6 ms·

I find IPv6 to be a very mobile centric technology. As a back-end developer and infrastructure engineer I don't see the point of it. If I used IPv6 everywhere i

I find IPv6 to be a very mobile centric technology. As a back-end developer and infrastructure engineer I don't see the point of it. If I used IPv6 everywhere in my server room outsiders could see the topology of my internal Network. NAT isn't an annoyance on the server side, it's a requirement for security. I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. They always switch because they have more than 65k servers or to support mobile better. I feel like the people in charge who say that we should all move to IPv6 are the same people that we should that say we should all move QUIC and for the same reason: mobile clients like it better. But it's just not useful on the server side.

shrimp_emoji 3y ago
Do security properly. You're just relying on a kludge that fucks up addressing which was only invented because there weren't enough addresses.
- thriftwy 3y ago
  Proper security is when everything is closed off and inaccessible by default. IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design. I hope I never get to be a DevOps and support that. Or have IPv6 in my home network. One bad firewall rule or insecure port open, and you get ransomware in your face.
  - NewJazz 3y ago
    Proper security is when everything is closed off and inaccessible by default. I have met a lot of infrastructure engineers who do that... then never give the people who need access access. So the system just sits and collects dust. You have users. Acknowledge them. The network shouldn't even be the primary security boundary to begin with. One bad firewall rule or insecure port open Firewall !== routing. Nobody said you can't run a border firewall on your home network.
    - thriftwy 3y ago
      I don't want to run a border firewall on my home network, because I am not devops, neither is my mother, who also has a home network, etc. The former sound like a management problem. One call from up above and access will appear.
      - lxgr 3y ago
        > I don't want to run a border firewall on my home network If you're running a NAT, you're already running something much more complex than that. It's not rocket science for CPE manufacturers to make "outbound connections only" the default. My home router does just that.
        djha-skin 3y ago
        More of the same with this situation. A bunch of client developers telling me how to do my job. It's such a huge risk to show people what is in my network. It's such a huge risk to the business. It makes no sense to It makes no sense to reveal that. But I suppose telling you is not worth anyone's time, you're just going to say you like it better because you're a mobile developer.
        lxgr 3y ago
        I'm responding to GP, not you, who mentioned their home network, not your business network. > you're just going to say you like it better because you're a mobile developer. Not sure what issues you have with mobile developers, but I'm not one, not that it should matter if the argument is sound.
      - yjftsjthsd-h 3y ago
        > I don't want to run a border firewall on my home network, because I am not devops, Well... too bad? Do you want security or not? > neither is my mother, who also has a home network, etc. If your hypothetical non-technical mother just buys a normal off-the-shelf router (+AP+switch+...) then it'll already have a firewall by default. It's not like end-users are expected to design/implement these things themselves.
  - Arnavion 3y ago
    What component on your router prevents a packet with destination IP 192.168.1.2 appearing on WAN from crossing over to the 192.168.1/24 LAN and reaching the device with that IP? Hint: It's the same one that also prevents IPv6 packets from making that same crossing.
    - thriftwy 3y ago
      This makes exactly zero sense. So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that work? At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP.
      - Arnavion 3y ago
        >So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Of course. Unless you add rules to allow incoming traffic, say a rule to allow incoming traffic for $LAN_MACHINE1_IP:$PORT/tcp, to cross from WAN to LAN. >At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. The reason the scenario in my previous comment doesn't work has nothing to do with NAT. The reason such a packet would be dropped is because the firewall has a rule to filter bogons on the WAN interface. More generally, your home network firewall will have a default rule to block all incoming traffic on WAN unless explicitly allowed via additional rules, and that applies to both IPv4 and IPv6. >WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP. Well if you trust your ISP so much then I assume you just have your firewall turned off always, right?
      - lxgr 3y ago
        > So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Yes! > How does that work? Stateful firewalling. It's much simpler than NAT masquerading tables. Just imagine a NAT, but with all address and port mappings being the identity function.
  - lxgr 3y ago
    Same for IPv4 and one bad port forwarding rule, no? People also don't seem to have any issues getting hit by ransomware even in a world full of IPv4-only networks and NATs.
    - djha-skin 3y ago
      Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. Most developers are so far removed from this world they have no practical experience keeping the chaos out of the network, it's very frustrating from my end.
      - lxgr 3y ago
