3 ms·

Every consumer router I’ve ever seen drops unsolicited IPv6 packets by default. But that doesn’t mean that P2P routing is suddenly impossible. IPv6 makes P2P r

Every consumer router I’ve ever seen drops unsolicited IPv6 packets by default. But that doesn’t mean that P2P routing is suddenly impossible. IPv6 makes P2P routing substantially easier, even in a world of default firewalls that drop unsolicited packets. You can still apply standard NAT busting techniques like STUN with IPv6 devices behind firewalls, and you get much better results because IPv6 removes the need to track and predict the port mapping a standard NAT does. Two P2P systems can both send unsolicited packets to each others IPv6 addresses, with a specific port, and know that port number isn’t going to be remapped, so their outbound packets are guaranteed to have the right address and port data in them to get their respective firewalls to treat inbound traffic on those addresses and ports as solicited. This is particularly useful when dealing with CGNATs, where your residential devices ends up behind two NAT layers, both of them messing with your outbound traffic, which just creates an absolute nightmare when trying to NAT bust. IPv6 means that you’re no longer dealing with three or more stateful NATs/firewalls between two peers, and instead only have to deal with at most 2 (in the general case) stateful firewalls, who’s behaviour is inherently simpler and more predictable than a NAT ever is.

ninkendo 2y ago
The argument that NAT-busting (firwall-busting?) becomes easier with IPv6 is certainly true, but "easier" isn't necessarily enough to warrant an entirely new protocol suite. If that's the only benefit of IPv6, it doesn't sound worth it to me. UPnP/STUN is still possible with NAT/CGNAT, and you're going to need something like that even if there were no NAT, so to me it sounds like a bit of a wash, at least to the end-user. (Of course, the other huge benefit of IPv6 is "more addresses", so we need it just for that. But my point is that "global routability" isn't really the dream people think it is. In practice, the only differences between modern GUA-but-deny-by-default IPv6 setups and NAT'ed IPv4 setups are the simplicity of the former for the network administrators.)
- growse 2y ago
  > If that's the only benefit of IPv6, it doesn't sound worth it to me. It's not the only benefit, as anyone who's tried to build a large network or merge two networks with overlapping address space will tell you.
  - Spivak 2y ago
    IPv6 doesn't actually save you because it presumes a cultural norm that people will use globally unique addresses for all their networks which, while now possible, I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes.
    - throw0101c 2y ago
      > I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes. Except with 10/8 (or 172/12) everyone is using the same address space. How many network have a 10.0.0.0/24? What are the odds of a conflict for that? But if you have an ULA FDxx:xxxx:xxxx/48 address space, what are the odds that all those x bits will be the same for any two sites? That's 40 bits 'entropy'. Much, much lower (notwithstanding folks doing DEADBEEF, BADCAFE, etc).
    - patrakov 2y ago
      Not only that. Having private IPv6 addresses in the LAN is the easiest way to work with two ISPs and have fail-over. The other way is RFC8475, but I don't know of any implementation except my custom script on OpenWrt: https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-nat/146403/66 https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-...
    - growse 2y ago
      I imagine the threshold of org size where they stop taking their prefixes from their ISP and just go get their own from the RIR is .... Not big. Sure, some network engineers will try and design v6 networks as though they're v4, but everyone else will just go and get a squillion addresses from the RIR that's unique to their org and then just use/announce that.
      - silon42 2y ago
        What about home private network (for smart home, for example)?
- avianlyric 2y ago
  > UPnP/STUN is still possible with NAT/CGNAT You should tell that to my ISP, they’ve managed to deploy a CGNAT that’s proven to be completely STUN proof. The only way I can achieve any kind of P2P comms is using IPv6. IPv4 is useless for anything except strictly outbound connections. > and you're going to need something like that even if there were no NAT, so to me it sounds like a bit of a wash, at least to the end-user. Not in my case. As above, I simply can bust my ISPs CGNAT, so IPv6 is invaluable to me. Makes a huge difference to me, the end-user.
- vel0city 2y ago
  > UPnP/STUN is still possible with NAT/CGNAT Sometimes. I've experienced a few networks where even with STUN I'm still not able to get a workable session in IPv4.
  - saurik 2y ago
    Fixing that network you had an issue with to have working NAT-PMP or whatever is going to be infinitely easier than IPv6ing the entire world.
    - vel0city 2y ago
      I can't just ask my cell provider to change their CGNAT setup. There's nothing I can do on my end.
      - saurik 2y ago
        1) To the extent to which you can't ask them to change their CGNAT setup, you also can't "just" ask them to upgrade to IPv6. 2) In fact you at least can ask them to change their CGNAT setup, as they at least could, if they chose, unilaterally fix their CGNAT setup, while--even if you also felt it possible to ask them to upgrade to IPv6--upgrading to IPv6 as the solution requires the rest of the world to upgrade as well. The real question is then: which is solution to your problem is easier and cheaper to obtain, and the answer is clearly not "upgrade the world to IPv6". "I couldn't convince my ISP to fix their CGNAT setup, so I'd rather convince them--and everyone else--to upgrade to IPv6" makes no sense as a coping mechanism.

