5 ms·

> I learn new things all the time. IPv6 is much more complicated, and importantly, more complicated than it needs to be. There is really no reason for most devi

> I learn new things all the time. IPv6 is much more complicated, and importantly, more complicated than it needs to be. There is really no reason for most devices to be publicly reachable. Sigh. This myth really won't die. Publicly addressable ≠ publicly reachable. With my last ISP I had IPv6: every device (including my printer) on my local network had a public IPv6 address, but exactly zero were reachable thanks to the stateful packet inspection (SPI) on my Asus.

DrewADesign 10mo ago
You’re either arguing about semantics or missed the point they were trying to make. If it doesn’t have to be publicly reachable, why should it be publicly addressable in the first place? I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Considering most peoples use cases solely involve home networks of devices that they definitely do not want to be publicly reachable, why is needing to explicitly disallow that better for them? In non-abstract terms, I just don’t see how that works better.
- throw0101a 10mo ago
  > I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Because you do not know ahead of time which devices may have such a need, and by allowing for the possibility you open up more flexibility. > [Residential customers] don't care about engineering, but they sure do create support tickets about broken P2P applications, such as Xbox/PS gaming applications, broken VoIP in gaming lobbies, failure of SIP client to punch through etc. All these problems don't exist on native routed (and static) IPv6. > In order for P2P to work as close as possible to routed IPv6 in NATted IPv4, we had to deploy a bunch of workarounds such as EIM-NAT to allow TCP/UDP P2P punching to work both ways, we had to allow hairpinning on the CGNAT device to allow intra-CGNAT traffic to work between to CGNAT clients, as TURN can only detect the public-facing IP:Port, hairpinning allow 100.64.0.0/10 clients to talk to each other over the CGNATted public IP:Port. * https://blog.ipspace.net/2025/03/response-end-to-end-connectivity/#2585 https://blog.ipspace.net/2025/03/response-end-to-end-connect... By having (a) a public address, and (b) a CPE that supports PCP/IGD hole punching, you eliminate a whole swath of infrastructure (ICE/TURN/etc) and kludges. When it was first released, Skype was peer-to-peer, but because of NAT "super nodes" had to be invented in their architecture so that the clients/peers could have someone to 'bounce' off of to connect. But because of the prevalence of NAT, central servers are now the norm. A lot of folks on HN complain about centralization and concentration on the Internet, but how can it be otherwise when folks push back against technologies that would allow more peer-to-peer architectures?
  - everdrive 10mo ago
    It's baffling to argue that NAT is the real driver of centralization for internet technologies.
    - throw0101a 10mo ago
      > It's baffling to argue that NAT is the real driver of centralization for internet technologies. It doesn't help.
    - aboardRat4 10mo ago
      It surely was a big factor. When internet finally became popular, hosting a website on your own machine already became infeasible.
      - DrewADesign 10mo ago
        What do you mean by popular? I hosted a site on a home machine in the early teens. If you don't know how to do that with NAT, you should not have a web server under your control exposed to the internet.
        avianlyric 10mo ago
        The early teens didn’t have huge proliferation of ISPs using CGNATs. These days ISP can’t get hold of new IPv4 blocks, and increasingly don’t provide public IP addresses to residential routers, not without having to pay extra for that lowly single IPv4 address. Hosting a website behind a NAT isn’t as trivial as it used to be, and for many it’s now impossible without IPv6.
        aboardRat4 10mo ago
        >for many it’s now impossible without IPv6. It's impossible with ipv6 either. ISPs block incoming connections on ipv6 for residential addresses.
everdrive 10mo ago
>>Yes, a firewall can prevent these connection >Publicly addressable ≠ publicly reachable. I already addressed this, and I know how firewalls work. It would be nice if on a per-device basis I could opt into a choice to be publicly addressable. Instead, the entire standard is built around this.
- avianlyric 10mo ago
  You literally can. You can just use local link addresses, IPv6 routers are guarantee not to forward those packets out of the network, or forward traffic into the network addresses to one of those IPs. Devices within the network can all still talk to each other. If you really want to do the full Monty, add a NAT to your IPv6 router to have it translate to the local-link addresses, just like it would on IPv4. I would highlight this is also identical to IPv4, which notably is also a standard built around the idea that every device in the world can, and should, be given a publicly addressable IP. Many large corporations and universities with /8 IP blocks do exactly this. Unfortunately when they originally wrote the IPv4 standard they slightly underestimated how many devices would eventually connect to the internet.

