HN user
Since starlink supports v6, starlink users can p2p communicate with other v6 users. Both starlink and local carriers don't provide proper legacy connectivity, they are encumbered by cgnat so p2p does not work. Without p2p communications, users are forced into a client-server model and it's much easier to block a small number of servers rather than millions of potential peers.
You can get a large block, split it up and announce it from different places but that doesn't stop someone blocking your larger allocation.
Getting multiple blocks is harder - the RIRs will want justification for this, and would rather give you a single large block than lots of fragmented ones.
Only legacy address space is frequently bought and sold, so it moves between AS#s a lot and is also heavily fragmented.
With v6 this is not the case, a given AS# will typically have a single large allocation and can make it larger if they need to, it won't be sold and moved and an entity can't trade it in to get a different allocation.
Likely very old/outdated hardware. China is heavily pushing v6 and their "great firewall" has no problem with it.
Another issue they may have however is v6 enabling internal p2p communications directly between users whereas legacy addressing with cgnat does not, although they could block this pretty easily if they wanted.
No, but there is a third party FPGA core available which is called 68080, it's used in a modern line of Amiga accelerators and clones.
Singapore has had 10Gbps services available for many years already, for instance see this article from 2016:
https://www.straitstimes.com/tech/pcs/viewqwest-is-latest-to...
Very few people use it because 10gbps equipment carries a pretty hefty price premium over 1gbps and wireless standards could not get anywhere close to it until recently.
Even today with wifi7, you will be hogging a LOT of the available wireless spectrum. In a country like Singapore where most people live in dense apartment blocks the level of congestion is going to mean that you never see anywhere close to the theoretical maximum throughput on any wireless network.
The money would be much better spent helping them catch up to other countries with IPv6 deployment. Singapore has much less IPv6 deployment then its closest neighbor Malaysia, and even lags behind Myanmar:
Any junk that adds itself to auto start without giving users the choice is cancer... It's why Apple added a feature to macOS fairly recently which alerts you whenever something new is added.
This is generally caused by ignorance. Don't understand IPv6 so turn it off without investigating what the actual problem is. Usually it's caused by a broken IPv6 configuration - eg a route being announced but no actual connectivity.
Here IPv6 works perfectly and doesn't cause any problems. Many sites are much faster over v6 than legacy IP. Google stats show 45% of users access google over IPv6 so clearly it's working for all those millions of users too.
If IPv6 is not working you need to fix it, not turn it off.
They are fully compliant, SLAAC is part of the standard whereas DHCPv6 is an optional extra.
DHCPv6 also does not work without RA. DHCPv6 just assigns an address, a routable prefix, dns servers etc, it does not assign a subnet or any routes, you need route advertisements for that.
The point is until everyone moves to IPv6, the rest of us are stuck having to support dual stack - which is expensive (see the recent story about an ISP supporting a tribal reservation who had to spend an extra $300k and wait 11 months to support legacy IP) and introduces complexity/risk.
For a small network it makes no difference, everything is auto configured, mdns is used to lookup names, you can makes your hosts ::1 ::2 etc if you want to. Many ISPs around the world provide IPv6 by default, and users are using it without even realising, so it is being adopted just not fast enough. Global usage is around 42% based on published stats, and is well over 50% in many countries, as high as 80% in some.
IPv6 does provide benefits to end users, it reduces cost for the ISP and makes end to end connectivity viable which opens up a whole new set of opportunities. End to end is immensely beneficial for gaming, voip etc. Having everything centralised because users are encumbered by NAT is a big problem - increased latency, high costs (recouped from the users somehow - eg selling their data), single point of failure, applications which become useless once the central servers are shut down etc.
Not at all, your "local" network is the link-local address space, which legacy IP has no analog of. The link-local space cannot be routed either intentionally or accidentally.
RFC1918 address space IS routable, it just doesn't have a global route. There is nothing to stop devices adjacent to your wan interface (ie other customers) from manually adding a route to your RFC1918 address space via your firewall. Will that traffic be allowed? that depends on the device and its configuration, have you ever tested this scenario? probably not.
