5 ms·

Some noob questions here. How does one buy a block of IPv4 as an individual? (If that's allowed) After you purchase it, how does it come into your possession?

by yla92 3y ago

Some noob questions here. How does one buy a block of IPv4 as an individual? (If that's allowed) After you purchase it, how does it come into your possession? How do you utilize them?

TheHappyOddish 3y ago
Speak to the local RIR[1]. They have varying requirements, but broadly you generally need to justify your use case, multi-home (for your own AS) and pay a yearly membership fee. After that, you need to speak to your ISP about either advertising it or peering with you - or going dark fibre if you're a real masochist. Good luck, update us if you do it! 1. https://en.wikipedia.org/wiki/Regional_Internet_registry https://en.wikipedia.org/wiki/Regional_Internet_registry
- x86x87 3y ago
  Yeah usually you won't be able to buy one if you don't have your own AS
  - TheHappyOddish 3y ago
    In my area, the AS is usually provided 'free' with your membership.
deleted 3y ago
[deleted]
candiddevmike 3y ago
1. You most likely can't. You typically need to prove to a numbering authority that you need that many IPs (minimum /24) for X reason and you will be multihomed (connected to two+ ISPs) by Y date. 2. You are assigned a BGP Autonomous System Number (ASN) as part of the process. The IPs are assigned to your ASN. 3. You sign a peering contract with ISPs and peer with them using BGP on your router. You use your ASN to announce your block to have traffic routed to/from your router. One of the tragedies of IPv6, IMO, is not having a better/streamlined process for end users to get allocations without all the red tape. There's tons of space, let's pretend it's the 90s and give away IP blocks to whoever asks. Either require ISPs to give static allocations or make it easier for getting a personal block. No, prefix delegation is not good enough.
- fanf2 3y ago
  There is still some anxiety about the size of the global routing table. Handing out IPv6 prefixes for free would make the growth much harder to control. (Not that there is much control beyond RIR membership fees.) Also, there is no organization that can require anything of an ISP’s addressing plan. The IETF and the RIRs are associations, not governing bodies.
- namibj 3y ago
  Prefix delegation naturally follows physical hierarchy, keeping routing tables compact. Mandating something like a static /56 (physical location locked) to be available at no extra cost if the customer asks for it, would work fine, though. I'd even accept requiring this only for contracts that allow more than one customer device to access the Internet simultaneously. Yes, a phone plan with two SIMs on one contract would already trigger this.
- minimaul 3y ago
  It's a little tricky - the more unique v6 allocations we have, the more complex routing gets, and the more resources it needs. Having a ton of people/businesses with their own announced and unaggregatable /48s would add a lot of entries to routing tables.
- Veliladon 3y ago
  >One of the tragedies of IPv6, IMO, is not having a better/streamlined process for end users to get allocations without all the red tape. There's tons of space, let's pretend it's the 90s and give away IP blocks to whoever asks. Either require ISPs to give static allocations or make it easier for getting a personal block. No, prefix delegation is not good enough. This is by design. If we let arbitrary routings of /64 blocks pollute the global routing table shit is going to go sideways as the rest of the net scales up and up. We made that mistake with IPv4 and the only reason our routers haven't gone thermonuclear keeping up with the announced routes is we literally ran out of address space. We're not going to get the IPv6 equivalent of IPv4 /24s announced ever again. While minimum prefix lengths aren't hard enforced (yet), unless you have the means/reason to be multihomed using /48s you're pretty much going to be under the hierarchical routing of your transport or last mile provider.
atyvr 3y ago
You'll need to become a member of one of the regional Internet route registries, like RIPE or ARIN. Then you can buy, say a /24, and transfer it into your RIPE/ARIN account. Now you have your own IPv4 range. And you can start for example start to use it for your own servers. To do so you need to "announce" this new /24 to the internet, using a protocol known as BGP. You can do that yourself, using a router, assuming you have an Autonomous system number (AS). You can get these via RIPE or ARIN as well. Or rely on your hosting provider to do that. For example AWS support "bring your own IP address". In that case they will announce the ip prefix in BGP for you, and you can assign your ec2 instances public IP's out of your range. Equinix Metal, (previously Packet), also makes it easy to do this.
- j16sdiz 3y ago
  Before you can "announce" a prefix, you need an ISP willing to peer with you. BGP is a very insecure protocol. Most of its "security" are enforced by money and contract.
  - greyface- 3y ago
    > BGP is a very insecure protocol. Take a look at the state of RPKI. ROA validation is common these days, and ASPA validation will be common soon. You still need to manually validate that your peer truly represents the AS that they claim to, but if that's been done, ROA+ASPA validation prevents unauthorized announcements. Absent RPKI, people have been filtering based on IRR for ages, which will not necessarily prevent unauthorized announcements, but will require an attacker to leave a paper trail when making one.
- notyourwork 3y ago
  Thank you for this reply. I learned a lot from it.
- Alifatisk 3y ago
  > To do so you need to "announce" this new /24 to the internet, using a protocol known as BGP. You can do that yourself, using a router, assuming you have an Autonomous system number (AS). Is this how BGP hijacking is done?
kxrm 3y ago
I actually went through this process with ARIN. So I can give you that perspective. It wasn't a big deal, the only minor concern I had was it felt like you're encouraged to sign up under a business entity. I had an LLC, so it was natural just to use that. I don't know what kind of vetting they do if you decide to use yourself as an organization though instead of a different legal entity. You need to provide justification, and frankly it's not that big of a challenge to get a /22 which is what I got. As long as you can show how you would like to use them and over what time frame, they will allow you to go through with the acquisition. An ASN is not required to get any IP block. You can always associate your IPs with any ASN that you want so long as that ASN owner is cooperating with you. I went ahead and grabbed an ASN for ease but some ISPs will allow you to use their ASN. You also do not have to purchase an IPv4 block from someone. You can go through the normal IPv4 request process, however the waitlist [1] is now over a year long for IPv4. However IPv6 are given out very quickly. IPs you acquire this way are "free" to acquire with your ARIN membership. Your membership dues are determined by the assets you hold, there is a fee schedule [2] and you need to pay it annually to maintain your membership and ASN/IP assignments. I encourage anyone interested in understanding this process to go through it, it didn't take a ton of time nor did it cost a lot in the grand scheme of things. Being an ARIN member also entitles you to be a part of how IPs are governed in the region you acquired them in. They will occasionally send out surveys and you can vote on issues. [1] https://www.arin.net/resources/guide/ipv4/waiting_list/ https://www.arin.net/resources/guide/ipv4/waiting_list/ [2] https://www.arin.net/resources/fees/fee_schedule/ https://www.arin.net/resources/fees/fee_schedule/
- CMCDragonkai 3y ago
  I'm curious if one were to be certain nation state and was happy being a completely isolated intranet, that they would just exit such arin or related associations and just create their own governing body of IP allocations? In such a case such an internet would be a completely separate internet right? I wonder if sanctions may ever apply to the internet itself and we may see a break up of the internet into regional internet's. And if we want to ensure global connectivity these associations would need to be completely independent and voluntary standard and such fees would be paid to an international standards body not beholden to any particular nation's whims? What if nations started adding intercontinental NAT gateways acting as the entry and exit points between their national boundaries and the rest of the world.

