8 ms·

I recently moved to a 'cheap' ISP because I could get double the speed for half the price. They use CG-NAT and it's been awful. I don't need to forward any por

by koyote 2y ago

I recently moved to a 'cheap' ISP because I could get double the speed for half the price. They use CG-NAT and it's been awful. I don't need to forward any ports but seemingly because I share an IP with a billion people I get Captchas everywhere (Google, Cloudflare etc.). I was even blocked from accessing Reddit without an account at some point.

NelsonMinar 2y ago
Starlink uses CGNAT. It's awful, I'm regularly getting CAPTCHAs on random websites. They now support IPv6 but only with dynamic address allocations so you don't get a lot of advantages from it.
- imoverclocked 2y ago
  I hadn’t put that quite together. I wonder how many people would value IPv6 if they knew it meant less CAPTCHAs.
  - alwayslikethis 2y ago
    I'd imagine that to be short lived. IPv6 having such a huge address spaces means the IP reputations are even more worthless than IPv4 so eventually the bots would use it too, and if the ratio of bots to real users become too high sites may refuse IPv6 traffic altogether.
    - matrix2003 2y ago
      It’s a little different though in that rather than an IP having a bad reputation, it’s usually a /64. That’s how I have seen IPv6 reputation managed since it’s a common network slice & NAT is not really used anymore.
    - preisschild 2y ago
      You can block ipv6 /64 subnets just like you can block IPv4 /32 IPs.
    - NelsonMinar 2y ago
      Ooof that's an ugly thought. But I think "refuse IPv6 traffic altogether" is not possible for any consumer site. Per the article, there's 40% adoption of IPv6 now and it's only growing. Major parts of the world rely on IPv6 working right. I guess sites could go IPv4-only but given how many other problems there are with IP reputations, that'd be awfully dumb.
  - NelsonMinar 2y ago
    CAPTCHAs are the main reason I turned IPv6 on. No idea if it will actually help in practice, it's hard to measure. The other Starlink hassle is the geocoding for user IPv4 addresses is wildly wrong. I'm in Grass Valley, CA near Sacramento but sites all think my IP is either in Seattle or Los Angeles, depending on the week. This makes streaming services a huge PITA, I have to jump through hoops to convince them I'm in the Sacramento TV market about once a month. IPv6 could help with this too, Starlink could give out more precisely geolocated addresses. Not sure they're doing it though, all I see are IPv4 addresses in the geocoding feed: https://geoip.starlinkisp.net/feed.csv https://geoip.starlinkisp.net/feed.csv
    - esaym 2y ago
      I was on a cruise ship in the Caribbean for a week just last month and I purchased the starlink powered internet package. Looking at my IP data, location info showed that I was actually in Dallas, Texas. Very sad!
    - azalemeth 2y ago
      Or, as an alternative, we try to convince people that geoIP lookups are at best uncertain and at worst actively misleading -- and perhaps shouldn't be taken at face value. I personally think this would be a great thing. For paid services that allegedly need to know where you are geographically located, use your billing address. For advertisers it's one less bit of useful information...
      - NelsonMinar 2y ago
        I agree! Now please convince Youtube TV, Hulu, and friends. YTTV at least will prefer your phone's geolocation to the IP address, that's how I "check in" to my metro every couple of months.
- matrix2003 2y ago
  Why do dynamic address allocations matter? Most IPv4 consumer WAN addresses are also dynamic. I’m asking, because I’m an advocate of having your gateway advertise a separate, stable ULA /64 in conjunction with the globally-routable dynamic /64. This gives you a stable set of addressable LAN IPs, and you can usually ignore the dynamic globally routable IPs. Granted this won’t work for everyone, but if dynamic global addresses are an issue, you should be requesting a plan that supports a static delegation from your ISP anyway.
  - vetinari 2y ago
