13 ms·

Thinking about our passive exposure to IPv6 issues

68 points by jesprenj 3y ago

jesprenj 3y ago
I have an example from my ISP. While it theoretically started with IPv6 all the way back in around 2012, their IPv6 infrastructure still remains quite crippled -- they won't even assign you static prefixes, all you get is a DHCPv6 /56 (meaning you can't set a PTR). And the example revolves exactly around filtering and firewalls -- on IPv4 they drop outgoing packets whose source address isn't a part of their subnet -- they prevent source spoofing of other addresses. But on IPv6 they do not do that. I noticed this when their router somehow lost the prefix route to me -- I was informed that their DHCP server adds router dynamically to routers -- and I could still send packets. But I couldn't just send packets from my prefix, but also from any other address, including stuff like 2000::.
- jeroenhd 3y ago
  That's pretty silly. I wouldn't have much faith in my ISP if they'd mess up that badly. Perhaps the good network engineer that got IPv4 working right left before they could implement IPv6? Or maybe they don't provide enough of a training budget for their engineers to stay up to date on networking technology? Either way, if their core business is doing networking, I'd expect them to be better at this!
- eqvinox 3y ago
  > their router somehow lost the prefix route to me -- I was informed that their DHCP server adds router dynamically to routers for the curious, that's (in most cases) DHCPv6-PD relay agent operation, https://www.rfc-editor.org/rfc/rfc8987.html#name-general https://www.rfc-editor.org/rfc/rfc8987.html#name-general "Delegating relay": Delegating relay: A delegating relay acts as an intermediate device, forwarding DHCPv6 messages containing IA_PD and IAPREFIX options between the client and server. The delegating relay does not implement a DHCPv6 server function. The delegating relay is also responsible for routing traffic for the delegated prefixes. It's generally done by having the relay be a passive observer of the DHCPv6-PD packets it is relaying between client and server, installing and updating routes for prefixes as needed. That RFC also goes into detail on problems with these setups. What you experienced was probably the loss of state described in section 3.2.
  - jesprenj 3y ago
    Thank you!
- davidmurdoch 3y ago
  I think that's what my ISP (spectrum) does, which has thus prevented me from enabling IPV6 on my router. It works for a little bit, then just stops. Support won't help since I want to use my own hardware.
UpToTheSky 3y ago
This is one of the reasons I do not support IPv6 anywhere. It would take a lot more work to support two types of network requests. I hope I can ignore it up to the point where I can make a complete switch, use only IPv6 and stop supporting IPv4 everywhere. I wouldn't be surprised if that point never comes and I can be a happy "IPv4 only infrastructure" person forever. Or IPv7 comes out before running an IPv4-only infrastructure becomes a problem. I think the mistake of IPv6 was to not be a superset of IPv4.
- jeroenhd 3y ago
  Does it? If you pretend IPv6 doesn't exist, sure, but that's like pretending UDP doesn't exist because all of your applications use TCP, or only logging traffic going to port 80 because you don't have HTTPS yet. Every firewall I've come across has a default deny rule for incoming IPv6 traffic, giving the firewall the same properties as any IPv4 network. Host firewalls are the same; anything ranging from Windows Firewall to UFW and firewalld have presets to block all traffic except for the applications you've whitelisted. Once you get to huge enterprise routers managing routable IPv4 addresses and IPv6 addresses the situation may become different, but it's still not that much overhead. The biggest problem with securing IPv6 seems to be ignoring it assuming that makes it disappear. If you configure your firewall to drop all IPv4 traffic not on a whitelist but somehow manage to forget to add the same rule for IPv6, you should re-evaluate your networking knowledge and maybe get up to speed with how the internet has changed since 2015.
  - UpToTheSky 3y ago
    Its not just firewalls. Its also all kinds of code that interacts with the internet in all kinds of ways. Extending all that code to two kinds of IPs, writing tests, setting up two types of IPs in development, staging and production, monitoring real life implications ... that would be a huge cost with no benefit at all.
    - jeroenhd 3y ago
      If you're writing code, you'll be either manually specifying the IP address family (so there's no real IPv6 risk) or you're probably using middleware that does all the hard parts for you anyway. If anything, I'm annoyed how hard it is to get a socket listening on both IPv4 and IPv6 in many low level libraries. I just want a socket to receive data on, who cares what address family it's from. In my experience, IPv6 Just Works (tm) with modern software. There are some mid 00's frameworks for blacklisting abusive hosts that can't parse IPv6 addresses, or don't understand the /64 subnet you need to treat as a single IP address, but that's all I've ever run into. If anything, that gave me an excuse to finally get rid of an old Perl network filter running on my server. I'm not sure how many tests the average piece of software needs that deals with the type of address family connecting. I suppose it matters if you want to test your rate limiting middleware or your logging library? That should only matter for the vendored code of course because modern libraries all have those tests themselves already. It's not like you need to run and write every test twice, only one or two very specific subcomponents if any. If you're writing firewalls or kernels or router firmware then yeah you'll have your hands full with this stuff, but that's far from the standard developer experience. In those cases, IPv6 is a reality as much as TCP and UDP are.
