Comcast Automatically Enabling IPv6 in San Francisco

http://blog.kylemanna.com/ipv6/2015/06/13/comcast-automatically-enabling-ipv6-in-san-francisco/

by 2bluesc • 11 years ago

23 52 11 years ago

blog.kylemanna.com

nemothekid• 11 years ago

Comcast has been doing this for a while, at least in SF. I first noticed, through gmail as well, that I was using ipv6 for atleast 2 years now. I think they started rollout back in 2013.

RyJones• 11 years ago

I got IPv6 from Comcast near Seattle the day after Thanksgiving, 2013. https://www.flickr.com/photos/ryjones/11079544726/

jamescun• 11 years ago

Would have been earlier than that. I subscribed to Comcast in Mountain View in 2012 and received IPv6 addresses.

X-Istence3• 11 years ago

An engineer at Comcast in this nanog video [1] claims they have 60% penetration in their own network for IPv6. Which is excellent news.

[1] https://www.youtube.com/watch?v=EfjdOc41g0s&app=desktop

junto• 11 years ago

What are the security and privacy implications for home users when an ISP simply switches them on?

2bluesc2• 11 years ago

The biggest that comes to mind is that with dual stack IPv6 all the people running through IPv4 anonymizing VPNs will be bypassed for sites that support IPv6. Oops.

IPv6 has some minor privacy extensions too, but likely still allow you to be geolocated.

X-Istence3• 11 years ago

Depends on the CPE, however as long as there is a default firewall, there would no real issues.

The problem I've found is that too many CPE's allow IPv6 inbound without a firewall, so it exposes end clients directly to the internet.

With IPv4 generally there is a default drop all firewall rule.

kstrauser• 11 years ago

I've had native IPv6 in Alameda for a couple of years now. I've had literally no problems, ever, with it and haven't once disabled it or otherwise adjusted my configuration to make a service work.

eeZi3• 11 years ago

In Germany, Unitymedia - the largest cable ISP - did so as well. You don't even get a public IPv4 anymore unless you call them and beg, and apparently they stopped doing even that.

stock_toaster• 11 years ago

Do they run nat64 or something for reaching the ip4'ternet?

Flockster2• 11 years ago

The standard is called Dual-Stack Light, which means you are getting a native IPv6 adress and your IPv4 traffic runs through a carrier-grade NAT. This is necessary, because the cable-providers here in Germany came to late to the Game and got to little IPv4 Chuncks. For normal users this is a good solution, when the NATing service is stable enough. (Sometimes the server is down and you are forced to IPv6 only..) But throug the carrier-grade NAT, you can not run your own services, like a teamspreak server etc.

rdl• 11 years ago

Unfortunately Comcast Business still has extremely limited IPv6 even in areas where Residential has IPv6

ars3• 11 years ago

Comcast enabled it everywhere as far as I know.

I'd like to use IPv6 on my servers but I need fail2ban support first.

simon_vetter• 11 years ago

I would recommend sshguard [1] as a fail2ban replacement. It does much of what fail2ban used to do out of the box and has supported ipv6 for a long, long time.

It is packaged in debian, ubuntu and probably other major distros these days.

[1] http://www.sshguard.net/

simoncion9• 11 years ago

shrug I would recommend deactivating password logins and using only key-based logins.

In the many, many, many months I've had my internet-facing IPv6-enabled SSH servers online, I've only received one bogus SSH connection attempt from an IPv6 address at the University of Michigan.

ars3• 11 years ago

Thanks for the tip! sshguard seems better than fail2ban.

klodolph• 11 years ago

You're going to need to start testing both IPv6 and IPv4 on your servers. An nginx misconfiguration on my server gave clients a redirect loop, but only for IPv6 clients. Analytics show ~15% IPv6 penetration for the last app I made, and it was a bit embarrassing that it was broken at first. Reverse DNS on IPv6 client addresses gave me Comcast host names.

tomjen33• 11 years ago

Or, which is what most places are going to do, turn of AAAA names.

simoncion9• 11 years ago

If you've a correctly configured network, you can disable IPv6 without screwing with DNS. All you have to do to your IPv4-only network is... absolutely nothing.

PhantomGremlin• 11 years ago

I have Comcast (Oregon), but right now I block all IPv6 at my firewall. If/when it's available here, why should I enable it? Why would I care?

This isn't a troll. I'm ignorant of the practical advantages as it has actually been deployed so far. I'd like to know how it improves my life. E.g. will I get a block of addresses, instead of just 1?