    It matters, because when the prefix changes, it changes IP addresses of every single device in your network. As you wrote, internally, you can use ULA. But you cannot open access from outside, because your firewall rules will become invalid with prefix change. With classic IPv4 NAT, your internal addresses don't change, so your port forwarding works, even if the WAN address changes. Together, with a single /64 -- which means no subnets for you -- you are getting worse deal than with IPv4. You shouldn't have to contact your ISP for a plan (for a premium, obviously), that allows you to segment your network or open access to specific devices. What's the use of direct connections -- the IPv6 promise -- when you cannot use them anyway? In short, with limitations like these, you are getting a bad deal.
    - xrisk 2y ago
      I don’t know what router you use, but openwrt lets you set firewall rules that only match the last 64 bits. This should solve your problem, provided you configure your router to hand out static IPv6 leases to devices.
      - vetinari 2y ago
        There are wildly different solutions for different routers. I'm using Mikrotik, which doesn't allow prefix-less addresses in firewall, but allows you to put hostnames into your rules (so it will ask DNS what the address is and once the ttl expires, it will ask again). On some CPEs (I don't remember which), it allowed to enter mac addresses, so the forwarding would always work for specific device, with any GUA address. But we have to remember, that all these solution are optional and brand-specific; there's a wide range of devices that do not have anything to solve this problem.
- iam-TJ 2y ago
  I've been using Starlink since early 2021 with IPv6 only internally. Starlink User Terminal hands out a /56 prefix (via DHCPv6) and mine has not changed in all that time so I wouldn't call it dynamic. The User Terminal issues a router advertisement (RA) and my gateway gives itself an address in that /64 via SLAAC in addition to assigning itself an address from the /56 prefix. If not using prefix delegation each host's address is dependent on their SLAAC policy - if not preferring stable addresses (e.g: EUI64) then of course the public address will vary (be dynamic) when using temporary "privacy" addresses. My gateway delegates /60 sub-prefixes of the /56 and bare-metal hosts then either delegates /62 or advertises /64s from the /60 to VMs, containers, network namespaces and so forth. As someone else described, I have my gateway also delegate ULA prefixes by changing just the first two octets of the public delegated prefix to fddc (fd = ULA, dc = "data center :) but otherwise identical and likewise on the bare-metal hosts, etc. ULA is used for internal services; ISP delegated prefix for anything that needs public access. Multicast-DNS takes care of internal hostnames; everything is ${hostname}.local There's a separate VLAN for legacy IPv4-only devices that does NAT64 using a ULA prefix. DNS64/NAT64 for the laggards like github.com that can't grok 128 bit addresses :) The only time I have problems with web services is when their DNS advertises an AAAA resource record but their firewall/load-balancers/servers are not configured to allow/listen on it.
  - NelsonMinar 2y ago
    Thanks for the report with success with IPv6 and Starlink. Do you make inbound connections to devices on your LAN? Do they work? Starlink recently updated their FAQ with more info on addressing: https://www.starlink.com/support/article/1192f3ef-2a17-31d9-261a-a59d215629f4 https://www.starlink.com/support/article/1192f3ef-2a17-31d9-... As for static addresses, it says "a reservation system retains the ... IPv6 prefix even when the system is off or rebooted. However, relocating the Starlink or software updates may change these addresses." I suspect in practice the IPv6 address will only change if you get moved to a different POP ground station. Some customers never get moved. I've been moved several times because I'm in NorCal and they keep switching me between Seattle and Los Angeles. Here's some recent discussion of users reporting what they've observed about changing IPv6 addresses: https://www.reddit.com/r/Starlink/comments/1b6mr4c/how_static_are_ipv6_assignments/ https://www.reddit.com/r/Starlink/comments/1b6mr4c/how_stati...
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]

