6 ms·

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff w

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

inigyou 3mo ago
Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range. If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.
- kowbell 3mo ago
  "all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"
  - iso1631 3mo ago
    192.168.0.0/24 -> fd00:0::/64 192.168.1.0/24 -> fd00:1::/64 192.168.2.0/24 -> fd00:2::/64 192.168.240.0/24 -> fd00:240::/64 It's not a great idea, but its no harder. No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem. Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.
    - SV_BubbleTime 3mo ago
      I doubt any endpoints are entirely ipv6. So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow. I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for. No human said “hey, networking sucks. Please make it much harder at my level!!”.
      - tracker1 3mo ago
        I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct. like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated. To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.
        pbhjpbhj 3mo ago
        >limited to 10. and 102.168 I assume you meant 10.x.x.x and 192.168.x.x -- (and 172.16.x.x?), ie the standard subnets for home router-modems (which are non-routing and so can't be used on the internet).
        tracker1 3mo ago
        Of course... this would transitionally make the ipv6 internal addresses easier to understand in the context of typical migration... you have the public prefix and the public ipv6 addresses of your internal network map cleanly to the internal/nat'd ipv4 ... you could still use any ipv6 internally once most of the internet transitioned.. but it'd be easier to reason with at least... I still don't know WTF/HTF ipv6 addresses are issued, where or how I can centrally control static assignment to a given MAC.
        iso1631 3mo ago
        Public IP6s are allocated the same as ipv4, either ask for a block (I assume you'll need your own AS and appropiate method to announce), or your ISP hands you a block (should be a /48 I think, or maybe a /56) Private you can do whatever you want in the fd00:: range fd00:1:/64 for vlan 1 fd00:2:/64 for vlan 2 etc Or fd00:ea7:cace::/64 fd00:b00b:13s::/64 Or have your hosts on fd00:192:168:0::1 fd00:192:168:0::2 fd00:192:168:0::3 (you don't have to have your router on :0 if you don't want to, just like you don't have to use .1 or .254 in a ipv4 /24) If you want to allocate a given IP to a given mac address centrally then you need DHCPv6 as normal. The problem is that because dhcp isn't as required as it is under v4 (because of slacc), not all clients will support it, or support it properly. For desktops + servers you should be fine though.
    - tracker1 3mo ago
      One thing I don't appreciate... Is the nature of NAT protected my internal/home network before... now, I have to actually configure firewall settings etc. to protect IPv6 issued addresses internally. I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.
      - tredre3 3mo ago
        > Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. SLAAC is the only way that works across all IPV6 devices. In that mode, the router advertises the prefix and the device assigns its own address (prefix + its mac address). DHCPv6 exists but is poorly supported. It sucks for people who like assigning IPs individually from an authoritative place (through static dhcp entries on the router). But people like us are "doing it wrong", you see? We must accept that in this brave new worlds an IP means nothing.
        inigyou 3mo ago
        And there's always static configuration, useful for servers.
        tracker1 3mo ago
        Which doubly sucks in terms of assigning a DNS name to an IP/PC... and/or opening the assignment to less restricted access... feels just problematic to me. Again, I don't know any of IPv6 enough to use it really right or wrong.
        inigyou 3mo ago
        If your ISP offers it, you should just try it. If not, do you have a website on a VPS or something? Try making that work with v6. It's really not a scary monster, it's mostly the same thing again but with long addresses, and a few convention changes that come with long addresses. Examples of convention changes: end devices can each get several addresses for privacy and for being on multiple networks concurrently. SLAAC is stateless because addresses in a /64 are so endless there's no need to keep a central registry of which ones are already used. NAT is rare because it's no longer necessary, even though there is no internet police to stop you from using it (please try to avoid it). P2P is so much easier - applications can be written under the assumption connectivity is end-to-end with firewall hole punching.
    - ianburrell 3mo ago
      The proper way to do ULA is to generate random 40-bit ID. Then your ULA are likely unique. Which means that if you want to connect or merge with another company, the networks are distinct. IPv4 has a lot of trouble since everyone is using 10/8 space for corporate networks.
      - inigyou 3mo ago
        If someone can't remember 192.168 they definitely can't remember their own chosen random 40 bits.
  - inigyou 3mo ago
    you can use 1234 if you want, that's also unused space
  - Multicomp 3mo ago
