4 ms·

> a) According to [0], AWS has provided IPv6 addressing to EC2 instances since 2016. Yes, but that isn't what we are talking about. 2022 is when they added nat

by mike_d 2y ago

> a) According to [0], AWS has provided IPv6 addressing to EC2 instances since 2016. Yes, but that isn't what we are talking about. 2022 is when they added native IPv6 support, prior to that it was just a fancy NAT like translation.

simoncion 2y ago
> 2022 is when they added native IPv6 support, prior to that it was just a fancy NAT like translation. Are you sure about that? The relevant docs from 2019 (the Wayback Machine doesn't have anything earlier) sure make it seem like you're getting globally-reachable IPv6 addresses: From [0]: > To complete this exercise, do the following: ... > * Launch an Amazon EC2 instance into your subnet, and associate an IPv6 address with your instance during launch. An IPv6 address is globally unique, and allows your instance to communicate with the Internet. Yes, the last bit of that doesn't automatically mean that your instance is globally-reachable. Read on. From [1]: > IPv6 addresses are globally unique, and therefore reachable over the Internet. You can control whether instances are reachable via their IPv6 addresses by controlling the routing for your subnet, or by using security group and network ACL rules. For more information, see Security. From the "Inbound" table of the "Recommended Rules for Scenario 1" section of [2]: > | 170 | IPv6 address range of your home network | TCP | 22 | ALLOW | Allows inbound SSH traffic from your home network (over the Internet gateway). | Am I missing some part of the docs where they talk about how there was some fancy NAT-like translation box that made it so that these weren't globally-reachable IP addresses? Was AWS just lying in their docs? [0] <https://web.archive.org/web/20190131164146/https://docs.aws.amazon.com/vpc/latest/userguide/get-started-ipv6.html https://web.archive.org/web/20190131164146/https://docs.aws....> [1] <https://web.archive.org/web/20190801182729/https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html https://web.archive.org/web/20190801182729/https://docs.aws....> [2] <https://web.archive.org/web/20191021190354/https://docs.aws.amazon.com/vpc/latest/userguide/vpc-recommended-nacl-rules.html https://web.archive.org/web/20191021190354/https://docs.aws....>
- mike_d 2y ago
  You seem to be confusing being able to reach IPv6 with native IPv6. With rare exceptions AWS does not document how their internal network functions because it is a trade secret. However for the longest time it was fairly easy to test: if you removed the IPv4 address from an instance it was no longer reachable via IPv6. AWS was never built with IPv6 in mind and it is mostly glued on. As of right now 88% of AWS services are IPv4 only: https://awsipv6.neveragain.de/ https://awsipv6.neveragain.de/ (uncheck the Hide IPv4 only box)
  - simoncion 2y ago
    > You seem to be confusing being able to reach IPv6 with native IPv6. I mean, on the one hand, I'm taking AWS at their word. If they wrote subtle lies into their docs, one can hardly be blamed for failing to understand the truth of the situation. But on the other hand, if * My VM has its globally-reachable IPv6 address assigned to it * Can transmit packets to globally-reachable IPv6 hosts using that address * Can receive unsolicited packets from globally-reachable IPv6 hosts on that address whatever hairs you're splitting seem to be a distinction without a difference? Based on my professional experience, "wacky SDN stuff" is par for the course in the Public Clown. Or, to put it another way, the customer of an ISP couldn't care less about how exactly that ISP delivers them globally-reachable IPv6 service, just so long as it behaves exactly like you'd expect globally-reachable IPv6 service to behave. Maybe between the customer's edge router and the Internet the ISP has some wacky tunnel that runs only over IPv4, and breaks IPv6 service if you turn it off... the customer doesn't give any shits, just so long as the IPv6 service works correctly and reliably. > As of right now 88% of AWS services are IPv4 only... This to me is an entirely irrelevant statistic. My expectation is that end-user systems aren't going to be IPv6-only for a very, very long time, but are going to nearly all have globally-reachable IPv6 addresses relatively soon. So, one should (for the foreseeable future) expect global bidirectional reachability for end-user systems on IPv6, and typical NAT "initiated by end-user request" reachability for end-user systems on IPv4.