        Well, what's the difference? Also my network (dual stack) is quite orderly as far as I can tell, thank you very much. I promise I won't ask you for help if that ever changes, if it helps :)
      - labcomputer 3y ago
        > Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. No, it's like you're a fish trying to explain flying to birds. You don't understand the fundamentals of IPv6 (among other things, in other comments you have revealed that you think IPv6 addresses are MAC-based, think Comcast is a wireless ISP, and aren't aware of stateful firewalls). You have so many misconceptions about IPv6 it's no wonder you hate it.
  - eqvinox 3y ago
    > IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design. Please refer to RFC6092 "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service" (Jan 2011) (Despite the 'recommended' in the title, this is made mandatory by other specifications.) It does exactly what you ask for: "Proper security is when everything is closed off and inaccessible by default."
  - patrakov 3y ago
    > Proper security is when everything is closed off and inaccessible by default. Not only that. PCI DSS explicitly requires hiding the network topology from outsiders - even though they cannot connect. So it is either NAT or very short-lived IPv6 addresses, and guess what - for internal audits of who did what, NAT works better.
  - justsomehnguy 3y ago
    > IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design only if you chose it be. It doesn't differ from a public routable IPv4 block at all: or you explicitly allow anything being routed to addresses in that block - or not
- djha-skin 3y ago
  Doesn't sound like you're an infrastructure engineer.
  - shrimp_emoji 3y ago
    I am absolutely not. :)
- munchler 3y ago
  Seems to me that IPv4 was invented back when cybersecurity was much less of a concern.
lxgr 3y ago
What does "useful on the server side" mean? And how useful is a server really that can't (efficiently) serve any clients because they're all on IPv6?
- yjftsjthsd-h 3y ago
  Depending on your architecture, it's easy to run dual-stack to the load balancer, and then pure IPv4 or IPv6 internally without any problems.
  - lxgr 3y ago
    That's fair. To be honest, I don't care at all what the site I'm trying to reach does internally after it terminates my connection to them via either IPv4 and IPv6 – just don't pretend that IPv6 is not a thing.
yjftsjthsd-h 3y ago
> If I used IPv6 everywhere in my server room outsiders could see the topology of my internal Network. NAT isn't an annoyance on the server side, it's a requirement for security. You can NAT IPv6, but it really sounds like you're doing security-by-obscurity, which is less than rigorous. If your servers are properly secured you should be able to publish a complete list of your servers and their IPs on your website and not impact your security at all. > I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. I have. His designs were often... aspirational.
- djha-skin 3y ago
  Of course we should do more than security by obscurity, but sometimes obscurity is the only thing we have. We need to do everything in our power to secure the servers. Of course we're going to lock the doors, but if we can also obscure what's there, we should.
  - eqvinox 3y ago
    If obscurity is the only thing you have, you have nothing. (And I say this not in jest or to be patronizing, I say this as a warning re. your security.) Whether this applies to NAT is a different question.
- thriftwy 3y ago
  That's not security by obscurity. Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. With IPv6, knowing addresses of these machines will let you spam them with packets and possibly breach them the second firewall goes down for any reason.
  - yjftsjthsd-h 3y ago
    > Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. If you have a firewall, then no amount of information will give you access either. > the second firewall goes down for any reason Is this like... a thing that you've actually seen happen? Because it really sounds like something that at best happened 20 years ago in a freak accident that will never happen again. If we're allowing equipment to just randomly break to that degree then I get to assume that your NAT will just forward incoming traffic directly to servers.
dilyevsky 3y ago
> I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. Around 10 years ago the company I worked for used ipv6 to successfully deal with huge number of ephemeral VMs. It was a great solution. I saw Fly.io using similar approach for their internal networking so I assume they did it bc they thought it was better as well. So now you have.
- djha-skin 3y ago
  So you fall in the more than 65,000 servers camp then. Of course it's great for ephemeral stuff. It's just that most people don't have that problem and it's a huge pain to use it for anything else. So no, I haven't.
  - dilyevsky 3y ago
    Spoken like a person who clearly never had to peer two vpcs that just happened to have intersecting subnets > Of course it's great for ephemeral stuff. It's just that most people don't have that problem A lot of people run containers these days. It’s not unusual to have endpoints in the tens of thousands or more and there are other considerations that make ipv4 management hard/impossible
    - djha-skin 3y ago
      Yeah, I have. Not that big of a deal. Most of it's just good network planning. We were able to get around the problem. And I manage a kubernetes container stack. It's simple, you NAT k8s connections to the outside network, or more likely use an nginx ingress.
- hitpointdrew 3y ago
