11 ms·
Enabling IPv6 support for IPv4-only apps on Linux
- imoverclocked 3y agoSuper cool! I tried doing a pure IPv6 network a little over a decade ago; Maybe I’ll try it again. Though, my cheap IoT devices likely still need IPv4… but perhaps not internet connectivity. It might be fun to explore just how much IPv4 continues to be ingrained into cheap Things (eg: Arduino WiFI?) There always seems to be a long tail of small places where IPv4 pops straight back into the equation.
- red_trumpet 3y agoSmall places? When I disabled IPv4 a few weeks ago, I couldn't use: HN, GitHub, Reddit, Discord, Duckduckgo.
- broeng 3y agoAlmost sounds like a productivity enhancement.
- roygbiv2 3y agoAlso Android doesn't support DHCPv6
- piperswe 3y agoWhat's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all)
- chungy 3y agoYou can do finer-grained subnets with DHCP than SLAAC will give you.
- darkr 3y agoAs a general rule, if you're deploying IPv6 subnets sized as anything other than /64, you're doing it wrong
- tsimionescu 3y agoThe only reason for that "rule" is SLAAC.
- darkr 3y agoActually it's primarily due to NDP and EUI-64. Eliminating ARP is a very good thing for reasons of scalability, reliability and security.
- tsimionescu 3y agoNDP doesn't impose any restrictions on IP addresses, it uses special prefixes anyway. EUI-64 is a part of SLAAC, not NDP. Finally, NDP is not really any more secure at least than ARP (at least not if you don't implement SEND as well, which I'm not sure if anyone does, at least in consumer networks). Not sure about reliability or scalability either.
- p1mrx 3y agoI think SLAAC's /64 limit functions as a "trojan horse" forcing ISPs to give everyone at least 64 bits of address space. Most would allocate /112-/128 per customer if it were slightly easier. Designing the internet with lots of unused space at the edges will probably be useful in 100 years.
- tsimionescu 3y agoRegardless of the /64 limit, I expect DHCPv6 will win out in the consumer side (with ISPs giving customers pre-configured wifi routers with DHCPv6 already configured). SLAAC is both very complicated, and its privacy extensions are anyway not something ISPs have been friendly to even if it weren't such an extra hassle.
- sgjohnson 3y agoall of the DHCP options, for example. SLAAC just tells the endpoint device to self-assign an address and to roll with it. For example, there’s no way to pass in DNS servers with SLAAC.
- MayeulC 3y agoCan't you provide DNS servers as part of router advertisement packets ? RFC8106
- sgjohnson 3y agoI stand corrected, but I haven't seen this in practice yet.
- magicalhippo 3y agoThis requires client support though, which isn't a given.
- stephen_g 3y agoI expect basically anything that supports SLAAC would have supported DNS advertisements for at least a few years…
- ArchOversight 3y agoThat is most operating systems and devices these days.
- rnhmjoj 3y agoThe DNS bit it's not true: there's RFC8106 [1] for this and it's widely supported. You can set a list of DNS servers to use (RDNSS) and a domain suffix for resolving unqualified hostnames (DNSSL), exactly as for DHCP. [1]: https://datatracker.ietf.org/doc/html/rfc8106 https://datatracker.ietf.org/doc/html/rfc8106
- throw0101a 3y ago> What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all) In corporate-y environments it allows for easier tracking of user-MAC-IP mappings for auditing purposes. If you use SLAAC there is no auto-logging as the client simply picks an address itself. One way to do tracking with SLAAC could be to SNMP scrape/trap ipNetToPhysicalTable of RFC 4293. Another would be 802.1X or MAC authentication (interim) accounting via RADIUS (RFC 2866).
- aidenn0 3y agoThe primary advantage is you can delegate prefixes over DHCP, but that probably doesn't matter for most Android devices There are other advantages too, like if you want to assign specific addresses to specific devices without having to configure each device separately.
- Dagger2 3y agoThose all work for me, on my v6-only desktop. (I don't use Discord, but their homepage loads at least.) None of those sites have v6 though, so you'll need some form of backwards compatibility running to reach them. Presumably you were missing that.
- shapefrog 3y agoDocker hub was the one that pushed me over the edge, so I just paid the extra 50c a month per server for ipv4 on cloud servers. Update - 23 Aug 2023 — Today, we are pleased to announce the general availability of IPv6 support for the Docker Hub Registry Apparently it can be done now, I wont be finding out in a hurry.
