4 ms·

It’s interesting because much of the “better” has eroded away in the current IPv6 landscape: - “You don’t need NAT”: well, you still need a stable address spac

It’s interesting because much of the “better” has eroded away in the current IPv6 landscape: - “You don’t need NAT”: well, you still need a stable address space for your LAN that survives your ISP randomly changing your prefix (which has happened to me at least a half dozen times over the past year), and the best option for that is ULA, which erodes many of the benefits of “no NAT” because my IP’s are not routable. - “No DHCP”, well you can’t reliably know the IP address of anything on your network without it: SLAAC with EUI-64 was supposed to make addresses stable and derived from your MAC address, but oops, that’s a privacy nightmare, so we end up randomly generating them (and rotating them!) IMO this is more complicated than DHCP, not less. Oh and DHCP lets you assign dynamic DNS names to every lease you hand out, and you lose that too with SLAAC. You can do mDNS but that doesn’t help with public hosts that you want to access from the internet, you’re left with static IPs there, and god help you if you get re-prefixed (see point #1) because now your static IP won’t route because your ISP changed the prefix. I’m really rooting for ipv6, trust me, but it feels like all the greenfield rearchitecting they did ultimately doesn’t seem much better than the IPv4 equivalent standards. NAT is here to stay, unfortunately, and so is DHCP.

simoncion 2y ago
> ...the best option for that is ULA... I have both globally-routable and ULA addresses assigned to the hosts on my LAN. The ULA addresses are in my local DNS, and I update global DNS whenever the site's global prefix changes. Aside from the fact that the global prefix changes way too frequently (like once a quarter) it works great for me. > ...so we end up randomly generating them (and rotating them!)... Yeah, I turn this shit off whenever I have the power to. This was a fucking stupid-ass thing to have on by default. Hella buncha ways you can be tracked that give zero shits about what your IP address is. (This is one time when I wish the Net Heads would have consulted with the Web Heads and learned about how trackers actually work.) > NAT is here to stay, unfortunately, and so is DHCP. Nothing wrong with doing DHCPv6 and SLAAC, or just DHCPv6. My network just uses SLAAC, but folks who need more features than that provides have another tool they can deploy. This is a good thing. And you __can__ use NAT if you choose to, but if you're being assigned a publicly-routable prefix, there's no real reason to. Set up your border firewall to deny inbound unsolicited traffic, and set up uPNP (or similar) to hole-punch and you end up with the same security guarantees.
- ninkendo 2y ago
  I think you’re making my point for me quite nicely… Originally it was “IPv6 is great, you don’t need dhcp”, but then it became “well you may need DHCP anyway so here’s DHCPv6”, and then that becomes necessary often enough that you can’t really point to that as a benefit of IPv6 any more. You don’t need NAT but you need a lot of the systems complexity that NAT requires, because you have to manage two sets of addresses in various configurations. Split DNS, etc. You’re fine if you own the address range and it isn’t provided to you dynamically with DHCP-PD, but that isn’t the case with basically 100% of residential deployments. You need to multihome to even apply as a RIR to get your own prefix.
  - ninkendo 2y ago
    Thinking aloud: there needs to be a rethinking of how prefixes work in the next ::/3 we allocate for global unicast: it should be possible for individuals to get their own /48 for basically the same price as a domain name today. Hell, they could make cash as people rush to buy the memorable ones. Make personal route announcement a basic part of ISP service as defined by the FCC. We’d have a fighting chance of actually having a decentralized internet again. But I’m basically wishing for a pony at this point.