by mike_d 2y ago

simoncion 2y ago

> 2022 is when they added native IPv6 support, prior to that it was just a fancy NAT like translation. Are you sure about that? The relevant docs from 2019 (the Wayback Machine doesn't have anything earlier) sure make it seem like you're getting globally-reachable IPv6 addresses: From [0]: > To complete this exercise, do the following: ... > * Launch an Amazon EC2 instance into your subnet, and associate an IPv6 address with your instance during launch. An IPv6 address is globally unique, and allows your instance to communicate with the Internet. Yes, the last bit of that doesn't automatically mean that your instance is globally-reachable. Read on. From [1]: > IPv6 addresses are globally unique, and therefore reachable over the Internet. You can control whether instances are reachable via their IPv6 addresses by controlling the routing for your subnet, or by using security group and network ACL rules. For more information, see Security. From the "Inbound" table of the "Recommended Rules for Scenario 1" section of [2]: > | 170 | IPv6 address range of your home network | TCP | 22 | ALLOW | Allows inbound SSH traffic from your home network (over the Internet gateway). | Am I missing some part of the docs where they talk about how there was some fancy NAT-like translation box that made it so that these weren't globally-reachable IP addresses? Was AWS just lying in their docs? [0] <https://web.archive.org/web/20190131164146/https://docs.aws.amazon.com/vpc/latest/userguide/get-started-ipv6.html https://web.archive.org/web/20190131164146/https://docs.aws....> [1] <https://web.archive.org/web/20190801182729/https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html https://web.archive.org/web/20190801182729/https://docs.aws....> [2] <https://web.archive.org/web/20191021190354/https://docs.aws.amazon.com/vpc/latest/userguide/vpc-recommended-nacl-rules.html https://web.archive.org/web/20191021190354/https://docs.aws....>

mike_d 2y ago
You seem to be confusing being able to reach IPv6 with native IPv6. With rare exceptions AWS does not document how their internal network functions because it is a trade secret. However for the longest time it was fairly easy to test: if you removed the IPv4 address from an instance it was no longer reachable via IPv6. AWS was never built with IPv6 in mind and it is mostly glued on. As of right now 88% of AWS services are IPv4 only: https://awsipv6.neveragain.de/ https://awsipv6.neveragain.de/ (uncheck the Hide IPv4 only box)
- simoncion 2y ago
  > You seem to be confusing being able to reach IPv6 with native IPv6. I mean, on the one hand, I'm taking AWS at their word. If they wrote subtle lies into their docs, one can hardly be blamed for failing to understand the truth of the situation. But on the other hand, if * My VM has its globally-reachable IPv6 address assigned to it * Can transmit packets to globally-reachable IPv6 hosts using that address * Can receive unsolicited packets from globally-reachable IPv6 hosts on that address whatever hairs you're splitting seem to be a distinction without a difference? Based on my professional experience, "wacky SDN stuff" is par for the course in the Public Clown. Or, to put it another way, the customer of an ISP couldn't care less about how exactly that ISP delivers them globally-reachable IPv6 service, just so long as it behaves exactly like you'd expect globally-reachable IPv6 service to behave. Maybe between the customer's edge router and the Internet the ISP has some wacky tunnel that runs only over IPv4, and breaks IPv6 service if you turn it off... the customer doesn't give any shits, just so long as the IPv6 service works correctly and reliably. > As of right now 88% of AWS services are IPv4 only... This to me is an entirely irrelevant statistic. My expectation is that end-user systems aren't going to be IPv6-only for a very, very long time, but are going to nearly all have globally-reachable IPv6 addresses relatively soon. So, one should (for the foreseeable future) expect global bidirectional reachability for end-user systems on IPv6, and typical NAT "initiated by end-user request" reachability for end-user systems on IPv4.