4 ms·

I think “and we’re gonna kill NAT too!” is precisely where IPv6 overstepped and started making things worse for itself. It didn’t need to be this way. NAT soun

I think “and we’re gonna kill NAT too!” is precisely where IPv6 overstepped and started making things worse for itself. It didn’t need to be this way. NAT sounds like a bad idea at first glance, but it doesn’t exist just to alleviate address shortages (although it does.) It doesn’t just exist to provide security by default either (although it does that too.) NAT is also the only sane choice in residential setups. Because your public IP address prefix isn’t static. That was never going to happen. And just saying “never put an IP address in any configuration file” isn’t a satisfactory answer. When a reprefix happens, and your clients are all only speaking on GUA addresses, your network is going to be fucked until they expire the old addresses. Not in theory, in practice. None of my devices in my household did any sort of reasonable thing when Comcast changes my prefix. I had to just go around and reboot everything. NAT means I am in 100% control over what IP addresses I configure in my own network. It means I can actually run a DNS server and it works. It means I can configure devices with static addresses and it actually works. ULA isn’t some edge case, it’s the only sane option in residential setups. (You know, that thing you need to maximally support in order for ipv6 to have a chance in hell at succeeding.) The IETF finally releasing guidance that ULA’s should be on equal footing to GUA’s feels like them finally admitting that there might be something to this whole NAT thing. It happened entirely too late IMO.

nucleardog 2y ago
Yeah, to agree with you in different words-- With IPv4 and NAT, I'm setting up a network. I control it from end-to-end. I can define whatever subnets I want, connect them how I want, put a static IP on my IoT device so Home Assistant can find them reliably, etc. Then I have _a_ point (well, three) where my network touches another network and all configuration and setup around how the two interface and interact is defined and controlled there. With IPv6 the expectation is I'm building out another little piece of someone else's network. Now all the communication within my network is closely intertwined with theirs. There's really no good way for me to handle that today. Using SLAAC so devices update when prefixes change leaves me unable to find/connect to anything. Short of installing a DDNS client on my air quality monitor somehow, how do I manage to connect to it? I can use DHCP6 (not on Android though!) and let the server handle DNS registrations. This would also regain the ability to push a NTP server to clients which would be a nice thing to have. Except now when the prefix changes the devices have no way to know and (like you say) I have to run around and reboot everything. And this still doesn't give me a path to load balancing across multiple connections! I guess really the bigger issue here is the dynamic nature of the prefixes. If I could go log into IANA and click a button and get assigned a /48 then log in to my ISPs' sites and attach it to my connection and be on my way... I'd deploy it today, no problem. I can't see any _technical_ reason that wouldn't be possible. But there isn't a snowball's chance in hell any ISP starts offering that ability on consumer connections when they could be gating it behind having a $5k/mo business connection.
- ninkendo 2y ago
  I know people that get a prefix from their RIR, announce it from a cheap $2 VPS in the same data center as their ISP, then just do a quick WireGuard tunnel to it (so sub-millisecond additional latency, ideally) and use that to route packets from the prefix. I guess it works pretty well, but like you said: I can also just… not. Because the other issue if you’re ULA-less is that if your router loses its connection and rescinds its RA (or you just stop the RA daemon, or shut down the router, etc), suddenly you don’t even have LAN connectivity any more because everything will have deleted its routes.
- andrewjf 2y ago
  > I guess really the bigger issue here is the dynamic nature of the prefixes. If I could go log into IANA and click a button and get assigned a /48 then log in to my ISPs' sites and attach it to my connection and be on my way... I'd deploy it today, no problem. Yes, this right here. It should work like a phone number where you can take it from provider to provider. You setup your gateway with your IPv6 prefix and then go. Problem is all the technical and non-technical stuff to actually make that work. - Verifying ownership of the prefix (rPKI or IRRs) and which ASNs are allowed to advertise it. - Limiting allocations to someone? I guess phones solve this with SIMs - Getting your ISP to route the traffic to your device - Getting the device to announce it with RAs - Dealing with asymmetric return routing over a slow "path" since it could be multi-homed - Dealing with routing aggregation since IPv6 routing tables would explode with all the /56s in there Maybe bring back Mobile IPv6? https://en.wikipedia.org/wiki/Mobile_IP https://en.wikipedia.org/wiki/Mobile_IP
- cyberax 2y ago
  > I can't see any _technical_ reason that wouldn't be possible Every additional route and its ASN takes up RAM in nearly _every_ router that has a DFZ (default-free zone) view. This RAM is not cheap, so regional registries are incentivized to keep the number of new registrations down. For IPv4 there are about 1 million routing entries right now, and for IPv6 about 200k. The IPv6 routing space can reasonably scale by about 5-10x before requiring serious changes in the core routers, but that's just not a lot of entries.

