4 ms·

The argument that NAT-busting (firwall-busting?) becomes easier with IPv6 is certainly true, but "easier" isn't necessarily enough to warrant an entirely new pr

The argument that NAT-busting (firwall-busting?) becomes easier with IPv6 is certainly true, but "easier" isn't necessarily enough to warrant an entirely new protocol suite. If that's the only benefit of IPv6, it doesn't sound worth it to me. UPnP/STUN is still possible with NAT/CGNAT, and you're going to need something like that even if there were no NAT, so to me it sounds like a bit of a wash, at least to the end-user. (Of course, the other huge benefit of IPv6 is "more addresses", so we need it just for that. But my point is that "global routability" isn't really the dream people think it is. In practice, the only differences between modern GUA-but-deny-by-default IPv6 setups and NAT'ed IPv4 setups are the simplicity of the former for the network administrators.)

growse 2y ago
> If that's the only benefit of IPv6, it doesn't sound worth it to me. It's not the only benefit, as anyone who's tried to build a large network or merge two networks with overlapping address space will tell you.
- Spivak 2y ago
  IPv6 doesn't actually save you because it presumes a cultural norm that people will use globally unique addresses for all their networks which, while now possible, I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes.
  - throw0101c 2y ago
    > I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes. Except with 10/8 (or 172/12) everyone is using the same address space. How many network have a 10.0.0.0/24? What are the odds of a conflict for that? But if you have an ULA FDxx:xxxx:xxxx/48 address space, what are the odds that all those x bits will be the same for any two sites? That's 40 bits 'entropy'. Much, much lower (notwithstanding folks doing DEADBEEF, BADCAFE, etc).
  - patrakov 2y ago
    Not only that. Having private IPv6 addresses in the LAN is the easiest way to work with two ISPs and have fail-over. The other way is RFC8475, but I don't know of any implementation except my custom script on OpenWrt: https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-nat/146403/66 https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-...
  - growse 2y ago
    I imagine the threshold of org size where they stop taking their prefixes from their ISP and just go get their own from the RIR is .... Not big. Sure, some network engineers will try and design v6 networks as though they're v4, but everyone else will just go and get a squillion addresses from the RIR that's unique to their org and then just use/announce that.
    - silon42 2y ago
      What about home private network (for smart home, for example)?
      - growse 2y ago
        Home networks don't usually have the problem of having to suddenly merge together with another, similarly-addressed network. Nothing stops you getting a subnet allocated from your local RIR and announcing that on the internet, if you care about that sort of thing for your home network though. You just need a decent ISP.
        ninkendo 2y ago
        > Nothing stops you […] You just need a decent ISP. I’ll just leave that there. No, I can’t just choose to have a decent ISP. I live in the real world where there’s only one choice where I live, same as a rather large majority of people in the world.
- yyyk 2y ago
  'You should switch your working local networking stack so as to help the scenario where the company is bought and you may well not be working there anymore and it's someone else's problem. Or the scenario where the company buys a different company and very likely needs to investigate and remodel the other company's network anyway.'
avianlyric 2y ago
> UPnP/STUN is still possible with NAT/CGNAT You should tell that to my ISP, they’ve managed to deploy a CGNAT that’s proven to be completely STUN proof. The only way I can achieve any kind of P2P comms is using IPv6. IPv4 is useless for anything except strictly outbound connections. > and you're going to need something like that even if there were no NAT, so to me it sounds like a bit of a wash, at least to the end-user. Not in my case. As above, I simply can bust my ISPs CGNAT, so IPv6 is invaluable to me. Makes a huge difference to me, the end-user.
vel0city 2y ago
> UPnP/STUN is still possible with NAT/CGNAT Sometimes. I've experienced a few networks where even with STUN I'm still not able to get a workable session in IPv4.
- saurik 2y ago
  Fixing that network you had an issue with to have working NAT-PMP or whatever is going to be infinitely easier than IPv6ing the entire world.
  - vel0city 2y ago
    I can't just ask my cell provider to change their CGNAT setup. There's nothing I can do on my end.
    - saurik 2y ago
      1) To the extent to which you can't ask them to change their CGNAT setup, you also can't "just" ask them to upgrade to IPv6. 2) In fact you at least can ask them to change their CGNAT setup, as they at least could, if they chose, unilaterally fix their CGNAT setup, while--even if you also felt it possible to ask them to upgrade to IPv6--upgrading to IPv6 as the solution requires the rest of the world to upgrade as well. The real question is then: which is solution to your problem is easier and cheaper to obtain, and the answer is clearly not "upgrade the world to IPv6". "I couldn't convince my ISP to fix their CGNAT setup, so I'd rather convince them--and everyone else--to upgrade to IPv6" makes no sense as a coping mechanism.

growse 2y ago

> If that's the only benefit of IPv6, it doesn't sound worth it to me. It's not the only benefit, as anyone who's tried to build a large network or merge two networks with overlapping address space will tell you.

