5 ms·

Interestingly, IPv6 is not listed as the solution

api 2y ago
The weird fear around it is crazy. It’s mostly just bigger IPs and it makes so much complexity and ugly hacks like NAT go away.
- userbinator 2y ago
  IPv6 is its own complexity.
  - api 2y ago
    Why?
    - Joel_Mckay 2y ago
      In general, the IPv6 stack is not supported on many smaller mcu. It is not that options like FreeRTOS can't support the stack, but rather the resource constraints pose a challenge. That being said, most modern SoCs are competitively priced... and will boot Linux just fine for under $5/part. =3
      - elcritch 2y ago
        Some of the new IoT protocols build on ipv6 natively. The resource overhead is minimal for modern mcus. Dropping dhcp and arp can save a lot of resources too. Also I have mcus with more ram than my first pc.
        jeroenhd 2y ago
        Disabling IPv6 in ESP-IDF can save about 40KiB of flash and 2KiB of RAM. Not enough that I'd do it by default, but I've hit the limit of some of my hobbyist ESP32s to the point where I've disabled modules to cram my code in there. Disabling IPv4 saves 25KiB of flash and less than a KiB of RAM. If you're down to the last kilobytes, disabling IPv6 makes more sense than disabling IPv4. Both options are choices of last resort, though.
        Joel_Mckay 2y ago
        A dual core 240MHz cpu with hardware paged flash and spi ram expansion support is not "small" in my opinion. However, I am a fan of their price point for hobby projects. Best regards =3
    - LegionMammal978 2y ago
      Eliminating NAT makes virtual networking much hairier. E.g., my desktop is currently connected to a big enterprise network that keeps track of all devices and will only allocate one IP address per MAC address. That leaves no IPs for any VMs on my desktop to use, so they must go through NAT if they want to communicate with the outside world.
      - pcpuser 2y ago
        That's definitely a limitation of your network. I don't see how ipv6 can shoulder any responsibility here.
      - Dylan16807 2y ago
        Are you talking about eliminating NAT on IPv4? IPv6, set up the normal way, does not allocate IPs. Devices can and will have several at once and their VMs can easily get some too.
        wmf 2y ago
        The enterprise corrupted IPv6 and disabled SLAAC so devices have to use whatever DHCPv6 gives them.
        somanyphotons 2y ago
        How does that work for android devices? I heard they don't allow dhcp provided addresses?
        wmf 2y ago
        The Android problem only occurs in an IPv6-only enterprise network which is very rare. Otherwise Android can use IPv4.
      - pjc50 2y ago
        Shouldn't the VMs have their own MACs?
    - deleted 2y ago
      [deleted]
    - positr0n 2y ago
      Great question that I don't think the other commentors really answered. Sadly I don't really know "why" either. Second system effect? Instead of making IPv6 just "IPv4 with 128bit instead of 32bit address space" the designers changed a bunch of things. NDP is new and different than ARP. ICMPv6 is extended and different. MLD instead of IGMP for multicast group membership. DHCP is extended and has a bunch of other alternatives, like SLAAC. IPsec is mandatory now. All the new IPv6 protocols seem more secure, more powerful, and more efficient. So I guess that is "why". But I bet in an alternative history where backwards compatibility and the upgrade process were prioritized IPv6 would be a lot more widespread.
- withinboredom 2y ago
  and also so many other things. ARP goes away, dhcp goes away -- yet people reinvented dhcp anyway and did it wrong (IHMO). I'm of the opinion that IPV6 changed some small things just enough to get people to have to learn new stuff -- and also forgot that NAT is not a firewall, somewhere along the way.
gnabgib 2y ago
It was 3 months ago: https://news.ycombinator.com/item?id=41884515 https://news.ycombinator.com/item?id=41884515
LegionMammal978 2y ago
An IPv6 router with a stateful firewall blocking incoming connections could have just the same issues with timeouts, I'd imagine. Switching to IPv6 doesn't just mean that anyone can make a P2P connection to anyone else (even STUN needs a third-party server to coordinate the two peers). (D)TLS session resumption (I'm not sure if their "Connection IDs" are that or something similar) seems like the most foolproof solution to this scenario, assuming that the remote host can support it.
- namibj 2y ago
  But it'd be trivial to tell it to free the device from it, unlike with NAT, where you pretty much have to expire sessions to not run out of memory.
  - LegionMammal978 2y ago
    Not if the end user isn't in control of the firewall. (And if they were, then they could just forward dedicated ports for the devices they need.) It might not be as bad as the CGNAT situation, but there are plenty of big WANs that can't be reconfigured at will.
  - chgs 2y ago
    I have firewalls in v4 and v6 networks which don’t do any natting (well other than some 6-4 between them). They track sessions for security purposes, and they time them out for both security and memory reasons.
- MerManMaid 2y ago
  >An IPv6 router with a stateful firewall blocking incoming connections could have just the same issues with timeouts, I'd imagine. You'd be surprised... PCP (Port Control Protocol) implemented by large vendors such as Cisco and Apple are able to punch through a firewall for up to 24 hours in a single session. https://github.com/Self-Hosting-Group/wiki/wiki/Port-Mapping-Protocols-Overview https://github.com/Self-Hosting-Group/wiki/wiki/Port-Mapping...
vv_ 2y ago
Few cellular modems commonly used in IoT support IPv6, and not all mobile network operators provide an IPv6 address. Since cellular connectivity plays a major role in the industry, IPv6 cannot be used as a blanket solution to this problem.
- altairprime 2y ago
  Either it would or it wouldn’t help in most cases, but the absence of consideration of it at all weakens the article’s arguments from a carrier perspective. IPv6 adoption was at 90% by US mobile carriers a couple years ago, and the US is not known for its telco infrastructure investment; so, while using IPv6 may not be a uniform cure for their issues, the article’s total focus on legacy IPv4 NAT issues is in stark contrast to its availability carrier-side in one of the weakest examples available. China regulates that IPv6 be supported and enabled by default on all hardware sold for use in-country since last year, and telcos have six months left until a first-stage IPv4 new-hardware prohibition goes into effect later this year, so the assumption that most cellular modems don’t support IPv6 seems unlikely as well given their regulatory climate. This deserves more research or at least an explanation of why such was not done for the initial release of the paper.
  - kiwijamo 2y ago
    There are still countries with zero IPv6 on mobile, e.g. New Zealand. All three mobile carriers refuse to deploy IPv6 on mobile despite two of them doing so on their fixed line networks. Do agree with your point tho IPv6 should be considered a possible solution.

