7 ms·

There is no downside to everything to be globally routable. It's completely orthogonal to firewalling. What is the risk you're picturing here? I'm really curio

There is no downside to everything to be globally routable. It's completely orthogonal to firewalling. What is the risk you're picturing here? I'm really curious. Features like RFC4941/8981 mean nobody can infer anything about your network from the source addresses they see making requests out if it. If you want to use link-local V6 addresses and NAT to a global one, you can do that. But IMHO that's sacrificing one of the greatest advantages of IPv6 for no tangible benefit.

thesuitonym 4y ago
I'm not saying there's any downside, I'm just saying it's not the magic bullet "this is why you should use ipv6" that everyone seems to think it is. It's a complete non-issue that nobody really cares about.
- growse 4y ago
  The point is that it gives you options. You might not want to have anything on a network reachable from the internet today, but next year you suddenly need that capability and it's useful to be able to take advantage of that, rather than wading through the buggy mess of NAT. > It's a complete non-issue that nobody really cares about. A significant number of people spend a significant amount of time trying to carve out and re-use address space in their existing IPv4 allocations and RFC1918 space. This becomes nightmarish the moment you start thinking about networks of any significant size and complexity. All of these problems go away with IPv6, and we care about that a lot.
- jcalvinowens 4y ago
  > It's a complete non-issue that nobody really cares about. Huh. IMHO it's the single most desirable feature, and the only reason I care about it at all. If you're approaching this from the home networking point of view, than I suppose I agree: even the most complex home network is just too simple for anything like this to matter much. As the network gets bigger, that sweet sweet global routability starts to make a lot of things a lot simpler... I'm lucky to have worked on an enormous deployment of V6-only servers, and it's downright magical in comparison to anything of comparable scale I've seen before or since. But yes, my home network is three NAT'd /24's because I'm too lazy to figure out how to make prefix delegation work...
  - kazen44 4y ago
    Also, IPV6 has far more scalable systems for dynamic address allocation compared to IPv4. SLAAC scales really, really well, and is fairly stateless compared to DHCPv4 or V6. Also, slaac allows one to easily change the global prefix of a vm/host if it lives on another layer 3 network. A good example of this: you have two seperate datacenter networks based on an EVPN-VXLAN solution, and you do no want to stretch layer 2 across both datacenters because stretching layer 2 is a terrible, terrible idea[0]. Before IPv6, moving VM;s across datacenters which have different public ip space was a major pain for two reasons: - IPV4 has no concept of using multiple addresses per interface without it having unexpected bahaviour on a host. - address management at scale is a major PITA because DHCP is not scalable. How to solve this with IPv6? It's fairly easy: - Use slaac + prefix delegation of your globally unique address space (which is different per Datacenter). - Use a different (site local) address to reach the VM for management purposes. Because this address is not globally routable, you are sure it will never leak into the greater internet and be reachable from the outside world. - If you are using anycast, you can easily announce this prefix to upstream BGP neighbours because you can use BGP Neighbour Autodiscovery[1]. Trying to do this with Ipv4 will result in a mess of administration, not to mention have to do some clever technical hacks to make it work on some operating systems. With IPv6 solving these issues becomes quite manageable. [0] https://blog.ipspace.net/2021/06/stretched-vlan-define-problem.html https://blog.ipspace.net/2021/06/stretched-vlan-define-probl... [1] https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-auto-discovered-neighbors.html https://www.juniper.net/documentation/us/en/software/junos/b...
  - JohnFen 4y ago