  > I worked for used ipv6 to successfully deal with huge number of ephemeral VMs. I find it hard to believe that "huge" exceeds 65,536, which is how many addresses you get with a /16.
  - 3y ago
simoncion 3y ago
> I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. Go talk to the infra people at Comcast. Their infra network is 100% IPv6 and their customers are almost exclusively fixed-location. > ...I don't see the point of it. I've personally seen (on more than one occasion) the IT infra mergers of pairs of companies delayed by 12+ months because of the need to renumber (and/or decom because there's just not enough IP address space) machines using RFC 1918 space. RFC 4193 eliminates the need for renumbering. There are many other reasons for it, but that's one of the ones that tears my heart to pieces each time I have to use multiple VPNs for a year or more while the Great Renumbering is underway.
- djha-skin 3y ago
  > Go talk to the infra people at Comcast. There are mobile providers so your argument is invalid. Also on the server side they are a famous case of people who need more than 65,000 servers which I covered in my comment. And renumbering is so, so much easier than switching network stacks. It'd be years to switch network stacks, not only to change over the addresses but also to change over entire business processes and higher swaths of security engineers to keep track of your now much more vulnerable network. It would be a business change, not just a network change.
  - lxgr 3y ago
    What? Comcast is primarily a fixed/wired network provider.
    - djha-skin 3y ago
      Still a case of over 65,000 servers. But yes they also still do run a mobile network.
      - lxgr 3y ago
        What servers? They're a cable ISP. I'm sure they also have some business users, many of which will be hosting servers, but that's not really the first thing I think of when I hear "Comcast has deployed IPv6". I'm thinking people connecting iPads and lightbulbs to some CPE, not data centers. And Comcast does that via IPv6, as do many cable or fiber ISPs these days. Many don't assign public IPv4 addresses to their residential customers anymore.
icedchai 3y ago
You should be relying on a firewall, not NAT. Coincidentally, most NAT boxes are also firewalls, but it's not the same thing. IPv6 is better because you have end-to-end connectivity, no private/public address hacks, which is how the Internet is supposed to work.
throw0101c 3y ago
> If I used IPv6 everywhere in my server room outsiders could see the topology of my internal Network. When was the last time an attacker punched a hole through a firewall device? Attacks generally start from compromising a user machine (e.g., phishing) or a server (via server-software exploit), installing some malware on already-internal machine, and start probing from there. Not being able to see the internal topology has hindered precisely zero network compromises. > While we definitely need firewalls and/or packet filters at the network edge, most of today’s attacks work on application-layer, using SQL injection or “Advanced Persistent Threats” like sending an Excel or PDF file with a 0-day exploit to a click-happy user. * https://blog.ipspace.net/2011/12/is-nat-security-feature.html https://blog.ipspace.net/2011/12/is-nat-security-feature.htm... You may wish to start thinking beyond the castle-and-moat network security model: * https://www.cloudflare.com/en-ca/learning/access-management/castle-and-moat-network-security/ https://www.cloudflare.com/en-ca/learning/access-management/... --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4: An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table(s) it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it. The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 the address/port rewriting is not done.† Only state tables are updated and checked. New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through.‡ There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. NAT is not a security feature but a workaround for the lack of IPv4 addresses. The security comes from the state checking. † It is possible to have private IPv6 addresses using ULA, and then the router/firewall uses NPTv6 to rewrite the prefix (leaving the /64 interface component alone). ‡ Just like with IPv4 (NAT), to allow unsolicited 'new' connections in you have to do do firewall hole punching with (e.g.) UPNP. But by default things are blocked.
throw0101c 3y ago
> I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. T-Mobile US: * https://www.youtube.com/watch?v=nNMNglk_CvE https://www.youtube.com/watch?v=nNMNglk_CvE Wells Fargo: * https://www.youtube.com/watch?v=EzTWjNUb4H4 https://www.youtube.com/watch?v=EzTWjNUb4H4 Microsoft * https://www.arin.net/blog/2019/04/03/microsoft-works-toward-ipv6-only-single-stack-network/ https://www.arin.net/blog/2019/04/03/microsoft-works-toward-... * https://www.youtube.com/watch?v=nd0vgU6WbPo https://www.youtube.com/watch?v=nd0vgU6WbPo Google: * https://www.youtube.com/watch?v=hb98hAb5_W8 https://www.youtube.com/watch?v=hb98hAb5_W8 LinkedIn: * https://www.youtube.com/watch?v=6ukwR86BClY https://www.youtube.com/watch?v=6ukwR86BClY Facebook is famously IPv6-only internally (and as of 2016, 60% of user traffic was over IPv6): * https://www.internetsociety.org/resources/deploy360/2014/case-study-facebook-moving-to-an-ipv6-only-internal-network/ https://www.internetsociety.org/resources/deploy360/2014/cas... * https://engineering.fb.com/2017/01/17/production-engineering/legacy-support-on-ipv6-only-infra/ https://engineering.fb.com/2017/01/17/production-engineering... * https://www.youtube.com/watch?v=lU_24f6Wr7E https://www.youtube.com/watch?v=lU_24f6Wr7E

