4 ms·

Half of AWS services aren't even available from an IPv6 endpoint, it's a clusterfuck. I'm all for carrot and stick but they are making a giant mess of it. Sou

Half of AWS services aren't even available from an IPv6 endpoint, it's a clusterfuck. I'm all for carrot and stick but they are making a giant mess of it. Source: https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-support.html#ipv6-service-support https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su... , see 'IPv6 only support' column.

cyberax 2y ago
Yeah. For example, ECR (Elastic Container Registry) is _not_ available on IPv6. Anything "serverless" such as ElastiCache or RDS is also not available. So it means that you can't have a fully-IPv6 stack for any modern application on AWS.
simoncion 2y ago
> ... see 'IPv6 only support' column. Is that relevant? There's nothing wrong with having RFC1918 addresses and globally-routable IPv6 addresses assigned to your VPC. Have the RFC1918 addresses accessing IPv4-only AWS resources and the globally-routable IPv6 addresses serving the world. Easy. After all, the major cloud providers don't charge for RFC1918 addresses... they just charge for globally-routable IPv4 addresses.
- lmm 2y ago
  > There's nothing wrong with having RFC1918 addresses and globally-routable IPv6 addresses assigned to your VPC. It's a pretty backwards way to build your network. You pay all the costs and gain none of the benefits.
  - simoncion 2y ago
    I'm afraid I don't follow. The way to express the design in a pure-IPv6 world would be that you use ULA addresses to reach the AWS services that you use and globally-routable addresses to reach the outside world. Given that the cost that we're avoiding paying with the mechanism I described in my previous post is the ongoing cost for globally-routable IPv4 addresses, I'm not sure what cost you're talking about paying. And given that the benefits are not having to pay for globally-routable IPs, I'm not sure what benefits you're talking about that we don't get? Are you perhaps one of those "Hosts must be IPv6-only, no dual-stack allowed!" people? If so, I regard that as a silly stance today, and expect it will remain a silly stance for the next several decades (maybe even the next century, who knows?).
    - akdor1154 2y ago
      Running single stack hosts is absolutely a reasonable goal. If i have choice between running ipv6 and nat6to4, and ipv4, ipv6, and nat4, surely the former is both a simpler setup, and a further step towards a real full v6 internet?
      - simoncion 2y ago
        > Running single stack hosts is absolutely a reasonable goal. Sure. I expect that it's not one that we will see most Internet-facing machines achieve in our lifetimes. > If i have choice between running ipv6 and nat6to4, and ipv4, ipv6, and nat4, surely the former is both a simpler setup... No. You already have an IPv4 stack in your OS, and I guaran-damn-tee you that your NAT64 setup is far more complicated than a NAT44 setup. [0] > ...and a further step towards a real full v6 internet? Sure. But there's no inherent value in dropping IPv4. The only thing wrong with IPv4 that's not also wrong with IPv6 is that it doesn't have enough address space. Moving more and more globally-reachable servers and hosts to IPv6 reduces the number of IPv4 addresses required, which solves the "not enough addresses" problem of IPv4. [0] AFAIK, if you use NAT64, you either let both direct-IP connections [1] and inbound IPv4 port forwarding not work, OR you must use additional (substantially complex) software to make that work. So, either you break some software that happens to use IPv4, or you massively increase your system software complexity. Seems bad either way. [1] That is, connections to IPv4 hosts without a pre-connection DNS lookup.
      - acdha 2y ago
        I agree, but more and more customers are strictly limiting egress for security reasons which reduces the argument somewhat. I think it’s more likely that not overpaying for NAT Gateways will be a more effective source of pressure for AWS customers.
    - lmm 2y ago
      I meant the network admin costs, if you're having to run dual stack, and especially if you're getting a network setup where you can't fearlessly combine/add routes between any two subnets that you have. To my mind the key benefit of using IPv6, the thing that makes it worth doing at all, is to stop having to worry about address assignment and address collisions and local addresses; obviously you do still probably want to talk to v4-only outside resources, but if you can't get away from having to give all your hosts individual v4 addresses and keep track of them then frankly you might as well just stay v4-only (except at the load balancer or what have you - which might be what you meant, but it sounded like you were talking about using a mix of v4 and v6 within the VPC).