    Agreed 100%! I know there's tough challenges to making this reality, but if https://serverspace.io/about/blog/ipv8-explained-what-we-know-about-the-new-internet-draft/ https://serverspace.io/about/blog/ipv8-explained-what-we-kno... could be an IRL thing, I would buy company network equipment and use computer OSes that supported this draft standard. It's a much better compromise and ergonomics to migrate from IPv4 to an IPv4 respecting successor, where IPv6 is just the academic snobbery and utterly alien mental model for not-enough benefits. For the same reason Unix stuck around and beat up its own successor Plan 9/inferno. That inertia even decades later is the same reason IPv4 still beats IPv6. IPv8 is more of a linux to unix than a plan 9.
    - inigyou 3mo ago
      ipv8 is a "vibe coded" specification from someone who doesn't understand the problem at all. Just like ipv6, you can't use ipv8 without upgrading the whole internet. The internet is mostly ipv6 capable and not at all ipv8 capable so why do you want to throw away that progress and reset the clock? It's also just a worse design, centralising a bunch of things and trying to authoritatively define what counts as "a network" on both sides of the communication, unlike v4 and v6 where you just have raw bits and can interpret them how you want. I mean ipv8 defines the internet as a bunch of networks and a network as a bunch of computers. And a network is something that has an ASN. Your computers would be on your ISP's big network, not your small home network because you can't have a network inside a network. It also decreases the number of bits than we already have (in ipv6), limiting futureproofing. It also says every network device will log in with OAuth. Yes, really.
- Matuzy 3mo ago
  > Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.
  - vitally3643 3mo ago
    The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address. It's not about low adoption, it's that there are unimaginably many IPv6 addresses. ...which is a major reason for why it has low adoption
    - Matuzy 3mo ago
      Thanks for the reply. I'm reminded every now and then of the magnitude of the address space in v6. Then I do nothing with that information and slowly lose appreciation for the size again :)
      - lukan 3mo ago
        https://xkcd.com/865/ https://xkcd.com/865/
  - inigyou 3mo ago
    All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range. The point of IPv6 was to make the addresses so long they are easy to manage.
    - SV_BubbleTime 3mo ago
      >The point of IPv6 was to make the addresses so long they are easy to manage. lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.
cyanydeez 3mo ago
Sounds like someones on the path to sovereign citizenship. I can't wait for our cyber-sovereign citizenships who deny various IP ranges coming from the government's domain naming system.
jabart 3mo ago
Didn't AT&T do that and Cloudflare made them change it when they aquired that space?
- tracker1 3mo ago
  I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security. Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, eventually I'll setup autofailover on my router (OpnSense). For now, I just swap the cables.
  - hackernudes 3mo ago
    Quantenna used 1.1.1.1 for RPC to their wifi chip in their SDK by default. Should not have been exposed to global routing but of course people screwed that up. https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-1-1-1-1-e64901e41a09 https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-...
  - Melatonic 3mo ago
    Or they didn't want you to know the IP(s) so you could easily block it Sounds like they blocked Cloudflare but couldn't block Google
  - ethin 3mo ago
    My ISP won't give me the router credentials because they claim that that would somehow risk their network interconnectivity or something. I have no idea how this makes any sense since a router (shouldn't) give me that level of access, but maybe I'm missing something?
    - bityard 3mo ago
      If the router is also the modem, it can have diagnostic stuff that could (I am careful to point out: theoretically) cause them a big support headache in one way or another. Also, I had a DSL modem back in the day with its own terrible NAT built-in. I managed to log in (I may have been given the admin password from a friend who worked at the ISP, allegedly) and once I put it into bridge mode, I was able to acquire multiple public IPv4 addresses via DHCP.
tracker1 3mo ago
LOL, they should have just used a 10.x space instead if they wanted slightly simpler numbers. On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.
- zrobotics 3mo ago
  I dunno, seems like it could be a bit vague. Does 45 refer to 45 Webley or 45 GAP? Could possibly also refer to 45 Colt I guess, if you're boring. But 45 Colt, 45 ACP, 45 Colt Government? Also, just in case this comment isn't pedantic enough, 10.22 would be a firearm range, not an ammo range. And AFAIK they only ever chambered that for .22 rimfire cartridges. ;)
  - tracker1 3mo ago
    I appreciate the pedantry, but in this case it's pretty immaterial to what specifically it refers to, and yeah, I'm pretty boring like that. I made me smile.
mr_mitm 3mo ago
I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.
- inigyou 3mo ago
  As long as it's strictly separated from the internet it works. The Internetwork Packet Exchange, used for cellular roaming, is a parallel global internet with its own addresses and allocation policies.
- prerok 3mo ago
  This story is so silly it must be true. Thank you, made me laugh out loud.

