Dagger2

84 ms·

541.
by Dagger2 5y ago
If you're using proxy NDP then you don't have "more than enough" IP space for what you're doing. You have none and you're hacking up a workaround -- one that's inevitably going to have people coming away
542.
by Dagger2 5y ago
It's not just NAT, you may also need split DNS, and it's a constant drag on everything because you keep needing to map between two sets of addresses. And it gets way harder when you have multiple or large companies involved, becau
543.
by Dagger2 5y ago
Sure. I was just pointing out that if you really wanted to use 254, you could use fd00:ec2::fe and write it as fd00:ec2::0.0.0.254 -- though mainly because I wanted people to know that doing so was possible, not because it was in any way a
544.
by Dagger2 5y ago
You could write it as fd00:ec2::0.0.0.254...
545.
by Dagger2 5y ago
> If it was profitable, the ISP would do it and pocket the now unnecessary service costs. This is another "if you ask an economist" situation. In the real world, people will happily spend more effort justifying not doing v6 and
546.
by Dagger2 5y ago
10/8 isn't actually that much space. It's only 256 /16s. Either way, mergers are common and it only takes one VPN to another company also using 10/8 to have a problem.
547.
by Dagger2 5y ago
I didn't say it was simple, just no harder than v4. In many ways it's easier in practice because you don't need to also use NAT on top. I've got a static /48 from my consumer ISP here -- it sounds like your complain
548.
by Dagger2 5y ago
It was up to about one /8 per three weeks just before we ran out, and I can't imagine there isn't a huge amount of built-up demand after 10 years of no new allocations at the top.
549.
by Dagger2 5y ago
We've already gone to an absolutely massive amount of effort to provide enough supply for a transition. What did we do with it? We squandered it. ISPs don't need more v4 addresses. If anything, they need fewer of them.
550.
by Dagger2 5y ago
But you can slow it down by making more v4 address space available. I'm of the general opinion that doing so would be a really bad idea. Let's focus our efforts on v6, not on efforts to delay v6.
551.
by Dagger2 5y ago
There's nothing crazy about v6's model -- or at least nothing that isn't also crazy in v4, since v6 uses almost exactly the same networking model that v4 does.
552.
by Dagger2 5y ago
Because that's basically what v6 did. It just added enough octets that we don't need to turn around and do it again immediately afterwards, since deploying new L3 protocols is hard enough as it is without needing to do it twice.
553.
by Dagger2 5y ago
That's L3 cache though; they only have 0.5 MB of L2 cache per core. I'm not really sure how much each of these types of memory cost, but I did find [1] which says "The cost of TCAM is also about 30 times more per bit of stora
554.
by Dagger2 5y ago
But if you're doing fast hardware routing, that's tens and tens of megabytes of TCAM, not DRAM. It's more akin to CPU cache in terms of latency, capacity and cost.
555.
by Dagger2 5y ago
You do it in exactly the same way you would if the NAT wasn't there. NAT only applies to outbound connections. It does nothing for inbound ones, and thus doesn't provide any firewalling functionality.
556.
by Dagger2 5y ago
They said that v6 for home networks was frustrating, but it's not. The frustration is coming from the terrible v4 CGNAT, and that has nothing to do with v6 and everything to do with v4 being insufficient. It's amazing how hard peo
557.
by Dagger2 5y ago
Indeed not. That's not what I said. I don't even want them talking out to the internet by default, which is why I have a separate subnet with a different set of firewall rules that only allows whitelisted outbound connections.
558.
by Dagger2 5y ago
If the CGNAT is bad, that's a problem with the CGNAT. If your ISP won't turn off CGNAT without turning off v6 at the same time, that's your ISP's fault. v6 works completely fine in both cases. Your problems aren't w
559.
by Dagger2 5y ago
Because they don't know the words. It's not uncommon for people to want to do things that would be best done with a separate subnet though. For example, VPNing in from your phone or making a separate isolated network for untrusted
560.
by Dagger2 5y ago
If you already know v4 then there's not much to learn. There are only really three differences: a) You use a /64 from the subnet your upstream assigns you, instead of a /24 from RFC1918. b) You don't use NAT. c) You run
561.
by Dagger2 5y ago
There are sadly a ton of ISPs that do CGNAT on a v4-only service. Smaller or newer ISPs like WISPs often do it, or ISPs for apartment blocks or student accommodation, but it's hardly limited to those. Germany in particular has a couple
562.
by Dagger2 5y ago
You're essentially describing NAT64, a thing which exists in v6 already. I use it on my desktop, which has no v4 address. You're arguing for something we already have. v6 isn't really very complex. In fact it's generally
563.
by Dagger2 5y ago
No credible design is possible , because when people ask for a backwards-compatible IPng what they're really asking for is a forwards-compatible IPv4, and they can't have it because v4 isn't forwards compatible. IPv6 is back
564.
by Dagger2 5y ago
The general plan was, and is still, to stop using v4 once it stops being useful, in much the same way that people stopped using IPX when it stopped being useful. (By which I mean: people still use IPX today, but in general you don't ne
565.
by Dagger2 5y ago
That sounds like problems with either CGNAT or your ISP, not with v6. In fact v6 is how you avoid those problems.
566.
by Dagger2 5y ago
Can you explain how it was compatible? That RFC says "Updated Internet hosts talk to old Internet hosts using the current Internet suite unchanged." which sounds exactly the same as the way v6 normally does it. As far as I could t
567.
by Dagger2 5y ago
Comcast uses /64 for the WAN network and will give you up to a /60 routed prefix for LAN-side networks.
568.
by Dagger2 5y ago
I was under the impression that the point was "NAT blocks connections", and I was attempting to point out that it doesn't. Testing with the firewall on will only demonstrate that the router blocks connections when the firewal
569.
by Dagger2 5y ago
Alright. Most consumer routers do both NAT and firewalling, especially in their stock configurations, but I can drag one out and disable the firewall on it to test with. I hooked the router up to my network, and then hooked my laptop up beh
570.
by Dagger2 5y ago
I've tested it before, multiple times; NAT won't deny an inbound connection. A router that's NATing outbound connections will allow inbound connections through unless there's also a firewall. Of course it's very com

More ›