13 ms·

I spent a week without IPv4 (2023)

168 points by mahirsaid 10mo ago

glitchc 10mo ago
While these articles are useful in understanding the utility of IPv6, what would really help is an article explaining step by step how to configure a home network using IPv6. The tutorial should answer these questions: - How to ensure there are no collisions in address space? Translates to, how to pick safe addresses, is there a system? - How do I route from an external network resource to an internal network resource? Translates to, can you provide syntax on how to connect to an smb share? Set up a web service that works without WireGuard or equivalent? - How does one segment networks, configure a vlan, set up a firewall?
- candiddevmike 10mo ago
  - if you're talking a private/local prefix, you can use tools like this to generate one: https://unique-local-ipv6.com/ https://unique-local-ipv6.com/. Otherwise DHCPv6 and SLAAC will ensure no collisions for the most part. - Use global/public addresses on all your devices (using something like prefix delegation) or use NAT. - Same as IPv4. Prefix delegation will let your ISP assign you multiple networks, and then most routers will break these up into /64 networks for each of your VLANs.
- Latty 10mo ago
  - SLAAC - the address spaces for IPv6 are so huge, collisions are extremely unlikely outside of intentional actions. - Open holes through firewalls, point DNS at the address, and it should just work, the joys of actually having public addresses. - Same way as with IPv4 mostly. The only real difference is because SLAAC assumes a /64 you probably want your networks to be at least that big.
  - oezi 10mo ago
    > extremely unlikely outside of intentional actions. But come on! It is a legitimate question, do you just scramble keys when picking an address? > the joys of actually having public addresses. If your ISP gives you a static IPv6. Unfortunately in Germany none of the ISP for private users does (last I checked).
    - db48x 10mo ago
      > do you just scramble keys when picking an address? No. Your ISP or tunnel broker gives you a network prefix. Then you configure SLAAC to use that prefix and hand out addresses within it. Job done. For example, the prefix might look like 2001:470:e904::/48. Your computers can use any addresses you want as long as they start with that prefix. Since you don’t want to manually hand out addresses to every computer, you configure a router to hand out addresses via SLAAC. Your computers will use SLAAC to discover the prefix from the router, then fill in the bottom 64 bits of the address with a random number. They then ask the local network if anyone is using that full address. If not then they are done and have a working address. If somehow someone is using that address then they try again with a different random number. Servers that want a fixed address will just use their network card’s MAC address (or anything similar, if you want) instead of a random number. The protocol is the same either way. Notice that this actually gives you some bits of your own to play with, if you want. The full address is 128 bits long. The first 48 were used by the prefix and the bottom 64 by the individual devices, leaving 16 bits in the middle. You could tell your router that the prefix for SLAAC is 2001:470:e904:42::/64, for example, and then use the other subnets for other purposes. Maybe 2001:470:e904:beef::/64 is a special subnet just for your meat freezer and associated monitoring equipment. I don't know, you get to make these things up for yourself. Maybe you manage a corporate network that has a separate VLAN for phones than for normal PCs, and a third VLAN for the guest WiFi. You can give them each a different prefix by embedding the VLAN id into the prefix you advertise via SLAAC. There’s also DHCPv6 if you want even more control over which addresses are handed out, or you want to subdivide your network even more finely. Or if ISPs ever start handing out smaller prefixes. > If your ISP gives you a static IPv6. Unfortunately in Germany none of the ISP for private users does (last I checked). Sure, that’s true. But they probably don’t hand out static addresses for IPv4 either. Not without paying extra, that’s for sure. Either way if you want some static identifier for your computer(s) then the solution is the same: DNS. Of course if you _are_ running a corporate network with a bunch of VLANS like that then you should actually get your own prefix from your RIR rather than from your ISP. Then you purchase IP transit services from your ISP rather than consumer internet access. You can then advertise your prefix(es) via BGP. Again, this is exactly what you would do for IPv4. Same software, same configuration, just longer addresses. The main advantage of this extra work is that you can keep your addresses static even if you move to an entirely different ISP. You can also use the same addresses over multiple connections to multiple ISPs for better redundancy.
- jcgl 10mo ago
  - Devices using SLAAC (idk about DHCPv6) do a thing called Duplicate Address Detection to manage just this. No need to worry. If you’re manually assigning addresses and have a conflict, one of the devices will mark its address(es) as duplicate and refuse to use them. Quite useful. - Easiest is to use your devices’ public (“global unicast”) addresses and allow traffic on your firewall. This is how IP was meant to be used; no NAPT in sight. If you like, you can use ULAs locally and then do NPTv6 for internet-facing access. But I’d recommend against that to start. Regarding the services, there’s not really anything IPv6 specific. Whether v4 or v6, you shouldn’t be exposing SMB to the internet. Whether v4 or v6, you can put any IP-based service behind Wireguard or any other tunneling solution. There’s nothing specific to v6 there; just use v6 addresses in your config, and you’ll be good to go. - Basically the same way as with v4; IP (whether v4 or v6) have mostly the same semantics in their layer (layer 3). The only thing is that you’ll want to allow certain kinds of ICMPv6 traffic, assuming your firewall vendor doesn’t do that out of the box. When it comes to VLANs, that’s layer 2, so your layer 3 protocol doesn’t play any role there. Network segmentation is way more fun with v6 because you have enough address space to make nice hierarchical topologies.
candiddevmike 10mo ago
I wish I could switch my network to all IPv6 and use NAT64/DNS64, but Android, the world's most popular OS, purposefully disables DHCPv6. I am forced to support IPv4/DHCPv4 for the foreseeable future to support these broken devices.
- avidiax 10mo ago
  Why can't you use stateless autoconfig?
  - candiddevmike 10mo ago
    Because I want to control the suffix assigned to devices for firewall rules and monitoring purposes.
    - avidiax 10mo ago
      Seems like the wrong layer unless your network has more than one router/gateway. Use MAC as the key for firewall and monitoring. Then you don't have multiple rules per device.
      - buggjenrmf 10mo ago
        ”You’re holding it wrong”
- franklyworks 10mo ago
  Android supports SLAAC and has good support transitional tech like xlat464 and DHCP option 108. I have used these on my network and office to move to IPv6-only for Android. What about lack of DHCPv6 prevents you from using IPv6 on Android?
  - candiddevmike 10mo ago
    I can't run SLAAC and DHCPv6 at the same time without giving devices multiple addresses, and Android doesn't support DHCPv6, so I'd have to carve out a separate, SLAAC-based, android-only network. And then figure out firewall rules, multicast reflection, etc.
avidiax 10mo ago
People keep saying that IPv6 allows you to more easily host services, but you still have to support IPv4. Try connecting to your IPv6-only service on Hotel WiFi -- you usually can't. It's unfortunate, but IPv6 doesn't really solve any problems for a home user. And I say this as someone that has deployed IPv6 at home before.
- mattypg 10mo ago
  > It's unfortunate, but IPv6 doesn't really solve any problems for a home user. CG-NAT and strict NAT in general. Newer ISPs often force users onto CG-NAT, and my consoles have had numerous issues with NAT in general over the years. ISP routers also often make fixing this an opaque or impossible problem for the user. I don’t think IPv6 is the best thing ever, but I do think it solves the problems IPv4 did along with some annoying issues IPv4 struggled with.
- brandonkal 10mo ago
  It does make it easier. IPv6 pinholes are simpler than port forwarding. My IPv4 is not static but my IPv6 prefix is. So I don’t need dynamic DNS. I have no IPv4 port forwards, instead I run snid on a VPS to support legacy internet clients and call it a day.
  - avidiax 10mo ago
    https://github.com/AGWA/snid https://github.com/AGWA/snid So you basically have a cloud server and a domain with a wildcard record, and you then forward IPv4 through IPv6? I think this somewhat proves my point that IPv6 doesn't solve much for self-hosting. You still need some kind of working IPv4 setup. You are using IPv6 in place of either a reverse proxy or something like tailscale, which I suppose is more convenient.
jrm4 10mo ago
Hot take: IPv4 might be techinically worse, but it's "politically" (in the classic sense of the word) better. IPv6 essentially enables "universal internet IDs" for every device, which could streamline a lot of things, but enable a lot of weird surveillance/power balance issues that the cruft of IPv4 is actually incidentally helping guard against. Again, I'm old enough to remember when e.g. the ISPs were going to try to charge per device in each household.
- blahaj 10mo ago
  > Again, I'm old enough to remember when e.g. the ISPs were going to try to charge per device in each household. I don't really see that coming again and if it does you can just do NAT66 just like you can do NAT4.
  - jrm4 10mo ago
    You and I can, yes. But, network effects.
    - blahaj 10mo ago
      If ISPs would try charging per device with IPv6, NAT66 routers would just become an off the shelf product. You can just sell a black box to people that solves the issue. But more generally, I think times have changed enough for per device billing not being a viable approach anymore.
    - jcgl 10mo ago
      What network effects? Like a sibling comment already pointed out, privacy addresses come standard on all consumer OSes.
- ninkendo 10mo ago
