8 ms·

>IPv6 doesn't make things substantially harder, just different. But people don't want to learn new things I learn new things all the time. IPv6 is much more co

>IPv6 doesn't make things substantially harder, just different. But people don't want to learn new things I learn new things all the time. IPv6 is much more complicated, and importantly, more complicated than it needs to be. There is really no reason for most devices to be publicly reachable. Everyone keeps holding this up as a positive, but it's absolutely not. Most devices aren't servers. Yes, a firewall can prevent these connections, but the whole standard is built around this use case most people don't need most of the time. Private IP space is incredibly useful. I build it and set it up -- my ISP does not have control. This is _gone_ with IPv6 and it makes things much more complicated than they need to.

stavros 10mo ago
> There is really no reason for most devices to be publicly reachable. Everyone keeps holding this up as a positive, but it's absolutely not. Most devices aren't servers. Ever tried to call someone over the internet? Well, now you need a publicly reachable device. Please, stop spreading this ignorance. You rely on your devices being reachable from the internet every single day, you're just not aware of it, because you're using a barely-working pile of duct tape and string that sort-of allows peer to peer connections to happen, after some arcane STUN/TURN/whatever magic. If you wanted to send someone a file in the Olden Days, you'd just click on their IRC username, the client would open a connection to them and you'd send the file. Now you need to use iCloud or some nonsense, because apparently people believe that peer-to-peer connections aren't needed and shouldn't even work.
- fluoridation 10mo ago
  >Ever tried to call someone over the internet? Well, now you need a publicly reachable device. Uhh... Is this the '90s? People don't type in IP addresses (or phone numbers, back in the day) to connect with other people anymore. They connect to a common, publicly reachable server that deals with peers being behind NAT.
  - stavros 10mo ago
    How do you think this works, exactly?
  - jdiff 10mo ago
    Now you've got significant additional latency, which is why this is very often not what actually occurs in these situations if it's at all avoidable.
    - aboardRat4 10mo ago
      It doesn't really matter. Any communications provider must keep call records for the FSB, so routing them through central servers and recording there is the only option anyway.
      - jdiff 10mo ago
        Of course it matters. STUN isn't theoretical, it's in actual, practical use across a great many things. There's plenty of things that aren't "calls" in a telecommunications sense. Discord, Telegram, Zoom, Slack, Jitsi, and far more. And there are plenty of other things entirely that use the same tactics to get direct peer-to-peer connections.
        aboardRat4 10mo ago
        >Discord, Telegram, Zoom, Slack, Jitsi All of them are blocked for not complying with government's regulations where I live.
        jdiff 10mo ago
        That is a quite extreme outlier, then. Hardly relevant to the global IPv6 and peer-to-peer conversation we're having here, and your objection still only applies to one narrow use of the technology under discussion.
        10mo ago
- brewmarche 9mo ago
  I’m wondering, wouldn’t a default deny inbound firewall still need hole punching with IPv6? You wouldn’t need STUN to find your global address but if you use varying ports you’d need to communicate the port first, and you’d also need to time the simultaneous open. So a coordinating party is still needed somewhere. Getting rid of TURN relays (if you’re affected by symmetric NATs) is of course a huge plus.
  - stavros 9mo ago
    No, you'd have something like UPnP open a port on the firewall, I imagine. It depends on the setup, which can now be much more flexible, since the firewall can run on the machine itself. You also have the benefit that multiple machines can listen on the same port, so you don't need a proxy any more.
throw0101a 10mo ago
> I learn new things all the time. IPv6 is much more complicated, and importantly, more complicated than it needs to be. There is really no reason for most devices to be publicly reachable. Sigh. This myth really won't die. Publicly addressable ≠ publicly reachable. With my last ISP I had IPv6: every device (including my printer) on my local network had a public IPv6 address, but exactly zero were reachable thanks to the stateful packet inspection (SPI) on my Asus.
- DrewADesign 10mo ago
  You’re either arguing about semantics or missed the point they were trying to make. If it doesn’t have to be publicly reachable, why should it be publicly addressable in the first place? I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Considering most peoples use cases solely involve home networks of devices that they definitely do not want to be publicly reachable, why is needing to explicitly disallow that better for them? In non-abstract terms, I just don’t see how that works better.
  - throw0101a 10mo ago
