5 ms·

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forwa

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forward 15 years snd the situation has improved quite dramatically. IPv6 has some quirks that make it harder to digest. - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space - privacy extensions: it is very hard to explain to people why they have 3-4 IPv6 addresses assigned to their computer - multicast instead of broadcast - way too many ways for autoconfiguration (SLAAC, DHCPv6) - no real tentative mapping to what people were used to. Every IPv6 presentation I did had to start with “forget everything you know about IPv4” In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Those people love their NAT.

hnlmorg 6mo ago
The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with enterprise is that 80% of the work is explaining to other people, usually non-technical or pseudo-technical decision makers, why your design is safe. I really do think IPv6 missed a trick by not offering that.
- gucci-on-fleek 6mo ago
  > The nice thing about NAT [...] I really do think IPv6 missed a trick by not offering that IPv6 supports NAT [0], and nearly all routers make it easy to enable. The primary differences compared to IPv4 is that no-NAT is the default, and that it's more heavily discouraged, but it still works just as well as it does with IPv4. [0]: In the same way that IPv4 "supports" NAT, meaning that the protocol doesn't officially support it, but it's still possible to implement.
  - wongarsu 6mo ago
    But would we have said the same in 1996 or 2000? Part of the adoption curve seems to be that it took years to abandon some of the bad ideas around IPv6 and readopt some of the better ones from IPv4. And a good chunk of the complexity of IPv6 is that some of the early ideas are very persistent, both in some deployed systems and in people's minds
    - gucci-on-fleek 6mo ago
      > But would we have said the same in we 1996 or 2000? IPv6 the protocol supported NAT just as well back then as it does now, but the software probably didn't. Which goes back to my point [0] [1] that IPv6 is a great protocol with bad tooling and documentation. > Part of the adoption curve seems to be that it took years to abandon some of the bad ideas around IPv6 and readopt some of the better ones from IPv4. The only abandoned IPv6 concept that I'm personally aware of is A6 records [2], but I'm pretty young, so I'm sure that there are others that I'm just not aware of. My impression from reading the RFCs and Wikipedia is that IPv6 hasn't changed very much, but that doesn't really mean anything, since I wouldn't expect for current sources to talk about concepts abandoned 20+ years ago. [0]: https://news.ycombinator.com/item?id=47814070 https://news.ycombinator.com/item?id=47814070 [1]: https://news.ycombinator.com/item?id=44773999 https://news.ycombinator.com/item?id=44773999 [2]: https://datatracker.ietf.org/doc/html/rfc6563 https://datatracker.ietf.org/doc/html/rfc6563
      - izacus 6mo ago
        Just because it technically supported something in some RFC it doesn't mean you could get affordable and capable equipment supporting it.
  - ButlerianJihad 6mo ago
    > IPv6 supports NAT You say that, but in practice it does not. My consumer router, and every router I have configured, implicitly supports IPv4 NAT out of the box. But it will never NAT an IPv6 network. If I enable IPv6 then it operates by IPv6 rules, which means each device gets a Network ID and each Network ID gets routed directly and transparently. The router has no NAT table and no NAT settings for this protocol. So if NAT is “supported” whatever that means, it simply isn’t possible for most end-users.
    - gucci-on-fleek 6mo ago
      Consumer routers don't support lots of useful stuff though, so them not supporting NAT66 isn't very surprising. Enthusiasts are likely to use OpenWRT or nftables, both of which support NAT66 [0], and quickly Googling some random enterprise routers shows that they all support NAT66 too [1] [2] [3]. This isn't enabled by default because it's usually a bad idea, but it's certainly possible if you really want. (It's discouraged because NAT in general is a bad idea, but it's no worse with IPv6 than with IPv4; the only difference being that IPv4 effectively requires NAT.) [0]: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 [1]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16-11/nat-xe-16-11-book/iadnat-asr1k-nptv6.html https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat... [2]: https://www.animmouse.com/p/how-to-nat-ipv6-in-mikrotik/ https://www.animmouse.com/p/how-to-nat-ipv6-in-mikrotik/ [3]: https://www.juniper.net/documentation/us/en/software/junos/interfaces-next-gen-services/topics/task/usf-basic-nat44-configuring.html https://www.juniper.net/documentation/us/en/software/junos/i...
    - shibapuppie 6mo ago
      IPv6 DOES support NAT. If you've got a car that can't go 100, that doesn't mean nobody can, or that it doesn't exist. I don't care if you can't do it, it IS supported in the spec.
      - hnlmorg 6mo ago