  This hasn’t been the case in decades, every OS defaults to randomly generating the trailing 64 bits of your address and cycling through new addresses periodically. Your IPv6 address is only fixed to your device if you choose to configure it that way. Since the network half (leading 64 bits) is as fixed as your IPv4 address was, and the host half is random and constantly changing, an IPv6 address is exactly as uniquely identifying as an IPv4 address used to be.
layer8 10mo ago
If Google would announce that Chrome is dropping IPv4 support in n months, that would probably get things moving. ;)
- stevekemp 10mo ago
  I guess it would, but remember there are more services out there than just HTTP(S). For example the last time I had an IPv6-only host I had issues cloning things from github, as "git clone git@github.com..." failed due to github.com not having IPv6 records. A quick search revealed this open 3+ year old discussion - https://github.com/orgs/community/discussions/10539 https://github.com/orgs/community/discussions/10539
  - buggjenrmf 10mo ago
    You’re in luck, github is in the process of moving to azure!
  - Dagger2 10mo ago
    A quick workaround for that is to use one of the DNS servers from https://nat64.net/ https://nat64.net/. There are also people running reverse proxies specifically for GitHub, e.g. https://danwin1210.de/github-ipv6-proxy.php https://danwin1210.de/github-ipv6-proxy.php. (Ideally your ISP would be running NAT64 for you, especially if it's a VPS provider only giving you v6, but for whatever reason few of them do...)
- lostmsu 10mo ago
  Would have to be ChatGPT these days.
mojuba 10mo ago
> Groups of zeros can be omitted with two colons, but only once in an address (i.e. 2000:1::1, but not 2000::1::1 as that is ambiguous) Can someone explain why it's ambiguous? On the subject, IPv6 is one of the strangest inventions on the internet. Its utility and practically are obvious no matter how you look at it except... just one thing. Network-related things are generally easy to remember and then type from memory: IPv4, domain names, standard port numbers. Back in the day it was the phone numbers, again, easy to remember and dial when you need it. IPv6 is just too long and requires copy/paste all the time. This is the only real reason in my opinion, why IPv6 is doomed to be second-grade citizen for (probably) a few more decades.
- boob 10mo ago
  > Can someone explain why it's ambiguous? Because you don’t know how many zeroes are on each side around the 0001 in the middle. It can be 2000:0000:1:0000:0000:0000:0000:1 or 2000:0000:0000:0000:0000:1:0000:1 etc.
  - koakuma-chan 10mo ago
    This shortcut system of ipv6 only makes it worse. It's too hard to remember how it works.
    - karlshea 10mo ago
      ":: is all zeros" is too hard??
      - koakuma-chan 10mo ago
        It's not just ":: is all zeroes"
        ninkendo 10mo ago
        … such as?
mlangenberg 10mo ago
> There are also still a lot of misconceptions from network administrators who are scared of or don’t properly understand IPv6 Enable IPv6 on a TP-Link Omada router (ER7212PC) and all internal services are exposed to the outside world as there is no default IPv6 deny-all rule and no IPv6 firewall. I get why some people are nervous.
- gz09 10mo ago
  I believe that was more a bug in the firmware that's been fixed for a while now.
  - buggjenrmf 10mo ago
    A bug that was implemented, because ipv6 is more complex to secure.
  - mlangenberg 10mo ago
    In case of the ER7212PC, it’s only fixed in the v2 hardware revision. No free upgrade.
- throw0101c 10mo ago
  > Enable IPv6 on a TP-Link Omada router (ER7212PC) and all internal services are exposed to the outside world as there is no default IPv6 deny-all rule and no IPv6 firewall. I get why some people are nervous. A router routing traffic makes people nervous? Isn't that what it's supposed to do? I'd be annoyed if my router did not pass traffic. Now, if the ER7212PC was a firewall that would be something else. (And no, I'm not being pedantic: routers should pass traffic unless told otherwise, firewalls should block traffic unless told otherwise. The purposes of the two device classes are different, they just happen to both deal with Layer 3 protocol data units.)
  - tsimionescu 10mo ago
    Are you suggesting that people should buy both a router and a firewall for their home networks? I suppose they should buy a separate Wi-Fi AP as well, and a switch or two, in your opinion?
jyscao 10mo ago
I need to switch my home network to at least use IPv6 externally, because my ISP recently deployed CG-NAT, which made my SSH server that used to work no longer reachable from outside of my LAN.
- bakugo 10mo ago
  You can use a NAT-traversing VPN like tailscale to work around this.
karlshea 10mo ago
My two IPv6 issues (even having had a HE tunnel in the past): - My local ISP (US Internet, soon to be part of T-Mobile Fiber) hasn't enabled it, even though the CEO has said on Reddit for years that it's a priority. Now that they've been acquired who knows if it'll ever happen. - Linode allows transferring v4 addresses between machines, so if I need to rebuild something I can do so without involving my client who usually has control over DNS. They do not support moving v6 addresses, which means that the only sites I have control over that support v6 are the ones that I control DNS. Making IPv6 a thing seems like it would be super easy if a couple hours could be spent solving a bunch of dumb lazy problems.
- toast0 10mo ago
  > My local ISP (US Internet, soon to be part of T-Mobile Fiber) hasn't enabled it, even though the CEO has said on Reddit for years that it's a priority. Now that they've been acquired who knows if it'll ever happen. Being a priority doesn't mean it's high priority. It could be a priority, but the lowest ranked one, so other stuff always comes first. :P T-Mobile wireless US is pretty invested on IPv6, so if they take over the network, they may well push it.
  - karlshea 10mo ago
    It "finally hit the top of the project list" two years ago so we'll see lol. It's "T-Mobile Fiber Home Internet" which looks to be a bunch of local ISPs they've been snatching up, so we'll see what happens. USI's customer service and reliability have been amazing so hopefully that doesn't get screwed up.
rao-v 10mo ago
What’s the pragmatic solution to ipv6 allowing everybody in my household to be trivially and stably mapped to a unique subnet? I like the accidental semi-randomization that ipv4 and ISP NAT offered and I don’t see anything like it short of putting my entire home net on a VPN (it’s expensive and can’t keep up with my ISP’s bandwidth)
- yjftsjthsd-h 10mo ago
  It's true that you won't get CGNAT without having CGNAT. Depending on your concern, it is possible to NAT66 to make your entire network appear as one IP.
  - rao-v 10mo ago
    I’d love to pay my ISP to rotate my ipv6 subnet every week. It’s not an option. My comcast IP changes every so often and that’s of some value. It’s very unclear to me why people should be able to deterministic reach out to a specific device on my network. It has no value to me unless I run a service.
    - Dagger2 10mo ago
      Then the value is clear, isn't it? The value is that it gives you the ability to run a service. Maybe you don't want to do that today, which is fine -- you can simply not make use of the ability. If you ever change your mind, it's available and you can use it. Also... the ability for people to deterministically reach out to a specific device on your network is the exact same ability you use to deterministically reach out to specific devices on their networks, just viewed from the opposite side. If the Internet wasn't a place where people could decide to run services on their networks and connect to services that other people ran on their networks, what would the point even be? IPv6 supports customer-controlled prefix rotation. You can select how often it happens by configuring your router to periodically change its DUID. Of course, your ISP can ignore this signal and always assign the same prefix anyway, but you can hardly blame that on IPv6.
      - 9mo ago
tlogan 10mo ago
As a normal user: why do I need IPv6? As far as I know, the majority of websites (about 70%) do not support IPv6.
- badgersnake 10mo ago
  I don’t think that’s true. But of course it depends how you’re measure the majority of websites. Most of the figures I see show 60-70% of the top 100 sites do support it. But maybe that does not reflect your usage. Why do you need it? Maybe you don’t right now since ipv6 only sites are niche. The most tangible advantage I’ve seen is avoiding CGNAT. Gamers in particular don’t like that because it introduces latency. Services like Xbox live definitely do support ipv6 for this reason.
- paulddraper 10mo ago
  You need it because there aren’t enough IPv4. If you have a mobile device with data, you’re likely already using it.
  - sethops1 10mo ago
    Do we really need all the mobile phones and IoT devices of the world to be publicly addressable? Is that even a good thing?
    - paulddraper 10mo ago
      If you want to use the internet, you need an IP address. You can share that IP address by putting multiple hosts on the same local network and using parts of the transport later. NAT was invented because of lacking enough addresses.
      - buggjenrmf 10mo ago
        CGNAT is a guarantee that you have plausible deniability on the internet. NAT is also a guarantee that you are not addressable from the internet. It’s a feature.
Animats 10mo ago
Here's China's current IPv6 plan.[1] It was an explicit objective of the 14th Five Year Plan, now concluding, to get most of China's Internet on IPv6. About 70% of China's mobile users are on IPv6 now. But fixed IPv6 traffic in China is only 27%. [1] https://www.cac.gov.cn/2025-05/20/c_1749446498560205.htm https://www.cac.gov.cn/2025-05/20/c_1749446498560205.htm
- orangeboats 10mo ago
  Their IPv6 deployment rate saw a huge jump from 40ish% to 53% after this report though. https://stats.labs.apnic.net/ipv6/CN https://stats.labs.apnic.net/ipv6/CN
PaulKeeble 10mo ago
When I moved to an ISP that supported IPv6 earlier this year I ran into niggly problems. Ubuntu failed to update because one of its regional servers was misconfigured. OpenDNS one of its servers seemed not to be there on a regular basis over IPv6. I also had odd behaviour and latency issues where sometimes IPv6 would fail to route for short periods and it would fail and fall back to IPv4. It was a painful experience of trying to work out if I had misconfigured it, if it was something to do with my opensource router software or if it was my ISP or the end services. I didn't get to the end of working this out and reporting issues and I just gave up. Due to the intermittent nature of the issues I was facing I never managed to get a report of issues my ISP would accept. So I'll give it some time and give it a try after a year and see if things have improved, but it was definitely not ready for prime time.