NAT is a hack to get around a shortage of address space, nothing more. Once the shortage is gone there's no more need for NAT. That's why although NAT with IPv6 is possible, it's very rarely used because you no longer have any valid reason to use it. If you are think there are any other reasons to use NAT then you need to brush up on your network knowledge because a lot of smarter people than you or I are saying to avoid NAT and designing systems (eg IPv6) to fix the problems it causes.
US government advice is to avoid the use of NAT because of the extra complexity it introduces, which actually reduces security:
https://media.defense.gov/2023/Jan/18/2003145994/-1/-1/0/CSI...
Newspapers still work.. Why are you here at all instead of writing a letter to the editor of your local newspaper with good old pen and paper?
New technology has benefits, if you don't know what they are then you need to learn about them properly. Sticking with old technology because you fear the new is not a good plan.
The way you see legacy IP addresses is also an abstraction layer, their actual form is as a 32bit integer.
The link-local address is generated when you first enable the interface (ie when you load the drivers for your NIC), it won't change unless you manually force it to.
Linux will use EUI-64 if left to its own devices, or privacy extensions if you're using something like networkmanager. This makes sense because a desktop oriented distro will typically use networkmanager while a server oriented distro will not, and having a predictable eui-64 address is usually beneficial for a server.
You're thinking small..
In an organisation of any significant size, remembering legacy IP is much worse than v6.
Chances are you will have lots of disparate legacy blocks, some starting 1.x, some starting 80.x etc. Then you have all the RFC1918 space, and the possibility of overlapping address space in different areas of the business. Then you have to keep track of translations, so an internal address 10.1.1.1 could have an external address of 80.1.1.1 but only on port 25, if you're talking over port 443 then actually the traffic is forwarded to 192.168.1.1 instead.
IPv6 is simpler. You have a single prefix for your company, eg 2001:db8:: Then you split it out in a sensible hierarchical way, for instance 2001:db8:1:: is your facility in the US, 2001:db8:2:: is your facility in Canada etc. Beyond that you go down to VLANs and hosts as needed.
So 2001:db8:2:25::1 is a device in your toronto data center... 80.1.1.1 is where?!?!? 192.168.1.1 is where?!? and which one did you mean?!?!
Then there's no NAT, no address overlap, much simpler. 2001:db8:2:25::1 is the same device wether you're talking to it on port 1 or port 65535. Your firewall rules are simpler and more secure as a result.
Microsoft had a presentation about this, and they are a bigger organisation than most.
If you're only small then you don't care, technologies like SLAAC and MDNS exist for exactly this reason.
There's no reason you wouldn't use a VPN in exactly the same way. Just because devices have routable addresses doesn't mean they will allow connections from arbitrary sources. You can configure them to only allow connections from your IPv6 VPN pool. On the other hand using globally unique IPv6 addresses means your VPN won't conflict with the source network where users are connecting from.
SLAAC can provide DNS configuration, see RFC6106 for instance.
You can do HA in the same way with VRRP or whatever too, as you point out the built in mechanisms are generally better but you don't necessarily have to use them.
The chance of traffic leaking still exists, and does happen a lot with legacy IP too. The difference is that with v6 the traffic will be routed back to you, so you will be able to see it on your border firewalls. With legacy IP, the traffic will be dropped by the ISP or absorbed by the local network so you don't know it's happening and consequently you probably won't try to do anything about it.
Slammer (and other worms) propagated heavily despite NAT. If anything NAT made it worse, because once a single internal host got infected the worm now has a predictable and well known address space to scan for other devices it can infect.
NAT created a false sense of security, while also breaking a lot of other things. It is quite easy for the defaults to be wrong, you can end up with all kinds of unexpected scenarios which make internal hosts reachable - eg outbound traffic could open up inbound traffic on the same port from any source not just the one initially communicated with, UPNP can result in ports being opened, NAT slipstream attacks are another possibility, not to mention the fact that "not routable" and "there is no route" are two different things - someone who is on an adjacent network to your wan interface (ie other customers of the same isp) can easily direct traffic to your internal address space.
What reduced external attacks was not NAT, it was improved defaults - such as windows including a software firewall which blocks inbound connections by default, and unix based systems no longer shipping with large number of services (telnet, rpc, finger etc) enabled by default.