        That’s an interesting analogy because there’s several ways you could easily dismiss it. For example: if roads aren’t built to support cars travelling at 100 miles per hour then it doesn’t matter how much you argue that cars are can do 100MPH, because you’re still not going to be travelling at 100MPH. Or But if the only cars that can travel at 100 MPH are Bugatti Veyrons then it’s safe to say that 100MPH cars isn’t something available to even the average consumer of high end sports cars. Or Sure, some cars can travel at 100 MPH, but they’re so unstable at those speeds that it’s not even safe to attempted it. …You get the idea.
- eqvinox 6mo ago
  One good thing about IPv6 is that any reasonable allocation will be large enough to use sizable chunks as functional divisions. A small company might have a /48. You don't have to be concerned about address space when you just go, ok, first bit is for security zones. Or first 2 bits. Or first 3 bits. Do you need more than 8 security zones? (Also, ULAs¹ exist, and most people should use them, independent of a possible consideration to not roll out GUAs² in parallel as one would normally do.) ¹ Unique Local Address, fc..: and fd..: ² Global Unicast Address
  - matt-p 6mo ago
    Pretty much the only way I've seen a /48 split in practice is to get 256 /56 (one per site) then 256 /64 (one per VLAN).
    - eqvinox 6mo ago
      /52 and /60 are quite common as well, predictably what with falling on a "letter boundary" and all
      - matt-p 6mo ago
        Interesting. I've only seen /60 when they're trying to split up a /56, and IMO it's a little unclean.
- 9dev 6mo ago
  The price you pay is that it's more difficult to reason about what is accessible from elsewhere, because all devices are represented by your router from the outside, and there are no great ways to opt out of that. With NAT removed, you've still got the firewall rules, and that's fairly easy to reason about for me: Block anything from outside to inside, except X. Allow A talking to B. Allow B to receive Y from outside.
  - hnlmorg 6mo ago
    > and that's fairly easy to reason about for me But we aren’t talking about someone technical glancing at their home routers firewall. We are talking about explaining a network topology to enterprise teams like change management, CISO, etc in large infrastructure environments. That’s a whole different problem and half the time the people signing off that change either aren’t familiar with the infrastructure (which means explaining the entire context from the ground up) and often aren’t even engineers so need those changes explained in a simplified yet still retaining the technical detail. These types of organisations mandate CIS / NIST / etc compliance even where it makes zero sense and getting action items in such reports marked as “not required” often takes a meeting in itself with deep architectural discussing with semi-technical people. Are these types of organisations overly bureaucratic? Absolutely. But that’s typical for any enterprise organisation where processes have been placed to protect individuals and the business from undue risk. In short, what works for home set ups or even a start up isn’t necessarily what’s going to work for enterprise.
    - 9dev 6mo ago
      > But we aren’t talking about someone technical glancing at their home routers firewall. Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort. For network admins in commercial settings, this is even less of an excuse. IPv6, the protocol, is fairly well documented and understandable if you put in the work to do so. And I am confident in saying it is absolutely able to deliver on any kind of corporate network scenario, even moreso than IPv4.
- bladeee 6mo ago
  It is absolutely a thing in IPv6 as well, but why would you do that. https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Translation https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr...
  - hnlmorg 6mo ago
    For exactly the reasons I stated
- themafia 6mo ago
  It's just one firewall rule at the border to block all inbound traffic to a subnet or a range unless related to an outbound connection. Now you have identical security to a NAT. The huge win is you can forget about port forwarding and later just open the ports you need to the hosts you need or even the whole host if required.
  - hkpack 6mo ago
    Is it really identical when the receiving party can now identify every workstation at your internal network and track them separately? For example, any website can now not only log that the traffic originated from org A, but specifically from org A, workstation N. I wonder, is privacy implication is not important enough for people to worry about this?
    - Dagger2 6mo ago
      At this point, the people who would be worried about this ought to know that temporary addresses are a thing, and that they prevent workstation N from having a single fixed IP for its outbound connections that it could be identified with.
    - themafia 6mo ago
