Why you need IPv6

https://blog.ungleich.ch/en-us/cms/blog/2018/05/23/why-you-need-ipv6/

by telmich • 8 years ago

52 90 8 years ago

blog.ungleich.ch

gerdesj• 8 years ago

Bugger off! I am an IPv6 evangelist by the way but feel sold short and here's why:

IPv6 out of the box is not able to safely cope with multiple links to the rest of the internet. For example, you have a 100MB leased line and four FTTC connections to your site - which I happen to have. Each of those links has a IPv6 prefix and for me those are all /56. So far so good - I've got a lot of IPv6 addresses.

So, I use SLAAC to dole out five lots of addresses to my systems. There is no way for my systems to know which links are up or even to decide which ones would be favourite unless I turn everyone into a "router lite" via say OSPF. So I have to use my router to do that and use NPT to do NAT by another name.

IPv6 out of the box does not work properly with multiple links to the internet.

I really do feel quite ashamed when I say that I think IPv6 is badly broken. I deploy the bloody thing because its all we have. I remember that back in the seventies that this internet thing was touted as being able to route around problems due to nuclear attack. That was IPv4. Which is shit.

We have been sold out big style, several times. IPv6 can't cope with multi link without NAT via a different name and telephony has no useful ENUM.

Your internet is not run by genial Engineers. It's fucked up by entrenched monopolies, worldwide.

telmich6• 8 years ago

Can you describe the routing problem a bit more in detail? I'm trying to understand why multi link should be more a problem in IPv6 than in IPv4.

If you are multi homed it sounds as if you should have your own /48 IPv6 network (PI) and then only use the link addresses for routing - but maybe there is something that prevents you from - looking forward to hear your fully story!

hartator2• 8 years ago

I wonder as well. The main downside I have heard about IpV6 until now is that many softwares are not compatible.

yardstick4• 8 years ago

Multi-homed doesn’t help when you have two links to two different ISPs that you want to load balance. You need NAT for that. Also, I haven’t looked at multi-homing costs but I assume they are not free (let me know if I’m wrong). Plus in a small office or retail location, you don’t need a consistent public IP when you aren’t hosting servers (or they are only via VPN).

hossbeast• 8 years ago

How is this particular situation better with ipv4?

lwhalen• 8 years ago

BGP, most likely.

wmf2• 8 years ago

In IPv4 people have accepted that NAT is the best they'll ever get and it's pretty easy to do redneck multihoming by round-robin NATing a private network behind multiple public IPs. In contrast, some people thought IPv6 was going to violate the laws of physics in their favor so they're disappointed that it hasn't happened.

dmayle2• 8 years ago

So... you have multiple advertising routes, and each box has 5 public addresses, and the complaint is that the boxes can't magically decide how to handle all of the different routes?

When it comes to routing, you have two options, delegate or self-manage. In the case of self-management, yes, if you want complex route management, then you'll need software that handles complex route management.

Why not use Stateless DHCP, and configure a machine with short leases that can update the others as needed? It can handle the complex routing, and the clients just have to frequently ask if there are updates.

yardstick4• 8 years ago

In my case, I want to fail over from VDSL to 4G within a couple seconds of VDSL going down. Will short leases cover that?

I also like to load balance traffic on another site with two VDSL links and a 4G backup. I can’t do that without NAT.

daurnimator• 8 years ago

I've got the exact same issue.

The solution when I investigated was to use IPv6 network prefix translation; however most routers do not support it (including Mikrotik routerOS, which is what I mostly use).

So lacking that, instead I've gotten my own AS and am now a 'proper' internet peer.

X-Istence5• 8 years ago

Sounds like you should have your own PI space if you have multiple uplinks, and have that PI space advertised out across all four links. Then you can route packets however/wherever you want using whatever policy you'd like.

chaz6• 8 years ago

This is cost prohibitive, and I doubt most residential ISP's have the capability for this. I would like to have both a cable and a DSL ISP for redundancy but it's far from straightforward with IPv6 (and I have run IPv6 networks for not far off 20 years).

nanamo• 8 years ago

The fact that every device in your network is given a publicly reachable IP address is not something to brag about. It’s a security problem.

I’ll stick to my NAT, thank you.

zlynx• 8 years ago

Implement security properly and stop worrying about it.

If your devices have open services with vulnerabilities. AND You completely forgot or didn't bother to use a firewall. AND Your devices are using permanent instead of temporary IPv6 addresses.

THEN you might have a problem.

But it's more likely that your badly protected IoT devices are downloading their software updates from a HTTP site without SSL or checksum verification while using a DNS vulnerable to cache poisoning.

AstralStorm4• 8 years ago

Temporary v6 addresses are not a security measure, they're a privacy measure. (And a weak one at that.)