DrewADesign 10mo ago

You’re either arguing about semantics or missed the point they were trying to make. If it doesn’t have to be publicly reachable, why should it be publicly addressable in the first place? I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Considering most peoples use cases solely involve home networks of devices that they definitely do not want to be publicly reachable, why is needing to explicitly disallow that better for them? In non-abstract terms, I just don’t see how that works better.

throw0101a 10mo ago
> I can’t think of any common requirement that will be afforded to users having devices that will never need to be publicly reachable be publicly addressable. Because you do not know ahead of time which devices may have such a need, and by allowing for the possibility you open up more flexibility. > [Residential customers] don't care about engineering, but they sure do create support tickets about broken P2P applications, such as Xbox/PS gaming applications, broken VoIP in gaming lobbies, failure of SIP client to punch through etc. All these problems don't exist on native routed (and static) IPv6. > In order for P2P to work as close as possible to routed IPv6 in NATted IPv4, we had to deploy a bunch of workarounds such as EIM-NAT to allow TCP/UDP P2P punching to work both ways, we had to allow hairpinning on the CGNAT device to allow intra-CGNAT traffic to work between to CGNAT clients, as TURN can only detect the public-facing IP:Port, hairpinning allow 100.64.0.0/10 clients to talk to each other over the CGNATted public IP:Port. * https://blog.ipspace.net/2025/03/response-end-to-end-connectivity/#2585 https://blog.ipspace.net/2025/03/response-end-to-end-connect... By having (a) a public address, and (b) a CPE that supports PCP/IGD hole punching, you eliminate a whole swath of infrastructure (ICE/TURN/etc) and kludges. When it was first released, Skype was peer-to-peer, but because of NAT "super nodes" had to be invented in their architecture so that the clients/peers could have someone to 'bounce' off of to connect. But because of the prevalence of NAT, central servers are now the norm. A lot of folks on HN complain about centralization and concentration on the Internet, but how can it be otherwise when folks push back against technologies that would allow more peer-to-peer architectures?
- everdrive 10mo ago
  It's baffling to argue that NAT is the real driver of centralization for internet technologies.
  - throw0101a 10mo ago
    > It's baffling to argue that NAT is the real driver of centralization for internet technologies. It doesn't help.
  - aboardRat4 10mo ago
    It surely was a big factor. When internet finally became popular, hosting a website on your own machine already became infeasible.
    - DrewADesign 10mo ago
      What do you mean by popular? I hosted a site on a home machine in the early teens. If you don't know how to do that with NAT, you should not have a web server under your control exposed to the internet.
      - avianlyric 10mo ago
        The early teens didn’t have huge proliferation of ISPs using CGNATs. These days ISP can’t get hold of new IPv4 blocks, and increasingly don’t provide public IP addresses to residential routers, not without having to pay extra for that lowly single IPv4 address. Hosting a website behind a NAT isn’t as trivial as it used to be, and for many it’s now impossible without IPv6.
        aboardRat4 10mo ago
        >for many it’s now impossible without IPv6. It's impossible with ipv6 either. ISPs block incoming connections on ipv6 for residential addresses.

everdrive 10mo ago

>>Yes, a firewall can prevent these connection >Publicly addressable ≠ publicly reachable. I already addressed this, and I know how firewalls work. It would be nice if on a per-device basis I could opt into a choice to be publicly addressable. Instead, the entire standard is built around this.

avianlyric 10mo ago
You literally can. You can just use local link addresses, IPv6 routers are guarantee not to forward those packets out of the network, or forward traffic into the network addresses to one of those IPs. Devices within the network can all still talk to each other. If you really want to do the full Monty, add a NAT to your IPv6 router to have it translate to the local-link addresses, just like it would on IPv4. I would highlight this is also identical to IPv4, which notably is also a standard built around the idea that every device in the world can, and should, be given a publicly addressable IP. Many large corporations and universities with /8 IP blocks do exactly this. Unfortunately when they originally wrote the IPv4 standard they slightly underestimated how many devices would eventually connect to the internet.