      > any website can now not only log that the traffic originated from org A, but specifically from org A, workstation N. GeoIP databases and Cookies exist. So I'm not sure how your threat profile has increased here. > I wonder, is privacy implication is not important enough for people to worry about this? The most you can do over what is already possible is attempt an inventory or unit count of my office; however, you'd have to get every computer in my office to go to the same website that you control. Then you'd have to control for upgrades and other machine movements. I don't think this enables anything in particular.
- Dagger2 6mo ago
  Nope, it doesn't. The security model is based on your firewalls and routing, not on NAT. NAT just gets in the way and makes it harder to understand what's going on. For example, on a normal home network, if you don't have a firewall on your router then your ISP can connect to anything on your network. Even when they don't control the router and even if you're NATing. If you didn't realize this then apparently NAT didn't make it easier to reason about after all.
  - rileymat2 6mo ago
    Can you say more about the ISP connecting to any computer on your network? I can’t find any references to this aspect in googling the right terms and the concept is foreign to me. There are a bunch of ways to break it, or misconfigure it. But I have idea what this isp method is.
    - Dagger2 6mo ago
      It's just normal routing. If you send packets to a router, it'll route them. More concretely, they can run the equivalent of `ip route add 192.168.1.0/24 via <your WAN IP>` on a machine that's connected to your WAN network, and then their machine will send packets with a dest of 192.168.1.x to your router. Your router will route them onto your LAN because that's what its own routing table says to do with them. Anyone on your immediate upstream network can do this, not just your ISP. Also, if you use ISP-assigned GUAs then this inbound route will already exist and anyone on the Internet can connect. Applying NAT to your outbound connections will change their apparent source address, but it won't make that inbound route disappear.
      - mittensc 6mo ago
        Have you tried that? I have yet to see a router that allows that forwarding unless explicitly configured. Still, i'm using mostly openwrt/opnsense/mikrotik Default is to disallow/block forwarding packets from public wan to private range lan. ISP can still inject packets on ports that NAT opens if it spoofs the source address/port, so you still have some validity to argument.
- somat 6mo ago
  NAT is a statefull firewall with a trick. One is exactly as complicated to reason about as the other. Except on one you don't need the trick.
  - hnlmorg 6mo ago
    Not in the context I was describing.
  - Dagger2 6mo ago
    NAT is state tracking with a trick, but not firewalling. It doesn't block connections, so it's not a firewall.
- otabdeveloper4 6mo ago
  > But it is a lot easier to see and to explain what has access to what. "What has access to what" is exactly what computer security is.
- throw0101d 6mo ago
  > The nice thing about NAT is it makes the security model easier to reason about. I first heard that relying on the 'moated castle' design of security (firewalls) was bad idea and no longer best practice a decade or two ago, and while inside/outside may be a convenient mental shortcut for security, it shouldn't be relied about. Sure, sensible people know that NAT ≠ security, but by having private/public IPs I think it makes people's thinking lazy. Every system having publicly routable addresses (but not publicly accessible, due to SPI) would force more folks to actually examine their security controls. It's too easy to think "ah, this has a 10.x.y.z address, therefore it's inside and safe". No, because most attacks nowadays involve compromised/ing clients, and then running around 10.x networks where people got lazy because these things are on the "inside".
Hikikomori 6mo ago
>In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Those people love their NAT. Was also designed in the early 90s before security was taken seriously.
- ExoticPearTree 6mo ago
  > Was also designed in the early 90s before security was taken seriously. True, but since then it has transformed into “no one gets in because we have _private_ IP addresses”…
  - Hikikomori 6mo ago
    To be fair it's a pretty decent defense, in the early days of blaster and today with iot crap.
  - Ekaros 6mo ago
    I would need to ask the follow up question. Okay so what happens when someone gets in? Say some idiot install something they should not. Or there is some vulnerability in something you allow in? Extra layers is good. But it does not mean you can forgo anything else.
    - icedchai 6mo ago
      Okay, so you configure a firewall. NAT is not required.
- icedchai 6mo ago
  The real problem is many "enterprises" have people who don't understand networking. NAT was a solution to IP address depletion. This is not a problem we have with IPv6. If security is taken seriously, I'm sure they can spend a few minutes and learn how to configure a IPv6 firewall that allows no inbound connections. It's basically the simplest configuration possible.