    > I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Because you do not know ahead of time which devices may have such a need, and by allowing for the possibility you open up more flexibility. > [Residential customers] don't care about engineering, but they sure do create support tickets about broken P2P applications, such as Xbox/PS gaming applications, broken VoIP in gaming lobbies, failure of SIP client to punch through etc. All these problems don't exist on native routed (and static) IPv6. > In order for P2P to work as close as possible to routed IPv6 in NATted IPv4, we had to deploy a bunch of workarounds such as EIM-NAT to allow TCP/UDP P2P punching to work both ways, we had to allow hairpinning on the CGNAT device to allow intra-CGNAT traffic to work between to CGNAT clients, as TURN can only detect the public-facing IP:Port, hairpinning allow 100.64.0.0/10 clients to talk to each other over the CGNATted public IP:Port. * https://blog.ipspace.net/2025/03/response-end-to-end-connectivity/#2585 https://blog.ipspace.net/2025/03/response-end-to-end-connect... By having (a) a public address, and (b) a CPE that supports PCP/IGD hole punching, you eliminate a whole swath of infrastructure (ICE/TURN/etc) and kludges. When it was first released, Skype was peer-to-peer, but because of NAT "super nodes" had to be invented in their architecture so that the clients/peers could have someone to 'bounce' off of to connect. But because of the prevalence of NAT, central servers are now the norm. A lot of folks on HN complain about centralization and concentration on the Internet, but how can it be otherwise when folks push back against technologies that would allow more peer-to-peer architectures?
IgorPartola 10mo ago
No it is not: IPv4 header: https://upload.wikimedia.org/wikipedia/commons/thumb/6/60/IPv4_Packet-en.svg/960px-IPv4_Packet-en.svg.png https://upload.wikimedia.org/wikipedia/commons/thumb/6/60/IP... IPv6 header: https://bitjunkie.org/wp-content/uploads/2023/10/ipv6-Header.png https://bitjunkie.org/wp-content/uploads/2023/10/ipv6-Header... Notice how the IPv6 header is simpler? That’s because it is. It has normal working semantics, got rid of fragmentation, TTL is replaced by hop limit, and link-local addresses actually work as intended. The addresses look scary != more complicated. Please stop perpetuating this myth.
- everdrive 10mo ago
  If IPv6 were just an improved header and a longer address I'd be perfectly happy with it. I wasn't discussing either point you raised.
  - IgorPartola 10mo ago
    That is literally all it is. There is nothing else to it. You get P2P connections and a longer address. The rest is what they removed from the protocol, not what was added.
    - tsimionescu 10mo ago
      SLAAC is a huge and complex part of IPv6. Higher reliance on ICMPv6 is also a big part of it. Networking stacks for IPv6 are also more complex, especially if you want to support SLAAC, requiring things like multiple IPs on every machine by default, and so on. The very fact that you have to choose between static IP, SLAAC, and DHCPv6 is another complication - if the choice is even there, as some major devices don't support DHCPv6 (Android).
      - eqvinox 10mo ago
        > SLAAC is a huge and complex part of IPv6. Complex? Could you elaborate what exactly is complex about SLAAC? Are you referring to the various address generation modes?
notpushkin 10mo ago
> Private IP space is incredibly useful. I build it and set it up -- my ISP does not have control. You can have that with IPv6, too. You can even get your own ULA prefix that (hopefully [1]) only you will ever use: https://ula.ungleich.ch/ https://ula.ungleich.ch/ [1]: Technically, it doesn’t prevent anybody else from using the same space as you. (And you can’t advertise it, of course.)
binkHN 10mo ago
> Private IP space is incredibly useful. I build it and set it up -- my ISP does not have control. This is _gone_ with IPv6 and it makes things much more complicated than they need to. Not in the least; IPv6 has private address space just like IPv4.
luckman212 10mo ago
> Private IP space is incredibly useful ... This is _gone_ with IPv6 No, it's not. Learn about ULAs: https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address
antonvs 10mo ago
> the whole standard is built around this use case most people don't need most of the time. This seems to be a function of when it was developed, starting in the early 90s before the internet as we know it today, particularly the web, even existed. Security wasn’t seen the same way then, because the threats we have today simply didn’t exist. Not every company in the world had its own private networks, so there weren’t even good examples to follow. The result was a system designed in the effective equivalent of a vacuum, without regard for how the internet would actually end up being used. The result is the situation you described.
RiverCrochet 10mo ago
> This is _gone_ with IPv6 Incorrect. There is the ULA range, fc00::/7, which is not routable and can be used in the same place you'd use 192.168.0.0/16 or similar. You can even do something like fc00::192:168:0:0/120 if you really want. > There is really no reason for most devices to be publicly reachable. If you want things to work in one direction only, you really want television or radio. This is how most people really treat the Internet, unfortunately.