idatum 10mo ago
OpenBSD makes it easy to try IPv6 tunnelbroker.net with NAT64/DNS64 if your ISP only has IPv4 ("one more lab test away.." they say). This has worked for me well for a couple years. I do use a VLAN to keep the IPv6-only network separate (homelab) from video streamers in the household. In my pf.conf: # IPv6 tunnel block in log on $tun6_if all block in quick on $tun6_if inet6 from fd00::/8 to any antispoof quick for $tun6_if # allowed icmp6 pass in quick log on $tun6_if inet6 proto icmp6 icmp6-type { unreach, toobig, timex, paramprob, echoreq } # MSS clamping 60 bytes less than HE 1480 # 20 byte IPv4 tcp header + 40 byte IPv6 ip header match on $tun6_if all scrub (random-id max-mss 1420) and in /var/unbound/etc/unbound.conf: # DNS64/NAT64 module-config: "dns64 validator iterator" dns64-prefix: 64:ff9b::/96 Done. I don't have 464XLAT on Win11 but I do want to know if there's a hard coded IPv4 address anyway. I never had an issue.
- idatum 10mo ago
  Forgot the most important part of pf.conf! # NAT64 pass in inet6 from any to $nat64_prefix af-to inet from ($ext_if)
jrmg 10mo ago
I’m surprised home many technically knowledgeable people on Internet forums still think IPv6 is some niche, unreliable thing. In my direct experience, in the USA, at least Spectrum, AT&T, and Xfinity (Comcast) still run IPv4, of course, but they also have IPv6 working and on by default on their home internet offerings. All mainstream computer and mobile OSes support it by default and will prefer to connect with it over IPv4. ‘Everyone’ in many areas is using it. For many of us, our parents are using Facebook and watching Netflix over it. Over 50% of Google’s American traffic is over it. It just works.
- phito 10mo ago
  Myeah... I've had weird issues on my network that I could only resolve by disabling IPv6. Granted, it's probably my fault, but if everything still works fine with ipv4 that's fine to me. One day I will get into it and learn how it work and maybe I'll get it figured out... One day...
  - Dagger2 10mo ago
    Random guess: PMTUD? Like on v4, some people fuck up their PMTUD and are incapable of realizing or fixing it, so you have to have some kind of workaround. If setting your client machine MTU to 1280 (`ip link set mtu 1280 dev eth0` or equivalent) magically fixes it, that's your problem.
- opan 10mo ago
  I had working IPv6 in the past, but currently I seem to have no working IPv6. Using Xfinity. I have access to some servers at a friend's place in another city, pretty sure he also doesn't have IPv6. Maybe some phone calls would sort it out, but when "everything" still works (with IPv4), it's hard to care.
  - bigstrat2003 10mo ago
    That is really bizarre, because I have Comcast and I find their IPv6 support excellent. The only complaints I have are that I wish you could get bigger than a /60 prefix (a /56 would be nice), and that I wish it was feasible to get a static prefix as a residential customer. Granted you said you don't really care to fix it, but if that ever changes I do think you could get them to fix it pretty easily. IPv6 is one of the things they generally do right.
wolrah 10mo ago
> Don’t blame your provider when they deploy CG-NAT, embrace IPv6 and global routing instead. In theory this makes sense, but in practice my personal experience is that not a single wireline ISP I've ever seen deploy CG-NAT offered IPv6 service at all, nor did any of them indicate any intent or even interest when asked about it. The mobile providers on the other hand have almost entirely gone IPv6-first, using 6>4 transition methods as the default form of v4 access which I fully support. 4>4 CG-NAT should never have existed and providers who deploy it without offering fully functional v6 should be shamed.
suprjami 10mo ago
World IPv6 day 6-6-26, just turn IPv4 off. Let the world catch up. I said the same thing for 6-6-16 too.
- zygentoma 10mo ago
  Uh, I like that! I have some services on IPv6 only, but it rarely convinces anyone that they need IPv6 connectivity …
kachapopopow 10mo ago
the reason why I explicitely disable ipv6 cause "this shit don't work" (at the moment, will probably change in the future) - random slowdowns - horrible routing - larger packet overhead - hated by a lot of the people who run the internet - hated by companies who provide ddos protection - my poor TCAM cache in my budget routers - supporting ipv6 is really expensive in chassis routers However, I believe there is a solution: Swap ISP's to IPv6 only, swap to IPv4 unless there is an IPv6 route present then directly forward. This solves quite a few issues: Once every ISP has IPv6 you can drop ipv4 and swap directly to ipv6 without having to split your TCAM. This works because IPv6 can encode IPv4 in it.
- kachapopopow 10mo ago
  I guess I will add some clarification since this is still somehow getting traction: - this is from speaking with various techs in the space and holding an ASN - T1 ISP's will never put in the work to make switching to IPv6 easier.
Dylan16807 10mo ago
Am I missing something? Where's the part where he actually talks about his experience in that week? This goes straight from an overview of IPv6 to the conclusions section.
flumpcakes 10mo ago
I'm very surprised by the questions in this thread. There are some extremely basic things people are just not understanding. I suspect people hating on IPv6 have not spent the time with it. There is a difficulty in that it does behave quite differently to IPv4, and the lack of private addresses are also probably a shock.
- transcriptase 10mo ago
  The basic thing proponents don’t understand is that nobody in their right mind can intuitively understand IPV6 addresses because they look like MAC addresses with trisomy and are a pain in the ass to remember or type for absolutely no benefit to the non-network engineer. And there are infinitely more people with home routers and a few dozen devices than there are people running ISPs, fortune 500s, and data centres. Play with your convolution all you want, in 20 years the rest of us will still be happily assigning 192.168.x.x and ignoring it. V4 space running out is no more the average persons problem than undersea cables or certificate authority.
  - Dylan16807 10mo ago
    > nobody in their right mind can intuitively understand IPV6 addresses If someone can't understand "it's longer" then what is wrong with them? And using hex instead of decimal for magic computer numbers should be more intuitive, not less. Also structure-wise the first half is the subnet and the second half is the host. That's much more intuitive than IPv4. > absolutely no benefit to the non-network engineer If you do anything peer to peer at all, calls or file transfers or games, there's a benefit. And the typical benefit grows over time as more and more ISPs install CGNAT.
    - transcriptase 10mo ago
      > And using hex instead of decimal for magic computer numbers should be more intuitive, not less. How? Why is using hex any more intuitive than binary or a md5 hash for anyone who doesn’t do networking for a living? >If you do anything peer to peer at all, calls or file transfers or games, there's a benefit. And the typical benefit grows over time as more and more ISPs install CGNAT. Again how? I’ve been doing all of those without issue for nearly 30 years. What measurable benefit does the user see that hasn’t been a solved problem since Windows XP? Will my teams calls suddenly stop saying “poor network connection” on my 1000/1000 rock solid fibre connection? Will torrents suddenly find more seeds and peers? Will my games… have lower latency? Because I can’t think of another way anything networking related could be solved that wasn’t decades ago. When you say benefit, it should probably be noticeable or measurable in some way that doesn’t involve dashboards and millions of dollars in rack mounted gear.
1970-01-01 10mo ago
I have firsthand experience doing that experiment about 3 months ago. Completely removed my IP4 DHCP lease from my ISP at the router. About 50% of the public sites I tried to visit didn't resolve. So many public sites, that I gave up and went back to dual stack after just a day. Google, ChatGPT, and a few other popular sites were fine with pure IPv6 traffic, however sites like eBay and even HN did not resolve. IPv6 simply is still not ready for everyone to just transition into overnight.
- whatevaa 10mo ago
  A bit ironic that HN did not resolve.
mightyham 10mo ago
> Peer-to-peer communications such as gaming usually have to deal with NAT traversal, but with IPv6 this is no longer an issue, especially for multiple gamers using the same connection You know the list of "benefits" is thin when the second item is entirely theoretical. Even though IPv6 doesn't have to do NAT traversal, it still has to punch through your router's firewall which is effectively the same problem. Most ISP provided home routers simply block all incoming IPv6 traffic unless there is outbound traffic first, and provide little to no support for custom IPv6 rules. Even if that were not an issue, my bet is that there are close to zero popular games that actually use true peer to peer networking.
- brigade 10mo ago
  Getting a streamer’s IP attracts DDoSes and doxxing, so yeah it’s generally considered a vulnerability to use P2P in games
  - whatevaa 10mo ago
    Yeah, p2p is fine only with friends, people you know, otherwise it's like posting your private address for everybody to see.
- justaboutanyone 10mo ago
  Punching through just a firewall is much easier than punching through a typical NAT+firewall setup https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
  - whatevaa 10mo ago
    How do you punch trough firewalls? You have to manually open them, punching through firewall would be a firewall vulnerability.
    - tenacious_tuna 10mo ago
      This is a common function of uPnP, which I've seen as features in router config pages since the mid 2000s. https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr...
ChrisMarshallNY 10mo ago
I'm pretty underwhelmed by IPv6. It looks like the typical "horse designed by committee." I suspect that what will actually end up being implemented, will be a core subset of the spec. We'll have to see what's still standing, when the dust settles.
- db48x 10mo ago
