5 ms·

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you re

by yesco 4y ago

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember when working with IPv6 are: - IPv6 is very unidirectional, it's not a giant one way waterfall like IPv4/NAT - Routers don't assign addresses, they advertise "prefixes", usually multiple - Routers will usually have a prefix for: Internet, WAN, Link-Local (last one being advertised only to nodes directly connected to it) - Nodes use prefixes to auto-generate an address - Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same - Usually nodes can easily communicate back and forth across multiple local routers with little configuration or hierarchy - Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy - Even if every node has an external address now, you can still configure your firewall to ensure they are isolated from external connections (which is usually the default anyway). You don't need NAT to securely isolate things. - Once you get the hang of it you will realize how easy it makes everything and despair that support for it sucks and everyone makes it harder than they need to Finally for learning resources I honestly recommend just reading the RFCs, I personally learned this way and believe they provide the most direct understanding of the rational behind everything.

b1zguy 4y ago
Thanks for the insightful primer!
cj 4y ago
I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in ipv4 world, you know that server is truly unreachable via public internet)
- yesco 4y ago
  I generally see IPv6 being a better reflection of reality vs the illusion presented by IPv4/NAT. To put it another way, even if your server has no public IP address, if someone punches through your firewall it's not like that matters anymore right? If they have the keys to the kingdom they can change your network to be however they like. If your network is a house, and your firewall is the front door, then all NAT does is force you to have a weird fractal room layout where rooms are inside rooms, inside rooms. But if a dude breaks in through your front door, it doesn't matter how many rooms you have, he will find what he wants. IPv6 lets you have as much rooms as your want and lets you optionally send mail to specific ones. If someone breaks in they still have access to everything, but instead of having to navigate a fractal house, they have to navigate a house with a nicer layout and a trillion doors. The metaphor is falling a part a bit here but my point is that if your server has some form of physical network connection that eventually leads to the internet, it's address scheme isn't going to help you much, even if it makes you sleep better.
- Arnavion 4y ago
  >Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? Define "public/private". Your server has an IPv6 address that is globally identifiable. Your gateway may not necessarily route traffic to it. >(in ipv4 world, you know that server is truly unreachable via public internet) You don't know that, because a port forward rule on the gateway would route traffic to it after doing NAT. And if you made the effort to know that your gateway doesn't have such a rule, then you can equally make the effort to know that your gateway doesn't have a rule to forward traffic to the server's subnet.
  - deleted 4y ago
    [deleted]
- ActorNightly 4y ago
  Its pretty much the same. The reason why NAT with ipv4 works is because routers by default do not forward any incoming traffic from outside to inside host unless there is an entry in the lookup table based on ports or based on port forwarding rules. The important thing to realize is that the local ip addresses (192.x, 10.x, e.t.c) don't actually matter - they can be replaced with any schema as far as router is concerned, and made public. And this is because the core routing logic of the entry table based on port doesn't change. Ipv6 implementation doesn't really differ in this. With IPV6 routers can deny incoming traffic to the particular machine without a previous outgoing request connection, just like in the IPV4 NAT implementation. Receiving end knowing the full ip address of the machine (and even then, with privacy extensions, that ip address will no longer be valid in a day) doesn't really do anything against you security wise. However, unlike IPV4, if you actually want to set up connectivity across networks and in fact enable routers to forward traffic based on the ip address, you don't have to deal with NAT translation, udp hole punching, e.t.c. And furthermore, forcing harder endpoint security is a good thing. Routers are notoriously easy to exploit in a lot of cases, and once an attacker is on a router, NAT is worthless. Likewise for IoT devices that can be exploited through http based attacks against central servers also give you the same access.
justin_oaks 4y ago
Thanks, that helps a lot. This got me reading about IPv6 again. I'm trying to figure out how we'd set up an IPv6 network in the case where we have 1) Two upstream ISPs, mostly for failover, but could be loadbalanced too. 2) Internal servers with assigned DNS My initial thoughts were that for each of the two ISPs, each host (e.g. personal desktop or laptop) would use the IPv6 prefix and end up with two addresses. But in the interest of having an internal address for internal servers, we'd need yet another IPv6 prefix for internal use. That makes 3 IPv6 addresses per host. Does that make sense? I read about getting Provider Independent (PI) address prefixes, which would allow use to consolidate to a single IPv6 prefix, but from what I read, that costs money and should generally be used for large organizations. Ugh.
- Arnavion 4y ago
  If you want failover-independent IPs you can keep using NAT, ie NPTv6, at the gateway level and not bother with giving public IPs to your LAN machines.
  - GICodeWarrior 4y ago
    Have you implemented NPTv6 before? What routing product(s) have you implemented this with? Do you happen to have some documentation links handy? In my experience, this capability is missing from most off-the-shelf solutions, and in the cases where it is available, the documentation of this feature is missing or incomplete.
  - justin_oaks 4y ago
    That's possible, but my understanding is that NPTv6 is strongly discouraged. Part of the point of IPv6 is do away with NAT and the problems caused by it. I was hoping there was a better way.
    - Arnavion 4y ago
      Yes, that is correct. But not having NAT is the same as having addresses that depend on the subnet prefix.
nottorp 4y ago
Ok, i'll bite. > Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same > Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy So a device needs to have both an internal address and an "Internet/non-local" address in IPv6? Plus one for WAN and Link-Local? 4-5 addresses per device?
- pantalaimon 4y ago
  The internal address is optional, it's only useful if you want to have a known address if your uplink is down so you can do maintainance. You only need two addresses: - a global address - a link-local address
  - nottorp 4y ago
    Not clear. How do i reach a device in my local network? Via the optional internal address if my uplink is down and via my link-local address if my uplink is up? Is the link-local address any good if i'm on wifi but want to ssh into a wired host in my home? Are you getting my point yet? Edit: actually I won't wait. The point is it's needlessly overcomplicated. It was done by a commitee that didn't even consider people could try to set up their home network. It's good enough for the enterprise (except cloud sellers it seems) and the plebs should just buy a router. They also didn't consider someone would try to use the command line, since those addresses are not typable.
    - yesco 4y ago
      > Is the link-local address any good if i'm on wifi but want to ssh into a wired host in my home? Lets breath and think about this for a second, you want to know how to reach a device on your local network, your host has a "link-local" address. Could there be a connection here? The answer is yes because it's in the name, it's literally in the name, why are you confused? What is over complicated about this? Back when I was in college I did IPv6 compliance testing as a part time job. Me and random other freshman computer science + IT students were able to pick this up after a day or two of training (aka reading RFCs) with next to zero network experience. I really can't help but see your complaints about complexity as nothing but the whining of a child. (we also exclusively used the commandline)
therealmocker 4y ago
One thing I wish they had done with the much larger address space is make it easy for an individual to get their own block of IPv6 addresses. Letting enthusiasts experiment with their own address space seems like it would help with knowledge / adoption.
- FateOfNations 4y ago
  Big evil Comcast gives out a /60 to residential customers if you ask for it (via setting a DHCP option). That allows for 16 networks to work with.
  - akira2501 4y ago
    DHCPv6 Prefix Delegation. If you're a business customer, you get a larger allocation seemingly depending on the size of your IPv4 static block. I've been given /56 and /54 from their business service. It's quite nice.
- Bluecobra 4y ago
  I’m a network engineer by trade and think that would be cool, but I don’t think it’s a great idea to have a bunch of amateurs all of a sudden participating in BGP for numerous reasons. It’s certainly possible for an individual to setup a LLC, get an allocation from ARIN + AS number, order a business ISP connection w/ BGP and get an adequate router. It’s a high barrier of entry and won’t be cheap. Making that easier will likely lead to more widespread BGP issues (intentional or unintentional), filling up router TCAMs with even more prefixes, etc. There’s already communities out there for hobbyists to play with/learn BGP on private networks over VPN tunnels if you really want to.

