6 ms·

What are the advantages of IPv6 if I don't want direct routing (NAT is a feature for me, not a workaround)?

by ghusto 1y ago

rasguanabana 1y ago
The only thing that comes to mind for me is simpler header, but not sure if it makes much of a difference anyway.
- some_bird 1y ago
  Yes, it makes a difference: about 8 milliseconds. Properly implemented IPv6 has a lower latency. (and is more efficient, though i believe the energy savings are negligible) See this map: https://stats.labs.apnic.net/v6perf https://stats.labs.apnic.net/v6perf
wmf 1y ago
None.
- eddythompson80 1y ago
  Cheaper IPs?
  - yjftsjthsd-h 1y ago
    If someone doesn't want direct routing, why would that matter?
  - wmf 1y ago
    IPv6 is cheaper but also you can't access half the Internet.
    - simoncion 1y ago
      I've had "native" IPv6 service for something like twenty years. I've not had a problem with accessing any of the internet. If you're hinting that roughly half of the internet-connected servers don't have IPv6 addresses, then my reply is "so what?". Only idiots are suggesting that folks who aren't running an experimental lab (or ISPs that have the expertise required to set up the NATs needed to reach the IPv4 internet from v6-only service) go IPv6-only.
      - yjftsjthsd-h 1y ago
        I think they did in fact mean IPv6-only hosts. For instance, you can save some money getting a virtual box on Hetzner that doesn't have IPv4 connectivity. Of course, that box won't be able to talk to ex. github, so for some people it's really not worth it.
        herczegzsolt 1y ago
        GitHub.com not being available over IPv6 is the most harmful thing for IPv6 penetration.
        Thiez 1y ago
        That and poor support from cloud vendors. Looking at you, Azure. How is IPv6 not enabled for everything by default? It boggles the mind.
- ghusto 1y ago
  After reading all the replies, this appears to be the correct answer.
yjftsjthsd-h 1y ago
> NAT is a feature for me, not a workaround NAT can be fine, but why would it be a feature? (I guess maybe some privacy by way of sharing a public IP?)
- kortilla 1y ago
  It is an inadvertent firewall. It doesn’t allow unsolicited connections to whatever software is running is running on all of the crap in your house. IPv6 requires a stateful firewall on the router to provide the same protection. Then if you turn that on, it kinda defeats the point.
  - hnlmorg 1y ago
    NAT requires a stateful firewall too. In fact all router firewalls are stateful otherwise you’d have to have large ranges of ports permanently open to incoming connections. So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT.
    - kortilla 1y ago
      > NAT requires a stateful firewall too. Yes, you’re repeating what I’m saying. NAT forced router vendors to implement stateful connection tracking and it increased the security of everything behind them. > So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT. This isn’t how it played out in practice though. Huge swaths of home routers had no firewall at all when you enabled IPv6 support because it would have taken slightly extra work to enable the v6 conn tracking.
  - unethical_ban 1y ago
    Having a default deny policy for traffic to your network doesn't defeat the point of IPv6 or direct routing.
  - homebrewer 1y ago
    I think enough consumer routers run upnp servers out of the box that relying on NAT as a firewall is very unreliable. Have a look at upnp state table on your router, you might be surprised at things that have poked holes for the whole world to hammer at without you noticing.
silotis 1y ago
If your ISP issues you a routable IPv4 address then not much. Otherwise IPv6 lets you avoid CGNAT and all of the issues that come with that.
hnlmorg 1y ago
It depends what you want NAT for. If it’s for security then most of the actual security provided by NAT routing is actually just the routers firewall itself. So a good ipv6 firewall provides the same level of security. If it’s just because you’re a bit of a control freak and like to manage the assignment of IP addresses (and I fall into that category too) then my understanding is that you can also do this with ipv6 as ISPs typically hand you a wider subnet range (unlike ipv4 where you get just 1 IP). However I’ve tried a couple of times to adopt ipv6 into my stupidly bespoke home networking stack and failed each time. I really do want to adopt IPv6, if only because I like fiddling with tech, but, like yourself, I keep getting stuck on the “how do I integrate IPv6 into the infrastructure I already have” problem. Edit: if anyone has any recommended guides to configuring IPv6 using ISC dhcpd and unknown addresses supplied by your ISP, then I’d be interested to read them.
- simoncion 1y ago
  To be clear, what you have is a router that's asking your ISP for a DHCPv6-PD prefix, assigning slices of that to one or more interfaces on that router, and what you want is for your dhcpd on that router to assign prefix-oblivious addresses to specific hosts on your LAN? In other words, you want things to work like this? ISP-provided-PD-prefix 2001::/64 + Host address ::22 = Assigned address 2001::22 ISP-provided-PD-prefix 2001:1:/64 + Host address ::22 = Assigned address 2001:1::22 If so, I'll poke around the docs to see if this is possible. I'm running both dhcpcd and ISC dhcpd on my LAN and have a hobbyist's experience with them. But -honestly- what I've done is just relied on SLAAC to handle the globally-routable addresses, and advertised a ULA prefix for stable addresses. These go into my local DNS, but you could just as easily use that for DHCPd.
  - hnlmorg 1y ago
    Not sure if this is what you were describing, but my dhcpd server is a separate machine to the router. I’m just using an off the shelf ASUS router because it’s actually surprisingly good at the basics. But I wanted PXE booting so set up ISC dhcpd on a home server. To be fair, it might actually be possible to do this on my ASUS router. I’ve not actually checked. I’ve had the same setup up for years. Easily more than a decade. Only updating hardware when necessary. So I might be missing a trick with these latest ASUS routers.
Spooky23 1y ago
Very little. I started using it with Spectrum after upgrading a firewall and found. Lots of weird gotchas with DNS.
the8472 1y ago
When I was on an ISP with DS-Lite the IPv4 functionality regularly failed because the AFTR's port mapping saturated (equivalent to reaching ip_conntrack_max on linux). IPv6 wasn't affected since it doesn't involve a stateful middlebox that I don't control.
paulddraper 1y ago
“Unfortunately, NAT reduces the number of options for providing security.” - RFC 1631

