has IPv6 on the todo list. Last I saw, earlier this year, there was a debate about whether it was worth adding or not. At the moment it's defaulting to no, even though I've seen a few IPv6 addresses attempt to join and be rejected I can add IPv6 tunnels (VPNs and such) wherever I want, if I want to test software. But I could do that 20 years ago. It feels a bit artifical, not having the real thing. My current work has a VPN we must use to access work dev servers. Obviously that doesn't use IPv6. Forget about IPv6-"only", I'm still yet to see much IPv6 at all (except on phones).
  • aidenn0 4y ago
    My experience is quite different from yours: - my ISP has offered IPv6 /64 delegations for over 5 years now. - One cloud provider I use gives a discount for VMs with no IPv4 address, the other has ipv6 addresses.
  • arlcode 4y ago
    I've had IPv6 at my home for at least 10 years I would say. My parents do as well. I was recently surprised that ssh to my dual stack private server didn't connect at work. It turned out I had set up the config file as V6 only. Location: Southern Germany.
• mcguire 4y ago
  If the question is, "Why isn't IPv6 the most prominent protocol and v4 a legacy thing?" the answer is NAT and RFC1918 addresses. And NATs within NATs within NATs. The only "real" v4 address you need is for your publicly facing servers. There has been no incentive to go to v6.
• andix 4y ago
  Maybe it’s time to declare IPv6 as failed and find something new?
• psyclobe 4y ago
  I tried to deploy ipv6 with my vlans on my Ubiquiti stuff. Good luck debugging or calling any tech support when stuff doesn't work, no one understands it heh. Hell even comcast couldn't answer the question as to the delegation subnet size on their provisioned routers (key for deploying more then 1 vlan behind it).
• g3000 4y ago
  > I noticed huge swaths of the GPG infrastructure are defunct Many key servers shut down because they were receiving way too many GDPR requests. The idea of public permanent name and email records sound crazy in today's landscape.
• unquietwiki 4y ago
  Hey all... unquietwiki from r/ipv6; been lead-mod there for a while now (though the rest of the folks are really amazing on the mod-side). IPv6 has saved my bacon more times in the past 15 years, than IPv4 has fought with me. No clashing of IPv4 ranges. No fighting with NAT. Ability to easily have concurrent networks, for different purposes. Ability to assign multiple network addresses. Internally, it "just works" on basically anything not an older licensing server, or LAN game. Microsoft is using it internally. Apple has been mandating MacOS and iOS apps to support it for several years now. Usage over the Internet is exceeding 50% in major countries. Where it falls short... a lot of ISPs use equipment that don't handle it well, and/or don't have the staff to implement it properly; and the ISP buyouts and mergers here in the US of the past 15-20 years REALLY messed up the timeline on adoption. Cloud services, a lot of the stuff Google & Microsoft built up their public offerings on, they were designed largely on older virtualization setups that precluded how IPv6 works, until recently; same goes for Docker & Kubernetes. A lot of VPS hosts support it just fine; but a lot of businesses aren't leveraging those, as they could be. And lastly... a lot of IT guys still don't care for IPv6; as those biases show up in these & on Reddit; so that perpetuates the cycle.
