ninkendo

30 ms·

511.
by ninkendo 2y ago
I know people that get a prefix from their RIR, announce it from a cheap $2 VPS in the same data center as their ISP, then just do a quick WireGuard tunnel to it (so sub-millisecond additional latency, ideally) and use that to route packets
512.
by ninkendo 2y ago
How would a packet with a destination IP of my internal RFC1918 address have landed on my WAN interface in the first place? It would require my ISP to have a routing rule that sends it to my router. Is that the threat model you’re thinking
513.
by ninkendo 2y ago
> The most common NAT (PAT) configurations don't deny unsolicited inbound traffic That doesn’t make sense. If I have a single routable IPv4 addresses and 100 machines behind it with RFC1918 addresses, how can any possible router “al
514.
by ninkendo 2y ago
I think I’d mostly agree with you if only one layer of NAT is in play, but in reality we have CGNAT and it makes it supremely difficult to host services without a very cooperative ISP (laughable.) And there are more internet subscribers in
515.
by ninkendo 2y ago
> Nothing stops you […] You just need a decent ISP. I’ll just leave that there. No, I can’t just choose to have a decent ISP. I live in the real world where there’s only one choice where I live, same as a rather large majority of people
516.
by ninkendo 2y ago
I think “and we’re gonna kill NAT too!” is precisely where IPv6 overstepped and started making things worse for itself. It didn’t need to be this way. NAT sounds like a bad idea at first glance, but it doesn’t exist just to alleviate addr
517.
by ninkendo 2y ago
IPv6 certainly hasn’t “won” in the sense that it’s nowhere near where it should have been by now, but I would definitely not say we need to make something else that also isn’t ipv4 and thus also isn’t forward compatible. IPv6 is still the
518.
by ninkendo 2y ago
> Right. But ULAs have ridiculous routing rules Could you elaborate? I’m able to run ULA-only just fine, with one line in my pf.conf to route 1:1 to my GUA prefix. The NAT is stateless. Maybe you’re referring to the fact that typical OS’
519.
by ninkendo 2y ago
I'm starting to notice a pattern in these threads in HN every time IPv6 comes up. It's kinda like the vim/emacs holy war back in the day. I also see it in threads about Rust vs C++. There's a kind of holy war, where peop
520.
by ninkendo 2y ago
> I don't think any reasonable engineer expects that that end would ever be the case, even if it was one of the stated original "dreams" of IPv6. Then imagine my frustration when that'e the exact argument people are g
521.
by ninkendo 2y ago
You’d need more than a /64 from your ISP if you wanted to do a separate guest network with static NAT though. OP was saying ipv6 makes it hard to do a guest network if all you get is a /64 from your ISP, but stateful NAT can fix t
522.
by ninkendo 2y ago
A lot of people seem to think I’m anti-ipv6… I’m not, actually. I run it at home, I evangelize for it, I think it’s the future and the sooner we move to it, the better. It solves real problems, the shortage of addresses being the most obvio
523.
by ninkendo 2y ago
Now try that on an ipv4-only host trying to talk to an IPv6-only address. You can’t, hence, 2 internets. (Yes, I understand there is no other way for a larger address space to exist that doesn’t have this problem. We are in violent agreemen
524.
by ninkendo 2y ago
I guess you really enjoy feeling superior so I’m just going to give you this one. You win. You’re very smart and you know more about router software than I do. (I’ll leave you to ponder whether this changes my point at all, but I don’t thin
525.
by ninkendo 2y ago
Sick burn bro I mean if you’re just going to sling ad-hominems around and invent your own argument so you have a chance at winning it, sure. I’m not aware of the specific RFC’s du jour that are used for auto-configuring routers. But after s
526.
by ninkendo 2y ago
How does ipv6 let me take my IP with me, exactly? Citation needed. I mean, I have WireGuard installed on my phone and I get a tunnel my house wherever I go, but that’s not really the same thing, is it? You’re saying there’s a way for me, wh
527.
by ninkendo 2y ago
I mean it’s not a great answer, but you could always set up a ULA for your guest network and use NAT. :-P But I’m with you on prefix delegation sucking. Prefixes change, and that makes all your devices’ addresses change. ULA’s solve this. B
528.
by ninkendo 2y ago
Ok so try calling my phone at sip://ninkendo.example. Oh, I’m actually not at my house. I’m traveling and my device is moving from one cell tower to the next, getting a new IP address every few minutes. Then I get to my friends ho
529.
by ninkendo 2y ago
> With having a public IP address, PMP enabled on my router, and DNS registration I have this today. That’s cool for you, congratulations. I’m talking about the broader internet at large, and the billions of users on it, and the software
530.
by ninkendo 2y ago
Again with the not reading. Let me try to sum up my position so we can end this whole “nuh uh!” nonsense. IPv6 was designed in a world where we thought we’d have a truly peer-to-peer internet where anyone could just talk to someone else’s d
531.
by ninkendo 2y ago
In what world do you not need to rely on an external service to find information like this? IP addresses change, people move around, etc etc. The topic of discussion right now is peer-to-peer software, which is the quintessential thing that
532.
by ninkendo 2y ago
> Like, say, a SIP client? No, not like, say, a SIP client. You seem pretty intent on not reading my whole comments or something. Mind responding to what I’m saying and not just making up your own arguments? I’m saying “ipv6 alone won’t
533.
by ninkendo 2y ago
Can you pick a specific thing in my post to argue against? I never claimed NAT and firewalls are the same thing. I claimed that whether you’re using IPv4 with NAT, or IPv6 with a default-deny firewall, you can’t have software just “assume”
534.
by ninkendo 2y ago
I’m not talking about SIP, I’m talking about a hypothetical piece of software that an IPv6 proponent may typically claim that is made possible by unique GUA’s for each device. My point is that the GUA alone isn’t enough to make this work, y
535.
by ninkendo 2y ago
If you want to hypothesize a world where we’re all on IPv6 and thus game matchmaking software can take advantage of the unique addresses for every console, you should also admit that the same software could also just use a unique port f
536.
by ninkendo 2y ago
Right but that only leaves that device vulnerable. The other devices are not.
537.
by ninkendo 2y ago
Maybe. In the alternate reality, we probably would have the same threats on the internet as we do today, and the same boneheaded software that misconfigures things, so my guess is that we’d still have consumer firewalls at the gateway that
538.
by ninkendo 2y ago
Please re-read my comment, as it seems like you skimmed it and think I’m making a different point than I did. To use your example: > If I want my game console to allow incoming traffic for game matchmaking, I can then do that My point is
539.
by ninkendo 2y ago
The argument that NAT-busting (firwall-busting?) becomes easier with IPv6 is certainly true, but "easier" isn't necessarily enough to warrant an entirely new protocol suite. If that's the only benefit of IPv6, it doesn&#
540.
by ninkendo 2y ago
Interesting, I haven't read much about that. I've always assumed somebody must have written an RFC to automate how home firewalls should be configurable automatically by software that "wants to" allow incoming connection

More ›