stavros 10mo ago

> There is really no reason for most devices to be publicly reachable. Everyone keeps holding this up as a positive, but it's absolutely not. Most devices aren't servers. Ever tried to call someone over the internet? Well, now you need a publicly reachable device. Please, stop spreading this ignorance. You rely on your devices being reachable from the internet every single day, you're just not aware of it, because you're using a barely-working pile of duct tape and string that sort-of allows peer to peer connections to happen, after some arcane STUN/TURN/whatever magic. If you wanted to send someone a file in the Olden Days, you'd just click on their IRC username, the client would open a connection to them and you'd send the file. Now you need to use iCloud or some nonsense, because apparently people believe that peer-to-peer connections aren't needed and shouldn't even work.

fluoridation 10mo ago
>Ever tried to call someone over the internet? Well, now you need a publicly reachable device. Uhh... Is this the '90s? People don't type in IP addresses (or phone numbers, back in the day) to connect with other people anymore. They connect to a common, publicly reachable server that deals with peers being behind NAT.
- stavros 10mo ago
  How do you think this works, exactly?
- jdiff 10mo ago
  Now you've got significant additional latency, which is why this is very often not what actually occurs in these situations if it's at all avoidable.
  - aboardRat4 10mo ago
    It doesn't really matter. Any communications provider must keep call records for the FSB, so routing them through central servers and recording there is the only option anyway.
    - jdiff 10mo ago
      Of course it matters. STUN isn't theoretical, it's in actual, practical use across a great many things. There's plenty of things that aren't "calls" in a telecommunications sense. Discord, Telegram, Zoom, Slack, Jitsi, and far more. And there are plenty of other things entirely that use the same tactics to get direct peer-to-peer connections.
      - aboardRat4 10mo ago
        >Discord, Telegram, Zoom, Slack, Jitsi All of them are blocked for not complying with government's regulations where I live.
        jdiff 10mo ago
        That is a quite extreme outlier, then. Hardly relevant to the global IPv6 and peer-to-peer conversation we're having here, and your objection still only applies to one narrow use of the technology under discussion.
        10mo ago
brewmarche 9mo ago
I’m wondering, wouldn’t a default deny inbound firewall still need hole punching with IPv6? You wouldn’t need STUN to find your global address but if you use varying ports you’d need to communicate the port first, and you’d also need to time the simultaneous open. So a coordinating party is still needed somewhere. Getting rid of TURN relays (if you’re affected by symmetric NATs) is of course a huge plus.
- stavros 9mo ago
  No, you'd have something like UPnP open a port on the firewall, I imagine. It depends on the setup, which can now be much more flexible, since the firewall can run on the machine itself. You also have the benefit that multiple machines can listen on the same port, so you don't need a proxy any more.

throw0101a 10mo ago

> I learn new things all the time. IPv6 is much more complicated, and importantly, more complicated than it needs to be. There is really no reason for most devices to be publicly reachable. Sigh. This myth really won't die. Publicly addressable ≠ publicly reachable. With my last ISP I had IPv6: every device (including my printer) on my local network had a public IPv6 address, but exactly zero were reachable thanks to the stateful packet inspection (SPI) on my Asus.