- hkgjjgjfjfjfjf 3y ago[dead]
- dehrmann 3y agoI don't have IPv6 enabled. Literally everything works.
- BenjiWiebe 3y agoCongrats on having a non-CGNAT Internet connection available.
- nelgaard 3y agoplus these individual devices will live for a long time. I recently had to setup a non-encrypted website because I have a few old devices that can no longer do HTTPS. IPv4 on local networks will probably exist for a very long time.
- dspillett 3y ago> I recently had to setup a non-encrypted website because I have a few old devices that can no longer do HTTPS. That sounds like they haven't been updated for TLS>1.1 – if that is the case then rather than going all the way down the HTTP you could enable TLS1.1 (and maybe 1.0). It is open to POODLE/BEAST/others that way, but still have some protection and the site's configuration differs less from the rest of your infrastructure. Unless the site is completely internal only of course, in which case just sticking with HTTP may be less faf.
- tsimionescu 3y agoIs there any way to get a certificate that these old devices would trust and that would work over TLS < 1.2?
- nelgaard 3y agoNo, that is the problem. They worked with less and less websites until there were none left. I needed to install some packages, which I could just put on my own server. And I have an old Blackberry Bold that now show current electricity prices, so I know when to starte my washing machine. That can also run on own webserver. https://gitlab.com/nelgaard/elpriser https://gitlab.com/nelgaard/elpriser
- toast0 3y agoTechnically the certificate issues are separate from the protocol versioning. It's just that clients that don't support TLS 1.2 often also don't support sha2 certificates or may not have a path to validate certificates from currently available CAs (although you can usually push through that; no protocol support and no cert signature support is not a user bypass prompt) As a side note, barely anything supports TLS 1.1 but not TLS 1.2
- zekica 3y agoIf the network already supports NAT64 I would use CLAT running on the system. That way you don't need LD_PRELOAD.
- Kaxo 3y agoI feel the exact opposite. I've recently been experimenting with ipv6 only via NAT64/DNS64 and run into the same problem (with steam trying to connect out to hard-coded ipv4 addresses). I started to look into CLAT and really didn't want to have to go through the hassle of a whole new virtual interface with routes etc, when one single app can't just pass a couple different args to connect(). I actually had thought about trying to write something exactly like this myself. I'm glad to learn it already exists.
- trustingtrust 3y ago> To prove that IPv6 is ready for production use No one is debating it's not ready for production use. It's just that it's a lot easier to configure clients in dual stack than do a 6 to 4 translation.
- deleted 3y ago[deleted]
- heartjudytenuta 3y ago"To prove that IPv6 is ready for production use, I built a second PC so I can access the IPv4 Internet"
- viraptor 3y agoBeing able to access legacy systems from new ones is a good property of new systems. This workaround is important. (Also that may be done on routers which today deal with NAT anyway)
- heartjudytenuta 3y agoThis isn't a workaround; it is a kludge. There are far better solutions in this problem space (some mentioned in this very thread).
- Bluecobra 3y agoYeah I don't get it. If you need to access IPv4 for legacy reasons then dual stack seems like the solution here. Yes it's a lot of overhead since you have to deal with an IPv4 and IPv6 routing table. AFAIK Windows has had both enabled by default for a long time.
- usr1106 3y agoAn average user is not expected to do that. But I understand there are mobile operators out there who have been doing this (instead of NAT) for a while because they don't have IPv4 addresses for every consumer subscription? Wasn't T-Mobile US one of them? (Not living in the US.)
- BlueTemplar 3y agoAn average user shouldn't be able to find hardware not supporting IPv6, because it shouldn't be allowed to be sold. (And soon, hardware supporting IPv4.) Just like it happened with digital TV standards.
- usr1106 3y agossh 64:ff9b::1.3.3.7 What address syntax is that? I mean I can easily guess what it means, but I wasn't aware such mixture exists. Do connect(2) and friends support that?
- g232089 3y agoIt's an RFC6052 address.
- usr1106 3y agoThanks for the pointer. Actually RFC6052 just refers to RFC4291 from 2006 in this case. And that simply calls it an alternative representation. Edit: RFC1884 from 1995 already had it, nothing has changed in that aspect.
