4 ms·

I have Comcast (Oregon), but right now I block all IPv6 at my firewall. If/when it's available here, why should I enable it? Why would I care? This isn't a tro

I have Comcast (Oregon), but right now I block all IPv6 at my firewall. If/when it's available here, why should I enable it? Why would I care? This isn't a troll. I'm ignorant of the practical advantages as it has actually been deployed so far. I'd like to know how it improves my life. E.g. will I get a block of addresses, instead of just 1? BTW, apropos of nothing, we would have never needed IPv6 if there was a charge for IPv4 addresses. Assume $1 per month. Do you think MIT would pay $16,000,000+ per month? Assume $1 per year. Do you think MIT would pay $16,000,000 per year? In either case I think the clear answer would be: NO!

tomjen3 11y ago
You can probably get almost all the ipv6 addresses you want. I am not sure why you would block ipv6 exactly, but the saddest thing is that I can't really point you to a good reason to implement ipv6 on a server, seeing as everything has to work with ipv4. And we can't charge MIT for the ips because they were given away way back when (so they are legally the property of MIT).
- simoncion 11y ago
  For like, all of the frameworks that the cool kids are using, IPv6 is handled transparently and out of the box. For the C++ programmer, both the various libcs and Boost have handled IPv6 for a very long time. It's the same story with C#. I would expect it to be similar for other CLR languages. Java? Erlang? Same story.
  - justincormack 11y ago
    It took a while, Twisted in Python seemed to have issues with code I was using (buildbot), although the upstream issues are now closed, so maybe I should try again.
  - tomjen3 11y ago
    That is true, but even the effort to source an IPv6 (probably just a few clicks on your providers website) and configure the firewall correctly isn't worth the effort.
    - simoncion 11y ago
      I and many of my peers and superiors strongly disagree. I'm also suspicious that you're not arguing in good faith.
  - hobarrera 11y ago
    > For like, all of the frameworks that the cool kids are using, IPv6 is handled transparently and out of the box. Yeah, except for golang. go applications don't work on IPv6-nodes, and issues have been open for almost two years now.
    - 15155 11y ago
      HAProxy? ELB?
      - hobarrera 11y ago
        That won't help with client applications.
    - simoncion 11y ago
      Jeez. That golang bug is pretty bad. I'd like to know why it seems that the devs are acting like it's a difficult problem to solve; clearly I'm missing something. But, uh, the presence of that bug doesn't invalidate my statement. IPv6 support works out of the box in Go and -if you're on a dual-stack host-[0] everything works great! [0] So, if you're like not on a cell network with a modern smartphone, or like in an area served by APNIC [1], you're fine! ;) [1] Because, like, pff, how many people could be served by the networks numbered by that organization? ;)
      - hobarrera 11y ago
        I've a pure-IPv6 setup with NAT64. No golang application works, on any of my machines. This bug is so incredibly critical is actually means that almost every program that depends on golang will not work on any of my machines, or any new machine added to my network.
        simoncion 11y ago
        Heh. I guess the gonuts [0] are okay with golang not being used on smartphones, in Asia-Pacific, or in Africa. 'Tis a pity. Can you tell me why the golang folks are acting like solving the underlying problem is so terribly difficult? [0] To the downvoters: golang-nuts is the name of the official golang general discussion list. "gonuts" is used lovingly in this context.
mitchty 11y ago
Why should use enable it? For one, its faster generally, for two it gets more throughput. If those two aren't enough for you I'm at a loss. Honestly I don't see a future for ipv4, ipv6 simplifies so much. Watch that nanog video posted in this thread, you might be surprised at the view of ipv6. I've been using ipv6 for years now, zero issues. Also ipv4 charging for addresses is a complete economic hack around a technical issue. Ipv6 gets us away from the hacks, technical or not. Unless you like stuff like carrier grade nats making things like p2p video harder than it need be. Honestly the inverse should be happening more, drop ipv4 and start doing nat for ipv4 at the gateways that matter.
simoncion 11y ago
Do you use uPnP? Do you do any port forwarding? If the answer to either of those questions is "Yes", then you should consider activating IPv6, if your ISP supports it.[0] The most tight-assed ISPs give you a /64 allocation. Because most machines use something called SLAAC, this means that this /64 is enough for a single subnet. The IETF strongly recommends that ISPs hand out at least a /56, but really wants to see /52s being handed out to each customer. In San Francisco, it seems that Comcast Residential connections get handed out at most a /60. Comcast uses DHCPv6-PD, so your DHCPv6 client needs to ask for the larger allocation. On routers that support IPv6, configuring your client to do this is typically very easy. As an aside, if you enable IPv6, please don't filter ICMP. ICMP was pretty important in IPv4, and has become absolutely critical in IPv6. [0] If you use uPnP, you're relying on firewalls on your endpoints for your security anyway -because any host can poke a hole in the NAT at any time-, so activating IPv6 doesn't substantially change your security situation.
- zyx321 11y ago
  >The IETF strongly recommends that ISPs hand out at least a /56 I never really understood that. IPv6 has 128 bit addresses, so even at /96 every single customer will have as many addresses as the entire IPv4 space. Why is /64 considered "tight-assed"?
  - welterde 11y ago
    Right now SLAAC (Stateless address autoconfiguration) needs at least a /64 to work properly, thus only giving the customer a /64 means they can't run autoconfig on more than one broadcast segment.
- hobarrera 11y ago
  Why would they used DHCPv6 instead of SLAAC? It seems more complex, and I don't see any advantages. SLAAC is like the "default" for IPv6, while DHCP is something on top of it. Plus it's usually not enable out-of-the-box on all devices.
  - simoncion 11y ago
justincormack 11y ago
You should get a /64, ie a gigantic lot of addresses, or more, by default. So all machines are directly addressable. If you eg open the ssh port, you can log in to anywhere directly. eg all my machines at home have AAAA addresses, and so do my VMs hosted externally, and I can log in directly which is much easier.
- hobarrera 11y ago
  A /56 is the recommendation (and what my ISP gives me), though I wouldn't be surprised if a lot actually use /64 blocks. There's still an enormous amount left anyway.