jjav 6mo ago
> In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Topic drift, but for younger people who didn't live it, that's how it used to be! For most of the 90s my workstation in the office (at several employers) was directly on the Internet. There were no firewalls, no filtering of any kind. I ran my email server on my desktop workstation to receive all emails, both from "internal" (but there was no "internal" really, since every host was on the Internet) people and anyone in the world. I ran my web server on that same workstation, accessible to the whole Internet. That was the norm, the Internet was completely peer to peer. Good times.
- icedchai 6mo ago
  Same! I even had my home network on a public /24.
  - ExoticPearTree 6mo ago
    The good ol’ days. Same. Had a public IP on my computer, could SSH into it to read my mail.
    - jjav 6mo ago
      That I still do, but now it goes through a firewall, a bastion host and a second different firewall.
- vrighter 6mo ago
  i still do this today!
  - CodesInChaos 6mo ago
    You run a mail server on a residential IP? I thought that pretty much guarantees non delivery nowadays?
- thbb123 6mo ago
  Pretty much all tech companies and universities had a drop-in ftp server where anyone could, anonymously, put and retrieve files. It was a collective 'pastebin' useful to exchange information with clients and partners. On the ftp server of the company I worked for, someone had put a cracked copy of our software for their colleagues to use.
BobbyTables2 6mo ago
The SLAAC/DHCPv6 combo seems really strange to me. Either IP/DNS/gateway discovery with one or the other could be tolerable. But allowing combinations such as SLAAC for addressing and DHCP for DNS discovery is lunacy. It’s as if one said, let’s take the most basic and critical step and make it as complicated as possible and explore the combinatorial explosion…
- kalleboo 6mo ago
  The article mentions that DHCPv6 was an afterthought because DHCP itself barely existed when IPv6 was being designed - they were still using things like RARP or BOOTP! https://en.wikipedia.org/wiki/Reverse_Address_Resolution_Protocol https://en.wikipedia.org/wiki/Reverse_Address_Resolution_Pro... https://en.wikipedia.org/wiki/Bootstrap_Protocol https://en.wikipedia.org/wiki/Bootstrap_Protocol
  - rao-v 6mo ago
    The article does seem to simultaneously claim that IPv6’s design is the result of wierd no longer current pressures but also that it’s perfectly fine and correctly designed.
teddyh 6mo ago
> IPv6 has some quirks that make it harder to digest. Almost every point in your list is wrong. > - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space IPv4 has link-local addresses, too. Those are the 169.254.X.X addresses that you see on Windows machines. IPv6 adds nothing new. > - privacy extensions: it is very hard to explain to people why they have 3-4 IPv6 addresses assigned to their computer Well then, don’t use them. Configure the machines with one address each, just like before. If you want the (arguable) advantages of the privacy extensions, they are available, but not mandatory. > - multicast instead of broadcast IPv4 always had multicast, too. IPv6 is simplified by considering the broadcast concept to be a kind of multicast. > - way too many ways for autoconfiguration (SLAAC, DHCPv6) SLAAC is just link-local addresses, which you already mentioned above. Did you mean NDP with router advertisements? If you did, you do have a small point, but DHCP6 is still there like always. IPv6 just offers an additional feature for the simple cases where a host just needs an IP address, netmask and a router address. > - no real tentative mapping to what people were used to. Every IPv6 presentation I did had to start with “forget everything you know about IPv4” That’s the complete opposite of my experience. Almost everything in IPv6 works exactly the same as with IPv4.
- patmorgan23 6mo ago
  You're being obtuse. Every point in the original comment is correct, you just disagree they're issues. The original comment also doesn't state they are issues just that they are differences. • link local addresses .Auto configuration addresses are in V4 but they are used entirely differently. Interfaces do not have link local addresses if they have a DHCP or statically configured address, in V6 it is extremely common to use a link local address as the gateway, in V4 this basically never happens.
  - teddyh 6mo ago
    > The original comment also doesn't state they are issues just that they are differences. My point is that, in most cases, these aren’t differences, since IPv4 does the same thing as IPv6. Therefore, the claim that IPv6 “has some quirks that make it harder to digest [than IPv4]” is incorrect. > Interfaces do not have link local addresses if they have a DHCP or statically configured address I could be wrong, but I seem to recall that Windows machines always have a IPv4LL address? > in V6 it is extremely common to use a link local address as the gateway What? I have never seen this.