by koyote 2y ago

NelsonMinar 2y ago

Starlink uses CGNAT. It's awful, I'm regularly getting CAPTCHAs on random websites. They now support IPv6 but only with dynamic address allocations so you don't get a lot of advantages from it.

imoverclocked 2y ago
I hadn’t put that quite together. I wonder how many people would value IPv6 if they knew it meant less CAPTCHAs.
- alwayslikethis 2y ago
  I'd imagine that to be short lived. IPv6 having such a huge address spaces means the IP reputations are even more worthless than IPv4 so eventually the bots would use it too, and if the ratio of bots to real users become too high sites may refuse IPv6 traffic altogether.
  - matrix2003 2y ago
    It’s a little different though in that rather than an IP having a bad reputation, it’s usually a /64. That’s how I have seen IPv6 reputation managed since it’s a common network slice & NAT is not really used anymore.
  - preisschild 2y ago
    You can block ipv6 /64 subnets just like you can block IPv4 /32 IPs.
  - NelsonMinar 2y ago
    Ooof that's an ugly thought. But I think "refuse IPv6 traffic altogether" is not possible for any consumer site. Per the article, there's 40% adoption of IPv6 now and it's only growing. Major parts of the world rely on IPv6 working right. I guess sites could go IPv4-only but given how many other problems there are with IP reputations, that'd be awfully dumb.
- NelsonMinar 2y ago
  CAPTCHAs are the main reason I turned IPv6 on. No idea if it will actually help in practice, it's hard to measure. The other Starlink hassle is the geocoding for user IPv4 addresses is wildly wrong. I'm in Grass Valley, CA near Sacramento but sites all think my IP is either in Seattle or Los Angeles, depending on the week. This makes streaming services a huge PITA, I have to jump through hoops to convince them I'm in the Sacramento TV market about once a month. IPv6 could help with this too, Starlink could give out more precisely geolocated addresses. Not sure they're doing it though, all I see are IPv4 addresses in the geocoding feed: https://geoip.starlinkisp.net/feed.csv https://geoip.starlinkisp.net/feed.csv
  - esaym 2y ago
    I was on a cruise ship in the Caribbean for a week just last month and I purchased the starlink powered internet package. Looking at my IP data, location info showed that I was actually in Dallas, Texas. Very sad!
  - azalemeth 2y ago
    Or, as an alternative, we try to convince people that geoIP lookups are at best uncertain and at worst actively misleading -- and perhaps shouldn't be taken at face value. I personally think this would be a great thing. For paid services that allegedly need to know where you are geographically located, use your billing address. For advertisers it's one less bit of useful information...
    - NelsonMinar 2y ago
      I agree! Now please convince Youtube TV, Hulu, and friends. YTTV at least will prefer your phone's geolocation to the IP address, that's how I "check in" to my metro every couple of months.
matrix2003 2y ago
Why do dynamic address allocations matter? Most IPv4 consumer WAN addresses are also dynamic. I’m asking, because I’m an advocate of having your gateway advertise a separate, stable ULA /64 in conjunction with the globally-routable dynamic /64. This gives you a stable set of addressable LAN IPs, and you can usually ignore the dynamic globally routable IPs. Granted this won’t work for everyone, but if dynamic global addresses are an issue, you should be requesting a plan that supports a static delegation from your ISP anyway.
- vetinari 2y ago
  It matters, because when the prefix changes, it changes IP addresses of every single device in your network. As you wrote, internally, you can use ULA. But you cannot open access from outside, because your firewall rules will become invalid with prefix change. With classic IPv4 NAT, your internal addresses don't change, so your port forwarding works, even if the WAN address changes. Together, with a single /64 -- which means no subnets for you -- you are getting worse deal than with IPv4. You shouldn't have to contact your ISP for a plan (for a premium, obviously), that allows you to segment your network or open access to specific devices. What's the use of direct connections -- the IPv6 promise -- when you cannot use them anyway? In short, with limitations like these, you are getting a bad deal.
  - xrisk 2y ago
    I don’t know what router you use, but openwrt lets you set firewall rules that only match the last 64 bits. This should solve your problem, provided you configure your router to hand out static IPv6 leases to devices.
    - vetinari 2y ago
      There are wildly different solutions for different routers. I'm using Mikrotik, which doesn't allow prefix-less addresses in firewall, but allows you to put hostnames into your rules (so it will ask DNS what the address is and once the ttl expires, it will ask again). On some CPEs (I don't remember which), it allowed to enter mac addresses, so the forwarding would always work for specific device, with any GUA address. But we have to remember, that all these solution are optional and brand-specific; there's a wide range of devices that do not have anything to solve this problem.
iam-TJ 2y ago
I've been using Starlink since early 2021 with IPv6 only internally. Starlink User Terminal hands out a /56 prefix (via DHCPv6) and mine has not changed in all that time so I wouldn't call it dynamic. The User Terminal issues a router advertisement (RA) and my gateway gives itself an address in that /64 via SLAAC in addition to assigning itself an address from the /56 prefix. If not using prefix delegation each host's address is dependent on their SLAAC policy - if not preferring stable addresses (e.g: EUI64) then of course the public address will vary (be dynamic) when using temporary "privacy" addresses. My gateway delegates /60 sub-prefixes of the /56 and bare-metal hosts then either delegates /62 or advertises /64s from the /60 to VMs, containers, network namespaces and so forth. As someone else described, I have my gateway also delegate ULA prefixes by changing just the first two octets of the public delegated prefix to fddc (fd = ULA, dc = "data center :) but otherwise identical and likewise on the bare-metal hosts, etc. ULA is used for internal services; ISP delegated prefix for anything that needs public access. Multicast-DNS takes care of internal hostnames; everything is ${hostname}.local There's a separate VLAN for legacy IPv4-only devices that does NAT64 using a ULA prefix. DNS64/NAT64 for the laggards like github.com that can't grok 128 bit addresses :) The only time I have problems with web services is when their DNS advertises an AAAA resource record but their firewall/load-balancers/servers are not configured to allow/listen on it.
- NelsonMinar 2y ago
  Thanks for the report with success with IPv6 and Starlink. Do you make inbound connections to devices on your LAN? Do they work? Starlink recently updated their FAQ with more info on addressing: https://www.starlink.com/support/article/1192f3ef-2a17-31d9-261a-a59d215629f4 https://www.starlink.com/support/article/1192f3ef-2a17-31d9-... As for static addresses, it says "a reservation system retains the ... IPv6 prefix even when the system is off or rebooted. However, relocating the Starlink or software updates may change these addresses." I suspect in practice the IPv6 address will only change if you get moved to a different POP ground station. Some customers never get moved. I've been moved several times because I'm in NorCal and they keep switching me between Seattle and Los Angeles. Here's some recent discussion of users reporting what they've observed about changing IPv6 addresses: https://www.reddit.com/r/Starlink/comments/1b6mr4c/how_static_are_ipv6_assignments/ https://www.reddit.com/r/Starlink/comments/1b6mr4c/how_stati...
deleted 2y ago
[deleted]

deleted 2y ago

[deleted]