10 ms·
Comcast Automatically Enabling IPv6 in San Francisco
- nemothekid 11y agoComcast has been doing this for a while, at least in SF. I first noticed, through gmail as well, that I was using ipv6 for atleast 2 years now. I think they started rollout back in 2013.
- RyJones 11y agoI got IPv6 from Comcast near Seattle the day after Thanksgiving, 2013. https://www.flickr.com/photos/ryjones/11079544726/ https://www.flickr.com/photos/ryjones/11079544726/
- jamescun 11y agoWould have been earlier than that. I subscribed to Comcast in Mountain View in 2012 and received IPv6 addresses.
- X-Istence 11y agoAn engineer at Comcast in this nanog video [1] claims they have 60% penetration in their own network for IPv6. Which is excellent news. [1]: https://www.youtube.com/watch?v=EfjdOc41g0s&app=desktop https://www.youtube.com/watch?v=EfjdOc41g0s&app=desktop
- junto 11y agoWhat are the security and privacy implications for home users when an ISP simply switches them on?
- 2bluesc 11y agoThe biggest that comes to mind is that with dual stack IPv6 all the people running through IPv4 anonymizing VPNs will be bypassed for sites that support IPv6. Oops. IPv6 has some minor privacy extensions too, but likely still allow you to be geolocated.
- X-Istence 11y agoThis is something the VPN providers need to fix, either by setting a default IPv6 route that doesn't go anywhere so happy eyeballs will follow IPv4 or by adding IPv6 to their proxies.
- X-Istence 11y agoDepends on the CPE, however as long as there is a default firewall, there would no real issues. The problem I've found is that too many CPE's allow IPv6 inbound without a firewall, so it exposes end clients directly to the internet. With IPv4 generally there is a default drop all firewall rule.
- kstrauser 11y agoI've had native IPv6 in Alameda for a couple of years now. I've had literally no problems, ever, with it and haven't once disabled it or otherwise adjusted my configuration to make a service work.
- eeZi 11y agoIn Germany, Unitymedia - the largest cable ISP - did so as well. You don't even get a public IPv4 anymore unless you call them and beg, and apparently they stopped doing even that.
- stock_toaster 11y agoDo they run nat64 or something for reaching the ip4'ternet?
- Flockster 11y agoThe standard is called Dual-Stack Light, which means you are getting a native IPv6 adress and your IPv4 traffic runs through a carrier-grade NAT. This is necessary, because the cable-providers here in Germany came to late to the Game and got to little IPv4 Chuncks. For normal users this is a good solution, when the NATing service is stable enough. (Sometimes the server is down and you are forced to IPv6 only..) But throug the carrier-grade NAT, you can not run your own services, like a teamspreak server etc.
- justincormack 11y agoDo they let you run services on ipv6 easily, ie unfiltered access and firewall control?
- eeZi 11y agoNope, at least not for Unitymedia. There's a IPv6 firewall, but without rules - you can just switch it on or off, making it unsuitable for pretty much any service hosting - you either have to expose your entire network, or you cannot access anything at all. For 5€/month, they will issue a better router with a full-features firewall, though.
- Flockster 11y agojustincormack: Yes, you can set up an IPv6 service on your connection if you like. The only problem for IPv4 services is the lack of your own global IPv4 address.
- rdl 11y agoUnfortunately Comcast Business still has extremely limited IPv6 even in areas where Residential has IPv6
- ars 11y agoComcast enabled it everywhere as far as I know. I'd like to use IPv6 on my servers but I need fail2ban support first.
- simon_vetter 11y agoI would recommend sshguard [1] as a fail2ban replacement. It does much of what fail2ban used to do out of the box and has supported ipv6 for a long, long time. It is packaged in debian, ubuntu and probably other major distros these days. [1] http://www.sshguard.net/ http://www.sshguard.net/
- simoncion 11y agoshrug I would recommend deactivating password logins and using only key-based logins. In the many, many, many months I've had my internet-facing IPv6-enabled SSH servers online, I've only received one bogus SSH connection attempt from an IPv6 address at the University of Michigan.
- ams6110 11y agoThat will change though. I receive hundreds of IPv4 connection attempts every day, as more systems move to IPv6 so will the attacks. Interesting though is that covering the entire IPv6 space is a much larger task. That should hold down the volume of random attempts for a while, just by dilution effect.
- ars 11y ago> I would recommend deactivating password logins and using only key-based logins. I do that when I can, but sometimes it's not possible. Also, fail2ban works for other things besides ssh, which I need.
- ars 11y agoThanks for the tip! sshguard seems better than fail2ban.
- klodolph 11y agoYou're going to need to start testing both IPv6 and IPv4 on your servers. An nginx misconfiguration on my server gave clients a redirect loop, but only for IPv6 clients. Analytics show ~15% IPv6 penetration for the last app I made, and it was a bit embarrassing that it was broken at first. Reverse DNS on IPv6 client addresses gave me Comcast host names.
- PhantomGremlin 11y agoI have Comcast (Oregon), but right now I block all IPv6 at my firewall. If/when it's available here, why should I enable it? Why would I care? This isn't a troll. I'm ignorant of the practical advantages as it has actually been deployed so far. I'd like to know how it improves my life. E.g. will I get a block of addresses, instead of just 1? BTW, apropos of nothing, we would have never needed IPv6 if there was a charge for IPv4 addresses. Assume $1 per month. Do you think MIT would pay $16,000,000+ per month? Assume $1 per year. Do you think MIT would pay $16,000,000 per year? In either case I think the clear answer would be: NO!
- tomjen3 11y agoYou can probably get almost all the ipv6 addresses you want. I am not sure why you would block ipv6 exactly, but the saddest thing is that I can't really point you to a good reason to implement ipv6 on a server, seeing as everything has to work with ipv4. And we can't charge MIT for the ips because they were given away way back when (so they are legally the property of MIT).
- simoncion 11y agoFor like, all of the frameworks that the cool kids are using, IPv6 is handled transparently and out of the box. For the C++ programmer, both the various libcs and Boost have handled IPv6 for a very long time. It's the same story with C#. I would expect it to be similar for other CLR languages. Java? Erlang? Same story.
- justincormack 11y agoIt took a while, Twisted in Python seemed to have issues with code I was using (buildbot), although the upstream issues are now closed, so maybe I should try again.
- tomjen3 11y agoThat is true, but even the effort to source an IPv6 (probably just a few clicks on your providers website) and configure the firewall correctly isn't worth the effort.
- levifig 11y agoComcast customer in Maryland here. I've had IPv6 fully enabled for at least 6 months now… :)
- techdragon 11y agothis makes me jealous... In Australia all the mobile networks are using carrier grade NAT to avoid using IPv6 ... And there's only one ISP with IPv6 and the others don't care because they already acquired enough IPv4 addresses they can probably survive another decade on IPv4 It's shit.
- j0hnj0nes 11y agoJust wait until they have to keep all the metadata by law... I suspect they will after they realise you can't tie things down in CGNAT
- 2bluesc 11y agoSide note, just noticed that Comcast SF broke my /60 prefix delegation that had been working for almost 2 years[1]. Appears to be affecting DSLR[2] users too. Anyone else observe this? [1] https://gist.github.com/1cec3537f61aefd1d6bc https://gist.github.com/1cec3537f61aefd1d6bc [2] https://www.dslreports.com/forum/r30112054-IPv6-IPv6-prefix-delegation-stuck-with-64 https://www.dslreports.com/forum/r30112054-IPv6-IPv6-prefix-...
- eeZi 11y agoApparently, there are Comcast employees on the dslreports.com which actually helped users there. Cool.