hnlmorg 6mo ago

The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with enterprise is that 80% of the work is explaining to other people, usually non-technical or pseudo-technical decision makers, why your design is safe. I really do think IPv6 missed a trick by not offering that.

gucci-on-fleek 6mo ago
> The nice thing about NAT [...] I really do think IPv6 missed a trick by not offering that IPv6 supports NAT [0], and nearly all routers make it easy to enable. The primary differences compared to IPv4 is that no-NAT is the default, and that it's more heavily discouraged, but it still works just as well as it does with IPv4. [0]: In the same way that IPv4 "supports" NAT, meaning that the protocol doesn't officially support it, but it's still possible to implement.
- wongarsu 6mo ago
  But would we have said the same in 1996 or 2000? Part of the adoption curve seems to be that it took years to abandon some of the bad ideas around IPv6 and readopt some of the better ones from IPv4. And a good chunk of the complexity of IPv6 is that some of the early ideas are very persistent, both in some deployed systems and in people's minds
  - gucci-on-fleek 6mo ago
    > But would we have said the same in we 1996 or 2000? IPv6 the protocol supported NAT just as well back then as it does now, but the software probably didn't. Which goes back to my point [0] [1] that IPv6 is a great protocol with bad tooling and documentation. > Part of the adoption curve seems to be that it took years to abandon some of the bad ideas around IPv6 and readopt some of the better ones from IPv4. The only abandoned IPv6 concept that I'm personally aware of is A6 records [2], but I'm pretty young, so I'm sure that there are others that I'm just not aware of. My impression from reading the RFCs and Wikipedia is that IPv6 hasn't changed very much, but that doesn't really mean anything, since I wouldn't expect for current sources to talk about concepts abandoned 20+ years ago. [0]: https://news.ycombinator.com/item?id=47814070 https://news.ycombinator.com/item?id=47814070 [1]: https://news.ycombinator.com/item?id=44773999 https://news.ycombinator.com/item?id=44773999 [2]: https://datatracker.ietf.org/doc/html/rfc6563 https://datatracker.ietf.org/doc/html/rfc6563
    - izacus 6mo ago
      Just because it technically supported something in some RFC it doesn't mean you could get affordable and capable equipment supporting it.
- ButlerianJihad 6mo ago
  > IPv6 supports NAT You say that, but in practice it does not. My consumer router, and every router I have configured, implicitly supports IPv4 NAT out of the box. But it will never NAT an IPv6 network. If I enable IPv6 then it operates by IPv6 rules, which means each device gets a Network ID and each Network ID gets routed directly and transparently. The router has no NAT table and no NAT settings for this protocol. So if NAT is “supported” whatever that means, it simply isn’t possible for most end-users.
  - gucci-on-fleek 6mo ago
    Consumer routers don't support lots of useful stuff though, so them not supporting NAT66 isn't very surprising. Enthusiasts are likely to use OpenWRT or nftables, both of which support NAT66 [0], and quickly Googling some random enterprise routers shows that they all support NAT66 too [1] [2] [3]. This isn't enabled by default because it's usually a bad idea, but it's certainly possible if you really want. (It's discouraged because NAT in general is a bad idea, but it's no worse with IPv6 than with IPv4; the only difference being that IPv4 effectively requires NAT.) [0]: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 [1]: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16-11/nat-xe-16-11-book/iadnat-asr1k-nptv6.html https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat... [2]: https://www.animmouse.com/p/how-to-nat-ipv6-in-mikrotik/ https://www.animmouse.com/p/how-to-nat-ipv6-in-mikrotik/ [3]: https://www.juniper.net/documentation/us/en/software/junos/interfaces-next-gen-services/topics/task/usf-basic-nat44-configuring.html https://www.juniper.net/documentation/us/en/software/junos/i...
  - shibapuppie 6mo ago
    IPv6 DOES support NAT. If you've got a car that can't go 100, that doesn't mean nobody can, or that it doesn't exist. I don't care if you can't do it, it IS supported in the spec.
    - hnlmorg 6mo ago