AndyMcConachie 3y ago
IPv6 is such a mess. If I could go back in time to 1995 I would kick some people at IETF meetings. All they had to do was increase the number of octets from 32 to 64. Instead they redesigned almost everything about how IP works and IMHO made things much more complicated than they needed to be.
- viraptor 3y ago
  We'd likely be in the same situation right now, just with fewer extra features which are actually good. The C API would have to change in almost the same way. The network hardware would have to have separate paths anyway. Rules would still have to cover both cases separately. Sure, we'd save a little bit of time from the extra features, but I don't see how anyone's deployment approach would be different.
- eqvinox 3y ago
  So… you have learned from this and are now actively monitoring and participating at the IETF, so your expertise can be taken into account to prevent similar messes in the future? (An octet is a byte btw, so it'd be an increase from 4 to 8.)
- icedchai 3y ago
  So any increase in address size meant updates on all hosts and routers. If you're going to do a huge, global infrastructure update, it better be worth it. The changes made with IPv6 actually simplified deployment compared to IPv4.
  - JohnFen 3y ago
    > If you're going to do a huge, global infrastructure update, it better be worth it. But if you've changed things so radically that it discourages moving to the replacement protocol, isn't that a problem? > The changes made with IPv6 actually simplified deployment compared to IPv4. Perhaps, but they also make transitioning from IPv4 to IPv6 orders of magnitude more difficult.
    - 3y ago
nikanj 3y ago
1) When was the last time you fixed networking issues by turning on IPv6? 2) When was the last time you fixed networking issues by turning off IPv6? For me, the answer to 1) remains "never", the answer to 2) is currently "Late winter"
- patrakov 3y ago
  > 1) When was the last time you fixed networking issues by turning on IPv6? In 2017. The problem was that file copying via scp was very slow between the servers (one in Germany, one in China). I set up a he.net tunnel in China, got an IPv6 address, and it went much faster via IPv6.
- eqvinox 3y ago
  3) When was the last time you fixed networking issues by turning on IPv4? About a year ago, when I noticed wikipedia still doesn't have IPv6 reachable DNS resolvers. 4) When was the last time you fixed networking issues by turning off IPv4? A few weeks ago, IPv4 was just slow for some reason I couldn't quite determine.
- icedchai 3y ago
  I've been running IPv6 since roughly 2007, starting with SiXXS tunnels, then HE.net tunnels, then moving to native. In that time, all problems "due to IPv6" were fixable. Turning off IPv6 was never the actual answer.
  - magicalhippo 3y ago
    Of course. But it's quick and almost always works.
- jeroenhd 3y ago
  1. Yesterday, actually! 2. Never, because altering my network in a way that I'm no longer able to reach my own servers isn't really a "solution".
- toast0 3y ago
  > 1) When was the last time you fixed networking issues by turning on IPv6? I've used IPv6 to help users behind CGNAT; enabling IPv6 for client -> server often means those clients no longer go through carrier stateful firewalls and their sometimes tragically low idle timeouts (I've seen timeouts as low as 10 seconds). I've also used IPv6 to help in a proxy config when I couldn't get the upstream servers configured for more listening ports; it's super easy to get extra v6 source addresses for the proxy servers and harder to get v4 addresses. With high volumes and low session times, you run into port reuse issues at around 10k-20k sessions per {source ip, dest ip, dest port} tuple; theoretically you can get to 64k, but TIME_WAIT takes time to clear and you don't want to be too aggressive. Probably less going forward, but v6 and v4 often have different routed paths, and sometimes you want to get off of one path and onto another. If you're using a tunneled v6 connection, you almost certainly have a different path for most destinations. > 2) When was the last time you fixed networking issues by turning off IPv6? My previous DSL modem would crash when receiving fragmented IPv6 packets. My current one doesn't crash, but adds a lot of internal latency. Temporarily fixed by disabling IPv6; permanently fixed by using the modem in bridge mode and doing PPPoE on my own personal equipment (at great cost to my own sanity, PPPoE is gross, and I built a multi-node redundancy setup, so PPPoE sessions can be transferred between my redundant routers, bleh)
imoverclocked 3y ago