by yla92 3y ago

Some noob questions here. How does one buy a block of IPv4 as an individual? (If that's allowed) After you purchase it, how does it come into your possession? How do you utilize them?

TheHappyOddish 3y ago

Speak to the local RIR[1]. They have varying requirements, but broadly you generally need to justify your use case, multi-home (for your own AS) and pay a yearly membership fee. After that, you need to speak to your ISP about either advertising it or peering with you - or going dark fibre if you're a real masochist. Good luck, update us if you do it! 1. https://en.wikipedia.org/wiki/Regional_Internet_registry https://en.wikipedia.org/wiki/Regional_Internet_registry

x86x87 3y ago
Yeah usually you won't be able to buy one if you don't have your own AS
- TheHappyOddish 3y ago
  In my area, the AS is usually provided 'free' with your membership.

deleted 3y ago

[deleted]

candiddevmike 3y ago

1. You most likely can't. You typically need to prove to a numbering authority that you need that many IPs (minimum /24) for X reason and you will be multihomed (connected to two+ ISPs) by Y date. 2. You are assigned a BGP Autonomous System Number (ASN) as part of the process. The IPs are assigned to your ASN. 3. You sign a peering contract with ISPs and peer with them using BGP on your router. You use your ASN to announce your block to have traffic routed to/from your router. One of the tragedies of IPv6, IMO, is not having a better/streamlined process for end users to get allocations without all the red tape. There's tons of space, let's pretend it's the 90s and give away IP blocks to whoever asks. Either require ISPs to give static allocations or make it easier for getting a personal block. No, prefix delegation is not good enough.