ninkendo 2y ago

The argument that NAT-busting (firwall-busting?) becomes easier with IPv6 is certainly true, but "easier" isn't necessarily enough to warrant an entirely new protocol suite. If that's the only benefit of IPv6, it doesn't sound worth it to me. UPnP/STUN is still possible with NAT/CGNAT, and you're going to need something like that even if there were no NAT, so to me it sounds like a bit of a wash, at least to the end-user. (Of course, the other huge benefit of IPv6 is "more addresses", so we need it just for that. But my point is that "global routability" isn't really the dream people think it is. In practice, the only differences between modern GUA-but-deny-by-default IPv6 setups and NAT'ed IPv4 setups are the simplicity of the former for the network administrators.)

growse 2y ago
> If that's the only benefit of IPv6, it doesn't sound worth it to me. It's not the only benefit, as anyone who's tried to build a large network or merge two networks with overlapping address space will tell you.
- Spivak 2y ago
  IPv6 doesn't actually save you because it presumes a cultural norm that people will use globally unique addresses for all their networks which, while now possible, I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes.
  - throw0101c 2y ago
    > I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes. Except with 10/8 (or 172/12) everyone is using the same address space. How many network have a 10.0.0.0/24? What are the odds of a conflict for that? But if you have an ULA FDxx:xxxx:xxxx/48 address space, what are the odds that all those x bits will be the same for any two sites? That's 40 bits 'entropy'. Much, much lower (notwithstanding folks doing DEADBEEF, BADCAFE, etc).
  - patrakov 2y ago
    Not only that. Having private IPv6 addresses in the LAN is the easiest way to work with two ISPs and have fail-over. The other way is RFC8475, but I don't know of any implementation except my custom script on OpenWrt: https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-nat/146403/66 https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-...
  - growse 2y ago
    I imagine the threshold of org size where they stop taking their prefixes from their ISP and just go get their own from the RIR is .... Not big. Sure, some network engineers will try and design v6 networks as though they're v4, but everyone else will just go and get a squillion addresses from the RIR that's unique to their org and then just use/announce that.
    - silon42 2y ago
      What about home private network (for smart home, for example)?
avianlyric 2y ago
> UPnP/STUN is still possible with NAT/CGNAT You should tell that to my ISP, they’ve managed to deploy a CGNAT that’s proven to be completely STUN proof. The only way I can achieve any kind of P2P comms is using IPv6. IPv4 is useless for anything except strictly outbound connections. > and you're going to need something like that even if there were no NAT, so to me it sounds like a bit of a wash, at least to the end-user. Not in my case. As above, I simply can bust my ISPs CGNAT, so IPv6 is invaluable to me. Makes a huge difference to me, the end-user.
vel0city 2y ago
> UPnP/STUN is still possible with NAT/CGNAT Sometimes. I've experienced a few networks where even with STUN I'm still not able to get a workable session in IPv4.
- saurik 2y ago
  Fixing that network you had an issue with to have working NAT-PMP or whatever is going to be infinitely easier than IPv6ing the entire world.
  - vel0city 2y ago
    I can't just ask my cell provider to change their CGNAT setup. There's nothing I can do on my end.
    - saurik 2y ago
      1) To the extent to which you can't ask them to change their CGNAT setup, you also can't "just" ask them to upgrade to IPv6. 2) In fact you at least can ask them to change their CGNAT setup, as they at least could, if they chose, unilaterally fix their CGNAT setup, while--even if you also felt it possible to ask them to upgrade to IPv6--upgrading to IPv6 as the solution requires the rest of the world to upgrade as well. The real question is then: which is solution to your problem is easier and cheaper to obtain, and the answer is clearly not "upgrade the world to IPv6". "I couldn't convince my ISP to fix their CGNAT setup, so I'd rather convince them--and everyone else--to upgrade to IPv6" makes no sense as a coping mechanism.