What are the advantages of IPv6 if I don't want direct routing (NAT is a feature for me, not a workaround)?

by ghusto 1y ago

What are the advantages of IPv6 if I don't want direct routing (NAT is a feature for me, not a workaround)?

rasguanabana 1y ago

The only thing that comes to mind for me is simpler header, but not sure if it makes much of a difference anyway.

some_bird 1y ago
Yes, it makes a difference: about 8 milliseconds. Properly implemented IPv6 has a lower latency. (and is more efficient, though i believe the energy savings are negligible) See this map: https://stats.labs.apnic.net/v6perf https://stats.labs.apnic.net/v6perf

wmf 1y ago

None.

eddythompson80 1y ago
Cheaper IPs?
- yjftsjthsd-h 1y ago
  If someone doesn't want direct routing, why would that matter?
- wmf 1y ago
  IPv6 is cheaper but also you can't access half the Internet.
  - simoncion 1y ago
    I've had "native" IPv6 service for something like twenty years. I've not had a problem with accessing any of the internet. If you're hinting that roughly half of the internet-connected servers don't have IPv6 addresses, then my reply is "so what?". Only idiots are suggesting that folks who aren't running an experimental lab (or ISPs that have the expertise required to set up the NATs needed to reach the IPv4 internet from v6-only service) go IPv6-only.
    - yjftsjthsd-h 1y ago
      I think they did in fact mean IPv6-only hosts. For instance, you can save some money getting a virtual box on Hetzner that doesn't have IPv4 connectivity. Of course, that box won't be able to talk to ex. github, so for some people it's really not worth it.
      - herczegzsolt 1y ago
        GitHub.com not being available over IPv6 is the most harmful thing for IPv6 penetration.
        Thiez 1y ago
        That and poor support from cloud vendors. Looking at you, Azure. How is IPv6 not enabled for everything by default? It boggles the mind.
ghusto 1y ago
After reading all the replies, this appears to be the correct answer.

yjftsjthsd-h 1y ago

> NAT is a feature for me, not a workaround NAT can be fine, but why would it be a feature? (I guess maybe some privacy by way of sharing a public IP?)

