5 ms·

I intentionally disable IPv6. It provides no advantage whatsoever (every user will be able to connect via IPv6) and it adds complexity and security risks, becau

I intentionally disable IPv6. It provides no advantage whatsoever (every user will be able to connect via IPv6) and it adds complexity and security risks, because you need separate firewall rules, dns records, etc for each stack. In addition, rate limiting with IPv6 is much harder (because IPs aren't scarce), so you risk DoS or other kind of abuse.

pests 2y ago
I think you mean every user will connect via IPv4. Users aren't getting single IPv6 addresses though. Most assign a /48 which is at least a bit better.
- redox99 2y ago
  Yes, I meant IPv4. And rate limiting is very uncertain. If I limit per /56, users that have an entire /48 can outright bypass the rate limit. If I limit per /48, maybe I'll erroneously limit thousands of users whose ISP has all of them on the same /48.
  - pests 2y ago
    Don't you have those same issues with banning/rate limiting IV46 though?
    - ta1243 2y ago
      The difference between a /48 (like my residential handoff) and a /64 (like some people get) is the same as a difference between blocking a single /32 ipv4 address and blocking an entire /16 - which is a very large allocation If you wanted to block me, you'd have to block the whole /48. If you blocked a /48, you could be blocking 64,000 people.
      - pests 2y ago
        I meant IPv4 - one IP might represent thousands of users. Looks like crote brought the issue up in a sibling thread.
        redox99 2y ago
        I haven't experienced such congested CGNATs. And assuming there are people who are under such CGNATs, they are probably used to being rate limited all the time.
  - crote 2y ago
    But the exact same issue exists with IPv4 due to CGNAT? A single IPv4 address could be used by a single user, or their ISP could be sharing that same single IP with many thousands of users.
Control8894 2y ago
My employer also disables it (choice made above me). And I get it. It really is duplicating lots of work for absolutely no benefit (to the organizations doing the work). It's a shame that you're getting downvoted. I'm sure a lot of those people are shouting at their screen "well just learn it" but even if you're familiar enough with all the stuff it changes (RA, NDP, heck the lack of NAT), it's still a ton of work to get it properly set up and worse yet to maintain.
- crote 2y ago
  The whole duplication doesn't have to be as bad as it might seem at first glance. Large companies (and even ISPs) seem to be going for "IPv6-mostly" rollouts. Basically, everything is done primarily using IPv6, with fallbacks to IPv4 only when strictly necessary. This means IPv4 traffic gets converted to IPv6 at the client, forwarded over an IPv6-only network, and turned into "native" IPv4 for the internet at an edge NAT64 gateway. Legacy IPv4-only devices (printers and such) get an isolated vlan with its own gateway, and will of course be replaced with IPv6-capable alternatives as soon as it's appropriate. I agree that for smaller companies it's relatively little benefit for the amount of work required, but if you're overhauling your network for other reasons anyways it makes little sense not to do it.
  - Control8894 2y ago
    Yes, IPv6-first is definitely the way to do it. Just be careful not to run into Github's issue (https://www.githubstatus.com/incidents/5y8b8lsqbbyq https://www.githubstatus.com/incidents/5y8b8lsqbbyq) or Google's issue (https://i.imgur.com/4gGECJ9.png https://i.imgur.com/4gGECJ9.png - in case you're not familiar, 2002:: is the 6to4 prefix, and 2002:a0 is the 6to4 version of 10/8, so I guess somehow I was deleting old users from within Google's own network!)
- bobbob1921 2y ago
  I’m sure this will annoy some people, but two hurdles for me in adopting ipV6 is, #1-it’s difficult/impossible to memorize the long v6 addresses versus the easy to remember ipv4 addresses (both public and private addresses I’m referring to). #2-lack of knowledge/understanding of how V6 addresses route versus a fairly deep knowledge of V4 addresses route/subnets.

pests 2y ago

I think you mean every user will connect via IPv4. Users aren't getting single IPv6 addresses though. Most assign a /48 which is at least a bit better.

redox99 2y ago
Yes, I meant IPv4. And rate limiting is very uncertain. If I limit per /56, users that have an entire /48 can outright bypass the rate limit. If I limit per /48, maybe I'll erroneously limit thousands of users whose ISP has all of them on the same /48.
- pests 2y ago
  Don't you have those same issues with banning/rate limiting IV46 though?
  - ta1243 2y ago
    The difference between a /48 (like my residential handoff) and a /64 (like some people get) is the same as a difference between blocking a single /32 ipv4 address and blocking an entire /16 - which is a very large allocation If you wanted to block me, you'd have to block the whole /48. If you blocked a /48, you could be blocking 64,000 people.
    - pests 2y ago
      I meant IPv4 - one IP might represent thousands of users. Looks like crote brought the issue up in a sibling thread.
      - redox99 2y ago
        I haven't experienced such congested CGNATs. And assuming there are people who are under such CGNATs, they are probably used to being rate limited all the time.
- crote 2y ago
  But the exact same issue exists with IPv4 due to CGNAT? A single IPv4 address could be used by a single user, or their ISP could be sharing that same single IP with many thousands of users.

Control8894 2y ago

My employer also disables it (choice made above me). And I get it. It really is duplicating lots of work for absolutely no benefit (to the organizations doing the work). It's a shame that you're getting downvoted. I'm sure a lot of those people are shouting at their screen "well just learn it" but even if you're familiar enough with all the stuff it changes (RA, NDP, heck the lack of NAT), it's still a ton of work to get it properly set up and worse yet to maintain.

crote 2y ago
The whole duplication doesn't have to be as bad as it might seem at first glance. Large companies (and even ISPs) seem to be going for "IPv6-mostly" rollouts. Basically, everything is done primarily using IPv6, with fallbacks to IPv4 only when strictly necessary. This means IPv4 traffic gets converted to IPv6 at the client, forwarded over an IPv6-only network, and turned into "native" IPv4 for the internet at an edge NAT64 gateway. Legacy IPv4-only devices (printers and such) get an isolated vlan with its own gateway, and will of course be replaced with IPv6-capable alternatives as soon as it's appropriate. I agree that for smaller companies it's relatively little benefit for the amount of work required, but if you're overhauling your network for other reasons anyways it makes little sense not to do it.
- Control8894 2y ago
  Yes, IPv6-first is definitely the way to do it. Just be careful not to run into Github's issue (https://www.githubstatus.com/incidents/5y8b8lsqbbyq https://www.githubstatus.com/incidents/5y8b8lsqbbyq) or Google's issue (https://i.imgur.com/4gGECJ9.png https://i.imgur.com/4gGECJ9.png - in case you're not familiar, 2002:: is the 6to4 prefix, and 2002:a0 is the 6to4 version of 10/8, so I guess somehow I was deleting old users from within Google's own network!)
bobbob1921 2y ago
I’m sure this will annoy some people, but two hurdles for me in adopting ipV6 is, #1-it’s difficult/impossible to memorize the long v6 addresses versus the easy to remember ipv4 addresses (both public and private addresses I’m referring to). #2-lack of knowledge/understanding of how V6 addresses route versus a fairly deep knowledge of V4 addresses route/subnets.