by yesco 4y ago

b1zguy 4y ago

Thanks for the insightful primer!

cj 4y ago

I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in ipv4 world, you know that server is truly unreachable via public internet)

yesco 4y ago
I generally see IPv6 being a better reflection of reality vs the illusion presented by IPv4/NAT. To put it another way, even if your server has no public IP address, if someone punches through your firewall it's not like that matters anymore right? If they have the keys to the kingdom they can change your network to be however they like. If your network is a house, and your firewall is the front door, then all NAT does is force you to have a weird fractal room layout where rooms are inside rooms, inside rooms. But if a dude breaks in through your front door, it doesn't matter how many rooms you have, he will find what he wants. IPv6 lets you have as much rooms as your want and lets you optionally send mail to specific ones. If someone breaks in they still have access to everything, but instead of having to navigate a fractal house, they have to navigate a house with a nicer layout and a trillion doors. The metaphor is falling a part a bit here but my point is that if your server has some form of physical network connection that eventually leads to the internet, it's address scheme isn't going to help you much, even if it makes you sleep better.
Arnavion 4y ago
>Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? Define "public/private". Your server has an IPv6 address that is globally identifiable. Your gateway may not necessarily route traffic to it. >(in ipv4 world, you know that server is truly unreachable via public internet) You don't know that, because a port forward rule on the gateway would route traffic to it after doing NAT. And if you made the effort to know that your gateway doesn't have such a rule, then you can equally make the effort to know that your gateway doesn't have a rule to forward traffic to the server's subnet.
- deleted 4y ago
  [deleted]
ActorNightly 4y ago
Its pretty much the same. The reason why NAT with ipv4 works is because routers by default do not forward any incoming traffic from outside to inside host unless there is an entry in the lookup table based on ports or based on port forwarding rules. The important thing to realize is that the local ip addresses (192.x, 10.x, e.t.c) don't actually matter - they can be replaced with any schema as far as router is concerned, and made public. And this is because the core routing logic of the entry table based on port doesn't change. Ipv6 implementation doesn't really differ in this. With IPV6 routers can deny incoming traffic to the particular machine without a previous outgoing request connection, just like in the IPV4 NAT implementation. Receiving end knowing the full ip address of the machine (and even then, with privacy extensions, that ip address will no longer be valid in a day) doesn't really do anything against you security wise. However, unlike IPV4, if you actually want to set up connectivity across networks and in fact enable routers to forward traffic based on the ip address, you don't have to deal with NAT translation, udp hole punching, e.t.c. And furthermore, forcing harder endpoint security is a good thing. Routers are notoriously easy to exploit in a lot of cases, and once an attacker is on a router, NAT is worthless. Likewise for IoT devices that can be exploited through http based attacks against central servers also give you the same access.