- chungy 3y agoIt's an IPv4-mapped IPv6 address. Just interpret the IPv4 address like it's the last 32 bits of the v6 address. In the example, 64:ff9b::103:307 is equivalent. A more complicated example might be akin to 64:ff9b::198.51.100.231, equivalent to 64:ff9b::c633:64e7.
- pavel_odintsov 3y agoThank you very much for this question. I've rewrote and improve my article to cover exactly this topic: https://pavel.network/building-gateway-to-access-legacy-ipv4-internet-from-ipv6-only-work-laptop/ https://pavel.network/building-gateway-to-access-legacy-ipv4...
- blueflow 3y agoThe main advantage of Linux over other systems is that its available from source and thus can be patched and recompiled easily. Here we see someone using LD_PRELOAD to patch the behavior of a binary, because they rely on distributions pre-compiled packages without means to change the source code themselves. This sort of negates that advantage, right?
- nightfly 3y agoHaving an additional way to effect changes in behavior without recompiling an application hardly negates the benefit you described. They don't say the _cant_ or _couldn't_ change the source themselves either. And what you described is hardly the main advantage of Linux, FreeBSD enables that _much_ easier.
- yrro 3y agoI don't think openssh upstream would accept a patch that makes ssh interpret ipv4 addresses as anything other than ipv4 addresses, and who wants to carry such a patch downstream forever?
- blueflow 3y agoYou don't need to merge upstream! Its your source, your build, your rules.
- yrro 3y agoAnd if you're happy to take on that work (and the associated risk) forever, go for it. For others, hacks like tnat64 work fine. They also work for lots of programs, where patching each one individually to somehow detect that it's behind NAT64 and behave differently is a lot of work!
- londons_explore 3y agoMaintaining your own patchset for your personal use is usually not a good use of your time and expertise. Every time someone runs a linter over upstream, you're going to have to remake that patch. Sure, it's only 20 mins... But that multiplied by every bit of software you patch and every release, and you quickly realise that a huge chunk of your life was wasted doing what is effectively busywork. Instead, contribute your time and efforts back to upstream, and now your efforts can help millions of people not just one. If others do the same, you'll see far more improvements to the software you use than you alone could ever write and maintain.
- sschueller 3y agoDoes anyone have a good write up of taking ones home network and going 100% ipv6 including dealing with iot devices that can't? I am thinking of doing it but I have a huge mix of devices from linux to windows and servers.
- m463 3y agoI'm 100% the opposite. Define everything ipv4, turn off ipv6 and have one set of private ip addresses, one set of firewall rules and NAT at the firewall/router.
- hot_gril 3y agoYep, first thing I always do on a new router or PC is get out of the dual stack situation by disabling v6.
- menthe 3y agoThere's absolutely _no_ good reason to do that if you're only facing the internet with a single IP on your router as a NAT gateway, except to make your life hell. Only thing that may be worth doing is parting ways with the one internet-facing IPv4 and relying solely on IPv6 there, but that's mostly up to your ISP and their own infrastructure. Even if you were to 100% NAT your IPv4 LAN to IPv6 WAN, and your ISP still dedicated your router a public IPv4, it'd benefit no one.
- BlueTemplar 3y agoWhy wouldn't you be able to disable IPv4 in the router ? Also, isn't trying to run both IPv4 and IPv6 inherently a security issue coming from the complexity of dealing with two overlapping networks with very different logic ?
- simiones 3y agoThen how would you reach the IPv4-only internet (i.e. a large part of the Internet)?
- londons_explore 3y agoWhy is this not just default behaviour? If I don't have IPv4 connectivity, yet a 6-to-4 gateway exists and I have IPv6 connectivity, and some app tries to use IPv4, then clearly the gateway should be used. How about some sysfs config option that says "redirect ipv4 to 6to4 gateway if no default ipv4 route exists", enabled by default.
- yrro 3y agoI'm sure LKML will be happy to review your proposed patch... :)
- xerces8 3y agoProbably due to side effect.
- xerces8 3y agoUh, I mean: side effects It would probably have undesired effect... effects! Why does it autocorrect to effect??... in some cases.
- the8472 3y agoThis is probably something you can setup with netfilter, not a sysfs knob.