fanf2 3y ago
There is still some anxiety about the size of the global routing table. Handing out IPv6 prefixes for free would make the growth much harder to control. (Not that there is much control beyond RIR membership fees.) Also, there is no organization that can require anything of an ISP’s addressing plan. The IETF and the RIRs are associations, not governing bodies.
namibj 3y ago
Prefix delegation naturally follows physical hierarchy, keeping routing tables compact. Mandating something like a static /56 (physical location locked) to be available at no extra cost if the customer asks for it, would work fine, though. I'd even accept requiring this only for contracts that allow more than one customer device to access the Internet simultaneously. Yes, a phone plan with two SIMs on one contract would already trigger this.
minimaul 3y ago
It's a little tricky - the more unique v6 allocations we have, the more complex routing gets, and the more resources it needs. Having a ton of people/businesses with their own announced and unaggregatable /48s would add a lot of entries to routing tables.
Veliladon 3y ago
>One of the tragedies of IPv6, IMO, is not having a better/streamlined process for end users to get allocations without all the red tape. There's tons of space, let's pretend it's the 90s and give away IP blocks to whoever asks. Either require ISPs to give static allocations or make it easier for getting a personal block. No, prefix delegation is not good enough. This is by design. If we let arbitrary routings of /64 blocks pollute the global routing table shit is going to go sideways as the rest of the net scales up and up. We made that mistake with IPv4 and the only reason our routers haven't gone thermonuclear keeping up with the announced routes is we literally ran out of address space. We're not going to get the IPv6 equivalent of IPv4 /24s announced ever again. While minimum prefix lengths aren't hard enforced (yet), unless you have the means/reason to be multihomed using /48s you're pretty much going to be under the hierarchical routing of your transport or last mile provider.

atyvr 3y ago

You'll need to become a member of one of the regional Internet route registries, like RIPE or ARIN. Then you can buy, say a /24, and transfer it into your RIPE/ARIN account. Now you have your own IPv4 range. And you can start for example start to use it for your own servers. To do so you need to "announce" this new /24 to the internet, using a protocol known as BGP. You can do that yourself, using a router, assuming you have an Autonomous system number (AS). You can get these via RIPE or ARIN as well. Or rely on your hosting provider to do that. For example AWS support "bring your own IP address". In that case they will announce the ip prefix in BGP for you, and you can assign your ec2 instances public IP's out of your range. Equinix Metal, (previously Packet), also makes it easy to do this.

j16sdiz 3y ago
Before you can "announce" a prefix, you need an ISP willing to peer with you. BGP is a very insecure protocol. Most of its "security" are enforced by money and contract.
- greyface- 3y ago
  > BGP is a very insecure protocol. Take a look at the state of RPKI. ROA validation is common these days, and ASPA validation will be common soon. You still need to manually validate that your peer truly represents the AS that they claim to, but if that's been done, ROA+ASPA validation prevents unauthorized announcements. Absent RPKI, people have been filtering based on IRR for ages, which will not necessarily prevent unauthorized announcements, but will require an attacker to leave a paper trail when making one.
notyourwork 3y ago
Thank you for this reply. I learned a lot from it.
Alifatisk 3y ago
> To do so you need to "announce" this new /24 to the internet, using a protocol known as BGP. You can do that yourself, using a router, assuming you have an Autonomous system number (AS). Is this how BGP hijacking is done?

kxrm 3y ago

I actually went through this process with ARIN. So I can give you that perspective. It wasn't a big deal, the only minor concern I had was it felt like you're encouraged to sign up under a business entity. I had an LLC, so it was natural just to use that. I don't know what kind of vetting they do if you decide to use yourself as an organization though instead of a different legal entity. You need to provide justification, and frankly it's not that big of a challenge to get a /22 which is what I got. As long as you can show how you would like to use them and over what time frame, they will allow you to go through with the acquisition. An ASN is not required to get any IP block. You can always associate your IPs with any ASN that you want so long as that ASN owner is cooperating with you. I went ahead and grabbed an ASN for ease but some ISPs will allow you to use their ASN. You also do not have to purchase an IPv4 block from someone. You can go through the normal IPv4 request process, however the waitlist [1] is now over a year long for IPv4. However IPv6 are given out very quickly. IPs you acquire this way are "free" to acquire with your ARIN membership. Your membership dues are determined by the assets you hold, there is a fee schedule [2] and you need to pay it annually to maintain your membership and ASN/IP assignments. I encourage anyone interested in understanding this process to go through it, it didn't take a ton of time nor did it cost a lot in the grand scheme of things. Being an ARIN member also entitles you to be a part of how IPs are governed in the region you acquired them in. They will occasionally send out surveys and you can vote on issues. [1] https://www.arin.net/resources/guide/ipv4/waiting_list/ https://www.arin.net/resources/guide/ipv4/waiting_list/ [2] https://www.arin.net/resources/fees/fee_schedule/ https://www.arin.net/resources/fees/fee_schedule/

CMCDragonkai 3y ago
I'm curious if one were to be certain nation state and was happy being a completely isolated intranet, that they would just exit such arin or related associations and just create their own governing body of IP allocations? In such a case such an internet would be a completely separate internet right? I wonder if sanctions may ever apply to the internet itself and we may see a break up of the internet into regional internet's. And if we want to ensure global connectivity these associations would need to be completely independent and voluntary standard and such fees would be paid to an international standards body not beholden to any particular nation's whims? What if nations started adding intercontinental NAT gateways acting as the entry and exit points between their national boundaries and the rest of the world.