    > IMHO it's the single most desirable feature, and the only reason I care about it at all. Fair enough. For me, this is a thing I literally could not care less about.
- throw0101c 4y ago
  > It's a complete non-issue that nobody really cares about. The availability of IPv4 addresses is something that more people will care about, and getting IPv6 going may help folks. From another comment in this sub-thread: > I've actually run into this [CG NAT] helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo. * https://news.ycombinator.com/item?id=35046929 https://news.ycombinator.com/item?id=35046929
- lmm 4y ago
  People care as soon as it bites them. If I can't stream my music when I'm on my work VPN because the IPs are the same, that's a pain. If my wife and I can't game together online because we "have the same IP" that's a pain. There are all these little irritations that come from not having a global address, and they add up.
adriancr 4y ago
> nobody can infer anything about your network They can infer that one IPV6 address matches to exactly one device. (reverse is not true, one device may have multiple addresses per privacy extensions) Once device is identified all its past traffic is discernible. Changing addresses means identification needs to be done again but once done it can be associated with past addresses and again, all its history is visible. Identification might just mean querying a data broker with HTTP headers. NAT does not have this issue.
- jcalvinowens 4y ago
  > They can infer that an address matches to a single device No they can't: the whole point of RFC4941/8981 is to prevent that. The source address for external connections is effectively randomized. All that can be inferred is that it came from your network, but even with NAT you know that anyway.
  - adriancr 4y ago
    > The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). This is what I structured my inital argument on. Do you see any fallacy in logic?
    - justeleblanc 4y ago
      You literally wrote "Once device is identified all its past traffic is discernible." How is that compatible with devices changing their address every day?
      - adriancr 4y ago
        you identify device each day, identity is X, daughter of Y on iPad. Once identified via data broker all its traffic is identifiable including torrents for example and porn websites, etc (say X goes to facebook with new address it now has real name) Once identity is known for address X you know its traffic for the day, including past traffic for the day. once address changes you do the whole identification again. All these logs where address is identified goes to bucket X. On addresses where you couldnt identify that day you put them in unknown bucket. Once you have a profile of the network, you can do exclusion (Only 4 people in household, 3 active with known addresses, not X, one unknown address, you can assume its X)
otabdeveloper4 4y ago
> There is no downside to everything to be globally routable. Yes there is. I sure as fuck don't want random people from the Internet to know how many devices and what kind populate my home LAN.
- rixthefox 4y ago
  If an adversary knowing your IP address scheme it’s so bad to you, you’re not doing it right. Security through obsecurity is not security.
  - jddj 4y ago
    I wonder if whoever coined that phrase knew that it would be used so often in contexts where people want both obscurity and security based on their own respective merits.
  - otabdeveloper4 4y ago
    > Security through obsecurity is not security. Yes, let's just flash a giant "welcome, nobody is home right now" sign to burglars whenever you leave the house unlocked.
- bert64 4y ago
  How is anyone going to discover that? You're going to have a minimum of a /64, noone is going to scan that looking for devices. Even if they do, your firewall is not going to allow the traffic unless you've explicitly configured it to do so. The only way someone will discover devices, is by analysing outbound traffic you make. Outbound IPv6 traffic will come from randomised addresses so the addressing information is useless. Other things disclosed by the devices (eg user-agent headers on web browsers and other fingerprintable data) are protocol agnostic.
- sgjohnson 4y ago
  nobody in our lifetimes is going to scan a single /64 of IPv6.