shrimp_emoji 3y ago

Do security properly. You're just relying on a kludge that fucks up addressing which was only invented because there weren't enough addresses.

thriftwy 3y ago
Proper security is when everything is closed off and inaccessible by default. IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design. I hope I never get to be a DevOps and support that. Or have IPv6 in my home network. One bad firewall rule or insecure port open, and you get ransomware in your face.
- NewJazz 3y ago
  Proper security is when everything is closed off and inaccessible by default. I have met a lot of infrastructure engineers who do that... then never give the people who need access access. So the system just sits and collects dust. You have users. Acknowledge them. The network shouldn't even be the primary security boundary to begin with. One bad firewall rule or insecure port open Firewall !== routing. Nobody said you can't run a border firewall on your home network.
  - thriftwy 3y ago
    I don't want to run a border firewall on my home network, because I am not devops, neither is my mother, who also has a home network, etc. The former sound like a management problem. One call from up above and access will appear.
    - lxgr 3y ago
      > I don't want to run a border firewall on my home network If you're running a NAT, you're already running something much more complex than that. It's not rocket science for CPE manufacturers to make "outbound connections only" the default. My home router does just that.
      - djha-skin 3y ago
        More of the same with this situation. A bunch of client developers telling me how to do my job. It's such a huge risk to show people what is in my network. It's such a huge risk to the business. It makes no sense to It makes no sense to reveal that. But I suppose telling you is not worth anyone's time, you're just going to say you like it better because you're a mobile developer.
        lxgr 3y ago
        I'm responding to GP, not you, who mentioned their home network, not your business network. > you're just going to say you like it better because you're a mobile developer. Not sure what issues you have with mobile developers, but I'm not one, not that it should matter if the argument is sound.
    - yjftsjthsd-h 3y ago
      > I don't want to run a border firewall on my home network, because I am not devops, Well... too bad? Do you want security or not? > neither is my mother, who also has a home network, etc. If your hypothetical non-technical mother just buys a normal off-the-shelf router (+AP+switch+...) then it'll already have a firewall by default. It's not like end-users are expected to design/implement these things themselves.
- Arnavion 3y ago
  What component on your router prevents a packet with destination IP 192.168.1.2 appearing on WAN from crossing over to the 192.168.1/24 LAN and reaching the device with that IP? Hint: It's the same one that also prevents IPv6 packets from making that same crossing.
  - thriftwy 3y ago
    This makes exactly zero sense. So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? How does that work? At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP.
    - Arnavion 3y ago
      >So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Of course. Unless you add rules to allow incoming traffic, say a rule to allow incoming traffic for $LAN_MACHINE1_IP:$PORT/tcp, to cross from WAN to LAN. >At least with NAT there is a known set of rules regarding how masquerading works, that I can reason about. The reason the scenario in my previous comment doesn't work has nothing to do with NAT. The reason such a packet would be dropped is because the firewall has a rule to filter bogons on the WAN interface. More generally, your home network firewall will have a default rule to block all incoming traffic on WAN unless explicitly allowed via additional rules, and that applies to both IPv4 and IPv6. >WAN will not sent such malformed packets in the first place, unless we are talking of mom and pop ISP. Well if you trust your ISP so much then I assume you just have your firewall turned off always, right?
