4 ms·

I will say just from a user standpoint, ipv6 is amazing. I recently made the switch to ipv6 on as many of my devices as possible purely because I can then acces

I will say just from a user standpoint, ipv6 is amazing. I recently made the switch to ipv6 on as many of my devices as possible purely because I can then access all of them directly, no network finangling. Since all my devices have publicly visible ipv6 addresses, I can access them e.g. laptop.lelandbatey.com homedesktop.lelandbatey.com phone.lelandbatey.com because I use tunnel brokers, sometimes the speeds not amazing, but the fact that I can connect at all makes it awesome. Also, those example hostnames are fake : )

pedrocr 13y ago
I deploy tinc[1] automatically in my base puppet config to give me direct connection over normal ipv4. It's a private network though so it won't work from a device I don't control as yours probably do. [1] http://tinc-vpn.org/ http://tinc-vpn.org/
lifeisstillgood 13y ago
I do have to ask - what's a tunnel broker, aren't you worried about security of those devices and - is it really that useful? Edit - if it is really that useful, is it not instead the death of cloud storage?
- TillE 13y ago
  6to4, SixXS, 6RD, and 6in4 are tunnels that are usable by pretty much anyone anywhere right now, as opposed to native IPv6. It helps if your router supports them, of course. Cloud storage is really nice when your home PC is switched off, or a hard drive crashes, or your computer catches on fire. Other than those sorts of problems, BitTorrent Sync can already do pretty much everything you want over IPv4.
- lelandbatey 13y ago
  The TL;DR of "what a tunnel broker is" is not something that I'm totally qualified to explain, but how I approach it is: A tunnel broker is like VPN/proxy that allows you to connect to the IPv6 web over IPv4. It adds latency to my connection (because all my IPv6 data goes from me, over IPv4 to the tunnel broker who then routes my data the rest of the way to where it's going), but for me it's worth it. In terms of security, my machines are run largely the same as any server: locked down, except when for the things I need. It helps that I only do this for *nix devices as well.
  - hrrsn 13y ago
    I do a similar thing, work ISP provides native IPv6, home ISP doesn't but I'm using a tunnel broker with my router. It has a nice IPv6 firewall built in that lets me manually allow ports through which is nice. It's fantastic having multiple computers at home listening on port 80. :)
- zaphoyd 13y ago
  Yes, it really is that useful. The ability to directly connect to machines on my home network without mucking with VPNs, port forwarding, etc is fantastic. The key thing it does is reduces friction when creating or using anything that could be accessed from off the local network. The ability to assign static addresses to custom DNS entries makes it even better. The more services that throw up IPv6 support the more useful it gets. If I could pull from Github over IPv6... or run SSL Labs TLS tests against an IPv6 VM... In particular, it is better than other VPN/port forwarding type solutions because it works transparently and universally. It works on your phone (where VPN can be more tricky). It works in environments where you aren't allowed to install special relay software. It works when you are a guest somewhere else without them having to change their network setup. As for cloud services... yes and no. In a world with direct addressing you open up many opportunities for innovation in the home cloud appliance market. However, many cloud services are made affordable because they can leverage shared infrastructure, sell usage metadata, or add and remove capacity instantly. Whether home based solutions could be competitive in price and reliability without those abilities. I see some categories of service that it makes sense for, others, less so. Security is a concern, yes, but one that can and should be addressed by good security tools and practices (firewalls, automatic security updates, good backups, not running services you don't use, etc) not by crippling your network with NAT.
  - cpeterso 13y ago
    If I don't care about direct addressing of devices at home, is there any reason for casual internet users to use IPv6?
    - zaphoyd 13y ago
      yes and no. As long as you are able to get a globally routeable ipv4 address for your home at a reasonable price, no. Once you start being subjected to CGN (either or your end or on the remote end) or the price pressure of IPv4 in your region then you will have a reason. Namely cost and performance. Because of this I would suggest that if you go router shopping that you should choose a model that supports IPv6 rather than not, even if you don't necessary care which you will end up using. Get a model with a good IPv6 firewall that you can tell to block all incoming connections. Lastly, I think it is dangerous for "casual users" to say things like "I don't care about direct addressing of devices at home". I firmly believe that universal direct addressing will result in new innovation that might change your mind. :)
- takeda 13y ago
  > aren't you worried about security of those devices Assuming he is having a firewall configured on his gateway then it is not any different from security standpoint than being behind a NAT. For example in my university, all computers have a public IPv4 address, it still does not mean you can connect to them from outside, but if you need to open a port to the world you don't need to deal with all that NAT crap.
- stephen_g 13y ago
  What would be the security issue? NAT does not add any security - the firewall does. Just because you have publicly routable addresses doesn't mean they're publicly accessible.
  - StavrosK 13y ago
    NAT is a good "disallow everything by default" firewall. If my router's firewall had a "disallow all incoming connections by default, it would be great, although I guess I should manage it with iptables, which is machine-specific.
    - zaphoyd 13y ago
      Most ipv6 enabled home routers have firewalls with a "block all incoming connections except for listed exceptions" feature. This effectively gives you the same security as NAT but without the port mangling (can run multiple machines on the same port).