An attacker can get route advertisements from your subnet if something is misconfigured on ISP side so they get out and do a tiny bit of inference to figure out which device it is.

AceJohnny2• 8 years ago

NAT accidentally and poorly gives you security through obscurity.

Use a firewall.

zAy0LfpBZLC8mAC17• 8 years ago

No, it doesn't. NAT alone does not prevent inbound connections. You need a stateful firewall in addition to the NAT for that. And if you have that, well, yeah, you obviously don't need NAT.

dorfsmay• 8 years ago

True, although ipv6 adds privacy concern as each device can now be identified by its IP, you need to make sure your OSes are configured to request different IP on each renegotiation.

anderiv2• 8 years ago

This trope needs to die. Just because a device has a publicly-routable IP does not mean that it’s freely-accessible. That’s why we have stateful firewalls.

There are millions of IPv4 systems at large enterprises and educational institutions that have public addresses, and do you think they’re accessible from the internet? Didn’t think so. They’re behind a default-deny stateful firewall, very similar in function to the stateful firewall that’s present on every single consumer router you can buy.

NAT is a hack that breaks things, and imposes un-needed performance bottlenecks.

marvy2• 8 years ago

I'm not so sure that this trope needs to die; it has a grain of truth to it, at least for home users. Consider this situation: I'm browsing the web on my laptop at home. Meanwhile, someone wants to hack into my laptop. Suppose they want to start with a simple port scan. If my ISP only gave me an IPv4 address, the attacker is out of luck: my laptop HAS NO NAME. They can send IP packets to my router, but unless the router itself has unusually serious security holes (such as remote code execution), the router will not send packets to arbitrary ports on my laptop, because there is no way to even ask it to do so. The best they can try to do is inject content into web pages I'm browsing, and https prevents even that.

Now I get IPv6. The attacker now has a perfectly reasonable way to send packets to my laptop. The router's job is to look at these packets and drop some of these packets while not dropping those that I rely on to browse the web, or whatever. Result: I am one bad config away from having my laptop be accessible from the internet.

You mention large enterprises. Sure, they can afford good sys admins. But the average computer user is their own sys admin. Are they ready for this job?

And if you say "yes", then here's the follow-up question: are they ready to administer the use-cases in sliken's comment, and still remain secure? https://news.ycombinator.com/item?id=17140187

zAy0LfpBZLC8mAC17• 8 years ago

public addresses

That is part of the problem. Just as "private addresses".

They are globally unique and globally ambiguous addresses. There is nothing "public" or "private" about them.

Sami_Lehtinen2• 8 years ago

There are several address scopes available. You don't need to use globally unique addresses, if you don't like. This seems to be very common misunderstanding.

* https://en.wikipedia.org/wiki/IPv6_address#Address_scopes

wmf2• 8 years ago

Not really. To access the Internet you either need to use global addresses or you need "illegal" NAT66. And consumer ISPs are definitely giving people global IPv6 addresses by default.

zAy0LfpBZLC8mAC17• 8 years ago

NAT does not prevent inbound connections, and noone is giving devices "publicly reachable IP address". The only thing a sensible IPv6 setup does is that it gives every device a unique address. And the stateful firewall that you also need with IPv4 to prevent inbound connections works just as well with IPv6, so no need to add a pile of NAT crap.

jandrese8• 8 years ago

NAT does not prevent inbound connections

True, but it also doesn't route them anywhere unless you've explicitly configured it to OR there was outbound traffic on that 5-tuple recently, so it's also wrong. The NAT functionality drops the errant packet on the floor just as much as a traditional firewall.

Note: this is referring to dynamic NAT, which is the kind of NAT that every SOHO router supports by default out of the box and is the only kind normal users ever use.

urda• 8 years ago

Stop acting like a NAT is going to save you. Protip: it isn't.

You need proper firewalls, NAT, and physical network design. It's an entire security package, you don't just slap NAT on it and call it done.

blackflame70007• 8 years ago

Could you help me understand some of the weaknesses of NAT vs a firewall? I was under the impression they were almost synonymous

sliken• 8 years ago

I pretty much agree with the article. Seems like quite a few of the .com companies exist because consumers don't have public IP's. With IPv6 suddenly replacing various services are easy. Assuming you have a router, raspberry Pi, or other machine you leave on 24/7.

After all seems like most end user use of the cloud could be replaced by a raspberry Pi. Things like file sharing via dropbox, webcams/security cams, photo sharing/browsing, internet enabled door locks and garage doors, and monitoring temperatures, furnace, AC, solar, power use,

Sure it's a bit of work, but I suspect many would happily run things themselves if there was a community solution that did it well. Last thing anyone wants to do is replace their smarthone because a random vendor died, lost interest, or was purchased. Like say google killing off Revolv after they bought Nest. Not to mention paying even a few $ a month for an internet enabled lock is silly.

blackflame70007• 8 years ago

Not with that measily 480mbps USB controller split between 4USBs and 1 Ethernet. RaspberryPi4 hopefully.