      That’s an interesting analogy because there’s several ways you could easily dismiss it. For example: if roads aren’t built to support cars travelling at 100 miles per hour then it doesn’t matter how much you argue that cars are can do 100MPH, because you’re still not going to be travelling at 100MPH. Or But if the only cars that can travel at 100 MPH are Bugatti Veyrons then it’s safe to say that 100MPH cars isn’t something available to even the average consumer of high end sports cars. Or Sure, some cars can travel at 100 MPH, but they’re so unstable at those speeds that it’s not even safe to attempted it. …You get the idea.
eqvinox 6mo ago
One good thing about IPv6 is that any reasonable allocation will be large enough to use sizable chunks as functional divisions. A small company might have a /48. You don't have to be concerned about address space when you just go, ok, first bit is for security zones. Or first 2 bits. Or first 3 bits. Do you need more than 8 security zones? (Also, ULAs¹ exist, and most people should use them, independent of a possible consideration to not roll out GUAs² in parallel as one would normally do.) ¹ Unique Local Address, fc..: and fd..: ² Global Unicast Address
- matt-p 6mo ago
  Pretty much the only way I've seen a /48 split in practice is to get 256 /56 (one per site) then 256 /64 (one per VLAN).
  - eqvinox 6mo ago
    /52 and /60 are quite common as well, predictably what with falling on a "letter boundary" and all
    - matt-p 6mo ago
      Interesting. I've only seen /60 when they're trying to split up a /56, and IMO it's a little unclean.
9dev 6mo ago
The price you pay is that it's more difficult to reason about what is accessible from elsewhere, because all devices are represented by your router from the outside, and there are no great ways to opt out of that. With NAT removed, you've still got the firewall rules, and that's fairly easy to reason about for me: Block anything from outside to inside, except X. Allow A talking to B. Allow B to receive Y from outside.
- hnlmorg 6mo ago
  > and that's fairly easy to reason about for me But we aren’t talking about someone technical glancing at their home routers firewall. We are talking about explaining a network topology to enterprise teams like change management, CISO, etc in large infrastructure environments. That’s a whole different problem and half the time the people signing off that change either aren’t familiar with the infrastructure (which means explaining the entire context from the ground up) and often aren’t even engineers so need those changes explained in a simplified yet still retaining the technical detail. These types of organisations mandate CIS / NIST / etc compliance even where it makes zero sense and getting action items in such reports marked as “not required” often takes a meeting in itself with deep architectural discussing with semi-technical people. Are these types of organisations overly bureaucratic? Absolutely. But that’s typical for any enterprise organisation where processes have been placed to protect individuals and the business from undue risk. In short, what works for home set ups or even a start up isn’t necessarily what’s going to work for enterprise.
  - 9dev 6mo ago
    > But we aren’t talking about someone technical glancing at their home routers firewall. Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort. For network admins in commercial settings, this is even less of an excuse. IPv6, the protocol, is fairly well documented and understandable if you put in the work to do so. And I am confident in saying it is absolutely able to deliver on any kind of corporate network scenario, even moreso than IPv4.
bladeee 6mo ago
It is absolutely a thing in IPv6 as well, but why would you do that. https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Translation https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr...
- hnlmorg 6mo ago
  For exactly the reasons I stated
themafia 6mo ago
It's just one firewall rule at the border to block all inbound traffic to a subnet or a range unless related to an outbound connection. Now you have identical security to a NAT. The huge win is you can forget about port forwarding and later just open the ports you need to the hosts you need or even the whole host if required.
- hkpack 6mo ago
  Is it really identical when the receiving party can now identify every workstation at your internal network and track them separately? For example, any website can now not only log that the traffic originated from org A, but specifically from org A, workstation N. I wonder, is privacy implication is not important enough for people to worry about this?
