4 ms·

I gave a couple of talks promoting IPv6 in 1999 and I'm happy that I finally have it at home as a residential customer. (I didn't until this year.) I'm also wo

by schoen 3y ago

I gave a couple of talks promoting IPv6 in 1999 and I'm happy that I finally have it at home as a residential customer. (I didn't until this year.) I'm also working on a project to reclaim some IPv4 address space, which people often object to on the grounds that people should "just use IPv6". So I have to defend the legitimacy of the demand for IPv4 address space. In connection with this issue, I recently ran some DNS lookups against lists of top 1,000,000 domains (the last Alexa one and the Cisco Umbrella one). What we see is that only dozens to hundreds of "top million sites" (depending on one's definition of "sites" and so on) are IPv6-only. That is, less than 0.1% of Internet sites currently have an AAAA record without a corresponding A record, notwithstanding things like Mythic Beasts's offering to sell this configuration to them. The over 99.9% of sites that still have an A record have it for a very good reason, which is that somewhere around half of all of their users (of course, quite a bit more in some regions and markets, and quite a bit less in others) would be unable to reach them at all otherwise. This is probably going to be true for a long time, even if that fraction keeps creeping steadily downward, and there's not much the site operators can do about that. On the other hand, maybe you're talking about things like the "A record but no AAAA record" case (sites that don't offer IPv6 support). This is around 45% of FQDNs that have any form of address record, according to my scans using recent Cisco Umbrella data. I don't particularly have a defense of this; in fact, I find it really unfortunate. I happen to also be involved with Let's Encrypt, and I've often seen a pattern where smaller site operators, at least, show no awareness of what IPv6 is and no desire to debug it (e.g. if their certificate request fails because their old AAAA record was broken). I think Happy Eyeballs has been kind of bad on this particular dynamic: small site operators will themselves perceive their sites as working fine with completely broken IPv6 configurations, and it can be hard to convince them otherwise! I'd love to see some kind of tool, messaging, initiative, or whatever that would encourage the long tail of site operators to be willing to spend, like, three minutes learning that IPv6 is a thing and that it's good if they have it set up correctly rather than not having it set up correctly. I still don't know what that would look like. I've seen dozens, if not hundreds, of forum posts telling people various forms of "it looks like your AAAA record is out of date; maybe you should delete it".

jeroenhd 3y ago
> The over 99.9% of sites that still have an A record have it for a very good reason A records work on v4 and v6, so they'll probably stick around for a while. Perhaps they'll end up being concentrated around 4-to-6 forwarding NAT-as-a-service companies, but they're the fallback mechanism. I don't think anyone is advocating for dropping A all together unless you're really trying to pinch pennies. > I'd love to see some kind of tool, messaging, initiative, or whatever If Google and Microsoft decided to put even the slightest bit of preference towards IPv6 capable websites, I think SEO hacking would do the rest for us. > like, three minutes learning that IPv6 is a thing and that it's good if they have it set up correctly rather than not having it set up correctly Learning to set up IPv6 properly will take more than three minutes. As much as I think IPv6 is a better designed protocol now that the necessary RFCs have come out, there's still a huge difference with legacy IP stuff. The concept of link-local addresses needs to be conveyed or people will put fe80:: addresses in their DNS records, and concepts like /48 or /64 subnets representing customers needs to be explained to prevent bots and spammers from taking over. Unlearning NAT and realizing NAT≠firwall is also something that can take surprisingly long. Enabling IPv6 may take five minutes, but the required background knowledge can take a day or more of learning and experimenting. Internet forum posts about deleting AAAA records are a great helpfulness thermometer for a forum. I treat them the same as the "just disable SELinux" posts; if that's a popular opinion, the forum probably doesn't know what it's talking about so all advice that gets upvoted there needs to be taken with a grain of salt. They're a problem, but also a warning beacon.
- JohnFen 3y ago
  > Unlearning NAT NAT is certainly not a firewall, but it is a very useful router function. I still don't understand how IPv6 makes NAT a thing that isn't useful to know. I want to expose my servers to the internet through a single shared IP address, and to be able to have those servers exist on different IP addresses inside my network. How does IPv6 allow this without NAT?
  - Dagger2 3y ago
    By reverse proxying. Run a load balancer on a single machine and have that reverse proxy connections to their destination. But what if you insist on not using a proxy for whatever reason? When people say "NAT", they're usually talking about SNAT/MASQUERADE, i.e. NATing outbound connections. What you're asking for here is port forwards/DNAT, i.e. applying NAT to redirect an inbound connection. If you want to NAT inbound connections, you can do it without NATing outbound connections. Essentially: you don't need to "NAT", you just need to port forward. Honestly, I think you should just suck it up and use different hostnames for different services, because running all of your services on one IP is really bad for security since it makes it much easier to enumerate every service you're running -- it only takes scanning 65k ports on one IP to find them all, rather than 65k ports on 2^64 IPs. That's the difference between megabytes and yottabytes of port scan traffic. (If you NATed outbound connections to also come from this IP then things get even worse because every outbound connection from any of your machines immediately informs the server of the IP needed to make an inbound connection to you. That's a completely unnecessary security sacrifice.) But if you're going to run everything on one IP without proxying, you only need port forwards to do it, you don't need to run the network on some local IP range too.

