Remix.run Logo
Remix clone Hacker News
new | show | ask | jobsGithub
▲ inigyou a day ago

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range.

If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

▲Matuzy a day ago | parent | next [-]

> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range

I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.

▲inigyou a day ago | parent | next [-]

All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range.

The point of IPv6 was to make the addresses so long they are easy to manage.

▲SV_BubbleTime a day ago | parent | next [-]

>The point of IPv6 was to make the addresses so long they are easy to manage.

lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

▲tracker1 a day ago | parent | next [-]

I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even.

Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.

▲DrewADesign a day ago | parent | next [-]

It seems to have absolutely terrible ergonomics as a technology, in nearly every conceivable way.

▲inigyou a day ago | parent [-]

It's literally impossible to avoid long addresses being long or short addresses running out. One of those is a worse problem.

▲DrewADesign a day ago | parent [-]

The length isn’t the only thing that makes the ergonomics suck. The lack of backwards compatibility sucks. The “you don’t have to use NAT anymore” is great theoretically, but it renders a lot of casual network maintainers mental model of network security obsolete without a clear and simple alternative. The shorthand is not intuitive (though it’s not CIDR-level counterintuitive). Really, there’s way too much about working in IPv6 that’s not intuitive with even very solid IPv4 network knowledge.

So yeah, having to relearn a bunch of basic network knowledge that worked just fine for decades is a PITA, and I’m 100% positive a design process that focused more on the people that need to configure networks could have yielded a much friendlier, and therefore a much easier to adopt standard.

▲ndriscoll 19 hours ago | parent | next [-]

Instead of forwarding a port to a specific machine on the NAT page, you allow incoming traffic on that port to that machine on the firewall page. You'll want to add a stable IP to the host (in addition to the SLAAC rotating privacy IP if it already has one. One interface can have multiple addresses). That's pretty much it, except now you can allow the same port to multiple machines, where previously you could only forward to one (helpful for gaming, voip, etc. Wherever p2p works well). Firewall should already default deny incoming traffic just like ipv4.

▲ssl-3 18 hours ago | parent [-]

That sounds easy, but I think you just inadvertently demonstrated the quagmire that many seem to perceive.

Suppose I've got a machine on the LAN and I want to open it up to the world on port 1025 with IPv6.

This can't happen with SLAAC? It has to be a new address? Does the ISP pick the prefix for that address? And one can't centrally-manage that address (because people keep saying that DHCPv6 isn't worth stuffing around with)? What happens when the router fails over to a backup ISP? How does dynamic DNS fit in with all of this?

Those questions don't really exist with IPv4, wherein: One can just set up a static DHCP assignment, forward port 1025, and [optionally] set up dynamic DNS -- and this all happens within the confines of a single home router.

▲ndriscoll 17 hours ago | parent [-]

If it's MAC based SLAAC, it'll be stable, so you could use it. Otherwise you add a stable address. You could use DHCP if you want. If you're using a backup ISP with dynamic DNS, your failover should be the same as ipv4. You can already have ips from both prefixes on the interface. You're also way past clueless home user stage if you have that setup at all, so I can't imagine ipv6 is the stumbling block.

Things would be nicer if NAT66 were used by default for home users though so the question of prefixes would disappear, and it'd perhaps match the "more advanced" home user ipv4 mental model. You'd just use e.g. fd00::2 as your server address.

▲redeeman a day ago | parent | prev [-]

you fling around words like "network maintainers" quite casually, dont you? :)

its really extremely simple, just dont NAT, is that really so hard? just because you dont NAT, doesnt mean you have to let the traffic pass through, that is also an extremely simple concept, no?

▲DrewADesign 20 hours ago | parent [-]

Fling it around?

There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?

▲inigyou 6 minutes ago | parent | next [-]

Actually I think most people really do want that stuff accessible from the internet. Currently that requires a central server and a subscription, but imagine if it didn't. Imagine if you could log into your washing machine from anywhere instead of only when you're at home, and it would keep working even if LG went bankrupt.

▲ssl-3 18 hours ago | parent | prev | next [-]

Lack of NAT doesn't imply lack of firewall, though.