StudentStuff2• 8 years ago

The Raspberry Pi Foundation seems deadset on pushing the same genre of chip from Broadcom forward. I doubt the serious bandwidth limitations (all your I/O going over 1 USB port) or the notable chipset flaws (1GB of ram max) will be amended any time soon. They've had 6 years to fix the Raspberry Pi, yet it still has the same hard limits.

oconnore• 8 years ago

What online service is giving you 480mbps or better?

craftyguy3• 8 years ago

Seems like quite a few of the .com companies exist because consumers don't have public IP's

That only works if you pass around an ugly IP(v6) address. DNS is still a thing, because humans didn't like passing around pure IPv4 addresses, IPv6 addresses are even less human-readable.

throwaway218649• 8 years ago

Your comment makes no sense. No one is passing around IP addresses by hand. It sounds like you have not heard of dynamic DNS, and don't understand how P2P software works.

https://en.wikipedia.org/wiki/AAAA_record

https://en.wikipedia.org/wiki/Dynamic_DNS

https://en.wikipedia.org/wiki/Peer-to-peer

Can you please learn how basic networking works before posting on the topic of IPv6?

zAy0LfpBZLC8mAC17• 8 years ago

They evangelize for IPv6 ... and then they ask for money for a single /64? Seriously?

I would suggest anyone who wants a tunnel should look here:

https://tunnelbroker.net/

Nothing wrong with earning money, but please stop selling broken products.

telmich6• 8 years ago

We absolutely agree: if possible, use free tunnel services.

Unfortunately HE does not work with NAT (sic!), which is why we initially rolled out IPv6 VPNs internally. Also in most combinations you can actually use miredo/teredo, however some of our customer networks block teredo traffic, because they don't want their windows machines to be reachable from the IPv6 internet.

Just curious, why do you think it is a broken to sell IPv6 vpns?

zAy0LfpBZLC8mAC17• 8 years ago

It is broken to sell single /64s, that is not a sensible allocation size across administrative boundaries. A /56 would be the absolute minimum, and really it should be a /48.

magicalhippo2• 8 years ago

My cable ISP added IPv6 some years ago and recently my router finally got stable IPv6 support, so I decided to give it a try.

My use-case was exactly what the article highlights, putting my RPi on the net exposing a service.

As I quickly found out DNS was required, as the IPv6 addresses were just impossible to remember. The prefix I got from the ISP was a far cry from the 2001::42 shown in various articles on IPv6.

Then I discovered the prefix wasn't stable across cable modem reboots, and I used autoconfig on the RPi, so the suffix wasn't stable either. So that meant I dynamic DNS was suddenly a required feature, not an optional thing.

After spending half a day trying and failing to find a dynamic DNS service which supported IPv6 and which supported a client I could successfully and reliably use on my RPi, I gave up and went back to plain old IPv4 and NAT.

telmich6• 8 years ago

That's impressive to hear. If that is still the case, we will implement and offer an IPv6 DDNS service mid future.

Seriously. If you are blocked for using IPv6 by this, we will provide this service and announce it on https://twitter.com/datacenterlight.

magicalhippo2• 8 years ago

Cheers, I'll keep a look out.

Not sure how common it is for "home ISPs" to issue unstable prefixes, but that's what I got so...

wink• 8 years ago

You want to expose services of your home network? You can fiddle around with NAT, hack some proxies and waste a lot of time and energy on this setup.
With IPv6, you can assign every device in your network a public IPv6 address and decide on your router / firewall, which services to expose publicly.

Yeah, I used to think like this. Now I'm older and wiser (grumpier? lazier?) and because with great power comes great responsibility.. and everyone (including me) is running shitty router boxes instead of a perfectly tuned OpenBSD gateway... I think it would be really nice to have it but I'm not sold it will make the internet a safer place, instead it will expose all those IoT devices that can be wormed.

I also wanted to self-host stuff at home. Back when I had access to a basement (and no proper connection) running decent hardware was no problem, now in an apartment even a small silent NAS is annyoing enough already. Also I don't have no high hopes the fiber market in Germany will improve to a point where I can reasonably assume to have more than 10/20Mbit of upstream behind a static IP.

So yeah, this is a freedom for (from my PoV) a few percent of people, the rest won't bother or it will actively cause problems because nobody understands IPv6 firewalling and stuff. (Not you, dear readers, the masses that are happy if their wifi at home works, at all).

Why you need IPv6

Related Stories