IPv6 is pretty great. You don’t run out of numbers locally, you don’t run out of numbers globally. Most software and OSs just support it these days… many embedded things still don’t. I think the biggest pain point with IPv6 adoption is probably the large number of customers with a little netgear router that doesn’t know how to pass IPv6 through it. I also think local administrators that still purchase stuff that doesn’t support IPv6 are just shooting themselves in the foot. After all, the writing has been on the wall for over two decades.
- kps 3y ago
  > many embedded things still don’t. For home IoT, Matter uses IPv6, and may start picking up this year. (I worked on some IPv6-related things for it for my then-employer.)
  - STM32F030R8 3y ago
    Matter is based on thread which is full IPv6 I believe and thread has been around a while.
    - kps 3y ago
      Thread or WiFi transport, but yes, I'm sure Thread was influential.
    - wiml 3y ago
      Is Thread related to 6LoWPAN?
      - detaro 3y ago
        it builds on top of it
- fafqg 3y ago
  >IPv6 is pretty great. You don’t run out of numbers locally, you don’t run out of numbers globally. If that's everything IPv6 has going for it it's no wonder its adoption is still so low.
drpixie 3y ago
I was somewhat amazed that a significant university doesn't handle IPv6 - sigh.
- throw0101b 3y ago
  UToronto does: * https://bgp.he.net/AS239#_prefixes6 https://bgp.he.net/AS239#_prefixes6 It's just that particular department may not have bothered.
- mac-chaffee 3y ago
  Since universities were some of the first movers to the internet, there's a lot of legacy stuff holding them back. When you add in the sheer size and the lack of centralized power (which the author has talked about[1]), I'm definitely not surprised. [1]: https://utcc.utoronto.ca/~cks/space/blog/tech/UniversityMoney https://utcc.utoronto.ca/~cks/space/blog/tech/UniversityMone...
  - mixdup 3y ago
    This is changing rapidly and in significant ways, at least in the US There's a lot of requirements that apply to institutions as a whole to clean up their acts and mature a lot of their security processes to even be eligible for grants. A lot of the wild west days are coming to an end, and I've seen a push in several institutions to wrangle unit-level IT groups into one massive IT organization for their entire campuses. Not only is there a lot of security vulnerability there, but it's also a huge cost center that can be squeezed to flatten the curve of tuition, but not have to reduce the salary of three dozen associate deans
greyface- 3y ago
What are you going to do when your students need to access an IPv6-only service? How do the instructors of your networks courses feel about this approach? Do you think the lack of exposure to IPv6 puts your students at an advantage or disadvantage compared to those graduating from an institution running dual stacks?
- fafqg 3y ago
  Something they will have to think about the day that there are IPv6-only services. Which is not today or anytime soon.
  - Arnt 3y ago
    Well, I've seen several. Nothing for the general public. But things like the CMS/admin interface of a big web site. The site itself is on v4, the admin interface not.
  - eqvinox 3y ago
    > Something they will have to think about the day that there are IPv6-only services. Which is not today or anytime soon. Let me guess, you live in and/or operate setups in the US? Yeah, the US has disproportionately many IPv4 addresses. Meanwhile if one of our services doesn't need IPv4, it doesn't get IPv4. And if it does need IPv4, it's increasingly common to be IPv6 behind an IPv4 reverse proxy. And as a result, due to the extra reverse proxy, you'll increasingly just get worse performance on IPv4 than native IPv6.
    - fafqg 3y ago
      What you call the "extra reverse proxy" is cgnat and cgnat doesn't add more latency than any other host in the path to the destination server.
      - eqvinox 3y ago
        It's called CGNAT when you do it near the end user / eyeballs and do it generically for all services on the internet. When you do it near the service being provided, and only for your own services, it's called a Reverse Proxy. You are right that these two things are similar, but they aren't identical; CGNAT attempting to handle you trying to talk to who knows what on the Internet (e.g. game servers, VoIP) is a much harder problem to solve than a Reverse Proxy handling a known set of protocols you want to expose. And, yes, an unloaded CGNAT or Reverse Proxy is not noticable in terms of performance. However, both of them have load limits where you need to scale them up, and particularly CGNAT frequently degrades (due to larger tracking tables) before completely falling over.
yrro 3y ago
A brand new UK ISP, YouFibre, is providing FttP in many UK cities. It's incredible being able to get a symmetric 1 Gbit connection for £30 pcm. It's also incredible that, despite putting all their users behind CGNAT, they don't provide IPv6. I mean technically they are no _worse_ than their major competition here (Virgin Media which has failed to move on IPv6 for 20 years, why start now). But it's baffling that a _new_ network would be built without IPv6 provision!
- fpanzer 3y ago
  Same thing here in Germany, Fibre ISP in my hometown (80k population). Started 5 years ago, widely used already, but still no ipv6.
- sidewndr46 3y ago
  I have IPv6 available through one of my ISPs at my home, but it doesn't work properly. Packets are just dropped for random intervals here and there.
- chinaman425 3y ago
  [dead]
- radicaldreamer 3y ago