  - Dagger2 6mo ago
    At this point, the people who would be worried about this ought to know that temporary addresses are a thing, and that they prevent workstation N from having a single fixed IP for its outbound connections that it could be identified with.
  - themafia 6mo ago
    > any website can now not only log that the traffic originated from org A, but specifically from org A, workstation N. GeoIP databases and Cookies exist. So I'm not sure how your threat profile has increased here. > I wonder, is privacy implication is not important enough for people to worry about this? The most you can do over what is already possible is attempt an inventory or unit count of my office; however, you'd have to get every computer in my office to go to the same website that you control. Then you'd have to control for upgrades and other machine movements. I don't think this enables anything in particular.
Dagger2 6mo ago
Nope, it doesn't. The security model is based on your firewalls and routing, not on NAT. NAT just gets in the way and makes it harder to understand what's going on. For example, on a normal home network, if you don't have a firewall on your router then your ISP can connect to anything on your network. Even when they don't control the router and even if you're NATing. If you didn't realize this then apparently NAT didn't make it easier to reason about after all.
- rileymat2 6mo ago
  Can you say more about the ISP connecting to any computer on your network? I can’t find any references to this aspect in googling the right terms and the concept is foreign to me. There are a bunch of ways to break it, or misconfigure it. But I have idea what this isp method is.
  - Dagger2 6mo ago
    It's just normal routing. If you send packets to a router, it'll route them. More concretely, they can run the equivalent of `ip route add 192.168.1.0/24 via <your WAN IP>` on a machine that's connected to your WAN network, and then their machine will send packets with a dest of 192.168.1.x to your router. Your router will route them onto your LAN because that's what its own routing table says to do with them. Anyone on your immediate upstream network can do this, not just your ISP. Also, if you use ISP-assigned GUAs then this inbound route will already exist and anyone on the Internet can connect. Applying NAT to your outbound connections will change their apparent source address, but it won't make that inbound route disappear.
    - mittensc 6mo ago
      Have you tried that? I have yet to see a router that allows that forwarding unless explicitly configured. Still, i'm using mostly openwrt/opnsense/mikrotik Default is to disallow/block forwarding packets from public wan to private range lan. ISP can still inject packets on ports that NAT opens if it spoofs the source address/port, so you still have some validity to argument.
somat 6mo ago
NAT is a statefull firewall with a trick. One is exactly as complicated to reason about as the other. Except on one you don't need the trick.
- hnlmorg 6mo ago
  Not in the context I was describing.
- Dagger2 6mo ago
  NAT is state tracking with a trick, but not firewalling. It doesn't block connections, so it's not a firewall.
otabdeveloper4 6mo ago
> But it is a lot easier to see and to explain what has access to what. "What has access to what" is exactly what computer security is.
throw0101d 6mo ago
> The nice thing about NAT is it makes the security model easier to reason about. I first heard that relying on the 'moated castle' design of security (firewalls) was bad idea and no longer best practice a decade or two ago, and while inside/outside may be a convenient mental shortcut for security, it shouldn't be relied about. Sure, sensible people know that NAT ≠ security, but by having private/public IPs I think it makes people's thinking lazy. Every system having publicly routable addresses (but not publicly accessible, due to SPI) would force more folks to actually examine their security controls. It's too easy to think "ah, this has a 10.x.y.z address, therefore it's inside and safe". No, because most attacks nowadays involve compromised/ing clients, and then running around 10.x networks where people got lazy because these things are on the "inside".