Consumer routers with IPv6 support don't allow unsolicited inbound traffic by default. Good luck scanning an IPv6 block in any case.
Slammer and other worms scanned sequential legacy IP addresses, including the well known and predictable RFC1918 space. This method simply couldn't work with IPv6 because the address space is too large, you would be flooding out huge amounts of traffic for years on end before you happened to hit upon an active device.
IPv6 is better, not worse.
Some are... China, India, Israel all mandate IPv6 support from ISPs in their territory and the equipment they provide to users, as do some others.
The US has mandated IPv6 support for federal contracts since 2009, although they don't get involved outside of those directly providing services to the government itself. They now have plans to go IPv6-only, and eliminate the use of legacy IP within the federal government.
Allocation of legacy address space was always based on first come first served, so developed countries got the lions share of address space and left developing countries with scraps. This creates a severe inequality, and holds developing countries back. This is also why India and China are leading, as they have a huge disparity between their population and the number of legacy addresses available.
Pushing all your traffic through a third party cloud server causes a lot of problems.
It costs that third party real money to run that server...
What happens when they decide to shut if off because they no longer want to bear the costs? Your applications are a ticking timebomb...
What about privacy? What if the operator of that server decides to fund it through selling your data?
Sending your traffic through a third party server adds latency, sometimes a LOT of latency if that server is far away. This is very bad for certain latency sensitive things (gaming, calls etc).
If you're dependent on a third party server then you're screwed if it goes down, even if your own connection is fine.
Doing away with that and going back to peer to peer is MUCH better in most cases.
Most people don't buy their own router, the ISPs bulk buy thousands of routers at a time. The ISPs make up most of the market.
Many of these routers are managed by the ISP using protocols such as TR-069, several ISPs have already been found to not only manage the devices but also monitor certain data including what devices are present.
That requires someone who has the ability to monitor all your traffic - ie the government, your ISP, or a hacker who has infiltrated one of those two.
In this scenario it's a lot more work trying to map out your infrastructure than to try performing a MITM connection against some of your outbound traffic.
IP networking was designed with separate layers, NAT breaks this by having to span multiple layers. Generally NAT gateways only support TCP/UDP, other protocols are simply not supported, which has basically stifled protocol innovation (eg look at SCTP, it has some neat features but is hardly ever used because of NAT).
It gets even worse with higher level protocols like FTP. There is such a thing as FTPS (FTP over SSL) but it's rarely used because if you encrypt the traffic then the NAT gateway can't inspect and rewrite the traffic.
The same is true of IPSEC/ESP, if you have an encrypted TCP packet encapsulated with ESP the NAT gateway can't keep track of which internal host to forward it to because it can't see the source and destination ports.
A normal router does not need to care about anything further up the stack than IP. A firewall does, but even when a firewall doesn't explicitly support a particular protocol you could write a rule allowing any traffic with a particular protocol number between specific hosts is allowed, and anything else denied.
How is anyone going to discover that?
You're going to have a minimum of a /64, noone is going to scan that looking for devices.
Even if they do, your firewall is not going to allow the traffic unless you've explicitly configured it to do so.
The only way someone will discover devices, is by analysing outbound traffic you make. Outbound IPv6 traffic will come from randomised addresses so the addressing information is useless. Other things disclosed by the devices (eg user-agent headers on web browsers and other fingerprintable data) are protocol agnostic.
That's not tracking to you specifically, that's geo location so they're just trying to identify the general area for purposes of showing ads.
With IPv6 chances are your ISP has a single large address block, and then they split out parts of that address space to users in ontario and quebec. Unless the ISP publishes details of where they've allocated those blocks, any external site is just guessing.
With legacy IP chances are they have multiple small fragmented blocks, some of which are routed to ontario and some of which are routed to quebec so they're a bit easier to keep track of unless the ISP decides to move them.
Also when you address changes, the legacy address space is probably quite close to full so your previous address is released and probably taken by another customer fairly quickly. The IPv6 space will be much larger, and so recycling occurs far more slowly.
Either way youtube is just guessing, it only knows that the address space belongs to a canadian isp and it has to use the behaviour of whoever used those addresses last. If the previous user set their browser language to french and searched for french sites, youtube will remember that and is more likely to serve you french ads.