tomjen3 11y ago

You can probably get almost all the ipv6 addresses you want. I am not sure why you would block ipv6 exactly, but the saddest thing is that I can't really point you to a good reason to implement ipv6 on a server, seeing as everything has to work with ipv4. And we can't charge MIT for the ips because they were given away way back when (so they are legally the property of MIT).

simoncion 11y ago
For like, all of the frameworks that the cool kids are using, IPv6 is handled transparently and out of the box. For the C++ programmer, both the various libcs and Boost have handled IPv6 for a very long time. It's the same story with C#. I would expect it to be similar for other CLR languages. Java? Erlang? Same story.
- justincormack 11y ago
  It took a while, Twisted in Python seemed to have issues with code I was using (buildbot), although the upstream issues are now closed, so maybe I should try again.
- tomjen3 11y ago
  That is true, but even the effort to source an IPv6 (probably just a few clicks on your providers website) and configure the firewall correctly isn't worth the effort.
  - simoncion 11y ago
    I and many of my peers and superiors strongly disagree. I'm also suspicious that you're not arguing in good faith.
- hobarrera 11y ago
  > For like, all of the frameworks that the cool kids are using, IPv6 is handled transparently and out of the box. Yeah, except for golang. go applications don't work on IPv6-nodes, and issues have been open for almost two years now.
  - 15155 11y ago
    HAProxy? ELB?
    - hobarrera 11y ago
      That won't help with client applications.
  - simoncion 11y ago
    Jeez. That golang bug is pretty bad. I'd like to know why it seems that the devs are acting like it's a difficult problem to solve; clearly I'm missing something. But, uh, the presence of that bug doesn't invalidate my statement. IPv6 support works out of the box in Go and -if you're on a dual-stack host-[0] everything works great! [0] So, if you're like not on a cell network with a modern smartphone, or like in an area served by APNIC [1], you're fine! ;) [1] Because, like, pff, how many people could be served by the networks numbered by that organization? ;)
    - hobarrera 11y ago
      I've a pure-IPv6 setup with NAT64. No golang application works, on any of my machines. This bug is so incredibly critical is actually means that almost every program that depends on golang will not work on any of my machines, or any new machine added to my network.
      - simoncion 11y ago
        Heh. I guess the gonuts [0] are okay with golang not being used on smartphones, in Asia-Pacific, or in Africa. 'Tis a pity. Can you tell me why the golang folks are acting like solving the underlying problem is so terribly difficult? [0] To the downvoters: golang-nuts is the name of the official golang general discussion list. "gonuts" is used lovingly in this context.

mitchty 11y ago

Why should use enable it? For one, its faster generally, for two it gets more throughput. If those two aren't enough for you I'm at a loss. Honestly I don't see a future for ipv4, ipv6 simplifies so much. Watch that nanog video posted in this thread, you might be surprised at the view of ipv6. I've been using ipv6 for years now, zero issues. Also ipv4 charging for addresses is a complete economic hack around a technical issue. Ipv6 gets us away from the hacks, technical or not. Unless you like stuff like carrier grade nats making things like p2p video harder than it need be. Honestly the inverse should be happening more, drop ipv4 and start doing nat for ipv4 at the gateways that matter.

simoncion 11y ago

Do you use uPnP? Do you do any port forwarding? If the answer to either of those questions is "Yes", then you should consider activating IPv6, if your ISP supports it.[0] The most tight-assed ISPs give you a /64 allocation. Because most machines use something called SLAAC, this means that this /64 is enough for a single subnet. The IETF strongly recommends that ISPs hand out at least a /56, but really wants to see /52s being handed out to each customer. In San Francisco, it seems that Comcast Residential connections get handed out at most a /60. Comcast uses DHCPv6-PD, so your DHCPv6 client needs to ask for the larger allocation. On routers that support IPv6, configuring your client to do this is typically very easy. As an aside, if you enable IPv6, please don't filter ICMP. ICMP was pretty important in IPv4, and has become absolutely critical in IPv6. [0] If you use uPnP, you're relying on firewalls on your endpoints for your security anyway -because any host can poke a hole in the NAT at any time-, so activating IPv6 doesn't substantially change your security situation.

zyx321 11y ago
>The IETF strongly recommends that ISPs hand out at least a /56 I never really understood that. IPv6 has 128 bit addresses, so even at /96 every single customer will have as many addresses as the entire IPv4 space. Why is /64 considered "tight-assed"?
- welterde 11y ago
  Right now SLAAC (Stateless address autoconfiguration) needs at least a /64 to work properly, thus only giving the customer a /64 means they can't run autoconfig on more than one broadcast segment.
hobarrera 11y ago
Why would they used DHCPv6 instead of SLAAC? It seems more complex, and I don't see any advantages. SLAAC is like the "default" for IPv6, while DHCP is something on top of it. Plus it's usually not enable out-of-the-box on all devices.
- simoncion 11y ago

justincormack 11y ago

You should get a /64, ie a gigantic lot of addresses, or more, by default. So all machines are directly addressable. If you eg open the ssh port, you can log in to anywhere directly. eg all my machines at home have AAAA addresses, and so do my VMs hosted externally, and I can log in directly which is much easier.

hobarrera 11y ago
A /56 is the recommendation (and what my ISP gives me), though I wouldn't be surprised if a lot actually use /64 blocks. There's still an enormous amount left anyway.