5 ms·

I think it has more to do with the fact that there are a standard series of private IP blocks.

by cheald 12y ago

rdl 12y ago
Right, but if everyone used IPv6 there would be no need to use non-routeable private IPs for anything, you could just use non-conflicting IPv6 addresses and not route them.
- makomk 12y ago
  Even if you did use non-routeable private IPs, IPv6 provides enough different private address ranges - more than there are individual addresses in IPv4 - that it's unlikely they'd conflict.
- sliverstorm 12y ago
  I kind of like having standard private subnets. My router is always 192.168.1.1, or sometimes 10.0.1.1, and so is my friend's, my parent's, and my grandparent's.
  - agwa 12y ago
    You can have that in IPv6 too, with link-local addresses (fe80::/64). In fact, it's becoming quite common to assign fe80::1 to a subnet's default gateway.
  - EvanAnderson 12y ago
    It creates a lot of pain when you need to connect these networks to each other, though. Admittedly, that's probably not a problem for parents, friends, etc. At my Old Job I demanded we keep a "registry" of the RFC1918 address space we allocated to Customers. We never allocated Customers in overlapping address spaces. It made VPN connectivity to Customer A while on-site with Customer B much easier. It also helped out in one case where one Customer acquired another.
  - jon-wood 12y ago
    After spending some time as a contractor doing systems work for a few companies I've stopped ever assigning an internal network to 192.168.0.0, 192.168.1.0, or 10.0.0.0. The number of times I found myself attempting to VPN into a clients network, only to find it conflicted either with my home network, or whatever coffee shop I was sitting in, was ridiculous. Depending how many hosts you need to run on your network there are huge numbers of possible subnets you could use for an internal network - do yourself a favour and keep off the ones set up be default on every router sold.
    - stygiansonic 12y ago
      This is also important advice if you're thinking about setting up VPN access to your home network: Do not pick the most common/default subnets, i.e. 192.168.0.0/24, 192.168.0.1/24, etc. Picking a somewhat-random subnet as suggested would mitigate the problem and it's what I did for my home network.
  - lmm 12y ago
    Which is great until you and your friend want to play games with each other and need to set up a VPN.
  - deleted 12y ago
    [deleted]
- btgeekboy 12y ago
  That's basically what a ULA is for though - see RFC 4193. If I'm not big enough to acquire my own allocations from ARIN, I'd prefer not to have to renumber every piece of equipment (even those not externally accessible) when changing ISPs.
- samstave 12y ago
  But I can recall ip4 addresses en mass in my head. I can't memorize ip6 addresses easily. Plus, I'd like to keep pockets of private IPs that are never accessible as routable targets. Can you explain why I wouldn't to do this or why I should evolve my understanding of ip6 better?
  - agwa 12y ago
    IPv6 address don't have to be long or publicly routable. ULA addresses (fd00::/8) are the IPv6 analogue to RFC1918 and you could theoretically use ULA addresses as short as fd00::1, fd00::2, fd00::3, and so on. Of course if you do this you run the risk of colliding with other people, so you're encouraged to randomly generate the next 40 bits after fd, which leaves you with addresses like fd32:5e26:381d::1. That's longer than IPv4 addresses, but it's a pretty fair tradeoff to get a globally unique address. Even non-ULA IPv6 addresses need not be long. 2600:3c00:e000:6c::1 is the address of my server over at Linode, and I don't find that bad at all.
  - jon-wood 12y ago
    There's no real need to memorise IP addresses, that's what DNS was made for. If your servers are on the internet at large then they probably have DNS already, and if its a local network then most operating systems will now automatically work out where machines on the .local domain are (I'll be honest, I don't fully understand how that works).
    - jacquesm 12y ago
      I think it is a safe assumption that Sam knows what the DNS was made for.
    - vacri 12y ago
      I've had only a very limited exposure to IPv6, but it seemed to me that the slogan "DNS solves it for you!" doesn't really pan out. It solves it if you're on a well-set-up network and have your DNS up and running happily, but with the ad-hoc networks my [limited] experience has seen, it hasn't been trivial. Essentially, it means you have to run an interpreter service (the DNS) to understand the network - one more bit of software to configure and troubleshoot... though to be fair, IPv4 was also quite confusing when I first started playing with it.
- hrktb 12y ago
  The range of non-conflicting IPv4 private addresses is not really small. Everyone just happens to use the same two or three blocks, the easiest to remember.
  - agwa 12y ago
    Actually, when you're working at Facebook scale, the range is quite small. One of the reasons Facebook started moving to IPv6 was that they were running out of RFC1918 addresses.
- solidsnack9000 12y ago
  Service-net (https://github.com/mesosphere/service-net/ https://github.com/mesosphere/service-net/) is a proof-of-concept for service routing and discovery with IPv6 and DNS. The underlying mechanism is similar -- IP tables is used for routing and load-balancing -- but DNS and IPv6 tunneling are integrated as well. One downside of IPv6 on AWS is that the IPv6 tunneling protocol -- protocol number 41 -- is only available in VPCs. The EC2 classic network allows only 3 IP protocols -- TCP, UDP and ICMP -- to pass through it.
nitinics 12y ago
You can always create multiple routing instances (namespaces) for overlapping IPv4 blocks with a VRF-based strategy. This would create separate FIBs and IMHO is a cleaner approach than mangling packets with iptables.