thesuitonym 4y ago

I'm not saying there's any downside, I'm just saying it's not the magic bullet "this is why you should use ipv6" that everyone seems to think it is. It's a complete non-issue that nobody really cares about.

growse 4y ago
The point is that it gives you options. You might not want to have anything on a network reachable from the internet today, but next year you suddenly need that capability and it's useful to be able to take advantage of that, rather than wading through the buggy mess of NAT. > It's a complete non-issue that nobody really cares about. A significant number of people spend a significant amount of time trying to carve out and re-use address space in their existing IPv4 allocations and RFC1918 space. This becomes nightmarish the moment you start thinking about networks of any significant size and complexity. All of these problems go away with IPv6, and we care about that a lot.
jcalvinowens 4y ago
> It's a complete non-issue that nobody really cares about. Huh. IMHO it's the single most desirable feature, and the only reason I care about it at all. If you're approaching this from the home networking point of view, than I suppose I agree: even the most complex home network is just too simple for anything like this to matter much. As the network gets bigger, that sweet sweet global routability starts to make a lot of things a lot simpler... I'm lucky to have worked on an enormous deployment of V6-only servers, and it's downright magical in comparison to anything of comparable scale I've seen before or since. But yes, my home network is three NAT'd /24's because I'm too lazy to figure out how to make prefix delegation work...
- kazen44 4y ago
  Also, IPV6 has far more scalable systems for dynamic address allocation compared to IPv4. SLAAC scales really, really well, and is fairly stateless compared to DHCPv4 or V6. Also, slaac allows one to easily change the global prefix of a vm/host if it lives on another layer 3 network. A good example of this: you have two seperate datacenter networks based on an EVPN-VXLAN solution, and you do no want to stretch layer 2 across both datacenters because stretching layer 2 is a terrible, terrible idea[0]. Before IPv6, moving VM;s across datacenters which have different public ip space was a major pain for two reasons: - IPV4 has no concept of using multiple addresses per interface without it having unexpected bahaviour on a host. - address management at scale is a major PITA because DHCP is not scalable. How to solve this with IPv6? It's fairly easy: - Use slaac + prefix delegation of your globally unique address space (which is different per Datacenter). - Use a different (site local) address to reach the VM for management purposes. Because this address is not globally routable, you are sure it will never leak into the greater internet and be reachable from the outside world. - If you are using anycast, you can easily announce this prefix to upstream BGP neighbours because you can use BGP Neighbour Autodiscovery[1]. Trying to do this with Ipv4 will result in a mess of administration, not to mention have to do some clever technical hacks to make it work on some operating systems. With IPv6 solving these issues becomes quite manageable. [0] https://blog.ipspace.net/2021/06/stretched-vlan-define-problem.html https://blog.ipspace.net/2021/06/stretched-vlan-define-probl... [1] https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-auto-discovered-neighbors.html https://www.juniper.net/documentation/us/en/software/junos/b...
- JohnFen 4y ago
  > IMHO it's the single most desirable feature, and the only reason I care about it at all. Fair enough. For me, this is a thing I literally could not care less about.
throw0101c 4y ago
> It's a complete non-issue that nobody really cares about. The availability of IPv4 addresses is something that more people will care about, and getting IPv6 going may help folks. From another comment in this sub-thread: > I've actually run into this [CG NAT] helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo. * https://news.ycombinator.com/item?id=35046929 https://news.ycombinator.com/item?id=35046929
lmm 4y ago
People care as soon as it bites them. If I can't stream my music when I'm on my work VPN because the IPs are the same, that's a pain. If my wife and I can't game together online because we "have the same IP" that's a pain. There are all these little irritations that come from not having a global address, and they add up.

adriancr 4y ago

> nobody can infer anything about your network They can infer that one IPV6 address matches to exactly one device. (reverse is not true, one device may have multiple addresses per privacy extensions) Once device is identified all its past traffic is discernible. Changing addresses means identification needs to be done again but once done it can be associated with past addresses and again, all its history is visible. Identification might just mean querying a data broker with HTTP headers. NAT does not have this issue.

jcalvinowens 4y ago
> They can infer that an address matches to a single device No they can't: the whole point of RFC4941/8981 is to prevent that. The source address for external connections is effectively randomized. All that can be inferred is that it came from your network, but even with NAT you know that anyway.
- adriancr 4y ago
  > The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). This is what I structured my inital argument on. Do you see any fallacy in logic?
  - justeleblanc 4y ago
    You literally wrote "Once device is identified all its past traffic is discernible." How is that compatible with devices changing their address every day?
    - adriancr 4y ago
      you identify device each day, identity is X, daughter of Y on iPad. Once identified via data broker all its traffic is identifiable including torrents for example and porn websites, etc (say X goes to facebook with new address it now has real name) Once identity is known for address X you know its traffic for the day, including past traffic for the day. once address changes you do the whole identification again. All these logs where address is identified goes to bucket X. On addresses where you couldnt identify that day you put them in unknown bucket. Once you have a profile of the network, you can do exclusion (Only 4 people in household, 3 active with known addresses, not X, one unknown address, you can assume its X)

otabdeveloper4 4y ago

> There is no downside to everything to be globally routable. Yes there is. I sure as fuck don't want random people from the Internet to know how many devices and what kind populate my home LAN.

rixthefox 4y ago
If an adversary knowing your IP address scheme it’s so bad to you, you’re not doing it right. Security through obsecurity is not security.
- jddj 4y ago
  I wonder if whoever coined that phrase knew that it would be used so often in contexts where people want both obscurity and security based on their own respective merits.
- otabdeveloper4 4y ago
  > Security through obsecurity is not security. Yes, let's just flash a giant "welcome, nobody is home right now" sign to burglars whenever you leave the house unlocked.
bert64 4y ago
How is anyone going to discover that? You're going to have a minimum of a /64, noone is going to scan that looking for devices. Even if they do, your firewall is not going to allow the traffic unless you've explicitly configured it to do so. The only way someone will discover devices, is by analysing outbound traffic you make. Outbound IPv6 traffic will come from randomised addresses so the addressing information is useless. Other things disclosed by the devices (eg user-agent headers on web browsers and other fingerprintable data) are protocol agnostic.
sgjohnson 4y ago
nobody in our lifetimes is going to scan a single /64 of IPv6.