kortilla 1y ago
It is an inadvertent firewall. It doesn’t allow unsolicited connections to whatever software is running is running on all of the crap in your house. IPv6 requires a stateful firewall on the router to provide the same protection. Then if you turn that on, it kinda defeats the point.
- hnlmorg 1y ago
  NAT requires a stateful firewall too. In fact all router firewalls are stateful otherwise you’d have to have large ranges of ports permanently open to incoming connections. So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT.
  - kortilla 1y ago
    > NAT requires a stateful firewall too. Yes, you’re repeating what I’m saying. NAT forced router vendors to implement stateful connection tracking and it increased the security of everything behind them. > So you don’t actually need anything different nor special to have the same level of security with IPv6 vs IPv4 + NAT. This isn’t how it played out in practice though. Huge swaths of home routers had no firewall at all when you enabled IPv6 support because it would have taken slightly extra work to enable the v6 conn tracking.
- unethical_ban 1y ago
  Having a default deny policy for traffic to your network doesn't defeat the point of IPv6 or direct routing.
- homebrewer 1y ago
  I think enough consumer routers run upnp servers out of the box that relying on NAT as a firewall is very unreliable. Have a look at upnp state table on your router, you might be surprised at things that have poked holes for the whole world to hammer at without you noticing.

silotis 1y ago

If your ISP issues you a routable IPv4 address then not much. Otherwise IPv6 lets you avoid CGNAT and all of the issues that come with that.

hnlmorg 1y ago

It depends what you want NAT for. If it’s for security then most of the actual security provided by NAT routing is actually just the routers firewall itself. So a good ipv6 firewall provides the same level of security. If it’s just because you’re a bit of a control freak and like to manage the assignment of IP addresses (and I fall into that category too) then my understanding is that you can also do this with ipv6 as ISPs typically hand you a wider subnet range (unlike ipv4 where you get just 1 IP). However I’ve tried a couple of times to adopt ipv6 into my stupidly bespoke home networking stack and failed each time. I really do want to adopt IPv6, if only because I like fiddling with tech, but, like yourself, I keep getting stuck on the “how do I integrate IPv6 into the infrastructure I already have” problem. Edit: if anyone has any recommended guides to configuring IPv6 using ISC dhcpd and unknown addresses supplied by your ISP, then I’d be interested to read them.

simoncion 1y ago
To be clear, what you have is a router that's asking your ISP for a DHCPv6-PD prefix, assigning slices of that to one or more interfaces on that router, and what you want is for your dhcpd on that router to assign prefix-oblivious addresses to specific hosts on your LAN? In other words, you want things to work like this? ISP-provided-PD-prefix 2001::/64 + Host address ::22 = Assigned address 2001::22 ISP-provided-PD-prefix 2001:1:/64 + Host address ::22 = Assigned address 2001:1::22 If so, I'll poke around the docs to see if this is possible. I'm running both dhcpcd and ISC dhcpd on my LAN and have a hobbyist's experience with them. But -honestly- what I've done is just relied on SLAAC to handle the globally-routable addresses, and advertised a ULA prefix for stable addresses. These go into my local DNS, but you could just as easily use that for DHCPd.
- hnlmorg 1y ago
  Not sure if this is what you were describing, but my dhcpd server is a separate machine to the router. I’m just using an off the shelf ASUS router because it’s actually surprisingly good at the basics. But I wanted PXE booting so set up ISC dhcpd on a home server. To be fair, it might actually be possible to do this on my ASUS router. I’ve not actually checked. I’ve had the same setup up for years. Easily more than a decade. Only updating hardware when necessary. So I might be missing a trick with these latest ASUS routers.

Spooky23 1y ago

Very little. I started using it with Spectrum after upgrading a firewall and found. Lots of weird gotchas with DNS.

the8472 1y ago

When I was on an ISP with DS-Lite the IPv4 functionality regularly failed because the AFTR's port mapping saturated (equivalent to reaching ip_conntrack_max on linux). IPv6 wasn't affected since it doesn't involve a stateful middlebox that I don't control.

paulddraper 1y ago

“Unfortunately, NAT reduces the number of options for providing security.” - RFC 1631