nucleardog 2y ago

Yeah, to agree with you in different words-- With IPv4 and NAT, I'm setting up a network. I control it from end-to-end. I can define whatever subnets I want, connect them how I want, put a static IP on my IoT device so Home Assistant can find them reliably, etc. Then I have _a_ point (well, three) where my network touches another network and all configuration and setup around how the two interface and interact is defined and controlled there. With IPv6 the expectation is I'm building out another little piece of someone else's network. Now all the communication within my network is closely intertwined with theirs. There's really no good way for me to handle that today. Using SLAAC so devices update when prefixes change leaves me unable to find/connect to anything. Short of installing a DDNS client on my air quality monitor somehow, how do I manage to connect to it? I can use DHCP6 (not on Android though!) and let the server handle DNS registrations. This would also regain the ability to push a NTP server to clients which would be a nice thing to have. Except now when the prefix changes the devices have no way to know and (like you say) I have to run around and reboot everything. And this still doesn't give me a path to load balancing across multiple connections! I guess really the bigger issue here is the dynamic nature of the prefixes. If I could go log into IANA and click a button and get assigned a /48 then log in to my ISPs' sites and attach it to my connection and be on my way... I'd deploy it today, no problem. I can't see any _technical_ reason that wouldn't be possible. But there isn't a snowball's chance in hell any ISP starts offering that ability on consumer connections when they could be gating it behind having a $5k/mo business connection.

ninkendo 2y ago
I know people that get a prefix from their RIR, announce it from a cheap $2 VPS in the same data center as their ISP, then just do a quick WireGuard tunnel to it (so sub-millisecond additional latency, ideally) and use that to route packets from the prefix. I guess it works pretty well, but like you said: I can also just… not. Because the other issue if you’re ULA-less is that if your router loses its connection and rescinds its RA (or you just stop the RA daemon, or shut down the router, etc), suddenly you don’t even have LAN connectivity any more because everything will have deleted its routes.
andrewjf 2y ago
> I guess really the bigger issue here is the dynamic nature of the prefixes. If I could go log into IANA and click a button and get assigned a /48 then log in to my ISPs' sites and attach it to my connection and be on my way... I'd deploy it today, no problem. Yes, this right here. It should work like a phone number where you can take it from provider to provider. You setup your gateway with your IPv6 prefix and then go. Problem is all the technical and non-technical stuff to actually make that work. - Verifying ownership of the prefix (rPKI or IRRs) and which ASNs are allowed to advertise it. - Limiting allocations to someone? I guess phones solve this with SIMs - Getting your ISP to route the traffic to your device - Getting the device to announce it with RAs - Dealing with asymmetric return routing over a slow "path" since it could be multi-homed - Dealing with routing aggregation since IPv6 routing tables would explode with all the /56s in there Maybe bring back Mobile IPv6? https://en.wikipedia.org/wiki/Mobile_IP https://en.wikipedia.org/wiki/Mobile_IP
cyberax 2y ago
> I can't see any _technical_ reason that wouldn't be possible Every additional route and its ASN takes up RAM in nearly _every_ router that has a DFZ (default-free zone) view. This RAM is not cheap, so regional registries are incentivized to keep the number of new registrations down. For IPv4 there are about 1 million routing entries right now, and for IPv6 about 200k. The IPv6 routing space can reasonably scale by about 5-10x before requiring serious changes in the core routers, but that's just not a lot of entries.