justin_oaks 4y ago

Thanks, that helps a lot. This got me reading about IPv6 again. I'm trying to figure out how we'd set up an IPv6 network in the case where we have 1) Two upstream ISPs, mostly for failover, but could be loadbalanced too. 2) Internal servers with assigned DNS My initial thoughts were that for each of the two ISPs, each host (e.g. personal desktop or laptop) would use the IPv6 prefix and end up with two addresses. But in the interest of having an internal address for internal servers, we'd need yet another IPv6 prefix for internal use. That makes 3 IPv6 addresses per host. Does that make sense? I read about getting Provider Independent (PI) address prefixes, which would allow use to consolidate to a single IPv6 prefix, but from what I read, that costs money and should generally be used for large organizations. Ugh.

Arnavion 4y ago
If you want failover-independent IPs you can keep using NAT, ie NPTv6, at the gateway level and not bother with giving public IPs to your LAN machines.
- GICodeWarrior 4y ago
  Have you implemented NPTv6 before? What routing product(s) have you implemented this with? Do you happen to have some documentation links handy? In my experience, this capability is missing from most off-the-shelf solutions, and in the cases where it is available, the documentation of this feature is missing or incomplete.
- justin_oaks 4y ago
  That's possible, but my understanding is that NPTv6 is strongly discouraged. Part of the point of IPv6 is do away with NAT and the problems caused by it. I was hoping there was a better way.
  - Arnavion 4y ago
    Yes, that is correct. But not having NAT is the same as having addresses that depend on the subnet prefix.

nottorp 4y ago

Ok, i'll bite. > Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same > Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy So a device needs to have both an internal address and an "Internet/non-local" address in IPv6? Plus one for WAN and Link-Local? 4-5 addresses per device?

pantalaimon 4y ago
The internal address is optional, it's only useful if you want to have a known address if your uplink is down so you can do maintainance. You only need two addresses: - a global address - a link-local address
- nottorp 4y ago
  Not clear. How do i reach a device in my local network? Via the optional internal address if my uplink is down and via my link-local address if my uplink is up? Is the link-local address any good if i'm on wifi but want to ssh into a wired host in my home? Are you getting my point yet? Edit: actually I won't wait. The point is it's needlessly overcomplicated. It was done by a commitee that didn't even consider people could try to set up their home network. It's good enough for the enterprise (except cloud sellers it seems) and the plebs should just buy a router. They also didn't consider someone would try to use the command line, since those addresses are not typable.
  - yesco 4y ago
    > Is the link-local address any good if i'm on wifi but want to ssh into a wired host in my home? Lets breath and think about this for a second, you want to know how to reach a device on your local network, your host has a "link-local" address. Could there be a connection here? The answer is yes because it's in the name, it's literally in the name, why are you confused? What is over complicated about this? Back when I was in college I did IPv6 compliance testing as a part time job. Me and random other freshman computer science + IT students were able to pick this up after a day or two of training (aka reading RFCs) with next to zero network experience. I really can't help but see your complaints about complexity as nothing but the whining of a child. (we also exclusively used the commandline)

therealmocker 4y ago

One thing I wish they had done with the much larger address space is make it easy for an individual to get their own block of IPv6 addresses. Letting enthusiasts experiment with their own address space seems like it would help with knowledge / adoption.

FateOfNations 4y ago
Big evil Comcast gives out a /60 to residential customers if you ask for it (via setting a DHCP option). That allows for 16 networks to work with.
- akira2501 4y ago
  DHCPv6 Prefix Delegation. If you're a business customer, you get a larger allocation seemingly depending on the size of your IPv4 static block. I've been given /56 and /54 from their business service. It's quite nice.
Bluecobra 4y ago
I’m a network engineer by trade and think that would be cool, but I don’t think it’s a great idea to have a bunch of amateurs all of a sudden participating in BGP for numerous reasons. It’s certainly possible for an individual to setup a LLC, get an allocation from ARIN + AS number, order a business ISP connection w/ BGP and get an adequate router. It’s a high barrier of entry and won’t be cheap. Making that easier will likely lead to more widespread BGP issues (intentional or unintentional), filling up router TCAMs with even more prefixes, etc. There’s already communities out there for hobbyists to play with/learn BGP on private networks over VPN tunnels if you really want to.