Remix.run Logo
hhh 3 hours ago

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

anonymars an hour ago | parent | next [-]

Interesting -- seems like the side effect would be to basically prevent use by the DoD but not really anyone else. Bonus points if they sell a "government" version for higher cost

ec109685 10 minutes ago | parent | prev | next [-]

Yeah I wanted to do that at previous company. Got talked out of it, but it's nice have all those ips available.

accrual an hour ago | parent | prev | next [-]

I also know of a company who does this. The reason in their case is they act as a network concentrator, bridging hundreds of client IP spaces, so this helps them avoid conflicts with their own space without having to NAT constantly. There is still a lot of NAT for the more common ranges.

makr17 37 minutes ago | parent | prev | next [-]

I used to work somewhere that did that. Several of us in Eng pointed out that it was likely impossible to sell anything to DoD personnel since the reply would route internally. But I don't know if it was _fixed_, was still an issue when I left.

ErroneousBosh 2 hours ago | parent | prev | next [-]

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated".

You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

mr_mitm 17 minutes ago | parent | next [-]

I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.

tracker1 33 minutes ago | parent | prev | next [-]

LOL, they should have just used a 10.x space instead if they wanted slightly simpler numbers.

On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.

jabart 2 hours ago | parent | prev | next [-]

Didn't AT&T do that and Cloudflare made them change it when they aquired that space?

tracker1 31 minutes ago | parent | next [-]

I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security.

Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, eventually I'll setup autofailover on my router (OpnSense). For now, I just swap the cables.

hackernudes 13 minutes ago | parent [-]

Quantenna used 1.1.1.1 for RPC to their wifi chip in their SDK by default. Should not have been exposed to global routing but of course people screwed that up.

https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-...

ErroneousBosh 15 minutes ago | parent | prev [-]

Funny enough their problems really began in earnest about seven or eight years ago...

cyanydeez 2 hours ago | parent | prev | next [-]

Sounds like someones on the path to sovereign citizenship. I can't wait for our cyber-sovereign citizenships who deny various IP ranges coming from the government's domain naming system.

inigyou 2 hours ago | parent | prev [-]

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range.

If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

Matuzy 2 hours ago | parent | next [-]

> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range

I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.

inigyou an hour ago | parent | next [-]

All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range.

The point of IPv6 was to make the addresses so long they are easy to manage.

SV_BubbleTime 31 minutes ago | parent [-]

>The point of IPv6 was to make the addresses so long they are easy to manage.

lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

tracker1 27 minutes ago | parent [-]

I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even.

Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.

vitally3643 2 hours ago | parent | prev | next [-]

The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address.

It's not about low adoption, it's that there are unimaginably many IPv6 addresses.

...which is a major reason for why it has low adoption

Matuzy an hour ago | parent [-]

Thanks for the reply. I'm reminded every now and then of the magnitude of the address space in v6. Then I do nothing with that information and slowly lose appreciation for the size again :)

lukan 13 minutes ago | parent [-]

https://xkcd.com/865/

unethical_ban 36 minutes ago | parent | prev [-]

Respectfully I don't think they explained it well.

fc00::/7 is for "Unique Local Addresses". Basically, private, non-globally-routable addresses from which you can freely pick space. Kind of like RFC1918. It's deliberately huge and you should only use as much from it as you need. The idea being that if you merge with another organization or connect to them via VPN, it's unlikely your addresses will collide like with RFC 1918.

There's even a website (sites?) to register your ULA space on a volunteer basis to reduce collision chances.

kowbell 2 hours ago | parent | prev [-]

"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"

inigyou an hour ago | parent | next [-]

you can use 1234 if you want, that's also unused space

iso1631 2 hours ago | parent | prev [-]

192.168.0.0/24 -> fd00:0::/64

192.168.1.0/24 -> fd00:1::/64

192.168.2.0/24 -> fd00:2::/64

192.168.240.0/24 -> fd00:240::/64

It's not a great idea, but its no harder.

No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem.

Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.

tracker1 22 minutes ago | parent | next [-]

One thing I don't appreciate... Is the nature of NAT protected my internal/home network before... now, I have to actually configure firewall settings etc. to protect IPv6 issued addresses internally.

I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.

SV_BubbleTime 27 minutes ago | parent | prev [-]

I doubt any endpoints are entirely ipv6.

So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow.

I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for.

No human said “hey, networking sucks. Please make it much harder at my level!!”.

tracker1 17 minutes ago | parent [-]

I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct.

like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated.

To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.

bflesch 2 hours ago | parent | prev | next [-]

This will trip up most SOC workflows in funny ways, and I like it.

IPs having a global distinction between public/private is a convention, but local routing can widely differ.

Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.

freeone3000 2 hours ago | parent [-]

It’s only a convention in the sense that the IANA is a convention: https://www.iana.org/assignments/iana-ipv4-special-registry/...

192.0.0.0/24, 10/8, 172.16/12, and various other subslices of 192/8 are reserved for local use and are not publicly routable.

kotaKat 3 hours ago | parent | prev [-]

there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs.

22.0.0.0/8 - it's basically free real estate!

walrus01 2 hours ago | parent | next [-]

the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?

xoa 2 hours ago | parent | next [-]

>the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?

Just to chime in agreeing with sibling comments, the issue is when it's not about just your house and you're deep into self-hosted stuff with a lot of different properties and businesses other people's houses all sharing resources. Without a lot of coordination and consideration, which in practice doesn't really happen easily given the adhoc nature such things tend to organically develop out of, and all the random stuff that wants specific addresses at least for setup, it actually gets pretty easy to run into collisions. Allocations typically are definitely inefficient in many respects but also made sense in the context they were first done and of course can be a certain amount of effort to change.

In an ideal world I sorta feel like "IPv6" should have been more along the lines of <12 octet prefix>:<IPv4>, everyone gets a prefix or set of prefixes that they actually own and are consistent worldwide, or at least only change when geographic location changes, and then can just have the entire 32-bit IPv4 space for LAN however they want. Then you only have to care about prefix between LANs and it could all be extremely automated, internally you only need to use something that looks like IPv4 with the network hardware transparently able to handle prefixes for WAN. Backwards compatibility story would be a lot more straight forward too. Oh well.

@kotaKat: that's a great idea and I don't know why I forgot I played with that like 15 years ago. Really handy as a backup space that almost certainly won't collide with any commercial hardware at least.

ErroneousBosh 2 hours ago | parent | prev | next [-]

I work for a large organisation that has various blocks scattered around 10./8, some with highish values for the second octet and some with lowish values, so say 10.129.0.x/24 and 10.3.0.x/24 to pick just two out of a couple of thousand.

But one of our vendor networks uses 10.32.x.x/32 for various radio gateways, and the radios themselves all locally expose (this is where I give away too big a clue as to what I do) 10.0.0.101 as a management address that emits important link status data.

So you can imagine what a godawful bùrach everyone's routing tables are.

kotaKat 2 hours ago | parent | prev [-]

i deal with a lot of nerds that are all interconnected with one another and nobody can agree on a common subnet for their houses when we all decide to exchange routes internally. ;)

webstrand 24 minutes ago | parent | prev | next [-]

I also do this, except 7.0.0.0/8 instead. Its great for not conflicting with hotel wifi dhcp.

cryptonym 3 hours ago | parent | prev [-]

I have seen ISP doing CGNAT on DOD IP space.