    - lxgr 3y ago
      > So my home network appliances have public IPv6 addreases, but everything sent to these addresses is null routed? Yes! > How does that work? Stateful firewalling. It's much simpler than NAT masquerading tables. Just imagine a NAT, but with all address and port mappings being the identity function.
- lxgr 3y ago
  Same for IPv4 and one bad port forwarding rule, no? People also don't seem to have any issues getting hit by ransomware even in a world full of IPv4-only networks and NATs.
  - djha-skin 3y ago
    Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. Most developers are so far removed from this world they have no practical experience keeping the chaos out of the network, it's very frustrating from my end.
    - lxgr 3y ago
      Well, what's the difference? Also my network (dual stack) is quite orderly as far as I can tell, thank you very much. I promise I won't ask you for help if that ever changes, if it helps :)
    - labcomputer 3y ago
      > Not really no it's not the same. But this whole argument I feel like it's trying to explain flying to a fish. No, it's like you're a fish trying to explain flying to birds. You don't understand the fundamentals of IPv6 (among other things, in other comments you have revealed that you think IPv6 addresses are MAC-based, think Comcast is a wireless ISP, and aren't aware of stateful firewalls). You have so many misconceptions about IPv6 it's no wonder you hate it.
- eqvinox 3y ago
  > IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design. Please refer to RFC6092 "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service" (Jan 2011) (Despite the 'recommended' in the title, this is made mandatory by other specifications.) It does exactly what you ask for: "Proper security is when everything is closed off and inaccessible by default."
- patrakov 3y ago
  > Proper security is when everything is closed off and inaccessible by default. Not only that. PCI DSS explicitly requires hiding the network topology from outsiders - even though they cannot connect. So it is either NAT or very short-lived IPv6 addresses, and guess what - for internal audits of who did what, NAT works better.
- justsomehnguy 3y ago
  > IPv6 where your home network or backend infrastructure is a transparent glass house is a failure by design only if you chose it be. It doesn't differ from a public routable IPv4 block at all: or you explicitly allow anything being routed to addresses in that block - or not
djha-skin 3y ago
Doesn't sound like you're an infrastructure engineer.
- shrimp_emoji 3y ago
  I am absolutely not. :)
munchler 3y ago
Seems to me that IPv4 was invented back when cybersecurity was much less of a concern.

lxgr 3y ago

What does "useful on the server side" mean? And how useful is a server really that can't (efficiently) serve any clients because they're all on IPv6?

yjftsjthsd-h 3y ago
Depending on your architecture, it's easy to run dual-stack to the load balancer, and then pure IPv4 or IPv6 internally without any problems.
- lxgr 3y ago
  That's fair. To be honest, I don't care at all what the site I'm trying to reach does internally after it terminates my connection to them via either IPv4 and IPv6 – just don't pretend that IPv6 is not a thing.