BTW, apropos of nothing, we would have never needed IPv6 if there was a charge for IPv4 addresses. Assume $1 per month. Do you think MIT would pay $16,000,000+ per month? Assume $1 per year. Do you think MIT would pay $16,000,000 per year? In either case I think the clear answer would be: NO!

tomjen33• 11 years ago

You can probably get almost all the ipv6 addresses you want. I am not sure why you would block ipv6 exactly, but the saddest thing is that I can't really point you to a good reason to implement ipv6 on a server, seeing as everything has to work with ipv4.

And we can't charge MIT for the ips because they were given away way back when (so they are legally the property of MIT).

simoncion9• 11 years ago

For like, all of the frameworks that the cool kids are using, IPv6 is handled transparently and out of the box.

For the C++ programmer, both the various libcs and Boost have handled IPv6 for a very long time. It's the same story with C#. I would expect it to be similar for other CLR languages. Java? Erlang? Same story.

mitchty• 11 years ago

Why should use enable it? For one, its faster generally, for two it gets more throughput.

If those two aren't enough for you I'm at a loss. Honestly I don't see a future for ipv4, ipv6 simplifies so much. Watch that nanog video posted in this thread, you might be surprised at the view of ipv6.

I've been using ipv6 for years now, zero issues. Also ipv4 charging for addresses is a complete economic hack around a technical issue. Ipv6 gets us away from the hacks, technical or not. Unless you like stuff like carrier grade nats making things like p2p video harder than it need be.

Honestly the inverse should be happening more, drop ipv4 and start doing nat for ipv4 at the gateways that matter.

simoncion9• 11 years ago

Do you use uPnP? Do you do any port forwarding?

If the answer to either of those questions is "Yes", then you should consider activating IPv6, if your ISP supports it.[0]

The most tight-assed ISPs give you a /64 allocation. Because most machines use something called SLAAC, this means that this /64 is enough for a single subnet. The IETF strongly recommends that ISPs hand out at least a /56, but really wants to see /52s being handed out to each customer.

In San Francisco, it seems that Comcast Residential connections get handed out at most a /60. Comcast uses DHCPv6-PD, so your DHCPv6 client needs to ask for the larger allocation. On routers that support IPv6, configuring your client to do this is typically very easy.

As an aside, if you enable IPv6, please don't filter ICMP. ICMP was pretty important in IPv4, and has become absolutely critical in IPv6.

[0] If you use uPnP, you're relying on firewalls on your endpoints for your security anyway -because any host can poke a hole in the NAT at any time-, so activating IPv6 doesn't substantially change your security situation.

zyx321• 11 years ago

The IETF strongly recommends that ISPs hand out at least a /56

I never really understood that. IPv6 has 128 bit addresses, so even at /96 every single customer will have as many addresses as the entire IPv4 space. Why is /64 considered "tight-assed"?

hobarrera6• 11 years ago

Why would they used DHCPv6 instead of SLAAC?

It seems more complex, and I don't see any advantages. SLAAC is like the "default" for IPv6, while DHCP is something on top of it. Plus it's usually not enable out-of-the-box on all devices.

justincormack3• 11 years ago

You should get a /64, ie a gigantic lot of addresses, or more, by default. So all machines are directly addressable. If you eg open the ssh port, you can log in to anywhere directly. eg all my machines at home have AAAA addresses, and so do my VMs hosted externally, and I can log in directly which is much easier.

hobarrera6• 11 years ago

A /56 is the recommendation (and what my ISP gives me), though I wouldn't be surprised if a lot actually use /64 blocks. There's still an enormous amount left anyway.

levifig• 11 years ago

Comcast customer in Maryland here. I've had IPv6 fully enabled for at least 6 months now… :)

techdragon• 11 years ago

this makes me jealous... In Australia all the mobile networks are using carrier grade NAT to avoid using IPv6 ... And there's only one ISP with IPv6 and the others don't care because they already acquired enough IPv4 addresses they can probably survive another decade on IPv4

It's shit.

j0hnj0nes• 11 years ago

Just wait until they have to keep all the metadata by law...

I suspect they will after they realise you can't tie things down in CGNAT

2bluesc2• 11 years ago

Side note, just noticed that Comcast SF broke my /60 prefix delegation that had been working for almost 2 years[1].

Appears to be affecting DSLR[2] users too. Anyone else observe this?

[1] https://gist.github.com/1cec3537f61aefd1d6bc

[2] https://www.dslreports.com/forum/r30112054-IPv6-IPv6-prefix-...

eeZi3• 11 years ago

Apparently, there are Comcast employees on the dslreports.com which actually helped users there. Cool.

Comcast Automatically Enabling IPv6 in San Francisco

Related Stories