  This behavior was rare in the US market, but it is very common now that our wireless providers are entering the home internet market. T-Mobile and Verizon both use CGNAT (but do issue individual ipv6 addresses to end user devices).
  - throw0101b 3y ago
    > T-Mobile and Verizon both use CGNAT (but do issue individual ipv6 addresses to end user devices). More specifically, T-Mobile US only assigns IPv6 addresses to devices, and to reach the IPv4 world you have to go through a translation mechanism. Presentations from T-Mobile at NANOG and Rocky Mountain IPv6 Taskforce: * https://www.youtube.com/watch?v=d6oBCYHzrTA https://www.youtube.com/watch?v=d6oBCYHzrTA * https://www.youtube.com/watch?v=nNMNglk_CvE https://www.youtube.com/watch?v=nNMNglk_CvE
nubb 3y ago
ipv6 has been “around the corner” since 2010 and it sucks we’re trying to force a protocol everyone hates. i get all the reasons it’s great but when everyone on earth hates a single thing all together maybe it’s a sign???
- blacksmith_tb 3y ago
  Hmm, in the US at least it's pretty much ubiquitous on cell networks? My home ISP also at least does 6rd, not as nice as native, but a start.
- pantalaimon 3y ago
  https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
schoen 3y ago
I'm working on a project to increase the supply of IPv4 addresses, and people often complain that attempting to do so undermines confidence in (or, allegedly, the pressure to adopt) IPv6, thereby harming the IPv6 transition. I don't think we could possibly be anywhere near the top of the things harming the transition when we regularly encounter people actively encouraging others not to use IPv6 for either security or convenience reasons!
- bell-cot 3y ago
  > people often complain that attempting to do so undermines confidence in... A miserably common human behavior pattern. Anyone have a copy of the DSM-5 handy, to tell us the technical name for it?
idatum 3y ago
My fiber provider inherited network equipment that is preventing them from deploying IPv6. On their subreddit they responded from multiple inquiries that they are ready to provide a /60 once they upgrade their equipment. I imagine this may be a problem for other providers. Thankfully no CGNAT, so I have a couple VLANS that use he.net in the meantime.
ehPReth 3y ago
I am now supreme leader, IPv6 is mandatory for everyone with at least a /48 prefix available per customer location by 2025 or we'll break down your doors and take over; no IPv6 NAT allowed. ..if only. :(
- icedchai 3y ago
  IPv4 started like that. I worked at several ISPs, one of which had a ton of address space, and we gave every dedicated customer site a /24 by default. We had public IPs on all the desktops, no NAT, and generally no firewalls. The good old days...
  - ehPReth 3y ago
    sounds amazing!
    - icedchai 3y ago
      The 90's were fun times! I still miss the newness of it all.
dopylitty 3y ago
The IPv6 Buzz podcast had a recent episode[0] making the claim that IPv6 is happening on your network whether you intentionally enable/control it or not these days and I had a similar reaction to the one in the post. Definitely something to think about though if you’re in a position to worry about such things. 0: https://packetpushers.net/podcast/ipv6-buzz-123-why-you-need-an-ipv6-security-plan/ https://packetpushers.net/podcast/ipv6-buzz-123-why-you-need...
gerdesj 3y ago
I've been using IPv6 in anger for about a decade now and I have a few observations too. This blog implies that IPv6 might simply happen and that is bad. If it does "happen" for a particular site then it will "happen" in the same way as IPv4 does already. Routers generally fail safe and so do PCs. In general a router will by default block inbound and allow outbound, regardless of IP flavour. Yes it is a bit of a pain to maintain two lots of firewall rules but when you think about it you already have to worry about protocols too so IPv6 simply adds one more dimension to the already considerable combinations. A firewall rule generally worries about inbound/outbound IP/port/protocol. All IPv6 adds is IP version. You'll also be surprised how quickly you can become accustomed to the stupidly long addresses. You may have forgotten how long it took you to get to grips with dotted quads when you first encountered IP(v4). IPv6 does just work - it does have issues with multi ISP and that is a major issue that was never considered at the initial design stage. There are workarounds but they are shit unless you do full on BGP which is hardly a home user solution. It is what it is.
- wmf 3y ago
  Speaking of firewalls, iptables does not fail safe. When you create a rule it should apply to both v4 and v6 but that's not how it works.
  - yrro 3y ago
    nftables' `inet` table sees traffic from both IPv6 and IPv4. Why anything still uses iptables is beyond me!
nathants 3y ago
someone needs to start something like the nra but for ipv4. these cold dead hands.
- yrro 3y ago
  It's all very well if you _have_ an IPv4 address range. But if you don't you're screwed. IPv6 fixes this, it should be adopted everywhere. Those against it seem to be the same ones who make money from the artificial scarcity of IPv4, funny that...
1letterunixname 3y ago
Much of Meta (Facebook) is so expansive, they have wide areas with only IPv6 access (not necessarily public-facing).
jms703 3y ago
Network engineers gotta engineer. Embrace IPv6 through a dual stack approach. Stay ahead of the curve by ensuring and ensure your security strategy accounts for IPv6.