Spivak 2y ago
IPv6 doesn't actually save you because it presumes a cultural norm that people will use globally unique addresses for all their networks which, while now possible, I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes.
- throw0101c 2y ago
  > I imagine many network engineers will use IPv6's private address space to avoid ever having to re-address their network on ISP changes. Except with 10/8 (or 172/12) everyone is using the same address space. How many network have a 10.0.0.0/24? What are the odds of a conflict for that? But if you have an ULA FDxx:xxxx:xxxx/48 address space, what are the odds that all those x bits will be the same for any two sites? That's 40 bits 'entropy'. Much, much lower (notwithstanding folks doing DEADBEEF, BADCAFE, etc).
- patrakov 2y ago
  Not only that. Having private IPv6 addresses in the LAN is the easiest way to work with two ISPs and have fail-over. The other way is RFC8475, but I don't know of any implementation except my custom script on OpenWrt: https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-nat/146403/66 https://forum.openwrt.org/t/ipv6-wan-fail-over-without-ipv6-...
- growse 2y ago
  I imagine the threshold of org size where they stop taking their prefixes from their ISP and just go get their own from the RIR is .... Not big. Sure, some network engineers will try and design v6 networks as though they're v4, but everyone else will just go and get a squillion addresses from the RIR that's unique to their org and then just use/announce that.
  - silon42 2y ago
    What about home private network (for smart home, for example)?
    - growse 2y ago
      Home networks don't usually have the problem of having to suddenly merge together with another, similarly-addressed network. Nothing stops you getting a subnet allocated from your local RIR and announcing that on the internet, if you care about that sort of thing for your home network though. You just need a decent ISP.
      - ninkendo 2y ago
        > Nothing stops you […] You just need a decent ISP. I’ll just leave that there. No, I can’t just choose to have a decent ISP. I live in the real world where there’s only one choice where I live, same as a rather large majority of people in the world.
yyyk 2y ago
'You should switch your working local networking stack so as to help the scenario where the company is bought and you may well not be working there anymore and it's someone else's problem. Or the scenario where the company buys a different company and very likely needs to investigate and remodel the other company's network anyway.'

avianlyric 2y ago

> UPnP/STUN is still possible with NAT/CGNAT You should tell that to my ISP, they’ve managed to deploy a CGNAT that’s proven to be completely STUN proof. The only way I can achieve any kind of P2P comms is using IPv6. IPv4 is useless for anything except strictly outbound connections. > and you're going to need something like that even if there were no NAT, so to me it sounds like a bit of a wash, at least to the end-user. Not in my case. As above, I simply can bust my ISPs CGNAT, so IPv6 is invaluable to me. Makes a huge difference to me, the end-user.

vel0city 2y ago

> UPnP/STUN is still possible with NAT/CGNAT Sometimes. I've experienced a few networks where even with STUN I'm still not able to get a workable session in IPv4.

saurik 2y ago
Fixing that network you had an issue with to have working NAT-PMP or whatever is going to be infinitely easier than IPv6ing the entire world.
- vel0city 2y ago
  I can't just ask my cell provider to change their CGNAT setup. There's nothing I can do on my end.
  - saurik 2y ago
    1) To the extent to which you can't ask them to change their CGNAT setup, you also can't "just" ask them to upgrade to IPv6. 2) In fact you at least can ask them to change their CGNAT setup, as they at least could, if they chose, unilaterally fix their CGNAT setup, while--even if you also felt it possible to ask them to upgrade to IPv6--upgrading to IPv6 as the solution requires the rest of the world to upgrade as well. The real question is then: which is solution to your problem is easier and cheaper to obtain, and the answer is clearly not "upgrade the world to IPv6". "I couldn't convince my ISP to fix their CGNAT setup, so I'd rather convince them--and everyone else--to upgrade to IPv6" makes no sense as a coping mechanism.