cyberax 2y ago

Yeah. For example, ECR (Elastic Container Registry) is _not_ available on IPv6. Anything "serverless" such as ElastiCache or RDS is also not available. So it means that you can't have a fully-IPv6 stack for any modern application on AWS.

simoncion 2y ago

> ... see 'IPv6 only support' column. Is that relevant? There's nothing wrong with having RFC1918 addresses and globally-routable IPv6 addresses assigned to your VPC. Have the RFC1918 addresses accessing IPv4-only AWS resources and the globally-routable IPv6 addresses serving the world. Easy. After all, the major cloud providers don't charge for RFC1918 addresses... they just charge for globally-routable IPv4 addresses.

lmm 2y ago
> There's nothing wrong with having RFC1918 addresses and globally-routable IPv6 addresses assigned to your VPC. It's a pretty backwards way to build your network. You pay all the costs and gain none of the benefits.
- simoncion 2y ago
  I'm afraid I don't follow. The way to express the design in a pure-IPv6 world would be that you use ULA addresses to reach the AWS services that you use and globally-routable addresses to reach the outside world. Given that the cost that we're avoiding paying with the mechanism I described in my previous post is the ongoing cost for globally-routable IPv4 addresses, I'm not sure what cost you're talking about paying. And given that the benefits are not having to pay for globally-routable IPs, I'm not sure what benefits you're talking about that we don't get? Are you perhaps one of those "Hosts must be IPv6-only, no dual-stack allowed!" people? If so, I regard that as a silly stance today, and expect it will remain a silly stance for the next several decades (maybe even the next century, who knows?).
  - akdor1154 2y ago
    Running single stack hosts is absolutely a reasonable goal. If i have choice between running ipv6 and nat6to4, and ipv4, ipv6, and nat4, surely the former is both a simpler setup, and a further step towards a real full v6 internet?
    - simoncion 2y ago
      > Running single stack hosts is absolutely a reasonable goal. Sure. I expect that it's not one that we will see most Internet-facing machines achieve in our lifetimes. > If i have choice between running ipv6 and nat6to4, and ipv4, ipv6, and nat4, surely the former is both a simpler setup... No. You already have an IPv4 stack in your OS, and I guaran-damn-tee you that your NAT64 setup is far more complicated than a NAT44 setup. [0] > ...and a further step towards a real full v6 internet? Sure. But there's no inherent value in dropping IPv4. The only thing wrong with IPv4 that's not also wrong with IPv6 is that it doesn't have enough address space. Moving more and more globally-reachable servers and hosts to IPv6 reduces the number of IPv4 addresses required, which solves the "not enough addresses" problem of IPv4. [0] AFAIK, if you use NAT64, you either let both direct-IP connections [1] and inbound IPv4 port forwarding not work, OR you must use additional (substantially complex) software to make that work. So, either you break some software that happens to use IPv4, or you massively increase your system software complexity. Seems bad either way. [1] That is, connections to IPv4 hosts without a pre-connection DNS lookup.
    - acdha 2y ago
      I agree, but more and more customers are strictly limiting egress for security reasons which reduces the argument somewhat. I think it’s more likely that not overpaying for NAT Gateways will be a more effective source of pressure for AWS customers.
  - lmm 2y ago
    I meant the network admin costs, if you're having to run dual stack, and especially if you're getting a network setup where you can't fearlessly combine/add routes between any two subnets that you have. To my mind the key benefit of using IPv6, the thing that makes it worth doing at all, is to stop having to worry about address assignment and address collisions and local addresses; obviously you do still probably want to talk to v4-only outside resources, but if you can't get away from having to give all your hosts individual v4 addresses and keep track of them then frankly you might as well just stay v4-only (except at the load balancer or what have you - which might be what you meant, but it sounded like you were talking about using a mix of v4 and v6 within the VPC).