68 points by jesprenj 3y ago

I have an example from my ISP. While it theoretically started with IPv6 all the way back in around 2012, their IPv6 infrastructure still remains quite crippled -- they won't even assign you static prefixes, all you get is a DHCPv6 /56 (meaning you can't set a PTR). And the example revolves exactly around filtering and firewalls -- on IPv4 they drop outgoing packets whose source address isn't a part of their subnet -- they prevent source spoofing of other addresses. But on IPv6 they do not do that. I noticed this when their router somehow lost the prefix route to me -- I was informed that their DHCP server adds router dynamically to routers -- and I could still send packets. But I couldn't just send packets from my prefix, but also from any other address, including stuff like 2000::.

jeroenhd 3y ago
That's pretty silly. I wouldn't have much faith in my ISP if they'd mess up that badly. Perhaps the good network engineer that got IPv4 working right left before they could implement IPv6? Or maybe they don't provide enough of a training budget for their engineers to stay up to date on networking technology? Either way, if their core business is doing networking, I'd expect them to be better at this!
eqvinox 3y ago
> their router somehow lost the prefix route to me -- I was informed that their DHCP server adds router dynamically to routers for the curious, that's (in most cases) DHCPv6-PD relay agent operation, https://www.rfc-editor.org/rfc/rfc8987.html#name-general https://www.rfc-editor.org/rfc/rfc8987.html#name-general "Delegating relay": Delegating relay: A delegating relay acts as an intermediate device, forwarding DHCPv6 messages containing IA_PD and IAPREFIX options between the client and server. The delegating relay does not implement a DHCPv6 server function. The delegating relay is also responsible for routing traffic for the delegated prefixes. It's generally done by having the relay be a passive observer of the DHCPv6-PD packets it is relaying between client and server, installing and updating routes for prefixes as needed. That RFC also goes into detail on problems with these setups. What you experienced was probably the loss of state described in section 3.2.
- jesprenj 3y ago
  Thank you!
davidmurdoch 3y ago
I think that's what my ISP (spectrum) does, which has thus prevented me from enabling IPV6 on my router. It works for a little bit, then just stops. Support won't help since I want to use my own hardware.

UpToTheSky 3y ago

This is one of the reasons I do not support IPv6 anywhere. It would take a lot more work to support two types of network requests. I hope I can ignore it up to the point where I can make a complete switch, use only IPv6 and stop supporting IPv4 everywhere. I wouldn't be surprised if that point never comes and I can be a happy "IPv4 only infrastructure" person forever. Or IPv7 comes out before running an IPv4-only infrastructure becomes a problem. I think the mistake of IPv6 was to not be a superset of IPv4.

jeroenhd 3y ago
Does it? If you pretend IPv6 doesn't exist, sure, but that's like pretending UDP doesn't exist because all of your applications use TCP, or only logging traffic going to port 80 because you don't have HTTPS yet. Every firewall I've come across has a default deny rule for incoming IPv6 traffic, giving the firewall the same properties as any IPv4 network. Host firewalls are the same; anything ranging from Windows Firewall to UFW and firewalld have presets to block all traffic except for the applications you've whitelisted. Once you get to huge enterprise routers managing routable IPv4 addresses and IPv6 addresses the situation may become different, but it's still not that much overhead. The biggest problem with securing IPv6 seems to be ignoring it assuming that makes it disappear. If you configure your firewall to drop all IPv4 traffic not on a whitelist but somehow manage to forget to add the same rule for IPv6, you should re-evaluate your networking knowledge and maybe get up to speed with how the internet has changed since 2015.
- UpToTheSky 3y ago
  Its not just firewalls. Its also all kinds of code that interacts with the internet in all kinds of ways. Extending all that code to two kinds of IPs, writing tests, setting up two types of IPs in development, staging and production, monitoring real life implications ... that would be a huge cost with no benefit at all.
  - jeroenhd 3y ago
    If you're writing code, you'll be either manually specifying the IP address family (so there's no real IPv6 risk) or you're probably using middleware that does all the hard parts for you anyway. If anything, I'm annoyed how hard it is to get a socket listening on both IPv4 and IPv6 in many low level libraries. I just want a socket to receive data on, who cares what address family it's from. In my experience, IPv6 Just Works (tm) with modern software. There are some mid 00's frameworks for blacklisting abusive hosts that can't parse IPv6 addresses, or don't understand the /64 subnet you need to treat as a single IP address, but that's all I've ever run into. If anything, that gave me an excuse to finally get rid of an old Perl network filter running on my server. I'm not sure how many tests the average piece of software needs that deals with the type of address family connecting. I suppose it matters if you want to test your rate limiting middleware or your logging library? That should only matter for the vendored code of course because modern libraries all have those tests themselves already. It's not like you need to run and write every test twice, only one or two very specific subcomponents if any. If you're writing firewalls or kernels or router firmware then yeah you'll have your hands full with this stuff, but that's far from the standard developer experience. In those cases, IPv6 is a reality as much as TCP and UDP are.