I think it has more to do with the fact that there are a standard series of private IP blocks.

by cheald 12y ago

I think it has more to do with the fact that there are a standard series of private IP blocks.

rdl 12y ago

Right, but if everyone used IPv6 there would be no need to use non-routeable private IPs for anything, you could just use non-conflicting IPv6 addresses and not route them.

makomk 12y ago
Even if you did use non-routeable private IPs, IPv6 provides enough different private address ranges - more than there are individual addresses in IPv4 - that it's unlikely they'd conflict.
sliverstorm 12y ago
I kind of like having standard private subnets. My router is always 192.168.1.1, or sometimes 10.0.1.1, and so is my friend's, my parent's, and my grandparent's.
- agwa 12y ago
  You can have that in IPv6 too, with link-local addresses (fe80::/64). In fact, it's becoming quite common to assign fe80::1 to a subnet's default gateway.
- EvanAnderson 12y ago
  It creates a lot of pain when you need to connect these networks to each other, though. Admittedly, that's probably not a problem for parents, friends, etc. At my Old Job I demanded we keep a "registry" of the RFC1918 address space we allocated to Customers. We never allocated Customers in overlapping address spaces. It made VPN connectivity to Customer A while on-site with Customer B much easier. It also helped out in one case where one Customer acquired another.
- jon-wood 12y ago
  After spending some time as a contractor doing systems work for a few companies I've stopped ever assigning an internal network to 192.168.0.0, 192.168.1.0, or 10.0.0.0. The number of times I found myself attempting to VPN into a clients network, only to find it conflicted either with my home network, or whatever coffee shop I was sitting in, was ridiculous. Depending how many hosts you need to run on your network there are huge numbers of possible subnets you could use for an internal network - do yourself a favour and keep off the ones set up be default on every router sold.
  - stygiansonic 12y ago
    This is also important advice if you're thinking about setting up VPN access to your home network: Do not pick the most common/default subnets, i.e. 192.168.0.0/24, 192.168.0.1/24, etc. Picking a somewhat-random subnet as suggested would mitigate the problem and it's what I did for my home network.
- lmm 12y ago
  Which is great until you and your friend want to play games with each other and need to set up a VPN.
- deleted 12y ago
  [deleted]
btgeekboy 12y ago
That's basically what a ULA is for though - see RFC 4193. If I'm not big enough to acquire my own allocations from ARIN, I'd prefer not to have to renumber every piece of equipment (even those not externally accessible) when changing ISPs.
samstave 12y ago
But I can recall ip4 addresses en mass in my head. I can't memorize ip6 addresses easily. Plus, I'd like to keep pockets of private IPs that are never accessible as routable targets. Can you explain why I wouldn't to do this or why I should evolve my understanding of ip6 better?
- agwa 12y ago
  IPv6 address don't have to be long or publicly routable. ULA addresses (fd00::/8) are the IPv6 analogue to RFC1918 and you could theoretically use ULA addresses as short as fd00::1, fd00::2, fd00::3, and so on. Of course if you do this you run the risk of colliding with other people, so you're encouraged to randomly generate the next 40 bits after fd, which leaves you with addresses like fd32:5e26:381d::1. That's longer than IPv4 addresses, but it's a pretty fair tradeoff to get a globally unique address. Even non-ULA IPv6 addresses need not be long. 2600:3c00:e000:6c::1 is the address of my server over at Linode, and I don't find that bad at all.
- jon-wood 12y ago
  There's no real need to memorise IP addresses, that's what DNS was made for. If your servers are on the internet at large then they probably have DNS already, and if its a local network then most operating systems will now automatically work out where machines on the .local domain are (I'll be honest, I don't fully understand how that works).
  - jacquesm 12y ago
    I think it is a safe assumption that Sam knows what the DNS was made for.
  - vacri 12y ago
    I've had only a very limited exposure to IPv6, but it seemed to me that the slogan "DNS solves it for you!" doesn't really pan out. It solves it if you're on a well-set-up network and have your DNS up and running happily, but with the ad-hoc networks my [limited] experience has seen, it hasn't been trivial. Essentially, it means you have to run an interpreter service (the DNS) to understand the network - one more bit of software to configure and troubleshoot... though to be fair, IPv4 was also quite confusing when I first started playing with it.
hrktb 12y ago
The range of non-conflicting IPv4 private addresses is not really small. Everyone just happens to use the same two or three blocks, the easiest to remember.
- agwa 12y ago
  Actually, when you're working at Facebook scale, the range is quite small. One of the reasons Facebook started moving to IPv6 was that they were running out of RFC1918 addresses.
solidsnack9000 12y ago
Service-net (https://github.com/mesosphere/service-net/ https://github.com/mesosphere/service-net/) is a proof-of-concept for service routing and discovery with IPv6 and DNS. The underlying mechanism is similar -- IP tables is used for routing and load-balancing -- but DNS and IPv6 tunneling are integrated as well. One downside of IPv6 on AWS is that the IPv6 tunneling protocol -- protocol number 41 -- is only available in VPCs. The EC2 classic network allows only 3 IP protocols -- TCP, UDP and ICMP -- to pass through it.

nitinics 12y ago

You can always create multiple routing instances (namespaces) for overlapping IPv4 blocks with a VRF-based strategy. This would create separate FIBs and IMHO is a cleaner approach than mangling packets with iptables.