5 ms·

When I visit the NYT, it gets a full IPv6 address, non-NAT. Isn't this just as bad? Should we tell everyone to turn off IPv6 support?

p1mrx 11y ago
Technically www.nytimes.com doesn't see your IPv6 address, because the site is still IPv4-only.
harshreality 11y ago
If you want to hide the IP you're connecting from, and you want to use IPv6, then you have to find an IPv6-enabled VPN (or make one yourself with a cheap vps). The major use case for webrtc ip leak blocking is preventing leaking of rfc1918 IPs (or link/site-local IPv6 addresses) and preventing leaking of alternate LAN and alternate public IPs. For example, if you web browse through a VPN, this webrtc functionality will by default reveal not only your public VPN exit IP, but also your VPN rfc1918 ip, and also your real rfc1918 ip, and your primary, non-vpn public IP. All in the name of better connectivity for webrtc. It's horrible. I don't understand why webrtc does this. How does revealing non-global addresses help improve (edit: reliably improve) connectivity? Those addresses aren't guaranteed to be globally unique, so if you have two webrtc app users on the same non-global netblock, so what? Even if they have the same public IP, it's not guaranteed that they can talk to each other with their non-global addresses; they could be on different (isolated) internal networks. So the app will be blindly trying to connect to random internal ip addresses. Sounds fun for NIDS.
- cbhl 11y ago
  Doesn't it help if two people are sitting right next to each other behind the same NAT?
  - makomk 11y ago
    It's necessary if the NAT device doesn't support hairpinning. Unfortunately, historically many didn't, so users couldn't connect to other users on the same NAT using their public IPs, even with techniques that worked fine for connecting to other identical NAT setups elsewhere.
    - MichaelGG 11y ago
      Is it necessary? You could do a broadcast on the LAN if the public IP is the same.
      - nitrogen 11y ago
        That same-subnet local IPs behind one public IP can reach each other is probably not a safe assumption to make.
        MichaelGG 11y ago
        You only send a broadcast to attempt to reach the other party. If it does not work, you fallback to the public IP. This is sorta what ICE does already.
      - profmonocle 11y ago
        It's not safe to assume that multiple clients behind the same public IP are on the same LAN. At my office, wired and wireless clients NAT to the same public IP, despite being on different subnets. Plus, thanks to IPv4 depletion there might be multiple layers of NAT involved, because ISPs are having to deploy carrier-grade NAT.
- meowface 11y ago
  >and your primary, non-vpn public IP. All in the name of better connectivity for webrtc. It's horrible. I don't see how WebRTC could do this if you're actually routing 0.0.0.0 to your VPN, which I think is how a lot of people use VPNs when they're the kind you toggle on and off. Are you aware of a way it could get your non-VPN public IP even in those cases?
- mirimir 11y ago
  I use pfSense VMs as VPN gateways. It's easy to create nested VPN chains through virtual networking. The VM that I'm currently using has never seen my ISP-assigned IP address. I also have IPv6 disabled everywhere.
the8472 11y ago
With ipv6 there are the privacy extensions[1] for SLAAC which will assign your computer a new v6 address from your network prefix in a regular interval. This is enabled by default on windows, osx and some linux systems. But I do wonder whether webrtc can find your other v6 addresses, a host often has more than one. [1] https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941

p1mrx 11y ago

Technically www.nytimes.com doesn't see your IPv6 address, because the site is still IPv4-only.

harshreality 11y ago

If you want to hide the IP you're connecting from, and you want to use IPv6, then you have to find an IPv6-enabled VPN (or make one yourself with a cheap vps). The major use case for webrtc ip leak blocking is preventing leaking of rfc1918 IPs (or link/site-local IPv6 addresses) and preventing leaking of alternate LAN and alternate public IPs. For example, if you web browse through a VPN, this webrtc functionality will by default reveal not only your public VPN exit IP, but also your VPN rfc1918 ip, and also your real rfc1918 ip, and your primary, non-vpn public IP. All in the name of better connectivity for webrtc. It's horrible. I don't understand why webrtc does this. How does revealing non-global addresses help improve (edit: reliably improve) connectivity? Those addresses aren't guaranteed to be globally unique, so if you have two webrtc app users on the same non-global netblock, so what? Even if they have the same public IP, it's not guaranteed that they can talk to each other with their non-global addresses; they could be on different (isolated) internal networks. So the app will be blindly trying to connect to random internal ip addresses. Sounds fun for NIDS.

cbhl 11y ago
Doesn't it help if two people are sitting right next to each other behind the same NAT?
- makomk 11y ago
  It's necessary if the NAT device doesn't support hairpinning. Unfortunately, historically many didn't, so users couldn't connect to other users on the same NAT using their public IPs, even with techniques that worked fine for connecting to other identical NAT setups elsewhere.
  - MichaelGG 11y ago
    Is it necessary? You could do a broadcast on the LAN if the public IP is the same.
    - nitrogen 11y ago
      That same-subnet local IPs behind one public IP can reach each other is probably not a safe assumption to make.
      - MichaelGG 11y ago
        You only send a broadcast to attempt to reach the other party. If it does not work, you fallback to the public IP. This is sorta what ICE does already.
    - profmonocle 11y ago
      It's not safe to assume that multiple clients behind the same public IP are on the same LAN. At my office, wired and wireless clients NAT to the same public IP, despite being on different subnets. Plus, thanks to IPv4 depletion there might be multiple layers of NAT involved, because ISPs are having to deploy carrier-grade NAT.
meowface 11y ago
>and your primary, non-vpn public IP. All in the name of better connectivity for webrtc. It's horrible. I don't see how WebRTC could do this if you're actually routing 0.0.0.0 to your VPN, which I think is how a lot of people use VPNs when they're the kind you toggle on and off. Are you aware of a way it could get your non-VPN public IP even in those cases?
mirimir 11y ago
I use pfSense VMs as VPN gateways. It's easy to create nested VPN chains through virtual networking. The VM that I'm currently using has never seen my ISP-assigned IP address. I also have IPv6 disabled everywhere.

the8472 11y ago

With ipv6 there are the privacy extensions[1] for SLAAC which will assign your computer a new v6 address from your network prefix in a regular interval. This is enabled by default on windows, osx and some linux systems. But I do wonder whether webrtc can find your other v6 addresses, a host often has more than one. [1] https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941