- ignoramous 3y ago> How about some sysfs config option that says "redirect ipv4 to 6to4 gateway if no default ipv4 route exists", enabled by default. There are various 6to4 on-ramps that solve this. Popular ones are NAT64/DNS64, 464Xlat, and DS-Lite. In my experience, DS-Lite works nicely with v4-only apps/services or v6-only apps/services.
- gorkish 3y agoYeah I agree this does seem like something that really ought to simply be configurable out of the box with options for transparently handling both 6-to-4 and 4-to-6 when the appropriate services are discoverable or configured on the network. The top level reply here discussing how MacOS handles it seems like something that should be able to be recreated with iptables, but when searching I am extremely surprised to discover that Linux does not seem to have the ability to do anything similar. It seems most solutions focus on using socat in userspace to proxy data between the sockets which is not really a practical solution.
- xerces8 3y agoAnd me living here and now with no ipv6 at all. (they say my or most ISP can enable ipv6 on reuest; country : Slovenia, year : 2023)
- unmole 3y agoI moved to a new place ~600 meters away and had to go from having IPv6 over FTTH to IPv4 over copper. It's been over 6 months but I still can't get over it.
- loondri 3y agoI think retrofitting IPv4-only apps for IPv6 compatibility might be a short-term fix. It could be more forward-thinking to focus on developing new apps with inherent IPv6 support to prevent accruing technical debt and facing complications tied to maintaining outdated IPv4-only applications.
- BlueTemplar 3y agoPlease name and shame software/hardware that doesn't support IPv6 released after 2017 (when the IPv6 standard was finally finalized).
- SSLy 3y agoAny android phone
- crote 3y agoAndroid has had support for IPv6 since at least 2014, and there are plenty of mobile networks which are IPv6-only and work just fine with Android phones doing CLAT. The only thing missing is DHCPv6, and that's a deliberate decision - albeit a somewhat controversial one.
- janc_ 3y agoWhat do you mean? My Android phone does IPv6?
- WorldMaker 3y agoiOS app certification requires IPv6 support. Several mobile carriers only support IPv6 (with big carrier NAT64 gateways). In general, consumer apps and consumer APIs are being developed with IPv6 support. The new apps to name and shame for not natively supporting IPv6 in 2023 are mostly corporate and Big Enterprise.
- sargun 3y agoI made a Terrible decision of a project at Netflix. The idea was that you could swap out an IPv4 (AF_INET/SOCK_STREAM) socket with an AF_INET6 one. Turns out actually doing this with the Linux kernel is exceptionally difficult. You can swap out the underlying sk, but doing it safely is damn near impossible because the two data structures aren’t really built like that. One day, I’d love if someone added the ability to swap Unix sockets for TCP sockets at runtime to the kernel — for other reasons.
- endre 3y agoTell us more about Netflix experimental projects like this.
- dezgeg 3y agoDid you try just dup2()'ing a new socket file descriptor over the old socket file descriptor? Probably it bring other kinds of problems, but would be interesting to hear what they are.
- sargun 3y agoYep. You lose sockopts (trivially restorable), async ownership (less trivially restorable, but with some kernel patches, it’s possible), and epoll registration (which omg, wtf.). The other problem is that we found runtimes that would immediately send data after a non blocking connect (or receive data), and you needed a way to kick these off again. It was really a nightmare to restore all that state in a running socket. The real solution was to add a new address family, and patch the kernel (as opposed to a module), that could dynamically switch back and forth (think AF_KCM). Unfortunately, I never got around to that.
- finaard 3y agoWould be interesting to know which applications actually have problems with v6 - the example with directly using a v4 IP is more a user error, not an application issue. I pretty much stopped submitting patches enabling v6 functionality to various projects back in 2005 as everything I cared about was working at that point. (Side note, I was just trying to search a few of those - but seems that period pretty much doesn't exist in search engine caches anymore. I knew the state of preserving internet history is bad, but I didn't expect it to be _that_ bad)
- yetanotherloss 3y agoThere seem to be hard cuts in search returns at 5 and 10 years, it's been really difficult to find anything from before 2012 without incredibly specific searches. Lots and lots of link rot too so it's hard to say how much of that is google/bing/etc.
- Faaak 3y agoThe folding@home client, for example, is written in C with a "does everything" library (called cbang if I recall correctly). The library only uses sockets with AF_INET and thus it doesn't work even with AAAA records..