pedrocr 13y ago

I deploy tinc[1] automatically in my base puppet config to give me direct connection over normal ipv4. It's a private network though so it won't work from a device I don't control as yours probably do. [1] http://tinc-vpn.org/ http://tinc-vpn.org/

lifeisstillgood 13y ago

I do have to ask - what's a tunnel broker, aren't you worried about security of those devices and - is it really that useful? Edit - if it is really that useful, is it not instead the death of cloud storage?

TillE 13y ago
6to4, SixXS, 6RD, and 6in4 are tunnels that are usable by pretty much anyone anywhere right now, as opposed to native IPv6. It helps if your router supports them, of course. Cloud storage is really nice when your home PC is switched off, or a hard drive crashes, or your computer catches on fire. Other than those sorts of problems, BitTorrent Sync can already do pretty much everything you want over IPv4.
lelandbatey 13y ago
The TL;DR of "what a tunnel broker is" is not something that I'm totally qualified to explain, but how I approach it is: A tunnel broker is like VPN/proxy that allows you to connect to the IPv6 web over IPv4. It adds latency to my connection (because all my IPv6 data goes from me, over IPv4 to the tunnel broker who then routes my data the rest of the way to where it's going), but for me it's worth it. In terms of security, my machines are run largely the same as any server: locked down, except when for the things I need. It helps that I only do this for *nix devices as well.
- hrrsn 13y ago
  I do a similar thing, work ISP provides native IPv6, home ISP doesn't but I'm using a tunnel broker with my router. It has a nice IPv6 firewall built in that lets me manually allow ports through which is nice. It's fantastic having multiple computers at home listening on port 80. :)
zaphoyd 13y ago
Yes, it really is that useful. The ability to directly connect to machines on my home network without mucking with VPNs, port forwarding, etc is fantastic. The key thing it does is reduces friction when creating or using anything that could be accessed from off the local network. The ability to assign static addresses to custom DNS entries makes it even better. The more services that throw up IPv6 support the more useful it gets. If I could pull from Github over IPv6... or run SSL Labs TLS tests against an IPv6 VM... In particular, it is better than other VPN/port forwarding type solutions because it works transparently and universally. It works on your phone (where VPN can be more tricky). It works in environments where you aren't allowed to install special relay software. It works when you are a guest somewhere else without them having to change their network setup. As for cloud services... yes and no. In a world with direct addressing you open up many opportunities for innovation in the home cloud appliance market. However, many cloud services are made affordable because they can leverage shared infrastructure, sell usage metadata, or add and remove capacity instantly. Whether home based solutions could be competitive in price and reliability without those abilities. I see some categories of service that it makes sense for, others, less so. Security is a concern, yes, but one that can and should be addressed by good security tools and practices (firewalls, automatic security updates, good backups, not running services you don't use, etc) not by crippling your network with NAT.
- cpeterso 13y ago
  If I don't care about direct addressing of devices at home, is there any reason for casual internet users to use IPv6?
  - zaphoyd 13y ago
    yes and no. As long as you are able to get a globally routeable ipv4 address for your home at a reasonable price, no. Once you start being subjected to CGN (either or your end or on the remote end) or the price pressure of IPv4 in your region then you will have a reason. Namely cost and performance. Because of this I would suggest that if you go router shopping that you should choose a model that supports IPv6 rather than not, even if you don't necessary care which you will end up using. Get a model with a good IPv6 firewall that you can tell to block all incoming connections. Lastly, I think it is dangerous for "casual users" to say things like "I don't care about direct addressing of devices at home". I firmly believe that universal direct addressing will result in new innovation that might change your mind. :)
takeda 13y ago
> aren't you worried about security of those devices Assuming he is having a firewall configured on his gateway then it is not any different from security standpoint than being behind a NAT. For example in my university, all computers have a public IPv4 address, it still does not mean you can connect to them from outside, but if you need to open a port to the world you don't need to deal with all that NAT crap.
stephen_g 13y ago
What would be the security issue? NAT does not add any security - the firewall does. Just because you have publicly routable addresses doesn't mean they're publicly accessible.
- StavrosK 13y ago
  NAT is a good "disallow everything by default" firewall. If my router's firewall had a "disallow all incoming connections by default, it would be great, although I guess I should manage it with iptables, which is machine-specific.
  - zaphoyd 13y ago
    Most ipv6 enabled home routers have firewalls with a "block all incoming connections except for listed exceptions" feature. This effectively gives you the same security as NAT but without the port mangling (can run multiple machines on the same port).