  Your computer, and every other computer on the planet, already supports the entire IPv6 spec. There is no subset.
  - ChrisMarshallNY 10mo ago
    Well, we'll have to see what all the "in-between" bits do. There's a lot in it, that will require implementation by countless layers of routers, switches, caches, firewalls, etc. Look at Bluetooth, for an example, or TIFF. I printed out the Bluetooth spec once, just for Ss and Gs. It was over 2,000 pages (double-sided). I once tried writing a fully-compliant TIFF reader. Didn't go so well.
    - db48x 10mo ago
      Those all support IPv6 too. They’re the same computers, and they’ve all supported IPv6 for decades now. The IPv6 spec is a lot shorter than the spec for Bluetooth or TIFF.
      - ChrisMarshallNY 10mo ago
        Just because the physical and link layers support it, doesn't mean the application layer will. You could say the same for Bluetooth chips. I've seen stuff, man...
        kalleboo 10mo ago
        Apple requires that all iOS apps on the store function on an IPv6-only network (which is how several large mobile phone networks work), and everything works fine on the application layer.
imathew 10mo ago
My ISP has good IPv6 support. I was using it for a while and recently disabled it across my home network for simplicity of maintenance, cutting my vyos config in half. When I need to access something not available on IPv4 I'll set it up again but I'm not convinced that will happen in my lifetime.
seviu 10mo ago
And despite that, the place where I work, has disabled ipv6, rendering our development machines useless for trivial tasks such as debugging our iOS app on a device (which uses ipv6 under the hood) Reasons given: the security policies say ipv6 is not safe enough.
razighter777 10mo ago
The workarounds we need to enable P2P communication on the internet are a shame... we need turn, stun, webrtc, all this stuff so two computers can talk without a dedicated port forward or public ipv4. ipv6 is a beautiful protocol, (not perfect, but elegant) with a lot going for it. But the momentum of ipv4 is just too strong. It's a mess... with no good solution. I tried to turn off ipv4 and github (shame on you) stopped working. But what are we supposed to do? Have the government mandate everyone switch? (oh wait half of US government websites are ipv4 only) We did this to ourselves...
dpkirchner 10mo ago
I try enabling IPv6 every year or so. The last time I tried IPv6 at home I couldn't figure out what my netmask was, nor the size of my allocation. Some folks say my ISP issues /60s, others /64. I couldn't figure out how to get my IP to remain static long enough to have long-running TCP sessions, either. It was a mess and not much better than it was 20 years ago when I first tried it (and had to disable it because it being on broke all sorts of things). Maybe 2026 will be the year of IPv6. I kinda doubt it given I'm some jackass and dedicated network professionals still don't use IPv6.
- illusive4080 10mo ago
  If you have ATT fiber, it’s a pain in the butt. Their default router will only issue a single passthrough /64 on request. If you have multiple VLANs you have to setup some scripts to ask for more, and even then you only get 8 of them. The gateway reserves the other 8 from the /60 it gets for its own use. The only way I got IPv6 working well with them was to bypass their gateway. Now all my VLANs have /64, which is the standard subnet size.
  - ekropotin 10mo ago
    I think bypassing their gateway, that is - bringing your own router is the only way to do VLANs, because their gateway is very basic and doesn’t support VLANs at all.
    - illusive4080 10mo ago
      You can do VLANs with their gateway but only IPv4, or you have to write custom scripts to ask for additional IPv6 delegations.
      - ekropotin 10mo ago
        Interesting. Which model of their gateway do you have? I have BGW320 and it definitely doesn’t support vlan tagging.
ctippett 10mo ago
Every few years I check to see how far away Virgin Media are from offering IPv6. Just checked again... nope! https://www.havevirginmediaenabledipv6yet.co.uk/ https://www.havevirginmediaenabledipv6yet.co.uk/
daft_pink 10mo ago
I feel this doesn’t really address whether we are losing something privacy or security related by not having NAT. I think my main devices are always updated Mac iPhone or iPad and can handle it, but do I really want my thermostat or doorbell or lock or garage door opener or light switch directly accessible on the Internet or is the nat serving a useful purpose? I don’t feel like this is addressed in this article.
- yjftsjthsd-h 10mo ago
  > but do I really want my thermostat or doorbell or lock or garage door opener or light switch directly accessible on the Internet or is the nat serving a useful purpose? You should have a firewall, regardless of v4/v6.
  - mzajc 10mo ago
    You should, but the exposure from having no firewall is much higher without NAT. Packets with private network IPs are martians on the internet and will not find their way to your device unless they come from the same network and the ISP's infrastructure doesn't drop them. IPv6 addresses are routable across the internet so the packets will most likely get to your router, meaning anyone on the internet can talk to your LAN in the absence of a firewall. The reality is that consumer router firmware is horrible in every aspect, especially security, and this isn't going to change with IPv6 rollout. I fear the most likely scenario is that ISPs will set up inbound firewalls on their end, and then we'll be even worse off than we are right now.
    - jcgl 10mo ago
      Those naughty incoming packets can hit your private devices even with NAT-without-state full-firewall. The details depend on how your NAT actually implements the translation, but it’s perfectly possible for $randomHighPort to send all its incoming traffic straight to some device. Said another way, a NAT is not guaranteed to do something like match entries based on the layer 4 4-tuple.
martinald 10mo ago
Interesting. I did finally find a use for IPv6 which I wrote up here: https://martinalderson.com/posts/i-finally-found-a-use-for-ipv6/ https://martinalderson.com/posts/i-finally-found-a-use-for-i... Tbh though the docker problems are very serious and extremely painful to work around. Everything works great apart from Docker which has so many issues - it does not handle IPv6 inbound but IPv4 out well at all (at least as far as I can tell!).
transitorykris 10mo ago
In my 25 year career in network engineering, I’ve encounter needing it as a user exactly once, and that was earlier this year. Supabase’s free tier allows direct connections the Postgres only over IPv6. It’s too bad the deploment has been a long drawn and expensive process for everyone.
yjftsjthsd-h 10mo ago
> I spent a WEEK without IPv4 to understand IPv6 transition mechanisms > NAT64 - the method I’ve setup for this test > IPv6 is absolutely ready for prime-time and has been for awhile So... No, you spent a week effectively using both v6 and v4 with extra steps. If someone said "Linux is ready for primetime" but their setup only worked because they ran a bunch of applications in a Windows VM, I'd call that strong evidence that it really wasn't. Same here. That said... This is from early 2023. Any chance it's better now?
- rendaw 10mo ago
  None of the ISPs where I live provide NAT64 gateways. Exactly one advertised it, I signed up almost a year ago and they still haven't enabled it for me yet (I think they don't actually offer it and just forgot to remove the page).
- eqvinox 10mo ago
  > That said... This is from early 2023. Any chance it's better now? I accidentally went IPv6 only on my home wifi for a few weeks a while ago. I only noticed when GitHub didn't load (I avoid work things at home, hence accessing GitHub being rare.) Relatedly, fuck GitHub and their incompetence at rolling out IPv6. It's nothing other than that at this point. Blank, unadulterated incompetence.
- topranks 10mo ago
  No, because unfortunately the need for v4 hasn’t changed. In other words many sites and parts of the internet remain only on v4. Until nearly everything is on v6 too it won’t be realistic to ditch the mechanisms that provide v4 access.
- lmm 10mo ago
  > No, you spent a week effectively using both v6 and v4 with extra steps. It's less steps though. You can do all your network setup in the nice v6 world, and set up v4 emulation for those who need it. Yes, it's not yet practical to turn of v4 entirely, just like it's not yet practical to turn off Rosetta on your ARM mac.
- imrejonk 10mo ago
self_awareness 10mo ago
My ISP has IPv6 since years and I'm on 6 as well. NAT-less network is really cool, I can serve content directly from anything from my LAN. We should really leave IPv4 and move on.
sneak 10mo ago
I tried that, but my HN addiction ended it.
- ianburrell 10mo ago
  HN has IPv6 now. If Reddit would finish adding IPv6, almost all of my browsing would be IPv6.
illusive4080 10mo ago
AWS doesn’t offer PTR records for IPv6 addresses, which makes Gmail blacklist my email server’s IPv6 address. I had to disable IPv6 due to lack of PTR records.
- buggjenrmf 10mo ago
  Not being able to setup a spam server in aws is a feature.
  - illusive4080 10mo ago
    It’s not a spam server. I self host email for personal and non marketing business use. Don’t assume everyone running their own email is a spammer.
topranks 10mo ago
Dual-stack with a public IPv4 address is by far a preferable way to access the v4 internet than being stuck behind a provider NAT64 box. Totally understand why carriers may want IPv6 mostly and a v4-free core. But as an end user dual stack just seems simpler.
- jcgl 10mo ago
  Providers can do v6-only in their core while still providing public v4 to users. SIIT if they can still afford a public IP per customer, and MAP-T if they can’t.
  - jcgl 10mo ago
    Misspoke: more like a CLAT thing/464XLAT, rather than SIIT, I think
beAbU 10mo ago
My previous fibre provider in Ireland was Virgin, and as far as I could tell, it was fully IPV6. Every device in my network got a public address, and self hosting stuff from home as was easy as setting up an A record at my DNS host. No faffing around with port forwarding, proxying, nat bullshit or whatever. My memory is hazy, but there might have been some firewall stuff I had to do on the virgin supplied router.
torcete 10mo ago
I wonder about the possibility of running your own email server behind a domestic IPv6 address. Most of the domestic IPv4 networks have port 25 blocked for incoming connections. Maybe in the IPv6 realm things are bit more relaxed.