api 2y ago

The weird fear around it is crazy. It’s mostly just bigger IPs and it makes so much complexity and ugly hacks like NAT go away.

userbinator 2y ago
IPv6 is its own complexity.
- api 2y ago
  Why?
  - Joel_Mckay 2y ago
    In general, the IPv6 stack is not supported on many smaller mcu. It is not that options like FreeRTOS can't support the stack, but rather the resource constraints pose a challenge. That being said, most modern SoCs are competitively priced... and will boot Linux just fine for under $5/part. =3
    - elcritch 2y ago
      Some of the new IoT protocols build on ipv6 natively. The resource overhead is minimal for modern mcus. Dropping dhcp and arp can save a lot of resources too. Also I have mcus with more ram than my first pc.
      - jeroenhd 2y ago
        Disabling IPv6 in ESP-IDF can save about 40KiB of flash and 2KiB of RAM. Not enough that I'd do it by default, but I've hit the limit of some of my hobbyist ESP32s to the point where I've disabled modules to cram my code in there. Disabling IPv4 saves 25KiB of flash and less than a KiB of RAM. If you're down to the last kilobytes, disabling IPv6 makes more sense than disabling IPv4. Both options are choices of last resort, though.
        Joel_Mckay 2y ago
        A dual core 240MHz cpu with hardware paged flash and spi ram expansion support is not "small" in my opinion. However, I am a fan of their price point for hobby projects. Best regards =3
  - LegionMammal978 2y ago
    Eliminating NAT makes virtual networking much hairier. E.g., my desktop is currently connected to a big enterprise network that keeps track of all devices and will only allocate one IP address per MAC address. That leaves no IPs for any VMs on my desktop to use, so they must go through NAT if they want to communicate with the outside world.
    - pcpuser 2y ago
      That's definitely a limitation of your network. I don't see how ipv6 can shoulder any responsibility here.
    - Dylan16807 2y ago
      Are you talking about eliminating NAT on IPv4? IPv6, set up the normal way, does not allocate IPs. Devices can and will have several at once and their VMs can easily get some too.
      - wmf 2y ago
        The enterprise corrupted IPv6 and disabled SLAAC so devices have to use whatever DHCPv6 gives them.
        somanyphotons 2y ago
        How does that work for android devices? I heard they don't allow dhcp provided addresses?
        wmf 2y ago
        The Android problem only occurs in an IPv6-only enterprise network which is very rare. Otherwise Android can use IPv4.
    - pjc50 2y ago
      Shouldn't the VMs have their own MACs?
  - deleted 2y ago
    [deleted]
  - positr0n 2y ago
    Great question that I don't think the other commentors really answered. Sadly I don't really know "why" either. Second system effect? Instead of making IPv6 just "IPv4 with 128bit instead of 32bit address space" the designers changed a bunch of things. NDP is new and different than ARP. ICMPv6 is extended and different. MLD instead of IGMP for multicast group membership. DHCP is extended and has a bunch of other alternatives, like SLAAC. IPsec is mandatory now. All the new IPv6 protocols seem more secure, more powerful, and more efficient. So I guess that is "why". But I bet in an alternative history where backwards compatibility and the upgrade process were prioritized IPv6 would be a lot more widespread.
withinboredom 2y ago
and also so many other things. ARP goes away, dhcp goes away -- yet people reinvented dhcp anyway and did it wrong (IHMO). I'm of the opinion that IPV6 changed some small things just enough to get people to have to learn new stuff -- and also forgot that NAT is not a firewall, somewhere along the way.