Hikikomori 6mo ago

>In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Those people love their NAT. Was also designed in the early 90s before security was taken seriously.

ExoticPearTree 6mo ago
> Was also designed in the early 90s before security was taken seriously. True, but since then it has transformed into “no one gets in because we have _private_ IP addresses”…
- Hikikomori 6mo ago
  To be fair it's a pretty decent defense, in the early days of blaster and today with iot crap.
- Ekaros 6mo ago
  I would need to ask the follow up question. Okay so what happens when someone gets in? Say some idiot install something they should not. Or there is some vulnerability in something you allow in? Extra layers is good. But it does not mean you can forgo anything else.
  - icedchai 6mo ago
    Okay, so you configure a firewall. NAT is not required.
icedchai 6mo ago
The real problem is many "enterprises" have people who don't understand networking. NAT was a solution to IP address depletion. This is not a problem we have with IPv6. If security is taken seriously, I'm sure they can spend a few minutes and learn how to configure a IPv6 firewall that allows no inbound connections. It's basically the simplest configuration possible.

jjav 6mo ago

> In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Topic drift, but for younger people who didn't live it, that's how it used to be! For most of the 90s my workstation in the office (at several employers) was directly on the Internet. There were no firewalls, no filtering of any kind. I ran my email server on my desktop workstation to receive all emails, both from "internal" (but there was no "internal" really, since every host was on the Internet) people and anyone in the world. I ran my web server on that same workstation, accessible to the whole Internet. That was the norm, the Internet was completely peer to peer. Good times.

icedchai 6mo ago
Same! I even had my home network on a public /24.
- ExoticPearTree 6mo ago
  The good ol’ days. Same. Had a public IP on my computer, could SSH into it to read my mail.
  - jjav 6mo ago
    That I still do, but now it goes through a firewall, a bastion host and a second different firewall.
vrighter 6mo ago
i still do this today!
- CodesInChaos 6mo ago
  You run a mail server on a residential IP? I thought that pretty much guarantees non delivery nowadays?
thbb123 6mo ago
Pretty much all tech companies and universities had a drop-in ftp server where anyone could, anonymously, put and retrieve files. It was a collective 'pastebin' useful to exchange information with clients and partners. On the ftp server of the company I worked for, someone had put a cracked copy of our software for their colleagues to use.

BobbyTables2 6mo ago

The SLAAC/DHCPv6 combo seems really strange to me. Either IP/DNS/gateway discovery with one or the other could be tolerable. But allowing combinations such as SLAAC for addressing and DHCP for DNS discovery is lunacy. It’s as if one said, let’s take the most basic and critical step and make it as complicated as possible and explore the combinatorial explosion…

kalleboo 6mo ago
The article mentions that DHCPv6 was an afterthought because DHCP itself barely existed when IPv6 was being designed - they were still using things like RARP or BOOTP! https://en.wikipedia.org/wiki/Reverse_Address_Resolution_Protocol https://en.wikipedia.org/wiki/Reverse_Address_Resolution_Pro... https://en.wikipedia.org/wiki/Bootstrap_Protocol https://en.wikipedia.org/wiki/Bootstrap_Protocol
- rao-v 6mo ago
  The article does seem to simultaneously claim that IPv6’s design is the result of wierd no longer current pressures but also that it’s perfectly fine and correctly designed.

teddyh 6mo ago

> IPv6 has some quirks that make it harder to digest. Almost every point in your list is wrong. > - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space IPv4 has link-local addresses, too. Those are the 169.254.X.X addresses that you see on Windows machines. IPv6 adds nothing new. > - privacy extensions: it is very hard to explain to people why they have 3-4 IPv6 addresses assigned to their computer Well then, don’t use them. Configure the machines with one address each, just like before. If you want the (arguable) advantages of the privacy extensions, they are available, but not mandatory. > - multicast instead of broadcast IPv4 always had multicast, too. IPv6 is simplified by considering the broadcast concept to be a kind of multicast. > - way too many ways for autoconfiguration (SLAAC, DHCPv6) SLAAC is just link-local addresses, which you already mentioned above. Did you mean NDP with router advertisements? If you did, you do have a small point, but DHCP6 is still there like always. IPv6 just offers an additional feature for the simple cases where a host just needs an IP address, netmask and a router address. > - no real tentative mapping to what people were used to. Every IPv6 presentation I did had to start with “forget everything you know about IPv4” That’s the complete opposite of my experience. Almost everything in IPv6 works exactly the same as with IPv4.

patmorgan23 6mo ago
You're being obtuse. Every point in the original comment is correct, you just disagree they're issues. The original comment also doesn't state they are issues just that they are differences. • link local addresses .Auto configuration addresses are in V4 but they are used entirely differently. Interfaces do not have link local addresses if they have a DHCP or statically configured address, in V6 it is extremely common to use a link local address as the gateway, in V4 this basically never happens.
- teddyh 6mo ago
  > The original comment also doesn't state they are issues just that they are differences. My point is that, in most cases, these aren’t differences, since IPv4 does the same thing as IPv6. Therefore, the claim that IPv6 “has some quirks that make it harder to digest [than IPv4]” is incorrect. > Interfaces do not have link local addresses if they have a DHCP or statically configured address I could be wrong, but I seem to recall that Windows machines always have a IPv4LL address? > in V6 it is extremely common to use a link local address as the gateway What? I have never seen this.