168 points by mahirsaid 10mo ago

While these articles are useful in understanding the utility of IPv6, what would really help is an article explaining step by step how to configure a home network using IPv6. The tutorial should answer these questions: - How to ensure there are no collisions in address space? Translates to, how to pick safe addresses, is there a system? - How do I route from an external network resource to an internal network resource? Translates to, can you provide syntax on how to connect to an smb share? Set up a web service that works without WireGuard or equivalent? - How does one segment networks, configure a vlan, set up a firewall?

candiddevmike 10mo ago
- if you're talking a private/local prefix, you can use tools like this to generate one: https://unique-local-ipv6.com/ https://unique-local-ipv6.com/. Otherwise DHCPv6 and SLAAC will ensure no collisions for the most part. - Use global/public addresses on all your devices (using something like prefix delegation) or use NAT. - Same as IPv4. Prefix delegation will let your ISP assign you multiple networks, and then most routers will break these up into /64 networks for each of your VLANs.
Latty 10mo ago
- SLAAC - the address spaces for IPv6 are so huge, collisions are extremely unlikely outside of intentional actions. - Open holes through firewalls, point DNS at the address, and it should just work, the joys of actually having public addresses. - Same way as with IPv4 mostly. The only real difference is because SLAAC assumes a /64 you probably want your networks to be at least that big.
- oezi 10mo ago
  > extremely unlikely outside of intentional actions. But come on! It is a legitimate question, do you just scramble keys when picking an address? > the joys of actually having public addresses. If your ISP gives you a static IPv6. Unfortunately in Germany none of the ISP for private users does (last I checked).
  - db48x 10mo ago
    > do you just scramble keys when picking an address? No. Your ISP or tunnel broker gives you a network prefix. Then you configure SLAAC to use that prefix and hand out addresses within it. Job done. For example, the prefix might look like 2001:470:e904::/48. Your computers can use any addresses you want as long as they start with that prefix. Since you don’t want to manually hand out addresses to every computer, you configure a router to hand out addresses via SLAAC. Your computers will use SLAAC to discover the prefix from the router, then fill in the bottom 64 bits of the address with a random number. They then ask the local network if anyone is using that full address. If not then they are done and have a working address. If somehow someone is using that address then they try again with a different random number. Servers that want a fixed address will just use their network card’s MAC address (or anything similar, if you want) instead of a random number. The protocol is the same either way. Notice that this actually gives you some bits of your own to play with, if you want. The full address is 128 bits long. The first 48 were used by the prefix and the bottom 64 by the individual devices, leaving 16 bits in the middle. You could tell your router that the prefix for SLAAC is 2001:470:e904:42::/64, for example, and then use the other subnets for other purposes. Maybe 2001:470:e904:beef::/64 is a special subnet just for your meat freezer and associated monitoring equipment. I don't know, you get to make these things up for yourself. Maybe you manage a corporate network that has a separate VLAN for phones than for normal PCs, and a third VLAN for the guest WiFi. You can give them each a different prefix by embedding the VLAN id into the prefix you advertise via SLAAC. There’s also DHCPv6 if you want even more control over which addresses are handed out, or you want to subdivide your network even more finely. Or if ISPs ever start handing out smaller prefixes. > If your ISP gives you a static IPv6. Unfortunately in Germany none of the ISP for private users does (last I checked). Sure, that’s true. But they probably don’t hand out static addresses for IPv4 either. Not without paying extra, that’s for sure. Either way if you want some static identifier for your computer(s) then the solution is the same: DNS. Of course if you _are_ running a corporate network with a bunch of VLANS like that then you should actually get your own prefix from your RIR rather than from your ISP. Then you purchase IP transit services from your ISP rather than consumer internet access. You can then advertise your prefix(es) via BGP. Again, this is exactly what you would do for IPv4. Same software, same configuration, just longer addresses. The main advantage of this extra work is that you can keep your addresses static even if you move to an entirely different ISP. You can also use the same addresses over multiple connections to multiple ISPs for better redundancy.
jcgl 10mo ago
- Devices using SLAAC (idk about DHCPv6) do a thing called Duplicate Address Detection to manage just this. No need to worry. If you’re manually assigning addresses and have a conflict, one of the devices will mark its address(es) as duplicate and refuse to use them. Quite useful. - Easiest is to use your devices’ public (“global unicast”) addresses and allow traffic on your firewall. This is how IP was meant to be used; no NAPT in sight. If you like, you can use ULAs locally and then do NPTv6 for internet-facing access. But I’d recommend against that to start. Regarding the services, there’s not really anything IPv6 specific. Whether v4 or v6, you shouldn’t be exposing SMB to the internet. Whether v4 or v6, you can put any IP-based service behind Wireguard or any other tunneling solution. There’s nothing specific to v6 there; just use v6 addresses in your config, and you’ll be good to go. - Basically the same way as with v4; IP (whether v4 or v6) have mostly the same semantics in their layer (layer 3). The only thing is that you’ll want to allow certain kinds of ICMPv6 traffic, assuming your firewall vendor doesn’t do that out of the box. When it comes to VLANs, that’s layer 2, so your layer 3 protocol doesn’t play any role there. Network segmentation is way more fun with v6 because you have enough address space to make nice hierarchical topologies.

candiddevmike 10mo ago

I wish I could switch my network to all IPv6 and use NAT64/DNS64, but Android, the world's most popular OS, purposefully disables DHCPv6. I am forced to support IPv4/DHCPv4 for the foreseeable future to support these broken devices.

avidiax 10mo ago
Why can't you use stateless autoconfig?
- candiddevmike 10mo ago
  Because I want to control the suffix assigned to devices for firewall rules and monitoring purposes.
  - avidiax 10mo ago
    Seems like the wrong layer unless your network has more than one router/gateway. Use MAC as the key for firewall and monitoring. Then you don't have multiple rules per device.
    - buggjenrmf 10mo ago
      ”You’re holding it wrong”
franklyworks 10mo ago
Android supports SLAAC and has good support transitional tech like xlat464 and DHCP option 108. I have used these on my network and office to move to IPv6-only for Android. What about lack of DHCPv6 prevents you from using IPv6 on Android?
- candiddevmike 10mo ago
  I can't run SLAAC and DHCPv6 at the same time without giving devices multiple addresses, and Android doesn't support DHCPv6, so I'd have to carve out a separate, SLAAC-based, android-only network. And then figure out firewall rules, multicast reflection, etc.

avidiax 10mo ago

People keep saying that IPv6 allows you to more easily host services, but you still have to support IPv4. Try connecting to your IPv6-only service on Hotel WiFi -- you usually can't. It's unfortunate, but IPv6 doesn't really solve any problems for a home user. And I say this as someone that has deployed IPv6 at home before.

mattypg 10mo ago
> It's unfortunate, but IPv6 doesn't really solve any problems for a home user. CG-NAT and strict NAT in general. Newer ISPs often force users onto CG-NAT, and my consoles have had numerous issues with NAT in general over the years. ISP routers also often make fixing this an opaque or impossible problem for the user. I don’t think IPv6 is the best thing ever, but I do think it solves the problems IPv4 did along with some annoying issues IPv4 struggled with.
brandonkal 10mo ago
It does make it easier. IPv6 pinholes are simpler than port forwarding. My IPv4 is not static but my IPv6 prefix is. So I don’t need dynamic DNS. I have no IPv4 port forwards, instead I run snid on a VPS to support legacy internet clients and call it a day.
- avidiax 10mo ago
  https://github.com/AGWA/snid https://github.com/AGWA/snid So you basically have a cloud server and a domain with a wildcard record, and you then forward IPv4 through IPv6? I think this somewhat proves my point that IPv6 doesn't solve much for self-hosting. You still need some kind of working IPv4 setup. You are using IPv6 in place of either a reverse proxy or something like tailscale, which I suppose is more convenient.

jrm4 10mo ago

Hot take: IPv4 might be techinically worse, but it's "politically" (in the classic sense of the word) better. IPv6 essentially enables "universal internet IDs" for every device, which could streamline a lot of things, but enable a lot of weird surveillance/power balance issues that the cruft of IPv4 is actually incidentally helping guard against. Again, I'm old enough to remember when e.g. the ISPs were going to try to charge per device in each household.

blahaj 10mo ago
> Again, I'm old enough to remember when e.g. the ISPs were going to try to charge per device in each household. I don't really see that coming again and if it does you can just do NAT66 just like you can do NAT4.
- jrm4 10mo ago
  You and I can, yes. But, network effects.
  - blahaj 10mo ago
    If ISPs would try charging per device with IPv6, NAT66 routers would just become an off the shelf product. You can just sell a black box to people that solves the issue. But more generally, I think times have changed enough for per device billing not being a viable approach anymore.
  - jcgl 10mo ago
    What network effects? Like a sibling comment already pointed out, privacy addresses come standard on all consumer OSes.
ninkendo 10mo ago
This hasn’t been the case in decades, every OS defaults to randomly generating the trailing 64 bits of your address and cycling through new addresses periodically. Your IPv6 address is only fixed to your device if you choose to configure it that way. Since the network half (leading 64 bits) is as fixed as your IPv4 address was, and the host half is random and constantly changing, an IPv6 address is exactly as uniquely identifying as an IPv4 address used to be.