gnabgib 2y ago

It was 3 months ago: https://news.ycombinator.com/item?id=41884515 https://news.ycombinator.com/item?id=41884515

LegionMammal978 2y ago

An IPv6 router with a stateful firewall blocking incoming connections could have just the same issues with timeouts, I'd imagine. Switching to IPv6 doesn't just mean that anyone can make a P2P connection to anyone else (even STUN needs a third-party server to coordinate the two peers). (D)TLS session resumption (I'm not sure if their "Connection IDs" are that or something similar) seems like the most foolproof solution to this scenario, assuming that the remote host can support it.

namibj 2y ago
But it'd be trivial to tell it to free the device from it, unlike with NAT, where you pretty much have to expire sessions to not run out of memory.
- LegionMammal978 2y ago
  Not if the end user isn't in control of the firewall. (And if they were, then they could just forward dedicated ports for the devices they need.) It might not be as bad as the CGNAT situation, but there are plenty of big WANs that can't be reconfigured at will.
- chgs 2y ago
  I have firewalls in v4 and v6 networks which don’t do any natting (well other than some 6-4 between them). They track sessions for security purposes, and they time them out for both security and memory reasons.
MerManMaid 2y ago
>An IPv6 router with a stateful firewall blocking incoming connections could have just the same issues with timeouts, I'd imagine. You'd be surprised... PCP (Port Control Protocol) implemented by large vendors such as Cisco and Apple are able to punch through a firewall for up to 24 hours in a single session. https://github.com/Self-Hosting-Group/wiki/wiki/Port-Mapping-Protocols-Overview https://github.com/Self-Hosting-Group/wiki/wiki/Port-Mapping...

vv_ 2y ago

Few cellular modems commonly used in IoT support IPv6, and not all mobile network operators provide an IPv6 address. Since cellular connectivity plays a major role in the industry, IPv6 cannot be used as a blanket solution to this problem.

altairprime 2y ago
Either it would or it wouldn’t help in most cases, but the absence of consideration of it at all weakens the article’s arguments from a carrier perspective. IPv6 adoption was at 90% by US mobile carriers a couple years ago, and the US is not known for its telco infrastructure investment; so, while using IPv6 may not be a uniform cure for their issues, the article’s total focus on legacy IPv4 NAT issues is in stark contrast to its availability carrier-side in one of the weakest examples available. China regulates that IPv6 be supported and enabled by default on all hardware sold for use in-country since last year, and telcos have six months left until a first-stage IPv4 new-hardware prohibition goes into effect later this year, so the assumption that most cellular modems don’t support IPv6 seems unlikely as well given their regulatory climate. This deserves more research or at least an explanation of why such was not done for the initial release of the paper.
- kiwijamo 2y ago
  There are still countries with zero IPv6 on mobile, e.g. New Zealand. All three mobile carriers refuse to deploy IPv6 on mobile despite two of them doing so on their fixed line networks. Do agree with your point tho IPv6 should be considered a possible solution.