yjftsjthsd-h 3y ago

> If I used IPv6 everywhere in my server room outsiders could see the topology of my internal Network. NAT isn't an annoyance on the server side, it's a requirement for security. You can NAT IPv6, but it really sounds like you're doing security-by-obscurity, which is less than rigorous. If your servers are properly secured you should be able to publish a complete list of your servers and their IPs on your website and not impact your security at all. > I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. I have. His designs were often... aspirational.

djha-skin 3y ago
Of course we should do more than security by obscurity, but sometimes obscurity is the only thing we have. We need to do everything in our power to secure the servers. Of course we're going to lock the doors, but if we can also obscure what's there, we should.
- eqvinox 3y ago
  If obscurity is the only thing you have, you have nothing. (And I say this not in jest or to be patronizing, I say this as a warning re. your security.) Whether this applies to NAT is a different question.
thriftwy 3y ago
That's not security by obscurity. Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. With IPv6, knowing addresses of these machines will let you spam them with packets and possibly breach them the second firewall goes down for any reason.
- yjftsjthsd-h 3y ago
  > Security by obscurity if these servers could be reached if you knew their "real names". In case of NAT, no amount of information will let you access these machines, so it is proper security. It is almost as good as airgap. If you have a firewall, then no amount of information will give you access either. > the second firewall goes down for any reason Is this like... a thing that you've actually seen happen? Because it really sounds like something that at best happened 20 years ago in a freak accident that will never happen again. If we're allowing equipment to just randomly break to that degree then I get to assume that your NAT will just forward incoming traffic directly to servers.

dilyevsky 3y ago

> I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. Around 10 years ago the company I worked for used ipv6 to successfully deal with huge number of ephemeral VMs. It was a great solution. I saw Fly.io using similar approach for their internal networking so I assume they did it bc they thought it was better as well. So now you have.

djha-skin 3y ago
So you fall in the more than 65,000 servers camp then. Of course it's great for ephemeral stuff. It's just that most people don't have that problem and it's a huge pain to use it for anything else. So no, I haven't.
- dilyevsky 3y ago
  Spoken like a person who clearly never had to peer two vpcs that just happened to have intersecting subnets > Of course it's great for ephemeral stuff. It's just that most people don't have that problem A lot of people run containers these days. It’s not unusual to have endpoints in the tens of thousands or more and there are other considerations that make ipv4 management hard/impossible
  - djha-skin 3y ago
    Yeah, I have. Not that big of a deal. Most of it's just good network planning. We were able to get around the problem. And I manage a kubernetes container stack. It's simple, you NAT k8s connections to the outside network, or more likely use an nginx ingress.
hitpointdrew 3y ago
> I worked for used ipv6 to successfully deal with huge number of ephemeral VMs. I find it hard to believe that "huge" exceeds 65,536, which is how many addresses you get with a /16.
- 3y ago

simoncion 3y ago

> I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. Go talk to the infra people at Comcast. Their infra network is 100% IPv6 and their customers are almost exclusively fixed-location. > ...I don't see the point of it. I've personally seen (on more than one occasion) the IT infra mergers of pairs of companies delayed by 12+ months because of the need to renumber (and/or decom because there's just not enough IP address space) machines using RFC 1918 space. RFC 4193 eliminates the need for renumbering. There are many other reasons for it, but that's one of the ones that tears my heart to pieces each time I have to use multiple VPNs for a year or more while the Great Renumbering is underway.