layer8 10mo ago

If Google would announce that Chrome is dropping IPv4 support in n months, that would probably get things moving. ;)

stevekemp 10mo ago
I guess it would, but remember there are more services out there than just HTTP(S). For example the last time I had an IPv6-only host I had issues cloning things from github, as "git clone git@github.com..." failed due to github.com not having IPv6 records. A quick search revealed this open 3+ year old discussion - https://github.com/orgs/community/discussions/10539 https://github.com/orgs/community/discussions/10539
- buggjenrmf 10mo ago
  You’re in luck, github is in the process of moving to azure!
- Dagger2 10mo ago
  A quick workaround for that is to use one of the DNS servers from https://nat64.net/ https://nat64.net/. There are also people running reverse proxies specifically for GitHub, e.g. https://danwin1210.de/github-ipv6-proxy.php https://danwin1210.de/github-ipv6-proxy.php. (Ideally your ISP would be running NAT64 for you, especially if it's a VPS provider only giving you v6, but for whatever reason few of them do...)
lostmsu 10mo ago
Would have to be ChatGPT these days.

mojuba 10mo ago

> Groups of zeros can be omitted with two colons, but only once in an address (i.e. 2000:1::1, but not 2000::1::1 as that is ambiguous) Can someone explain why it's ambiguous? On the subject, IPv6 is one of the strangest inventions on the internet. Its utility and practically are obvious no matter how you look at it except... just one thing. Network-related things are generally easy to remember and then type from memory: IPv4, domain names, standard port numbers. Back in the day it was the phone numbers, again, easy to remember and dial when you need it. IPv6 is just too long and requires copy/paste all the time. This is the only real reason in my opinion, why IPv6 is doomed to be second-grade citizen for (probably) a few more decades.

boob 10mo ago
> Can someone explain why it's ambiguous? Because you don’t know how many zeroes are on each side around the 0001 in the middle. It can be 2000:0000:1:0000:0000:0000:0000:1 or 2000:0000:0000:0000:0000:1:0000:1 etc.
- koakuma-chan 10mo ago
  This shortcut system of ipv6 only makes it worse. It's too hard to remember how it works.
  - karlshea 10mo ago
    ":: is all zeros" is too hard??
    - koakuma-chan 10mo ago
      It's not just ":: is all zeroes"
      - ninkendo 10mo ago
        … such as?

mlangenberg 10mo ago

> There are also still a lot of misconceptions from network administrators who are scared of or don’t properly understand IPv6 Enable IPv6 on a TP-Link Omada router (ER7212PC) and all internal services are exposed to the outside world as there is no default IPv6 deny-all rule and no IPv6 firewall. I get why some people are nervous.

gz09 10mo ago
I believe that was more a bug in the firmware that's been fixed for a while now.
- buggjenrmf 10mo ago
  A bug that was implemented, because ipv6 is more complex to secure.
- mlangenberg 10mo ago
  In case of the ER7212PC, it’s only fixed in the v2 hardware revision. No free upgrade.
throw0101c 10mo ago
> Enable IPv6 on a TP-Link Omada router (ER7212PC) and all internal services are exposed to the outside world as there is no default IPv6 deny-all rule and no IPv6 firewall. I get why some people are nervous. A router routing traffic makes people nervous? Isn't that what it's supposed to do? I'd be annoyed if my router did not pass traffic. Now, if the ER7212PC was a firewall that would be something else. (And no, I'm not being pedantic: routers should pass traffic unless told otherwise, firewalls should block traffic unless told otherwise. The purposes of the two device classes are different, they just happen to both deal with Layer 3 protocol data units.)
- tsimionescu 10mo ago
  Are you suggesting that people should buy both a router and a firewall for their home networks? I suppose they should buy a separate Wi-Fi AP as well, and a switch or two, in your opinion?

jyscao 10mo ago

I need to switch my home network to at least use IPv6 externally, because my ISP recently deployed CG-NAT, which made my SSH server that used to work no longer reachable from outside of my LAN.

bakugo 10mo ago
You can use a NAT-traversing VPN like tailscale to work around this.

karlshea 10mo ago

My two IPv6 issues (even having had a HE tunnel in the past): - My local ISP (US Internet, soon to be part of T-Mobile Fiber) hasn't enabled it, even though the CEO has said on Reddit for years that it's a priority. Now that they've been acquired who knows if it'll ever happen. - Linode allows transferring v4 addresses between machines, so if I need to rebuild something I can do so without involving my client who usually has control over DNS. They do not support moving v6 addresses, which means that the only sites I have control over that support v6 are the ones that I control DNS. Making IPv6 a thing seems like it would be super easy if a couple hours could be spent solving a bunch of dumb lazy problems.

toast0 10mo ago
> My local ISP (US Internet, soon to be part of T-Mobile Fiber) hasn't enabled it, even though the CEO has said on Reddit for years that it's a priority. Now that they've been acquired who knows if it'll ever happen. Being a priority doesn't mean it's high priority. It could be a priority, but the lowest ranked one, so other stuff always comes first. :P T-Mobile wireless US is pretty invested on IPv6, so if they take over the network, they may well push it.
- karlshea 10mo ago
  It "finally hit the top of the project list" two years ago so we'll see lol. It's "T-Mobile Fiber Home Internet" which looks to be a bunch of local ISPs they've been snatching up, so we'll see what happens. USI's customer service and reliability have been amazing so hopefully that doesn't get screwed up.

rao-v 10mo ago

What’s the pragmatic solution to ipv6 allowing everybody in my household to be trivially and stably mapped to a unique subnet? I like the accidental semi-randomization that ipv4 and ISP NAT offered and I don’t see anything like it short of putting my entire home net on a VPN (it’s expensive and can’t keep up with my ISP’s bandwidth)

yjftsjthsd-h 10mo ago
It's true that you won't get CGNAT without having CGNAT. Depending on your concern, it is possible to NAT66 to make your entire network appear as one IP.
- rao-v 10mo ago
  I’d love to pay my ISP to rotate my ipv6 subnet every week. It’s not an option. My comcast IP changes every so often and that’s of some value. It’s very unclear to me why people should be able to deterministic reach out to a specific device on my network. It has no value to me unless I run a service.
  - Dagger2 10mo ago
    Then the value is clear, isn't it? The value is that it gives you the ability to run a service. Maybe you don't want to do that today, which is fine -- you can simply not make use of the ability. If you ever change your mind, it's available and you can use it. Also... the ability for people to deterministically reach out to a specific device on your network is the exact same ability you use to deterministically reach out to specific devices on their networks, just viewed from the opposite side. If the Internet wasn't a place where people could decide to run services on their networks and connect to services that other people ran on their networks, what would the point even be? IPv6 supports customer-controlled prefix rotation. You can select how often it happens by configuring your router to periodically change its DUID. Of course, your ISP can ignore this signal and always assign the same prefix anyway, but you can hardly blame that on IPv6.
    - 9mo ago

tlogan 10mo ago

As a normal user: why do I need IPv6? As far as I know, the majority of websites (about 70%) do not support IPv6.

badgersnake 10mo ago
I don’t think that’s true. But of course it depends how you’re measure the majority of websites. Most of the figures I see show 60-70% of the top 100 sites do support it. But maybe that does not reflect your usage. Why do you need it? Maybe you don’t right now since ipv6 only sites are niche. The most tangible advantage I’ve seen is avoiding CGNAT. Gamers in particular don’t like that because it introduces latency. Services like Xbox live definitely do support ipv6 for this reason.
paulddraper 10mo ago
You need it because there aren’t enough IPv4. If you have a mobile device with data, you’re likely already using it.
- sethops1 10mo ago
  Do we really need all the mobile phones and IoT devices of the world to be publicly addressable? Is that even a good thing?
  - paulddraper 10mo ago
    If you want to use the internet, you need an IP address. You can share that IP address by putting multiple hosts on the same local network and using parts of the transport later. NAT was invented because of lacking enough addresses.
    - buggjenrmf 10mo ago
      CGNAT is a guarantee that you have plausible deniability on the internet. NAT is also a guarantee that you are not addressable from the internet. It’s a feature.

