3 ms·

Yes, I know - but as the article mentions, it is not possible to "deprecate" IPv4 yet. I need both. And during this "migration phase", both IPv4+IPv6 must work

Yes, I know - but as the article mentions, it is not possible to "deprecate" IPv4 yet. I need both. And during this "migration phase", both IPv4+IPv6 must work alongside each other, which frankly speaking, I haven't yet managed to accomplish.

Faaak 3y ago
Well, tbh dual-stack is enabled in 70% of France's customers for example. If you start with a solid base (having a fixed IPv6 /56 delegation for example), or at least a dynamic allocation with IPv6-PD, then you'll see that it's way easier than IPv4 in the long end
- Helmut10001 3y ago
  I already get a headache when thinking of configuring firewall rules with a dynamic prefix for all my hosts.
  - Astronaut3315 3y ago
    I found building rules around a dynamic prefix to be simple enough on my old EdgeRouter once I found the poorly documented magic incantation to do so. It isn’t possible on the UniFi system that replaced it. Who needs basic core functionality anyway.
    - Helmut10001 3y ago
      Yeah, pfsense apparently just solved this partly (except for aliases) [1], same with OPNsense [2], where there is still an open issue [3]. There are some declined PRs that are not "high priority" [4]. Note that I have just looked these issues up - I don't have insight into any of these. This is not meant as ranting. [1]: https://redmine.pfsense.org/issues/6626 [2]: https://github.com/opnsense/core/issues/2544 [3]: https://github.com/opnsense/core/issues/6158 [4]: https://github.com/opnsense/core/pull/5574
- mike_d 3y ago
  Advocates often drag out the [large number]% of IPv6 in some case or another. It is only thanks to "happy eyeball" algorithms in the browser which prefer v4 when v6 is broken or non-performant that mitigate end user complaints to the point that people can just kind of turn it on in some state of broken and forget about it.
  - throw0101b 3y ago
    > It is only thanks to "happy eyeball" algorithms in the browser which prefer v4 when v6 is broken or non-performant that mitigate end user complaints to the point that people can just kind of turn it on in some state of broken and forget about it. There are entire ISPs that are IPv6-only at the CPE and have to deal with brain-dead software that can't handle it and so have to spend enormous amounts on CG-NAT: * https://community.roku.com/t5/Features-settings-updates/It-s-2022-and-still-no-IPv6/m-p/854673/highlight/true#M35732 https://community.roku.com/t5/Features-settings-updates/It-s... * https://news.ycombinator.com/item?id=35047624 https://news.ycombinator.com/item?id=35047624
    - mike_d 3y ago
      That specific article is about streaming, which absolutely provides a better experience over v4. As much as we like to pretend that the presence of v6 implies a "dual stack" environment, the reality is that at the transport layer v6 is a lot of hasty hacks to make a vocal minority happy. You still can't talk to Hurricane Electric from Cogent over v6. Lots of v6 links are still tunnels. v6 PMTU Discovery was a massive mistake that introduces latency.
systems_glitch 3y ago
Just grab yourself a Hurricane Electric tunnel and be done with it. It's so irritating to work with dynamic IPv6 assignments when you're not Just Some User. Best case, your ISP has really long lease times and you can fake it being "static." Usual case is you get everything working but there are often 5-minute periods where IPv6 is down because some dynamic changes happened at the wrong time.

Faaak 3y ago

Well, tbh dual-stack is enabled in 70% of France's customers for example. If you start with a solid base (having a fixed IPv6 /56 delegation for example), or at least a dynamic allocation with IPv6-PD, then you'll see that it's way easier than IPv4 in the long end

Helmut10001 3y ago
I already get a headache when thinking of configuring firewall rules with a dynamic prefix for all my hosts.
- Astronaut3315 3y ago
  I found building rules around a dynamic prefix to be simple enough on my old EdgeRouter once I found the poorly documented magic incantation to do so. It isn’t possible on the UniFi system that replaced it. Who needs basic core functionality anyway.
  - Helmut10001 3y ago
    Yeah, pfsense apparently just solved this partly (except for aliases) [1], same with OPNsense [2], where there is still an open issue [3]. There are some declined PRs that are not "high priority" [4]. Note that I have just looked these issues up - I don't have insight into any of these. This is not meant as ranting. [1]: https://redmine.pfsense.org/issues/6626 [2]: https://github.com/opnsense/core/issues/2544 [3]: https://github.com/opnsense/core/issues/6158 [4]: https://github.com/opnsense/core/pull/5574
mike_d 3y ago
Advocates often drag out the [large number]% of IPv6 in some case or another. It is only thanks to "happy eyeball" algorithms in the browser which prefer v4 when v6 is broken or non-performant that mitigate end user complaints to the point that people can just kind of turn it on in some state of broken and forget about it.
- throw0101b 3y ago
  > It is only thanks to "happy eyeball" algorithms in the browser which prefer v4 when v6 is broken or non-performant that mitigate end user complaints to the point that people can just kind of turn it on in some state of broken and forget about it. There are entire ISPs that are IPv6-only at the CPE and have to deal with brain-dead software that can't handle it and so have to spend enormous amounts on CG-NAT: * https://community.roku.com/t5/Features-settings-updates/It-s-2022-and-still-no-IPv6/m-p/854673/highlight/true#M35732 https://community.roku.com/t5/Features-settings-updates/It-s... * https://news.ycombinator.com/item?id=35047624 https://news.ycombinator.com/item?id=35047624
  - mike_d 3y ago
    That specific article is about streaming, which absolutely provides a better experience over v4. As much as we like to pretend that the presence of v6 implies a "dual stack" environment, the reality is that at the transport layer v6 is a lot of hasty hacks to make a vocal minority happy. You still can't talk to Hurricane Electric from Cogent over v6. Lots of v6 links are still tunnels. v6 PMTU Discovery was a massive mistake that introduces latency.

systems_glitch 3y ago

Just grab yourself a Hurricane Electric tunnel and be done with it. It's so irritating to work with dynamic IPv6 assignments when you're not Just Some User. Best case, your ISP has really long lease times and you can fake it being "static." Usual case is you get everything working but there are often 5-minute periods where IPv6 is down because some dynamic changes happened at the wrong time.