    - icedchai 2y ago
      You can basically do this today. There are RIPE LIRs that will allocate you a /48 pretty cheaply. There are tunneling services that will route it to you.
    - sgjohnson 2y ago
      It’s not actually expensive or difficult for an individual to get an ASN and IPv6 space. https://lagrange.cloud/products/lir https://lagrange.cloud/products/lir £15 one-off for an ASN and £7/y for a /48. Then you just need to find someone to give you a BGP session. https://bgp.services https://bgp.services
      - ninkendo 2y ago
dmm 2y ago
> you still need a stable address space for your LAN that survives your ISP randomly changing your prefix The randomly changing prefix is really annoying. There's no reason for your ISP to do this other than to try and upsell you on expensive commercial services.
- convolvatron 2y ago
  This was done so that networks could actually be renumbered to increase aggregation and routing efficacy. In todays work once you give out a number you cant take it back, and that leads to fragmentation (i.e. the swamp)
  - simoncion 2y ago
    > In todays work once you give out a number you cant take it back This isn't true. If it were, then home ISPs would never renumber client networks. You're probably thinking about the larger allocations handed to folks who have ASNs, rather than the small allocations handed small ISP customer sites... and even then, those can totally be reclaimed.
dagenix 2y ago
ULAs aren't the same as a NAT setup. You can assign all of your local devices stable ULAs _and_ also reputable addresses that randomly change. If you do that, there is no need for NAT.
- ninkendo 2y ago
  Right, I picked the word “eroded” because it’s not like the benefit is completely gone, but it’s not what was originally envisioned. I do ULA+global unicast too, but it would be far simpler if I actually had a reliable stable prefix and could just use that. I put my ULA addresses in local DNS (because that’s why I need ULA, I need to not worry about rewriting my zone file whenever my cable modem reboots), but that means I have to do split horizon DNS. I wish I didn’t have to. (Yes I do mDNS too but I need real DNS for lots of use cases.)
  - simoncion 2y ago
    > Right, I picked the word “eroded” because it’s not like the benefit is completely gone, but it’s not what was originally envisioned. You also said > NAT is here to stay Which, uh, it sure sounds like you're not using IPv6 NAT. In fact, it looks like aside from probably being confused about what "split horizon DNS" is [0] your setup is exactly like mine. Address autoconfig for both a annoyingly-frequently-changing global prefix, and a constant ULA prefix with DNS entries for the ULA addresses. [0] Does your DNS server serve LAN _and_ WAN clients? If it doesn't, and it only serves LAN clients, you're almost certainly confused.
    - simiones 2y ago
      They pretty clearly talk about public hosts, so it seems quite likely that they are in fact doing split-horizon DNS (i.e. machine1.site.com will be resolved to an ULA address if the query is coming from the same subnet, or to the public address otherwise).
      - simoncion 2y ago
        IF homie is serving public-facing DNS for the site with the same server that's serving local DNS, then yeah, sure, split-horizon DNS is probably the thing that you'd do. But: > They pretty clearly talk about public hosts Thing is, I ALSO have public hosts on my LAN. And they're in both the public DNS and in the DNS on my LAN. But public DNS is not served from my local DNS, so I don't have a split-horizon setup. The mere act of maintaining (in two entirely unrelated DNS servers) records for the same resource but with different data doesn't make a split-horizon setup. If it did, then I could reasonably claim "I'm running a split-horizon setup for mit.com!" just by adding an A record for "mit.com" to my local DNS server, despite being neither connected to any MIT internal networks, nor in a position to serve any data to MIT's Internet clients.

