4 ms·
Why not IPv6? Pretending that it doesn't exist?? https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechanisms https://en.wikipedia.org/wiki/List_of_IPv6_tr
by 1970-01-01 9mo ago
Why not IPv6? Pretending that it doesn't exist??
https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechanisms https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechan...
- lxgr 9mo agoIPv6 solves the addressing problem, not the reachability problem. Good luck opening ports in the stateful IPv6 firewalls in the scenarios outlined in TFA: > And that assumes a single NAT. Many sites have a security firewall behind the ISP modem, or a cellular modem in front of it. Double or triple NAT means configuring port forwarding on two or three devices in series, any of which can be reset or replaced independently.
- 1970-01-01 9mo agoWith IPv6 you don’t forward ports at all. The device already has a public address.
- jlokier 9mo agoThat's the addressing problem, although I have some bad news on that: NAT is used with IPv6 in some places. The reachability problem is, even with public addresses, sometimes you have to do the same thing to "configure port forwarding" with stateful IPv6 firewalls as with double or triple NAT IPv4.
- lxgr 9mo agoThat's why I said "open ports", not "forward ports". Stateful firewalls are very much a thing on v6. Many mobile ISPs don't allow incoming connections by default, for example. Many CPEs (home routers) also come with a v6 firewall (I'd guess it's probably more common than not?), and not everybody has admin access to theirs.
- bandrami 9mo agoYou don't have to forward ports with IPv6 but you certainly can, and that means some remote sites you have to interact with will.
- bigstrat2003 9mo agoI'm not really seeing a reason why it would be impossible to open firewalls in that scenario. More work, sure, but by no means impossible. In any case TFA says right up front that it is trying to solve the problem of overlapping subnets, which IPv6 solves nicely.
- lxgr 9mo agoIt's completely impossible if you simply don't have the necessary access. Not everybody can administer all firewalls upstream from them. Nor can everyone control whether their connection supports v6, unfortunately.
- digiown 9mo agoHole punching is a thing. Ports are not normally completely blocked. They allow replies, which can be exploited to do make a connection. Obviously this requires an out of band signaling mechanism. Tailscale does this, so does WebRTC, iirc. See: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
- lxgr 9mo agoYes, but I don't believe all firewalls support that, especially for TCP, and as you've mentioned, now you also need to maintain a handshaking mechanism. The complexity makes sense if you need to transport a lot of data peer-to-peer or the lowest possible latency, but if you don't, you might as well use that coordination server (which outbound-only clients are connecting to) for payload communication as well.
- direwolf20 9mo agoFirewalls don't track connections as carefully as you might think. They don't delete the mapping when an RST is received, so you can keep using it and receive a SYN in the other direction and now you have a connection.
- 9mo ago
- zamadatix 9mo agoThe article's proposed solution for IPv4 is a combination of VPN+NAT. The solution in IPv6 can be just VPN, sans NAT.
- bandrami 9mo agoIt can be sans NAT, but there's no guarantee it will be, and if a remote site chooses to NAT their IPV6 you still have to support it
- duskwuff 9mo agoI wouldn't be surprised if a lot of the hardware under management (e.g. IP cameras, NVRs, cable modems) lacks support for IPv6, and/or the customer networks that it's resident on don't have working IPv6 transit.
- reactordev 9mo agoIt’s definitely on the software side… The human side.
- eqvinox 9mo agoThe squishy side. Coincidentally I think that's an overestimation on the number of devices that don't support IPv6. At this point, vendors have to go out of their way to disable IPv6, and they lose out on some government/enterprise tenders that require IPv6 even if they're not running it (yet).
- reactordev 9mo agoRight, IPv6 is baked into the NIC, so it’s up to developers to use it.
- zokier 9mo agoThe solution is to run ipv6 on the overlay and have the customer site gateway thing they have to translate it to target ipv4. Conveniently you can do the translation it more or less statefully and very easily because you can just embed the ipv4 addr in ipv6. For example you could grab a /64 prefix, assign 32 bits to customer/gateway id and other 32 bits to target ipv4 addr.
- pcarroll 9mo agoIPv6 is very badly supported at the low end of the market. Cheap webcams, doorbells, etc. And that not counting already old equipment... If we had a nuclear war, we could start over. But for now, we are stuck. Blame it on Cisco for inventing NAT.
- qhwudbebd 9mo agoYes, I was going to suggest nat64 encapsulating the customer's v4 network on the wireguard overlay, but their embedded device is presumably a little linux board, and mainline linux still lacks any siit/clat/nat64 in netfilter. So I guess they'd end up in a world of pain with out-of-tree modules like jool or inefficient funnelling through taptun tayga-style.