- nova77hn 3y agoWSL2 famously doesn’t support ipv6 (because of NAT) which is mightily annoying.
- ajsnigrutin 3y agoWhy is NAT a problem here? IPv6 supports full NAT (no matter that the basic idea of ipv6 is "no nat").
- uxp8u61q 3y agoThe prerelease finally supports ipv6: https://github.com/microsoft/WSL/releases https://github.com/microsoft/WSL/releases
- josephcsible 3y ago
- simiones 3y agoInstead of doing something like `export A="64:ff9b::"` and then using `ssh $A1.3.3.7`, it's apparently much easier to install a new software package and do `export LD_PRELOAD=/the/new/package` and hope it doesn't break anything...
- nelgaard 3y agothe easiest would be to add to ~/.ssh/config: host *.*.*.* hostname 64:ff9:%h (without the empty line) Also work with scp, rsync,
- cramjabsyn 3y ago6 to 4 is pretty easy with socat but comes with the downsides of being a userspace l3 proxy
- ninkendo 3y agoComing from the Apple ecosystem, this is solved on macOS/iOS by a native implementation of 464XLAT on the device (particularly the CLAT relay part.) If you have a working NAT64/DNS64 setup, macOS can make a AAAA (ipv6 DNS) request to ipv4only.arpa, and observe the form the result comes back as, in order to learn the IPv6 prefix used for IPv4 compatibility on the network (eg. 64:ff9b::/96), and if it's not given an IPv4 address via DHCP, will set up a local interface at 192.0.0.1 that is the default route for all IPv4 traffic. Anything sent to this interface will translate the address to the corresponding IPv6 compatibility address and send it to your IPv6 router (which should use NAT64 to send it to the destination.) In this sense, you don't need any IPv4 infrastructure at all in your network (no DHCP, etc) and all traffic on your LAN will be IPv6, but IPv4-only apps (including those that hardcode IPv4 addresses and try to connect to them) work fine. A quick web search says that linux has a similar thing implemented as a userspace daemon (clatd) which presumably does something similar, and importantly doesn't rely on LD_PRELOAD hacks like this article suggests (LD_PRELOAD doesn't work with static binaries like those written in Go, for instance.)
- e61133e3 3y agoWhere can I find documentation about this?
- WirelessGigabit 3y agoT-Mobile has it in the USA for their mobile network. https://archive.nanog.org/sites/default/files/wednesday_general_byrne_breakingfree_11.pdf https://archive.nanog.org/sites/default/files/wednesday_gene...
- WirelessGigabit 3y agoThe largest problem with this is that that this IPv6 router lives outside of your devices. It lives somewhere at the ISPs infrastructure. And this causes a massive headache when it comes to systems that track you based on your IPv4 address. For example there are applications that track you by your IP address. And if you want to opt-out they refuse because the IPv4 address you give them is owned by T-Mobile. Also, it completely breaks stateless applications. When you have an IPv4 <> IPv4 UDP tunnel you can just send traffic. If one device is behind NAT you set up port forwarding. It'll work today, it'll work tomorrow, and in 2 years. The tunnel that the NAT64 system sets up is time-bound. So while outgoing traffic re-establishes the route, incoming traffic is not stateless. It stops. I have this issue with WireGuard and iOS. The iOS implementation sadly prefers A over AAAA. So when I'm on 5G it connects over a NAT64 route, but due to the NAT64 route dropping after x time push notifications break. When you then turn on the phone, some traffic re-establishes the NAT64 tunnel and all of the sudden you get a whole bunch of notifications.
- kuon 3y agoDiscord hardcodes ipv4 addresses and will not work for webrtc calls in DNS64 setup. In 2023 I consider it an insult to the internet as a whole.
- giancarlostoro 3y agoI'm of the opinion that IPv6 is old enough that the fact we have not hopped to it yet means its not happening anytime soon. I wanted it back in 2008 when I first learned about it, and I know its older than that (90s iirc) so its either going to come one day "abruptly" by force and break half the internet, or people will do hacks to maintain IPv4 as is. I think the only way IPv6 will ever become mainstream is if either the EU or US Congress pass a bill making it the preferred IP standard.