inigyou 3mo ago

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range. If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

kowbell 3mo ago
"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"
- iso1631 3mo ago
  192.168.0.0/24 -> fd00:0::/64 192.168.1.0/24 -> fd00:1::/64 192.168.2.0/24 -> fd00:2::/64 192.168.240.0/24 -> fd00:240::/64 It's not a great idea, but its no harder. No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem. Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.
  - SV_BubbleTime 3mo ago
    I doubt any endpoints are entirely ipv6. So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow. I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for. No human said “hey, networking sucks. Please make it much harder at my level!!”.
    - tracker1 3mo ago
      I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct. like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated. To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.
      - pbhjpbhj 3mo ago
        >limited to 10. and 102.168 I assume you meant 10.x.x.x and 192.168.x.x -- (and 172.16.x.x?), ie the standard subnets for home router-modems (which are non-routing and so can't be used on the internet).
        tracker1 3mo ago
        Of course... this would transitionally make the ipv6 internal addresses easier to understand in the context of typical migration... you have the public prefix and the public ipv6 addresses of your internal network map cleanly to the internal/nat'd ipv4 ... you could still use any ipv6 internally once most of the internet transitioned.. but it'd be easier to reason with at least... I still don't know WTF/HTF ipv6 addresses are issued, where or how I can centrally control static assignment to a given MAC.
        iso1631 3mo ago
        Public IP6s are allocated the same as ipv4, either ask for a block (I assume you'll need your own AS and appropiate method to announce), or your ISP hands you a block (should be a /48 I think, or maybe a /56) Private you can do whatever you want in the fd00:: range fd00:1:/64 for vlan 1 fd00:2:/64 for vlan 2 etc Or fd00:ea7:cace::/64 fd00:b00b:13s::/64 Or have your hosts on fd00:192:168:0::1 fd00:192:168:0::2 fd00:192:168:0::3 (you don't have to have your router on :0 if you don't want to, just like you don't have to use .1 or .254 in a ipv4 /24) If you want to allocate a given IP to a given mac address centrally then you need DHCPv6 as normal. The problem is that because dhcp isn't as required as it is under v4 (because of slacc), not all clients will support it, or support it properly. For desktops + servers you should be fine though.
  - tracker1 3mo ago
    One thing I don't appreciate... Is the nature of NAT protected my internal/home network before... now, I have to actually configure firewall settings etc. to protect IPv6 issued addresses internally. I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.
    - tredre3 3mo ago
      > Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. SLAAC is the only way that works across all IPV6 devices. In that mode, the router advertises the prefix and the device assigns its own address (prefix + its mac address). DHCPv6 exists but is poorly supported. It sucks for people who like assigning IPs individually from an authoritative place (through static dhcp entries on the router). But people like us are "doing it wrong", you see? We must accept that in this brave new worlds an IP means nothing.
      - inigyou 3mo ago
        And there's always static configuration, useful for servers.
      - tracker1 3mo ago
        Which doubly sucks in terms of assigning a DNS name to an IP/PC... and/or opening the assignment to less restricted access... feels just problematic to me. Again, I don't know any of IPv6 enough to use it really right or wrong.
        inigyou 3mo ago
        If your ISP offers it, you should just try it. If not, do you have a website on a VPS or something? Try making that work with v6. It's really not a scary monster, it's mostly the same thing again but with long addresses, and a few convention changes that come with long addresses. Examples of convention changes: end devices can each get several addresses for privacy and for being on multiple networks concurrently. SLAAC is stateless because addresses in a /64 are so endless there's no need to keep a central registry of which ones are already used. NAT is rare because it's no longer necessary, even though there is no internet police to stop you from using it (please try to avoid it). P2P is so much easier - applications can be written under the assumption connectivity is end-to-end with firewall hole punching.
  - ianburrell 3mo ago
    The proper way to do ULA is to generate random 40-bit ID. Then your ULA are likely unique. Which means that if you want to connect or merge with another company, the networks are distinct. IPv4 has a lot of trouble since everyone is using 10/8 space for corporate networks.
    - inigyou 3mo ago
      If someone can't remember 192.168 they definitely can't remember their own chosen random 40 bits.
- inigyou 3mo ago
  you can use 1234 if you want, that's also unused space
- Multicomp 3mo ago
  Agreed 100%! I know there's tough challenges to making this reality, but if https://serverspace.io/about/blog/ipv8-explained-what-we-know-about-the-new-internet-draft/ https://serverspace.io/about/blog/ipv8-explained-what-we-kno... could be an IRL thing, I would buy company network equipment and use computer OSes that supported this draft standard. It's a much better compromise and ergonomics to migrate from IPv4 to an IPv4 respecting successor, where IPv6 is just the academic snobbery and utterly alien mental model for not-enough benefits. For the same reason Unix stuck around and beat up its own successor Plan 9/inferno. That inertia even decades later is the same reason IPv4 still beats IPv6. IPv8 is more of a linux to unix than a plan 9.
  - inigyou 3mo ago
    ipv8 is a "vibe coded" specification from someone who doesn't understand the problem at all. Just like ipv6, you can't use ipv8 without upgrading the whole internet. The internet is mostly ipv6 capable and not at all ipv8 capable so why do you want to throw away that progress and reset the clock? It's also just a worse design, centralising a bunch of things and trying to authoritatively define what counts as "a network" on both sides of the communication, unlike v4 and v6 where you just have raw bits and can interpret them how you want. I mean ipv8 defines the internet as a bunch of networks and a network as a bunch of computers. And a network is something that has an ASN. Your computers would be on your ISP's big network, not your small home network because you can't have a network inside a network. It also decreases the number of bits than we already have (in ipv6), limiting futureproofing. It also says every network device will log in with OAuth. Yes, really.
Matuzy 3mo ago
> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.
- vitally3643 3mo ago
  The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address. It's not about low adoption, it's that there are unimaginably many IPv6 addresses. ...which is a major reason for why it has low adoption
  - Matuzy 3mo ago
    Thanks for the reply. I'm reminded every now and then of the magnitude of the address space in v6. Then I do nothing with that information and slowly lose appreciation for the size again :)
    - lukan 3mo ago
      https://xkcd.com/865/ https://xkcd.com/865/
- inigyou 3mo ago
  All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range. The point of IPv6 was to make the addresses so long they are easy to manage.
  - SV_BubbleTime 3mo ago
    >The point of IPv6 was to make the addresses so long they are easy to manage. lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