DrewADesign 10mo ago
You’re either arguing about semantics or missed the point they were trying to make. If it doesn’t have to be publicly reachable, why should it be publicly addressable in the first place? I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Considering most peoples use cases solely involve home networks of devices that they definitely do not want to be publicly reachable, why is needing to explicitly disallow that better for them? In non-abstract terms, I just don’t see how that works better.
- throw0101a 10mo ago
  > I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Because you do not know ahead of time which devices may have such a need, and by allowing for the possibility you open up more flexibility. > [Residential customers] don't care about engineering, but they sure do create support tickets about broken P2P applications, such as Xbox/PS gaming applications, broken VoIP in gaming lobbies, failure of SIP client to punch through etc. All these problems don't exist on native routed (and static) IPv6. > In order for P2P to work as close as possible to routed IPv6 in NATted IPv4, we had to deploy a bunch of workarounds such as EIM-NAT to allow TCP/UDP P2P punching to work both ways, we had to allow hairpinning on the CGNAT device to allow intra-CGNAT traffic to work between to CGNAT clients, as TURN can only detect the public-facing IP:Port, hairpinning allow 100.64.0.0/10 clients to talk to each other over the CGNATted public IP:Port. * https://blog.ipspace.net/2025/03/response-end-to-end-connectivity/#2585 https://blog.ipspace.net/2025/03/response-end-to-end-connect... By having (a) a public address, and (b) a CPE that supports PCP/IGD hole punching, you eliminate a whole swath of infrastructure (ICE/TURN/etc) and kludges. When it was first released, Skype was peer-to-peer, but because of NAT "super nodes" had to be invented in their architecture so that the clients/peers could have someone to 'bounce' off of to connect. But because of the prevalence of NAT, central servers are now the norm. A lot of folks on HN complain about centralization and concentration on the Internet, but how can it be otherwise when folks push back against technologies that would allow more peer-to-peer architectures?

IgorPartola 10mo ago

No it is not: IPv4 header: https://upload.wikimedia.org/wikipedia/commons/thumb/6/60/IPv4_Packet-en.svg/960px-IPv4_Packet-en.svg.png https://upload.wikimedia.org/wikipedia/commons/thumb/6/60/IP... IPv6 header: https://bitjunkie.org/wp-content/uploads/2023/10/ipv6-Header.png https://bitjunkie.org/wp-content/uploads/2023/10/ipv6-Header... Notice how the IPv6 header is simpler? That’s because it is. It has normal working semantics, got rid of fragmentation, TTL is replaced by hop limit, and link-local addresses actually work as intended. The addresses look scary != more complicated. Please stop perpetuating this myth.

everdrive 10mo ago
If IPv6 were just an improved header and a longer address I'd be perfectly happy with it. I wasn't discussing either point you raised.
- IgorPartola 10mo ago
  That is literally all it is. There is nothing else to it. You get P2P connections and a longer address. The rest is what they removed from the protocol, not what was added.
  - tsimionescu 10mo ago
    SLAAC is a huge and complex part of IPv6. Higher reliance on ICMPv6 is also a big part of it. Networking stacks for IPv6 are also more complex, especially if you want to support SLAAC, requiring things like multiple IPs on every machine by default, and so on. The very fact that you have to choose between static IP, SLAAC, and DHCPv6 is another complication - if the choice is even there, as some major devices don't support DHCPv6 (Android).
    - eqvinox 10mo ago
      > SLAAC is a huge and complex part of IPv6. Complex? Could you elaborate what exactly is complex about SLAAC? Are you referring to the various address generation modes?

notpushkin 10mo ago

> Private IP space is incredibly useful. I build it and set it up -- my ISP does not have control. You can have that with IPv6, too. You can even get your own ULA prefix that (hopefully [1]) only you will ever use: https://ula.ungleich.ch/ https://ula.ungleich.ch/ [1]: Technically, it doesn’t prevent anybody else from using the same space as you. (And you can’t advertise it, of course.)

binkHN 10mo ago

> Private IP space is incredibly useful. I build it and set it up -- my ISP does not have control. This is _gone_ with IPv6 and it makes things much more complicated than they need to. Not in the least; IPv6 has private address space just like IPv4.

luckman212 10mo ago

> Private IP space is incredibly useful ... This is _gone_ with IPv6 No, it's not. Learn about ULAs: https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address

antonvs 10mo ago

> the whole standard is built around this use case most people don't need most of the time. This seems to be a function of when it was developed, starting in the early 90s before the internet as we know it today, particularly the web, even existed. Security wasn’t seen the same way then, because the threats we have today simply didn’t exist. Not every company in the world had its own private networks, so there weren’t even good examples to follow. The result was a system designed in the effective equivalent of a vacuum, without regard for how the internet would actually end up being used. The result is the situation you described.

RiverCrochet 10mo ago

> This is _gone_ with IPv6 Incorrect. There is the ULA range, fc00::/7, which is not routable and can be used in the same place you'd use 192.168.0.0/16 or similar. You can even do something like fc00::192:168:0:0/120 if you really want. > There is really no reason for most devices to be publicly reachable. If you want things to work in one direction only, you really want television or radio. This is how most people really treat the Internet, unfortunately.