by schoen 3y ago

jeroenhd 3y ago

> The over 99.9% of sites that still have an A record have it for a very good reason A records work on v4 and v6, so they'll probably stick around for a while. Perhaps they'll end up being concentrated around 4-to-6 forwarding NAT-as-a-service companies, but they're the fallback mechanism. I don't think anyone is advocating for dropping A all together unless you're really trying to pinch pennies. > I'd love to see some kind of tool, messaging, initiative, or whatever If Google and Microsoft decided to put even the slightest bit of preference towards IPv6 capable websites, I think SEO hacking would do the rest for us. > like, three minutes learning that IPv6 is a thing and that it's good if they have it set up correctly rather than not having it set up correctly Learning to set up IPv6 properly will take more than three minutes. As much as I think IPv6 is a better designed protocol now that the necessary RFCs have come out, there's still a huge difference with legacy IP stuff. The concept of link-local addresses needs to be conveyed or people will put fe80:: addresses in their DNS records, and concepts like /48 or /64 subnets representing customers needs to be explained to prevent bots and spammers from taking over. Unlearning NAT and realizing NAT≠firwall is also something that can take surprisingly long. Enabling IPv6 may take five minutes, but the required background knowledge can take a day or more of learning and experimenting. Internet forum posts about deleting AAAA records are a great helpfulness thermometer for a forum. I treat them the same as the "just disable SELinux" posts; if that's a popular opinion, the forum probably doesn't know what it's talking about so all advice that gets upvoted there needs to be taken with a grain of salt. They're a problem, but also a warning beacon.

JohnFen 3y ago
> Unlearning NAT NAT is certainly not a firewall, but it is a very useful router function. I still don't understand how IPv6 makes NAT a thing that isn't useful to know. I want to expose my servers to the internet through a single shared IP address, and to be able to have those servers exist on different IP addresses inside my network. How does IPv6 allow this without NAT?
- Dagger2 3y ago
  By reverse proxying. Run a load balancer on a single machine and have that reverse proxy connections to their destination. But what if you insist on not using a proxy for whatever reason? When people say "NAT", they're usually talking about SNAT/MASQUERADE, i.e. NATing outbound connections. What you're asking for here is port forwards/DNAT, i.e. applying NAT to redirect an inbound connection. If you want to NAT inbound connections, you can do it without NATing outbound connections. Essentially: you don't need to "NAT", you just need to port forward. Honestly, I think you should just suck it up and use different hostnames for different services, because running all of your services on one IP is really bad for security since it makes it much easier to enumerate every service you're running -- it only takes scanning 65k ports on one IP to find them all, rather than 65k ports on 2^64 IPs. That's the difference between megabytes and yottabytes of port scan traffic. (If you NATed outbound connections to also come from this IP then things get even worse because every outbound connection from any of your machines immediately informs the server of the IP needed to make an inbound connection to you. That's a completely unnecessary security sacrifice.) But if you're going to run everything on one IP without proxying, you only need port forwards to do it, you don't need to run the network on some local IP range too.