AndyMcConachie 3y ago

IPv6 is such a mess. If I could go back in time to 1995 I would kick some people at IETF meetings. All they had to do was increase the number of octets from 32 to 64. Instead they redesigned almost everything about how IP works and IMHO made things much more complicated than they needed to be.

viraptor 3y ago
We'd likely be in the same situation right now, just with fewer extra features which are actually good. The C API would have to change in almost the same way. The network hardware would have to have separate paths anyway. Rules would still have to cover both cases separately. Sure, we'd save a little bit of time from the extra features, but I don't see how anyone's deployment approach would be different.
eqvinox 3y ago
So… you have learned from this and are now actively monitoring and participating at the IETF, so your expertise can be taken into account to prevent similar messes in the future? (An octet is a byte btw, so it'd be an increase from 4 to 8.)
icedchai 3y ago
So any increase in address size meant updates on all hosts and routers. If you're going to do a huge, global infrastructure update, it better be worth it. The changes made with IPv6 actually simplified deployment compared to IPv4.
- JohnFen 3y ago
  > If you're going to do a huge, global infrastructure update, it better be worth it. But if you've changed things so radically that it discourages moving to the replacement protocol, isn't that a problem? > The changes made with IPv6 actually simplified deployment compared to IPv4. Perhaps, but they also make transitioning from IPv4 to IPv6 orders of magnitude more difficult.
  - 3y ago

nikanj 3y ago

1) When was the last time you fixed networking issues by turning on IPv6? 2) When was the last time you fixed networking issues by turning off IPv6? For me, the answer to 1) remains "never", the answer to 2) is currently "Late winter"

patrakov 3y ago
> 1) When was the last time you fixed networking issues by turning on IPv6? In 2017. The problem was that file copying via scp was very slow between the servers (one in Germany, one in China). I set up a he.net tunnel in China, got an IPv6 address, and it went much faster via IPv6.
eqvinox 3y ago
3) When was the last time you fixed networking issues by turning on IPv4? About a year ago, when I noticed wikipedia still doesn't have IPv6 reachable DNS resolvers. 4) When was the last time you fixed networking issues by turning off IPv4? A few weeks ago, IPv4 was just slow for some reason I couldn't quite determine.
icedchai 3y ago
I've been running IPv6 since roughly 2007, starting with SiXXS tunnels, then HE.net tunnels, then moving to native. In that time, all problems "due to IPv6" were fixable. Turning off IPv6 was never the actual answer.
- magicalhippo 3y ago
  Of course. But it's quick and almost always works.
jeroenhd 3y ago
1. Yesterday, actually! 2. Never, because altering my network in a way that I'm no longer able to reach my own servers isn't really a "solution".
toast0 3y ago
> 1) When was the last time you fixed networking issues by turning on IPv6? I've used IPv6 to help users behind CGNAT; enabling IPv6 for client -> server often means those clients no longer go through carrier stateful firewalls and their sometimes tragically low idle timeouts (I've seen timeouts as low as 10 seconds). I've also used IPv6 to help in a proxy config when I couldn't get the upstream servers configured for more listening ports; it's super easy to get extra v6 source addresses for the proxy servers and harder to get v4 addresses. With high volumes and low session times, you run into port reuse issues at around 10k-20k sessions per {source ip, dest ip, dest port} tuple; theoretically you can get to 64k, but TIME_WAIT takes time to clear and you don't want to be too aggressive. Probably less going forward, but v6 and v4 often have different routed paths, and sometimes you want to get off of one path and onto another. If you're using a tunneled v6 connection, you almost certainly have a different path for most destinations. > 2) When was the last time you fixed networking issues by turning off IPv6? My previous DSL modem would crash when receiving fragmented IPv6 packets. My current one doesn't crash, but adds a lot of internal latency. Temporarily fixed by disabling IPv6; permanently fixed by using the modem in bridge mode and doing PPPoE on my own personal equipment (at great cost to my own sanity, PPPoE is gross, and I built a multi-node redundancy setup, so PPPoE sessions can be transferred between my redundant routers, bleh)

imoverclocked 3y ago

IPv6 is pretty great. You don’t run out of numbers locally, you don’t run out of numbers globally. Most software and OSs just support it these days… many embedded things still don’t. I think the biggest pain point with IPv6 adoption is probably the large number of customers with a little netgear router that doesn’t know how to pass IPv6 through it. I also think local administrators that still purchase stuff that doesn’t support IPv6 are just shooting themselves in the foot. After all, the writing has been on the wall for over two decades.