djha-skin 3y ago
> Go talk to the infra people at Comcast. There are mobile providers so your argument is invalid. Also on the server side they are a famous case of people who need more than 65,000 servers which I covered in my comment. And renumbering is so, so much easier than switching network stacks. It'd be years to switch network stacks, not only to change over the addresses but also to change over entire business processes and higher swaths of security engineers to keep track of your now much more vulnerable network. It would be a business change, not just a network change.
- lxgr 3y ago
  What? Comcast is primarily a fixed/wired network provider.
  - djha-skin 3y ago
    Still a case of over 65,000 servers. But yes they also still do run a mobile network.
    - lxgr 3y ago
      What servers? They're a cable ISP. I'm sure they also have some business users, many of which will be hosting servers, but that's not really the first thing I think of when I hear "Comcast has deployed IPv6". I'm thinking people connecting iPads and lightbulbs to some CPE, not data centers. And Comcast does that via IPv6, as do many cable or fiber ISPs these days. Many don't assign public IPv4 addresses to their residential customers anymore.

icedchai 3y ago

You should be relying on a firewall, not NAT. Coincidentally, most NAT boxes are also firewalls, but it's not the same thing. IPv6 is better because you have end-to-end connectivity, no private/public address hacks, which is how the Internet is supposed to work.

throw0101c 3y ago

> If I used IPv6 everywhere in my server room outsiders could see the topology of my internal Network. When was the last time an attacker punched a hole through a firewall device? Attacks generally start from compromising a user machine (e.g., phishing) or a server (via server-software exploit), installing some malware on already-internal machine, and start probing from there. Not being able to see the internal topology has hindered precisely zero network compromises. > While we definitely need firewalls and/or packet filters at the network edge, most of today’s attacks work on application-layer, using SQL injection or “Advanced Persistent Threats” like sending an Excel or PDF file with a 0-day exploit to a click-happy user. * https://blog.ipspace.net/2011/12/is-nat-security-feature.html https://blog.ipspace.net/2011/12/is-nat-security-feature.htm... You may wish to start thinking beyond the castle-and-moat network security model: * https://www.cloudflare.com/en-ca/learning/access-management/castle-and-moat-network-security/ https://www.cloudflare.com/en-ca/learning/access-management/... --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4: An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table(s) it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it. The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 the address/port rewriting is not done.† Only state tables are updated and checked. New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through.‡ There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. NAT is not a security feature but a workaround for the lack of IPv4 addresses. The security comes from the state checking. † It is possible to have private IPv6 addresses using ULA, and then the router/firewall uses NPTv6 to rewrite the prefix (leaving the /64 interface component alone). ‡ Just like with IPv4 (NAT), to allow unsolicited 'new' connections in you have to do do firewall hole punching with (e.g.) UPNP. But by default things are blocked.

throw0101c 3y ago

> I have yet to meet an infrastructure engineer or even hear of one who switched to IPv6 on purpose because they thought it was better. T-Mobile US: * https://www.youtube.com/watch?v=nNMNglk_CvE https://www.youtube.com/watch?v=nNMNglk_CvE Wells Fargo: * https://www.youtube.com/watch?v=EzTWjNUb4H4 https://www.youtube.com/watch?v=EzTWjNUb4H4 Microsoft * https://www.arin.net/blog/2019/04/03/microsoft-works-toward-ipv6-only-single-stack-network/ https://www.arin.net/blog/2019/04/03/microsoft-works-toward-... * https://www.youtube.com/watch?v=nd0vgU6WbPo https://www.youtube.com/watch?v=nd0vgU6WbPo Google: * https://www.youtube.com/watch?v=hb98hAb5_W8 https://www.youtube.com/watch?v=hb98hAb5_W8 LinkedIn: * https://www.youtube.com/watch?v=6ukwR86BClY https://www.youtube.com/watch?v=6ukwR86BClY Facebook is famously IPv6-only internally (and as of 2016, 60% of user traffic was over IPv6): * https://www.internetsociety.org/resources/deploy360/2014/case-study-facebook-moving-to-an-ipv6-only-internal-network/ https://www.internetsociety.org/resources/deploy360/2014/cas... * https://engineering.fb.com/2017/01/17/production-engineering/legacy-support-on-ipv6-only-infra/ https://engineering.fb.com/2017/01/17/production-engineering... * https://www.youtube.com/watch?v=lU_24f6Wr7E https://www.youtube.com/watch?v=lU_24f6Wr7E