And home routers have firewalls that block inbound connections by default -- including with no-NAT IPv6.

▲DrewADesign 15 hours ago | parent [-]

But lots of people want to do things like open up a few ports for a gaming console. You can obviously do it, but the inside network/outside network/poke a hole/simple ip addresses mental model makes it harder for people to just get frustrated and disable it. Of course absolutely nothing is impossible or more difficult from a technical networking perspective using IPv6. People want to learn as little as humanly possible to solve their problems. If the default easiest path is ‘disable the firewall, and suddenly you can use the LAN pvp mode with your 6th grade classmate’ then you better fucking believe that’s exactly what they’re going to do. The “well it’s not really that complicated” perspective is the main reason adoption of user-facing FOSS is lightyears behind commercial options.

▲inigyou 7 hours ago | parent | next [-]

I have ipv6 here in Europe. The router firewall configuration works basically the same as IPv4 port forwarding. You can add a firewall exception as easily as you can add a port forward. You can also turn the firewall off, globally or per device.

▲redeeman 8 hours ago | parent | prev [-]

how is it a different mental model? instead of opening the port in NAT via forward feature, you open the port in the firewall. it is in fact significantly simpler while overall being the same actions you take when you want to "forward"

▲DrewADesign 29 minutes ago | parent [-]

You’re right. That’s why everybody uses it and nobody is confused by it.

▲inigyou 6 minutes ago | parent [-]

Everyone whose ISP offers it uses it, yes.

▲redeeman 7 hours ago | parent | prev | next [-]

nobody suggests they should be, the ONLY difference is that the routers will block inbound connections by default, and you open your port in the firewall section instead of the shitty router instead of the nat/port forwarding

▲LocalH 19 hours ago | parent | prev [-]

NAT is good. It's CGNAT that's bad, because that's NAT imposed on subscribers, and not NAT that they control.

▲inigyou 7 hours ago | parent [-]

NAT is bad. CGNAT is worse.

▲unethical_ban a day ago | parent | prev [-]

No network is "smaller" than /64. All end-networks are /64.

Split subnets at four bit chunks.

Allocated networks, like to a home or small office, should be /56 or /60.

Then you have to think about link-local addresses and privacy addresses, and how to hand out IPv6 and configure DNS: SLAAC vs. DHCPv6 or some combination.

I have a rough draft of a beginner document but it's not ready. :)

▲zrail a day ago | parent [-]

(Pedantically) Maximum prefix length of /64 is only required if you want/need SLAAC. If you're assigning static addresses or using DHCPv6 for assignment you can go as small as you want. It's not weird to see /127 for tunnel subnets, for example.

▲unethical_ban a day ago | parent [-]

I didn't want to encourage non-standard behavior, but you are correct. Tunnels are a common use the same way /31s can be used in IPv4.

Going smaller than /64 is against best practice and unnecessary. People coming from IPv4 need to understand that trying to be careful with subnet sizing for purposes of preserving space is not a thing in IPv6 below /64. Maybe if a residential user has a /64 from their crappy ISP settings they'd need to do it, but not in a properly configured scenario and certainly not in enterprise.

▲inigyou 7 hours ago | parent [-]

If you have a network full of static addressed servers, you can go as small as you want. For WiFi networks random devices may connect to, you should just let them pick their own address in a /64 with SLAAC. You may choose to also let servers use SLAAC if you want to, in addition to their static address.

▲inigyou a day ago | parent | prev [-]

How many /24s does your organisation have? With IPv6, one block is almost always sufficient.

▲ErroneousBosh a day ago | parent [-]

It's mental that my fairly techy-orientated but otherwise pretty standard UK ISP provides me with a /48 as default.

So I have 1.2 million million million million IPv6 addresses available.

That ought to be enough, eh?

▲kemotep 2 hours ago | parent [-]

Of course, we could hand all 8 billion people on the planet a thousand /48’s each and still have trillions and trillions to spare.

▲inigyou 4 minutes ago | parent [-]

Realistically, allocation is more complicated than that, and there are arguments that the current allocation scheme isn't futureproof enough. But if that happens, there's enough room to change it and still keep all existing allocations working.