kps 3y ago
> many embedded things still don’t. For home IoT, Matter uses IPv6, and may start picking up this year. (I worked on some IPv6-related things for it for my then-employer.)
- STM32F030R8 3y ago
  Matter is based on thread which is full IPv6 I believe and thread has been around a while.
  - kps 3y ago
    Thread or WiFi transport, but yes, I'm sure Thread was influential.
  - wiml 3y ago
    Is Thread related to 6LoWPAN?
    - detaro 3y ago
      it builds on top of it
fafqg 3y ago
>IPv6 is pretty great. You don’t run out of numbers locally, you don’t run out of numbers globally. If that's everything IPv6 has going for it it's no wonder its adoption is still so low.

drpixie 3y ago

I was somewhat amazed that a significant university doesn't handle IPv6 - sigh.

throw0101b 3y ago
UToronto does: * https://bgp.he.net/AS239#_prefixes6 https://bgp.he.net/AS239#_prefixes6 It's just that particular department may not have bothered.
mac-chaffee 3y ago
Since universities were some of the first movers to the internet, there's a lot of legacy stuff holding them back. When you add in the sheer size and the lack of centralized power (which the author has talked about[1]), I'm definitely not surprised. [1]: https://utcc.utoronto.ca/~cks/space/blog/tech/UniversityMoney https://utcc.utoronto.ca/~cks/space/blog/tech/UniversityMone...
- mixdup 3y ago
  This is changing rapidly and in significant ways, at least in the US There's a lot of requirements that apply to institutions as a whole to clean up their acts and mature a lot of their security processes to even be eligible for grants. A lot of the wild west days are coming to an end, and I've seen a push in several institutions to wrangle unit-level IT groups into one massive IT organization for their entire campuses. Not only is there a lot of security vulnerability there, but it's also a huge cost center that can be squeezed to flatten the curve of tuition, but not have to reduce the salary of three dozen associate deans

greyface- 3y ago

What are you going to do when your students need to access an IPv6-only service? How do the instructors of your networks courses feel about this approach? Do you think the lack of exposure to IPv6 puts your students at an advantage or disadvantage compared to those graduating from an institution running dual stacks?

fafqg 3y ago
Something they will have to think about the day that there are IPv6-only services. Which is not today or anytime soon.
- Arnt 3y ago
  Well, I've seen several. Nothing for the general public. But things like the CMS/admin interface of a big web site. The site itself is on v4, the admin interface not.
- eqvinox 3y ago
  > Something they will have to think about the day that there are IPv6-only services. Which is not today or anytime soon. Let me guess, you live in and/or operate setups in the US? Yeah, the US has disproportionately many IPv4 addresses. Meanwhile if one of our services doesn't need IPv4, it doesn't get IPv4. And if it does need IPv4, it's increasingly common to be IPv6 behind an IPv4 reverse proxy. And as a result, due to the extra reverse proxy, you'll increasingly just get worse performance on IPv4 than native IPv6.
  - fafqg 3y ago
    What you call the "extra reverse proxy" is cgnat and cgnat doesn't add more latency than any other host in the path to the destination server.
    - eqvinox 3y ago
      It's called CGNAT when you do it near the end user / eyeballs and do it generically for all services on the internet. When you do it near the service being provided, and only for your own services, it's called a Reverse Proxy. You are right that these two things are similar, but they aren't identical; CGNAT attempting to handle you trying to talk to who knows what on the Internet (e.g. game servers, VoIP) is a much harder problem to solve than a Reverse Proxy handling a known set of protocols you want to expose. And, yes, an unloaded CGNAT or Reverse Proxy is not noticable in terms of performance. However, both of them have load limits where you need to scale them up, and particularly CGNAT frequently degrades (due to larger tracking tables) before completely falling over.

yrro 3y ago

A brand new UK ISP, YouFibre, is providing FttP in many UK cities. It's incredible being able to get a symmetric 1 Gbit connection for £30 pcm. It's also incredible that, despite putting all their users behind CGNAT, they don't provide IPv6. I mean technically they are no _worse_ than their major competition here (Virgin Media which has failed to move on IPv6 for 20 years, why start now). But it's baffling that a _new_ network would be built without IPv6 provision!

