Dagger2

46 ms·

721.
by Dagger2 7y ago
A seamless migration path (in the sense that you seem to be wanting it) was impossible. v4's design doesn't allow for it.
722.
by Dagger2 8y ago
Funnily enough, I did the exact same thing but for zsh's two-argument cd: cd() { if [[ -n "$2" && "$1" != "--" ]]; then builtin cd "${PWD/"$1"/"$2"}"; el
723.
by Dagger2 8y ago
I'm not fully sure what you're asking for here exactly... you're going to need a v4 infrastructure to route v4 packets, because that's what having a v4 infrastructure means . You can map the entire v4 space into a v6 &#
724.
by Dagger2 8y ago
Around here I'd expect something more like a 7 year minimum to be more likely... Limiting the timeframe does improve the costs and the privacy impact, but the ISP will still need to build and run all of the logging infrastructure, an
725.
by Dagger2 8y ago
I guess, but the fact remains that using RFC1918 is still both more effort and less secure than just using a firewall is, and that NAT doesn't help the situation. Do you really want the security of your network to rely on your ISP alwa
726.
by Dagger2 8y ago
What do you mean "incompatible"? You can run both of them at the same time, they work on the same links, in the same OS stacks, with the same programs, and you can talk between them or tunnel over them with a variety of transition
727.
by Dagger2 8y ago
Nope, because: - you would need to restrict yourself to an extremely tiny fraction of the v6 space that's the same size as the v4 space - you couldn't use any IPs that correspond to in-use v4 IPs because they would overlap - you c
728.
by Dagger2 8y ago
The most recent figures I've heard were that something like 40-60% of traffic (by bytes) on a dual-stacked client ISP will go over v6. I heard that stat about 4-5 years ago, so it seems reasonable to expect it to be even higher nowaday
729.
by Dagger2 8y ago
Even then, that would still only put you into the situation in the second paragraph of my previous post. You would still need a firewall, and if you have a firewall then shifting to RFC1918, adding MASQ NAT or even doing both won't hel
730.
by Dagger2 8y ago
Yes you can. Those "hacks" are how you do it. I mean, you can call them hacks, but at the end of the day v4 uses a fixed-width 32 bit address field and has no mechanism to extend it in a way that's compatible with other v4 ho
731.
by Dagger2 8y ago
v6 has dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... it has pretty much every possible backwards compatibility method that can work with v4. You could make
732.
by Dagger2 8y ago
It's quite a bit easier to eyeball than v4, because it's much easier to make sure that your network falls on a character boundary (multiple of 4 bits out of 128) than it is to make it fall on an octet boundary (multiple of 8 bits
733.
by Dagger2 8y ago
That would normally be called CGNAT. Yes, that does change things somewhat... except what's actually going to happen is that people will record the port number and the time as well as the IP, and the ISP is going to record every single
734.
by Dagger2 8y ago
Not really? I don't think you can reasonably argue that: 2001:db8:4242:1::2 is much harder to remember than: 203.0.113.42+192.168.1.2 In fact it's substantially fewer characters. Okay, obviously you can pick v6 addresses such th
735.
by Dagger2 8y ago
Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and use it for your network. Your computers then assign themselves rand
736.
by Dagger2 8y ago
It's too small. /56 should be the minimum unless there are hard technical reasons why you can't do that. My point was that a lot of ISPs seem to think that even /63 is too big, and that's in a 128-bit address spac
737.
by Dagger2 8y ago
It would be a random address from a given subnet, yes. Basically the privacy, tracking and banning implications of this are more or less the same as they are with v4+NAT, with the v4 public IP mapping to the v6 subnet. Note that there'
738.
by Dagger2 8y ago
It won't necessarily be for the router. The packet could be addressed to one of the machines on your LAN, in which case nothing NAT does will stop the router from happily forwarding it right through. NAT does nothing to stop a router f
739.
by Dagger2 8y ago
Isn't it? I thought we were talking about NAT, not about RFC1918. Even NAT in combination with RFC1918 doesn't give you security. The use of RFC1918 would certainly limit the set of people that could connect to your LAN machines,
740.
by Dagger2 8y ago
The advantage is that you can be behind a dozen layers of NAT on the v4 side and it doesn't matter so much because 99% of your traffic is going over v6 anyway and anything that needs an inbound connection has the v6 available instead o
741.
by Dagger2 8y ago
It's handled by a separate layer, yes, but that doesn't mean that the routing layer magically disappears. It's still there, and in fact it's still required to forward every single packet that goes through the router. NAT
742.
by Dagger2 8y ago
And then puts you behind CGNAT after they run so low on addresses that they don't even have enough for one per customer, giving you triple NAT with one of the NATs being completely out of your control. Good luck getting anything throug
743.
by Dagger2 8y ago
It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left
744.
by Dagger2 8y ago
There's no requirement for ISPs to allocate /64 blocks. The requirement is that they allocate enough address space for all of their client's networks to use /64s. As such, all recommendations are for /56 at least (w
745.
by Dagger2 8y ago
That's not what the article is saying. They're saying that you still need to provide access to legacy v4-only hosts on the internet somehow, and you either do that via v4 (i.e. dual stack) or by some transition technology of which
746.
by Dagger2 8y ago
It doesn't actually do that though. If you give a machine an IP of X, and then you turn on NAT on the upstream router so that its outbound connections appear to come from Y instead, the machine is still called X . NAT won't preve
747.
by Dagger2 8y ago
64 bits probably wouldn't be enough to let people avoid going into address conservation mode though. Heck, there are way too many ISPs allocating a single /64 in v6 land today , and there's far more space available in v6 tod
748.
by Dagger2 8y ago
Except NAT gives no security, because NAT doesn't block packets. If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor -- it's processed as normal like any other packet would b
749.
by Dagger2 8y ago
If your public address gets a random packet then the packet is addressed to your router, not one of your local devices. This is insecure if the router is providing some insecure service on that port, but otherwise it's irrelevant to th
750.
by Dagger2 8y ago
A stateful firewall isn't a fundamental requirement for NAT though, even modern NAT ("or actually PAT", as other posters seem to like saying...). State tracking is certainly a requirement, but tracking state is separate fro

More ›