- kuon 3y agoYeah, we need more incentive. Ipv6 is harder to implement yes, it is true, there is no point in denying this and arguing it solves tons of problem (it does). Most companies have ipv4 experience and it's just simpler. There must be some political pressure to make it move. But "hopefully" the economical pressure is starting to build up, a lot of providers are cheaper in ipv6 only configuration. Still, for a company like discord, not even using host names to allow DNS64 is really sad.
- photonbeam 3y agoPlenty of big sites have no AAAA record even
- pavel_odintsov 3y agoIt can be easily sorted out with DNS64 and NAT64: https://pavel.network/building-gateway-to-access-legacy-ipv4-internet-from-ipv6-only-work-laptop/ https://pavel.network/building-gateway-to-access-legacy-ipv4...
- 3y ago
- maltris 3y agoI kid you not, WordPress.org does not support IPv6 to fetch plugins, themes etc. https://meta.trac.wordpress.org/ticket/3090 https://meta.trac.wordpress.org/ticket/3090 "The WordPress.org systems team DO have IPv6 plans, but at present there are higher priority tasks and there's no widespread requirement for IPv6 connectivity." Its not possible to run a WordPress instance and auto-update with IPv6-only and without any kind of adress translation.
- giancarlostoro 3y agoSo when and how will IPv6 become the absolute standard? I presume an act of government law would do it, otherwise, if tech companies got together to force the change en masse, that would also do it. I don't understand why IPv6 has not become more prevalent over the coming years. Seems like we're taking baby steps and growing in our dependence on IPv4 IPs, although based on other comments here it sounds like at least Linux and Mac have a way to handle this transparently, not sure about Windows.
- hatch_q 3y agoPossibly never, because security. NAT at least tries to hide insecure IoT device on your grandma's wifi. shodan.io has support for ipv6. With ipv4 you're somewhat restricted to devices that get public ip (corporate networks) or devices that drill a hole (uPnP/port forward). IPv6 devices are publicly visible by default and you need to manually setup firewall to filter this out (not trivial - especially for UDP and ICMP)
- lazide 3y agoEvery firewall I’ve dealt with since forever has default deny on inbound traffic, state full allow for outbound connections. Regardless of NAT or not, and regardless of how cheap it is.
- hatch_q 3y agoName one vendor? I can name you 3 that don't. Zyxel, Ubiquiti, Mikrotik. Also anything wrt based (eg. dd-wrt). In fact one of the warnings on dd-wrt official IPv6 tutorial: """ Keep in mind it can be dangerous to enable IPv6 without also having a firewall on each client that handles IPv6 packets, or having ip6tables on your router to filter incoming connections. ip6tables is NOT included by default with DD-WRT, which means your clients will be directly exposed to the Internet once you have enabled IPv6. """
- hot_gril 3y agoThis is my concern too. NAT is nice because it's stupid and secure by default. No matter how you misconfigure it, the router simply doesn't know where to forward inbound packets to, unlike a firewall which has to actively block. My assumption for routers is that they won't handle firewalls right, especially the many cheapo ones.
- ok123456 3y agoHaving to do an LD_PRELOAD to front run system calls in order to support IPv6, tells you that IPv6 is just fundamentally broken.
- pavel_odintsov 3y agoIt was more about way to fix some very broken tool. ssh was just an example. It may be proprietary app without source code available.
- Jenda_ 3y agoBut the article is about doing a LD_PRELOAD to front run system calls in order to support IPv4.
- anticristi 3y agoToo bad I live in a developing country when it comes to IPv6. Hi from Sweden!
- pavel_odintsov 3y agoThank you for great feedback! I decided to cover NAT64 and DNS64 gateway setup guide mentioned in this article briefly: https://pavel.network/building-gateway-to-access-legacy-ipv4-internet-from-ipv6-only-work-laptop/ https://pavel.network/building-gateway-to-access-legacy-ipv4...
- nerdyadventurer 3y agoNot directly related, Recently I was looking at Hetzner cloud and noticed IPv6 only server instances are cheaper, can I use such service to serve my back-end while front-end is hosted on CF pages? I think IPv4 only hardware are rare these days, Am I wrong? (BTW sorry for my dumb questions)
- Dagger2 3y agoCF is capable of reverse proxying onto a v6-only backend server. I'm not very enthused by how much of the Internet is hosted behind Cloudflare, but they're certainly convenient for this exact use-case.