Animats 10mo ago

Here's China's current IPv6 plan.[1] It was an explicit objective of the 14th Five Year Plan, now concluding, to get most of China's Internet on IPv6. About 70% of China's mobile users are on IPv6 now. But fixed IPv6 traffic in China is only 27%. [1] https://www.cac.gov.cn/2025-05/20/c_1749446498560205.htm https://www.cac.gov.cn/2025-05/20/c_1749446498560205.htm

orangeboats 10mo ago
Their IPv6 deployment rate saw a huge jump from 40ish% to 53% after this report though. https://stats.labs.apnic.net/ipv6/CN https://stats.labs.apnic.net/ipv6/CN

PaulKeeble 10mo ago

When I moved to an ISP that supported IPv6 earlier this year I ran into niggly problems. Ubuntu failed to update because one of its regional servers was misconfigured. OpenDNS one of its servers seemed not to be there on a regular basis over IPv6. I also had odd behaviour and latency issues where sometimes IPv6 would fail to route for short periods and it would fail and fall back to IPv4. It was a painful experience of trying to work out if I had misconfigured it, if it was something to do with my opensource router software or if it was my ISP or the end services. I didn't get to the end of working this out and reporting issues and I just gave up. Due to the intermittent nature of the issues I was facing I never managed to get a report of issues my ISP would accept. So I'll give it some time and give it a try after a year and see if things have improved, but it was definitely not ready for prime time.

idatum 10mo ago

OpenBSD makes it easy to try IPv6 tunnelbroker.net with NAT64/DNS64 if your ISP only has IPv4 ("one more lab test away.." they say). This has worked for me well for a couple years. I do use a VLAN to keep the IPv6-only network separate (homelab) from video streamers in the household. In my pf.conf: # IPv6 tunnel block in log on $tun6_if all block in quick on $tun6_if inet6 from fd00::/8 to any antispoof quick for $tun6_if # allowed icmp6 pass in quick log on $tun6_if inet6 proto icmp6 icmp6-type { unreach, toobig, timex, paramprob, echoreq } # MSS clamping 60 bytes less than HE 1480 # 20 byte IPv4 tcp header + 40 byte IPv6 ip header match on $tun6_if all scrub (random-id max-mss 1420) and in /var/unbound/etc/unbound.conf: # DNS64/NAT64 module-config: "dns64 validator iterator" dns64-prefix: 64:ff9b::/96 Done. I don't have 464XLAT on Win11 but I do want to know if there's a hard coded IPv4 address anyway. I never had an issue.

idatum 10mo ago
Forgot the most important part of pf.conf! # NAT64 pass in inet6 from any to $nat64_prefix af-to inet from ($ext_if)

jrmg 10mo ago

I’m surprised home many technically knowledgeable people on Internet forums still think IPv6 is some niche, unreliable thing. In my direct experience, in the USA, at least Spectrum, AT&T, and Xfinity (Comcast) still run IPv4, of course, but they also have IPv6 working and on by default on their home internet offerings. All mainstream computer and mobile OSes support it by default and will prefer to connect with it over IPv4. ‘Everyone’ in many areas is using it. For many of us, our parents are using Facebook and watching Netflix over it. Over 50% of Google’s American traffic is over it. It just works.

phito 10mo ago
Myeah... I've had weird issues on my network that I could only resolve by disabling IPv6. Granted, it's probably my fault, but if everything still works fine with ipv4 that's fine to me. One day I will get into it and learn how it work and maybe I'll get it figured out... One day...
- Dagger2 10mo ago
  Random guess: PMTUD? Like on v4, some people fuck up their PMTUD and are incapable of realizing or fixing it, so you have to have some kind of workaround. If setting your client machine MTU to 1280 (`ip link set mtu 1280 dev eth0` or equivalent) magically fixes it, that's your problem.
opan 10mo ago
I had working IPv6 in the past, but currently I seem to have no working IPv6. Using Xfinity. I have access to some servers at a friend's place in another city, pretty sure he also doesn't have IPv6. Maybe some phone calls would sort it out, but when "everything" still works (with IPv4), it's hard to care.
- bigstrat2003 10mo ago
  That is really bizarre, because I have Comcast and I find their IPv6 support excellent. The only complaints I have are that I wish you could get bigger than a /60 prefix (a /56 would be nice), and that I wish it was feasible to get a static prefix as a residential customer. Granted you said you don't really care to fix it, but if that ever changes I do think you could get them to fix it pretty easily. IPv6 is one of the things they generally do right.

wolrah 10mo ago

> Don’t blame your provider when they deploy CG-NAT, embrace IPv6 and global routing instead. In theory this makes sense, but in practice my personal experience is that not a single wireline ISP I've ever seen deploy CG-NAT offered IPv6 service at all, nor did any of them indicate any intent or even interest when asked about it. The mobile providers on the other hand have almost entirely gone IPv6-first, using 6>4 transition methods as the default form of v4 access which I fully support. 4>4 CG-NAT should never have existed and providers who deploy it without offering fully functional v6 should be shamed.

suprjami 10mo ago

World IPv6 day 6-6-26, just turn IPv4 off. Let the world catch up. I said the same thing for 6-6-16 too.

zygentoma 10mo ago
Uh, I like that! I have some services on IPv6 only, but it rarely convinces anyone that they need IPv6 connectivity …

kachapopopow 10mo ago

the reason why I explicitely disable ipv6 cause "this shit don't work" (at the moment, will probably change in the future) - random slowdowns - horrible routing - larger packet overhead - hated by a lot of the people who run the internet - hated by companies who provide ddos protection - my poor TCAM cache in my budget routers - supporting ipv6 is really expensive in chassis routers However, I believe there is a solution: Swap ISP's to IPv6 only, swap to IPv4 unless there is an IPv6 route present then directly forward. This solves quite a few issues: Once every ISP has IPv6 you can drop ipv4 and swap directly to ipv6 without having to split your TCAM. This works because IPv6 can encode IPv4 in it.

kachapopopow 10mo ago
I guess I will add some clarification since this is still somehow getting traction: - this is from speaking with various techs in the space and holding an ASN - T1 ISP's will never put in the work to make switching to IPv6 easier.

Dylan16807 10mo ago

Am I missing something? Where's the part where he actually talks about his experience in that week? This goes straight from an overview of IPv6 to the conclusions section.

flumpcakes 10mo ago

I'm very surprised by the questions in this thread. There are some extremely basic things people are just not understanding. I suspect people hating on IPv6 have not spent the time with it. There is a difficulty in that it does behave quite differently to IPv4, and the lack of private addresses are also probably a shock.

transcriptase 10mo ago
The basic thing proponents don’t understand is that nobody in their right mind can intuitively understand IPV6 addresses because they look like MAC addresses with trisomy and are a pain in the ass to remember or type for absolutely no benefit to the non-network engineer. And there are infinitely more people with home routers and a few dozen devices than there are people running ISPs, fortune 500s, and data centres. Play with your convolution all you want, in 20 years the rest of us will still be happily assigning 192.168.x.x and ignoring it. V4 space running out is no more the average persons problem than undersea cables or certificate authority.
- Dylan16807 10mo ago
  > nobody in their right mind can intuitively understand IPV6 addresses If someone can't understand "it's longer" then what is wrong with them? And using hex instead of decimal for magic computer numbers should be more intuitive, not less. Also structure-wise the first half is the subnet and the second half is the host. That's much more intuitive than IPv4. > absolutely no benefit to the non-network engineer If you do anything peer to peer at all, calls or file transfers or games, there's a benefit. And the typical benefit grows over time as more and more ISPs install CGNAT.
  - transcriptase 10mo ago
    > And using hex instead of decimal for magic computer numbers should be more intuitive, not less. How? Why is using hex any more intuitive than binary or a md5 hash for anyone who doesn’t do networking for a living? >If you do anything peer to peer at all, calls or file transfers or games, there's a benefit. And the typical benefit grows over time as more and more ISPs install CGNAT. Again how? I’ve been doing all of those without issue for nearly 30 years. What measurable benefit does the user see that hasn’t been a solved problem since Windows XP? Will my teams calls suddenly stop saying “poor network connection” on my 1000/1000 rock solid fibre connection? Will torrents suddenly find more seeds and peers? Will my games… have lower latency? Because I can’t think of another way anything networking related could be solved that wasn’t decades ago. When you say benefit, it should probably be noticeable or measurable in some way that doesn’t involve dashboards and millions of dollars in rack mounted gear.

1970-01-01 10mo ago

I have firsthand experience doing that experiment about 3 months ago. Completely removed my IP4 DHCP lease from my ISP at the router. About 50% of the public sites I tried to visit didn't resolve. So many public sites, that I gave up and went back to dual stack after just a day. Google, ChatGPT, and a few other popular sites were fine with pure IPv6 traffic, however sites like eBay and even HN did not resolve. IPv6 simply is still not ready for everyone to just transition into overnight.

whatevaa 10mo ago
A bit ironic that HN did not resolve.

mightyham 10mo ago

> Peer-to-peer communications such as gaming usually have to deal with NAT traversal, but with IPv6 this is no longer an issue, especially for multiple gamers using the same connection You know the list of "benefits" is thin when the second item is entirely theoretical. Even though IPv6 doesn't have to do NAT traversal, it still has to punch through your router's firewall which is effectively the same problem. Most ISP provided home routers simply block all incoming IPv6 traffic unless there is outbound traffic first, and provide little to no support for custom IPv6 rules. Even if that were not an issue, my bet is that there are close to zero popular games that actually use true peer to peer networking.

brigade 10mo ago
Getting a streamer’s IP attracts DDoSes and doxxing, so yeah it’s generally considered a vulnerability to use P2P in games
- whatevaa 10mo ago
  Yeah, p2p is fine only with friends, people you know, otherwise it's like posting your private address for everybody to see.
justaboutanyone 10mo ago
Punching through just a firewall is much easier than punching through a typical NAT+firewall setup https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
- whatevaa 10mo ago
  How do you punch trough firewalls? You have to manually open them, punching through firewall would be a firewall vulnerability.
  - tenacious_tuna 10mo ago
    This is a common function of uPnP, which I've seen as features in router config pages since the mid 2000s. https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr...