  • AtlasBarfed 4y ago
    So the largest expansion of general availability compute (and associated addressing needs) occurs and it ignores ipv6. Re: 50% ... Your ipv6 numbers are very likely mobile, are they not? And those all CGNAT to ipv4 land? So the entire ipv6 mobile space (the biggest victory of the ipv6 war) is basically behind the #1 thing that ipv6 hate more than anything: a NAT. If you can't get ISPs to support it............ ............... ............... ISPs! The central access points to the internet for consumers! THE MAIN PEOPLE THAT YOU SHOULD HAVE CORRALLED. If you didn't get these people on IPv6 within a decade of the protocol, well I don't know what to say. I can't explain the massive degree of failure. Well, I don't have to, look at this thread. I just hear excuses. Blah blah ISPs Blah blah VMs blah blah kubernetes. If the ISPs don't support ipv6, then the software applications CANNOT be upgraded. If it is 2022 and there are major failures in ipv6 support (and there are) in places like comcast and the like, then whose fault is that? It is the fault of the ipv6 organizations, designers, ratifiers, etc. To underline, in America we have MASSIVE monopolies on consumer ISP access, and have for decades. That means in order to wrangle these organizations, you, what, get 10 people in the room and the FCC and get it hammered out? IPV6 isn't just a failure of protocol design. It is a massive failure of organization and outreach. The attitude, rife throughout all ipv6 conversations, is the protocol designers forced it on the internet and said "take it or leave it". The issue is ipv4 has ALWAYS been easier for a programmer. ipv6 always makes for more headaches. This is a massive massive failure. IPV4 networking sucks! NAT! bridges! Gateways! Prozies! port forwarding! CGNAT! It's still all easier than ipv6. Think about that. The issue here is that ipv6 has no hammer. It didn't have the FCC on board or some ultra-powerful group that could deliver the hammer. This is like IE6 (what is it about the number 6? don't answer that), that required a grassroots rebellion in silicon valley to dislodge. Well, and Google Chrome. GET A HAMMER. Idea: GOOGLE IS THE HAMMER.
• pha392 4y ago
  I will never use something like "2a00:1450:4004:801::200e" I have to think Instead with 162.241.217.123 I don't have to
• deleted 4y ago
  [deleted]
• solarkraft 4y ago
  Maybe IPv6 should have had a stronger backwards compatibility story. Maybe not IPv4+ as described in a sibling comment, but something that lets me easily be compatible with IPv4 without having to do the whole setup again. Having to actively manage 2 totally separate systems isn't economical at all, so it's no surprise that so few bother, myself included. I totally want to "switch to" (-> add) IPv6, but just can't justify the cost. There's nothing in it for me here, I would only lose.
• aristofun 4y ago
  Can you attach floating ip4 to your ip6only hetzner machines?
• wankle 4y ago
  IPv6 drives lock sync AD personalization which represents trillions of dollars; it's no wonder there are so many social engineering attempts to try and herd the public into using it.
• jgsaau 4y ago
  On the dark web IPV6 is seen as a way for hackers to hide amoungst the forest of trees. I can detail millions of IPV4 addresses that are not being used, some blocks with ISP / WISP that have never been allocated to a 'customer'
• stevewatson301 4y ago
  Poor support for IPv6 is not new, however a cheap way to workaround is to grab a VPN service and use it for your IPv4 needs.
• Sami_Lehtinen 4y ago
  I see this just as repetition of the 32 bit vs 64 bit operating systems. Why would anyone want to use 64 bit operating system? Instructions are longer, it requires more cache, RAM, disk space and so on, making performance worse. Nobody actually wants 64 bit systems. Endless problems with drivers, programs, etc.
• cheri9 4y ago
  [dead]
• daemon_9009 4y ago
• temp2022acc 4y ago
  I've always figured the easy way to improve adoption rates is to build in a statistical failure to ipv4 stacks; add a kernel option to drop 0.1% of ipv4 packets, or add a 250ms delay to ipv4 packets, and adoption of ipv6 will skyrocket without significantly impacting existing workloads because v4 will still work 99.9% of the time.
  • Dagger2 4y ago
    Who would opt in to using it? Only people who don't need the extra encouragement. It would be easy but entirely ineffective.
• topranks 4y ago
  We use it in production. Much of our traffic comes in to us on it. We dual stack, though, as we know we won’t be able to access all external resources we need over it. If you are expecting everything else to work over v6 before you deploy it then you’re hoping to be the last network on earth to do so. And there can only be one of them so that game of chicken can’t end. There will be a very long tail of networks only on v4. Yep.
• commandersaki 4y ago
  It's unlikely that IPv6 will be deployed widely for a few reasons. First, many companies and organizations have already invested heavily in IPv4 infrastructure, so it would be costly and time-consuming for them to switch to IPv6. Additionally, IPv4 and IPv6 are not interoperable, which means that devices using one protocol cannot communicate with devices using the other. Finally, there are still a large number of available IPv4 addresses, so there is no immediate need to switch to IPv6. Until these issues are addressed, it's unlikely that IPv6 will be widely deployed.
  • Lockal 4y ago
    Please, no ChatGPT in the comment section.