IPv6 actually makes such attacks more difficult, not less.
An attacker looking to be stealthy is not going to blast the network with nmap...
ARP is broadcast, NDP is solicited node multicast so simply by passively listening on the network you will discover nodes in the same layer 2 segment, with v6 and properly configured switches your passive discovery will be a lot more limited.
Other passive techniques would be monitoring things like DNS, and things the host you've compromised is actively communicating with. This isn't any different regardless of the protocol used.
You can also actively communicate with services like DNS or Active Directory and query information about the network, depending on your level of risk.
Just knowing the in-use IPv6 block is useless, the blocks are massive so even just identifying active hosts in a single known IPv6 block is a lot harder than simply scanning the entire RFC1918 legacy address space.
For active discovery, IPv6 is harder to attack - you can't scan the entire address block looking for hosts. The fact that such scans should be detected is exactly the same for either protocol. You also have to consider response time and what an attacker may be able to achieve before your response kicks in.
IPv6 makes it harder for attackers, not easier.
Routable does not mean reachable. A firewall is perfectly capable of controlling traffic between two routable addresses, without the added burden and complexity of having to translate the traffic to/from a non routable address.
The whitehouse has a public address, everyone knows its address and yet random people can't just walk in through the front door.
People assume that RFC1918 is not routable, but that's not the case... It's fully routable, but there is no global route. Have you ever tested routing to your RFC1918 address space from the ISP, or from a customer in the same neighborhood?
On some ISPs, all the customer routers in a given area are placed in a large legacy subnet, so if another customer adds a manual route to RFC1918 space using your router as next hop - the traffic will arrive on the WAN interface of your router. Some routers will actually route this traffic inside.
Have you ever tested this and verified that your router doesn't do this? Probably not, because most people haven't. They just assume that it can't, and get a nasty surprise if someone demonstrates that it can.
Those ISPs are broken and not following the RFCs or RIR guidelines.
There's nothing stopping you from using NAT with IPv6, people just don't do it because the only benefit of NAT is conserving limited address space. NAT on IPv6 just brings all downsides and no benefit because you (should) have no shortage of address space. In any case v6 with nat is no worse than legacy ip with nat, its just stupid because they're forcing a newer and better protocol to run in a degraded mode.
Consumer oriented routers and firewalls do not allow arbitrary inbound IPv6 connections by default, you have to explicitly enable them.
I still don't get scanned over IPv6, despite having a static /56 range for more than 10 years. Everything that's reachable over legacy IP is also reachable over v6, and i have several v6-only devices because i simply don't have enough legacy addresses for everything. Scanning v6 is extremely difficult, while the legacy blocks get scanned continuously.
Modern operating systems are not sitting there with exposed services by default, you have to manually open them up if you want. Simply connecting a win11 box to an open IPv6 connection is not going to get you joined to a botnet like connecting a winxp machine directly to a legacy connection did.
Modern devices are often exposed to hostile networks/users - every time you connect a portable device to a public wifi network you are exposing your device to the operators and other users of the network. Depending how that network is configured, you might be exposed to the internet too. You don't have any separate device between you and the hostile network, you are relying on the configuration of your machine itself.
ISP supplied routers are limited and generally garbage, this is a problem for legacy ip just as much as v6.
Using IP addresses directly is a bad practice in general, it introduced security risks in many scenarios.
SSL - usually cannot verify the cert, defeating the point of SSL SMB - windows will fail over to less secure ntlm auth instead of kerberos
If your using IP addresses instead of hostnames to reference machines, you're doing it wrong.
Also IPv6 is easier to remember in general... We have a single large IPv6 allocation (eg 2001:db8::/32), and everything sits under that in a logical layout. For legacy IP, we have several different allocations in different class A blocks (104.x, 66.x, 62.x etc) plus all the RFC1918 space used internally
A lot of mobile telcos use IPv6, but there are virtually no telcos around the world that don't force the use of some form of NAT (CGNAT, NAT64) for connecting to legacy sites. NAT64 is effectively another form of CGNAT, you only have a proper end to end connection if you're using IPv6 directly.
TMO US has 110 million customers, but they don't have 110 million legacy IP addresses, and most other telcos are in the same boat.