ChrisMarshallNY 10mo ago

I'm pretty underwhelmed by IPv6. It looks like the typical "horse designed by committee." I suspect that what will actually end up being implemented, will be a core subset of the spec. We'll have to see what's still standing, when the dust settles.

db48x 10mo ago
Your computer, and every other computer on the planet, already supports the entire IPv6 spec. There is no subset.
- ChrisMarshallNY 10mo ago
  Well, we'll have to see what all the "in-between" bits do. There's a lot in it, that will require implementation by countless layers of routers, switches, caches, firewalls, etc. Look at Bluetooth, for an example, or TIFF. I printed out the Bluetooth spec once, just for Ss and Gs. It was over 2,000 pages (double-sided). I once tried writing a fully-compliant TIFF reader. Didn't go so well.
  - db48x 10mo ago
    Those all support IPv6 too. They’re the same computers, and they’ve all supported IPv6 for decades now. The IPv6 spec is a lot shorter than the spec for Bluetooth or TIFF.
    - ChrisMarshallNY 10mo ago
      Just because the physical and link layers support it, doesn't mean the application layer will. You could say the same for Bluetooth chips. I've seen stuff, man...
      - kalleboo 10mo ago
        Apple requires that all iOS apps on the store function on an IPv6-only network (which is how several large mobile phone networks work), and everything works fine on the application layer.

imathew 10mo ago

My ISP has good IPv6 support. I was using it for a while and recently disabled it across my home network for simplicity of maintenance, cutting my vyos config in half. When I need to access something not available on IPv4 I'll set it up again but I'm not convinced that will happen in my lifetime.

seviu 10mo ago

And despite that, the place where I work, has disabled ipv6, rendering our development machines useless for trivial tasks such as debugging our iOS app on a device (which uses ipv6 under the hood) Reasons given: the security policies say ipv6 is not safe enough.

razighter777 10mo ago

The workarounds we need to enable P2P communication on the internet are a shame... we need turn, stun, webrtc, all this stuff so two computers can talk without a dedicated port forward or public ipv4. ipv6 is a beautiful protocol, (not perfect, but elegant) with a lot going for it. But the momentum of ipv4 is just too strong. It's a mess... with no good solution. I tried to turn off ipv4 and github (shame on you) stopped working. But what are we supposed to do? Have the government mandate everyone switch? (oh wait half of US government websites are ipv4 only) We did this to ourselves...

dpkirchner 10mo ago

I try enabling IPv6 every year or so. The last time I tried IPv6 at home I couldn't figure out what my netmask was, nor the size of my allocation. Some folks say my ISP issues /60s, others /64. I couldn't figure out how to get my IP to remain static long enough to have long-running TCP sessions, either. It was a mess and not much better than it was 20 years ago when I first tried it (and had to disable it because it being on broke all sorts of things). Maybe 2026 will be the year of IPv6. I kinda doubt it given I'm some jackass and dedicated network professionals still don't use IPv6.

illusive4080 10mo ago
If you have ATT fiber, it’s a pain in the butt. Their default router will only issue a single passthrough /64 on request. If you have multiple VLANs you have to setup some scripts to ask for more, and even then you only get 8 of them. The gateway reserves the other 8 from the /60 it gets for its own use. The only way I got IPv6 working well with them was to bypass their gateway. Now all my VLANs have /64, which is the standard subnet size.
- ekropotin 10mo ago
  I think bypassing their gateway, that is - bringing your own router is the only way to do VLANs, because their gateway is very basic and doesn’t support VLANs at all.
  - illusive4080 10mo ago
    You can do VLANs with their gateway but only IPv4, or you have to write custom scripts to ask for additional IPv6 delegations.
    - ekropotin 10mo ago
      Interesting. Which model of their gateway do you have? I have BGW320 and it definitely doesn’t support vlan tagging.

ctippett 10mo ago

Every few years I check to see how far away Virgin Media are from offering IPv6. Just checked again... nope! https://www.havevirginmediaenabledipv6yet.co.uk/ https://www.havevirginmediaenabledipv6yet.co.uk/

daft_pink 10mo ago

I feel this doesn’t really address whether we are losing something privacy or security related by not having NAT. I think my main devices are always updated Mac iPhone or iPad and can handle it, but do I really want my thermostat or doorbell or lock or garage door opener or light switch directly accessible on the Internet or is the nat serving a useful purpose? I don’t feel like this is addressed in this article.

yjftsjthsd-h 10mo ago
> but do I really want my thermostat or doorbell or lock or garage door opener or light switch directly accessible on the Internet or is the nat serving a useful purpose? You should have a firewall, regardless of v4/v6.
- mzajc 10mo ago
  You should, but the exposure from having no firewall is much higher without NAT. Packets with private network IPs are martians on the internet and will not find their way to your device unless they come from the same network and the ISP's infrastructure doesn't drop them. IPv6 addresses are routable across the internet so the packets will most likely get to your router, meaning anyone on the internet can talk to your LAN in the absence of a firewall. The reality is that consumer router firmware is horrible in every aspect, especially security, and this isn't going to change with IPv6 rollout. I fear the most likely scenario is that ISPs will set up inbound firewalls on their end, and then we'll be even worse off than we are right now.
  - jcgl 10mo ago
    Those naughty incoming packets can hit your private devices even with NAT-without-state full-firewall. The details depend on how your NAT actually implements the translation, but it’s perfectly possible for $randomHighPort to send all its incoming traffic straight to some device. Said another way, a NAT is not guaranteed to do something like match entries based on the layer 4 4-tuple.

martinald 10mo ago

Interesting. I did finally find a use for IPv6 which I wrote up here: https://martinalderson.com/posts/i-finally-found-a-use-for-ipv6/ https://martinalderson.com/posts/i-finally-found-a-use-for-i... Tbh though the docker problems are very serious and extremely painful to work around. Everything works great apart from Docker which has so many issues - it does not handle IPv6 inbound but IPv4 out well at all (at least as far as I can tell!).

transitorykris 10mo ago

In my 25 year career in network engineering, I’ve encounter needing it as a user exactly once, and that was earlier this year. Supabase’s free tier allows direct connections the Postgres only over IPv6. It’s too bad the deploment has been a long drawn and expensive process for everyone.

yjftsjthsd-h 10mo ago

> I spent a WEEK without IPv4 to understand IPv6 transition mechanisms > NAT64 - the method I’ve setup for this test > IPv6 is absolutely ready for prime-time and has been for awhile So... No, you spent a week effectively using both v6 and v4 with extra steps. If someone said "Linux is ready for primetime" but their setup only worked because they ran a bunch of applications in a Windows VM, I'd call that strong evidence that it really wasn't. Same here. That said... This is from early 2023. Any chance it's better now?

rendaw 10mo ago
None of the ISPs where I live provide NAT64 gateways. Exactly one advertised it, I signed up almost a year ago and they still haven't enabled it for me yet (I think they don't actually offer it and just forgot to remove the page).
eqvinox 10mo ago
> That said... This is from early 2023. Any chance it's better now? I accidentally went IPv6 only on my home wifi for a few weeks a while ago. I only noticed when GitHub didn't load (I avoid work things at home, hence accessing GitHub being rare.) Relatedly, fuck GitHub and their incompetence at rolling out IPv6. It's nothing other than that at this point. Blank, unadulterated incompetence.
topranks 10mo ago
No, because unfortunately the need for v4 hasn’t changed. In other words many sites and parts of the internet remain only on v4. Until nearly everything is on v6 too it won’t be realistic to ditch the mechanisms that provide v4 access.
lmm 10mo ago
> No, you spent a week effectively using both v6 and v4 with extra steps. It's less steps though. You can do all your network setup in the nice v6 world, and set up v4 emulation for those who need it. Yes, it's not yet practical to turn of v4 entirely, just like it's not yet practical to turn off Rosetta on your ARM mac.
imrejonk 10mo ago

self_awareness 10mo ago

My ISP has IPv6 since years and I'm on 6 as well. NAT-less network is really cool, I can serve content directly from anything from my LAN. We should really leave IPv4 and move on.

sneak 10mo ago

I tried that, but my HN addiction ended it.

ianburrell 10mo ago
HN has IPv6 now. If Reddit would finish adding IPv6, almost all of my browsing would be IPv6.

illusive4080 10mo ago

AWS doesn’t offer PTR records for IPv6 addresses, which makes Gmail blacklist my email server’s IPv6 address. I had to disable IPv6 due to lack of PTR records.

buggjenrmf 10mo ago
Not being able to setup a spam server in aws is a feature.
- illusive4080 10mo ago
  It’s not a spam server. I self host email for personal and non marketing business use. Don’t assume everyone running their own email is a spammer.

topranks 10mo ago

Dual-stack with a public IPv4 address is by far a preferable way to access the v4 internet than being stuck behind a provider NAT64 box. Totally understand why carriers may want IPv6 mostly and a v4-free core. But as an end user dual stack just seems simpler.

jcgl 10mo ago
Providers can do v6-only in their core while still providing public v4 to users. SIIT if they can still afford a public IP per customer, and MAP-T if they can’t.
- jcgl 10mo ago
  Misspoke: more like a CLAT thing/464XLAT, rather than SIIT, I think

beAbU 10mo ago

My previous fibre provider in Ireland was Virgin, and as far as I could tell, it was fully IPV6. Every device in my network got a public address, and self hosting stuff from home as was easy as setting up an A record at my DNS host. No faffing around with port forwarding, proxying, nat bullshit or whatever. My memory is hazy, but there might have been some firewall stuff I had to do on the virgin supplied router.

torcete 10mo ago

I wonder about the possibility of running your own email server behind a domestic IPv6 address. Most of the domestic IPv4 networks have port 25 blocked for incoming connections. Maybe in the IPv6 realm things are bit more relaxed.