simoncion 2y ago

> ...the best option for that is ULA... I have both globally-routable and ULA addresses assigned to the hosts on my LAN. The ULA addresses are in my local DNS, and I update global DNS whenever the site's global prefix changes. Aside from the fact that the global prefix changes way too frequently (like once a quarter) it works great for me. > ...so we end up randomly generating them (and rotating them!)... Yeah, I turn this shit off whenever I have the power to. This was a fucking stupid-ass thing to have on by default. Hella buncha ways you can be tracked that give zero shits about what your IP address is. (This is one time when I wish the Net Heads would have consulted with the Web Heads and learned about how trackers actually work.) > NAT is here to stay, unfortunately, and so is DHCP. Nothing wrong with doing DHCPv6 and SLAAC, or just DHCPv6. My network just uses SLAAC, but folks who need more features than that provides have another tool they can deploy. This is a good thing. And you __can__ use NAT if you choose to, but if you're being assigned a publicly-routable prefix, there's no real reason to. Set up your border firewall to deny inbound unsolicited traffic, and set up uPNP (or similar) to hole-punch and you end up with the same security guarantees.

ninkendo 2y ago
I think you’re making my point for me quite nicely… Originally it was “IPv6 is great, you don’t need dhcp”, but then it became “well you may need DHCP anyway so here’s DHCPv6”, and then that becomes necessary often enough that you can’t really point to that as a benefit of IPv6 any more. You don’t need NAT but you need a lot of the systems complexity that NAT requires, because you have to manage two sets of addresses in various configurations. Split DNS, etc. You’re fine if you own the address range and it isn’t provided to you dynamically with DHCP-PD, but that isn’t the case with basically 100% of residential deployments. You need to multihome to even apply as a RIR to get your own prefix.
- ninkendo 2y ago
  Thinking aloud: there needs to be a rethinking of how prefixes work in the next ::/3 we allocate for global unicast: it should be possible for individuals to get their own /48 for basically the same price as a domain name today. Hell, they could make cash as people rush to buy the memorable ones. Make personal route announcement a basic part of ISP service as defined by the FCC. We’d have a fighting chance of actually having a decentralized internet again. But I’m basically wishing for a pony at this point.
  - icedchai 2y ago
    You can basically do this today. There are RIPE LIRs that will allocate you a /48 pretty cheaply. There are tunneling services that will route it to you.
  - sgjohnson 2y ago
    It’s not actually expensive or difficult for an individual to get an ASN and IPv6 space. https://lagrange.cloud/products/lir https://lagrange.cloud/products/lir £15 one-off for an ASN and £7/y for a /48. Then you just need to find someone to give you a BGP session. https://bgp.services https://bgp.services
    - ninkendo 2y ago

dmm 2y ago

> you still need a stable address space for your LAN that survives your ISP randomly changing your prefix The randomly changing prefix is really annoying. There's no reason for your ISP to do this other than to try and upsell you on expensive commercial services.

convolvatron 2y ago
This was done so that networks could actually be renumbered to increase aggregation and routing efficacy. In todays work once you give out a number you cant take it back, and that leads to fragmentation (i.e. the swamp)
- simoncion 2y ago
  > In todays work once you give out a number you cant take it back This isn't true. If it were, then home ISPs would never renumber client networks. You're probably thinking about the larger allocations handed to folks who have ASNs, rather than the small allocations handed small ISP customer sites... and even then, those can totally be reclaimed.

dagenix 2y ago

ULAs aren't the same as a NAT setup. You can assign all of your local devices stable ULAs _and_ also reputable addresses that randomly change. If you do that, there is no need for NAT.

ninkendo 2y ago
Right, I picked the word “eroded” because it’s not like the benefit is completely gone, but it’s not what was originally envisioned. I do ULA+global unicast too, but it would be far simpler if I actually had a reliable stable prefix and could just use that. I put my ULA addresses in local DNS (because that’s why I need ULA, I need to not worry about rewriting my zone file whenever my cable modem reboots), but that means I have to do split horizon DNS. I wish I didn’t have to. (Yes I do mDNS too but I need real DNS for lots of use cases.)
- simoncion 2y ago
  > Right, I picked the word “eroded” because it’s not like the benefit is completely gone, but it’s not what was originally envisioned. You also said > NAT is here to stay Which, uh, it sure sounds like you're not using IPv6 NAT. In fact, it looks like aside from probably being confused about what "split horizon DNS" is [0] your setup is exactly like mine. Address autoconfig for both a annoyingly-frequently-changing global prefix, and a constant ULA prefix with DNS entries for the ULA addresses. [0] Does your DNS server serve LAN _and_ WAN clients? If it doesn't, and it only serves LAN clients, you're almost certainly confused.
  - simiones 2y ago
    They pretty clearly talk about public hosts, so it seems quite likely that they are in fact doing split-horizon DNS (i.e. machine1.site.com will be resolved to an ULA address if the query is coming from the same subnet, or to the public address otherwise).
    - simoncion 2y ago
      IF homie is serving public-facing DNS for the site with the same server that's serving local DNS, then yeah, sure, split-horizon DNS is probably the thing that you'd do. But: > They pretty clearly talk about public hosts Thing is, I ALSO have public hosts on my LAN. And they're in both the public DNS and in the DNS on my LAN. But public DNS is not served from my local DNS, so I don't have a split-horizon setup. The mere act of maintaining (in two entirely unrelated DNS servers) records for the same resource but with different data doesn't make a split-horizon setup. If it did, then I could reasonably claim "I'm running a split-horizon setup for mit.com!" just by adding an A record for "mit.com" to my local DNS server, despite being neither connected to any MIT internal networks, nor in a position to serve any data to MIT's Internet clients.