fpanzer 3y ago
Same thing here in Germany, Fibre ISP in my hometown (80k population). Started 5 years ago, widely used already, but still no ipv6.
sidewndr46 3y ago
I have IPv6 available through one of my ISPs at my home, but it doesn't work properly. Packets are just dropped for random intervals here and there.
chinaman425 3y ago
[dead]
radicaldreamer 3y ago
This behavior was rare in the US market, but it is very common now that our wireless providers are entering the home internet market. T-Mobile and Verizon both use CGNAT (but do issue individual ipv6 addresses to end user devices).
- throw0101b 3y ago
  > T-Mobile and Verizon both use CGNAT (but do issue individual ipv6 addresses to end user devices). More specifically, T-Mobile US only assigns IPv6 addresses to devices, and to reach the IPv4 world you have to go through a translation mechanism. Presentations from T-Mobile at NANOG and Rocky Mountain IPv6 Taskforce: * https://www.youtube.com/watch?v=d6oBCYHzrTA https://www.youtube.com/watch?v=d6oBCYHzrTA * https://www.youtube.com/watch?v=nNMNglk_CvE https://www.youtube.com/watch?v=nNMNglk_CvE

nubb 3y ago

ipv6 has been “around the corner” since 2010 and it sucks we’re trying to force a protocol everyone hates. i get all the reasons it’s great but when everyone on earth hates a single thing all together maybe it’s a sign???

blacksmith_tb 3y ago
Hmm, in the US at least it's pretty much ubiquitous on cell networks? My home ISP also at least does 6rd, not as nice as native, but a start.
pantalaimon 3y ago
https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html

schoen 3y ago

I'm working on a project to increase the supply of IPv4 addresses, and people often complain that attempting to do so undermines confidence in (or, allegedly, the pressure to adopt) IPv6, thereby harming the IPv6 transition. I don't think we could possibly be anywhere near the top of the things harming the transition when we regularly encounter people actively encouraging others not to use IPv6 for either security or convenience reasons!

bell-cot 3y ago
> people often complain that attempting to do so undermines confidence in... A miserably common human behavior pattern. Anyone have a copy of the DSM-5 handy, to tell us the technical name for it?

idatum 3y ago

My fiber provider inherited network equipment that is preventing them from deploying IPv6. On their subreddit they responded from multiple inquiries that they are ready to provide a /60 once they upgrade their equipment. I imagine this may be a problem for other providers. Thankfully no CGNAT, so I have a couple VLANS that use he.net in the meantime.

ehPReth 3y ago

I am now supreme leader, IPv6 is mandatory for everyone with at least a /48 prefix available per customer location by 2025 or we'll break down your doors and take over; no IPv6 NAT allowed. ..if only. :(

icedchai 3y ago
IPv4 started like that. I worked at several ISPs, one of which had a ton of address space, and we gave every dedicated customer site a /24 by default. We had public IPs on all the desktops, no NAT, and generally no firewalls. The good old days...
- ehPReth 3y ago
  sounds amazing!
  - icedchai 3y ago
    The 90's were fun times! I still miss the newness of it all.

dopylitty 3y ago

The IPv6 Buzz podcast had a recent episode[0] making the claim that IPv6 is happening on your network whether you intentionally enable/control it or not these days and I had a similar reaction to the one in the post. Definitely something to think about though if you’re in a position to worry about such things. 0: https://packetpushers.net/podcast/ipv6-buzz-123-why-you-need-an-ipv6-security-plan/ https://packetpushers.net/podcast/ipv6-buzz-123-why-you-need...

gerdesj 3y ago

I've been using IPv6 in anger for about a decade now and I have a few observations too. This blog implies that IPv6 might simply happen and that is bad. If it does "happen" for a particular site then it will "happen" in the same way as IPv4 does already. Routers generally fail safe and so do PCs. In general a router will by default block inbound and allow outbound, regardless of IP flavour. Yes it is a bit of a pain to maintain two lots of firewall rules but when you think about it you already have to worry about protocols too so IPv6 simply adds one more dimension to the already considerable combinations. A firewall rule generally worries about inbound/outbound IP/port/protocol. All IPv6 adds is IP version. You'll also be surprised how quickly you can become accustomed to the stupidly long addresses. You may have forgotten how long it took you to get to grips with dotted quads when you first encountered IP(v4). IPv6 does just work - it does have issues with multi ISP and that is a major issue that was never considered at the initial design stage. There are workarounds but they are shit unless you do full on BGP which is hardly a home user solution. It is what it is.

wmf 3y ago
Speaking of firewalls, iptables does not fail safe. When you create a rule it should apply to both v4 and v6 but that's not how it works.
- yrro 3y ago
  nftables' `inet` table sees traffic from both IPv6 and IPv4. Why anything still uses iptables is beyond me!

nathants 3y ago

someone needs to start something like the nra but for ipv4. these cold dead hands.

yrro 3y ago
It's all very well if you _have_ an IPv4 address range. But if you don't you're screwed. IPv6 fixes this, it should be adopted everywhere. Those against it seem to be the same ones who make money from the artificial scarcity of IPv4, funny that...

1letterunixname 3y ago

Much of Meta (Facebook) is so expansive, they have wide areas with only IPv6 access (not necessarily public-facing).

jms703 3y ago

Network engineers gotta engineer. Embrace IPv6 through a dual stack approach. Stay ahead of the curve by ensuring and ensure your security strategy accounts for IPv6.