cyanydeez 3mo ago

Sounds like someones on the path to sovereign citizenship. I can't wait for our cyber-sovereign citizenships who deny various IP ranges coming from the government's domain naming system.

jabart 3mo ago

Didn't AT&T do that and Cloudflare made them change it when they aquired that space?

tracker1 3mo ago
I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security. Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, eventually I'll setup autofailover on my router (OpnSense). For now, I just swap the cables.
- hackernudes 3mo ago
  Quantenna used 1.1.1.1 for RPC to their wifi chip in their SDK by default. Should not have been exposed to global routing but of course people screwed that up. https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-1-1-1-1-e64901e41a09 https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-...
- Melatonic 3mo ago
  Or they didn't want you to know the IP(s) so you could easily block it Sounds like they blocked Cloudflare but couldn't block Google
- ethin 3mo ago
  My ISP won't give me the router credentials because they claim that that would somehow risk their network interconnectivity or something. I have no idea how this makes any sense since a router (shouldn't) give me that level of access, but maybe I'm missing something?
  - bityard 3mo ago
    If the router is also the modem, it can have diagnostic stuff that could (I am careful to point out: theoretically) cause them a big support headache in one way or another. Also, I had a DSL modem back in the day with its own terrible NAT built-in. I managed to log in (I may have been given the admin password from a friend who worked at the ISP, allegedly) and once I put it into bridge mode, I was able to acquire multiple public IPv4 addresses via DHCP.

tracker1 3mo ago

LOL, they should have just used a 10.x space instead if they wanted slightly simpler numbers. On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.

zrobotics 3mo ago
I dunno, seems like it could be a bit vague. Does 45 refer to 45 Webley or 45 GAP? Could possibly also refer to 45 Colt I guess, if you're boring. But 45 Colt, 45 ACP, 45 Colt Government? Also, just in case this comment isn't pedantic enough, 10.22 would be a firearm range, not an ammo range. And AFAIK they only ever chambered that for .22 rimfire cartridges. ;)
- tracker1 3mo ago
  I appreciate the pedantry, but in this case it's pretty immaterial to what specifically it refers to, and yeah, I'm pretty boring like that. I made me smile.

mr_mitm 3mo ago

I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.

inigyou 3mo ago
As long as it's strictly separated from the internet it works. The Internetwork Packet Exchange, used for cellular roaming, is a parallel global internet with its own addresses and allocation policies.
prerok 3mo ago
This story is so silly it must be true. Thank you, made me laugh out loud.