▲ConceptJunkie a day ago | parent | prev [-]

The point of IPv6 was to make the addresses so long that we don't run out of them in 20 years or so.

There fixed that for you.

▲ralph84 a day ago | parent | next [-]

The problem is NAT solved the same problem more easily and cheaply. It was at the cost of making it difficult for every host to talk directly to every other host, but it turned out most of the people building networks didn't want that feature anyway.

▲inigyou 7 hours ago | parent [-]

It's been a strong centralisation pressure on the internet. Centralisation is bad.

▲inigyou a day ago | parent | prev [-]

We already ran out of ipv4 about 15 years AGO.

64 bits would be enough to avoid run out, but hierarchical allocation would still be a problem. 128 bits is long enough for many levels of hierarchy. (And yes, you can subnet all the bits, not just the first 64)

▲vitally3643 a day ago | parent | prev | next [-]

The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address.

It's not about low adoption, it's that there are unimaginably many IPv6 addresses.

...which is a major reason for why it has low adoption

▲Matuzy a day ago | parent [-]

Thanks for the reply. I'm reminded every now and then of the magnitude of the address space in v6. Then I do nothing with that information and slowly lose appreciation for the size again :)

▲lukan a day ago | parent [-]

https://xkcd.com/865/

▲unethical_ban a day ago | parent | prev [-]

Respectfully I don't think they explained it well.

fc00::/7 is for "Unique Local Addresses". Basically, private, non-globally-routable addresses from which you can freely pick space. Kind of like RFC1918. It's deliberately huge and you should only use as much from it as you need. The idea being that if you merge with another organization or connect to them via VPN, it's unlikely your addresses will collide like with RFC 1918.

There's even a website (sites?) to register your ULA space on a volunteer basis to reduce collision chances.

▲inigyou a day ago | parent [-]

If you can't remember 192.168 you definitely can't remember a randomly picked ULA. So just use fd00. It's not any worse than 192.168.

▲unethical_ban a day ago | parent [-]

True, I was thinking more about the allocation discussion than the "easy to remember".

Anyone in IT who allocates 1.1.1.0/24 because 192.168.0.0/24 is hard, should be allocated to trash pickup.

▲inigyou 7 hours ago | parent [-]

also easy to remember is 10.anything.anything.anything

▲kowbell a day ago | parent | prev [-]

"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"

▲iso1631 a day ago | parent | next [-]

192.168.0.0/24 -> fd00:0::/64

192.168.1.0/24 -> fd00:1::/64

192.168.2.0/24 -> fd00:2::/64

192.168.240.0/24 -> fd00:240::/64

It's not a great idea, but its no harder.

No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem.

Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.

▲ianburrell 14 hours ago | parent | next [-]

The proper way to do ULA is to generate random 40-bit ID. Then your ULA are likely unique. Which means that if you want to connect or merge with another company, the networks are distinct.

IPv4 has a lot of trouble since everyone is using 10/8 space for corporate networks.

▲inigyou 7 hours ago | parent [-]

If someone can't remember 192.168 they definitely can't remember their own chosen random 40 bits.

▲tracker1 a day ago | parent | prev | next [-]

One thing I don't appreciate... Is the nature of NAT protected my internal/home network before... now, I have to actually configure firewall settings etc. to protect IPv6 issued addresses internally.

I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.

▲tredre3 a day ago | parent | next [-]

> Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6.

SLAAC is the only way that works across all IPV6 devices. In that mode, the router advertises the prefix and the device assigns its own address (prefix + its mac address).

DHCPv6 exists but is poorly supported. It sucks for people who like assigning IPs individually from an authoritative place (through static dhcp entries on the router). But people like us are "doing it wrong", you see? We must accept that in this brave new worlds an IP means nothing.

▲tracker1 a day ago | parent | next [-]

Which doubly sucks in terms of assigning a DNS name to an IP/PC... and/or opening the assignment to less restricted access... feels just problematic to me.

Again, I don't know any of IPv6 enough to use it really right or wrong.

▲inigyou a day ago | parent | prev [-]

And there's always static configuration, useful for servers.

▲inigyou 7 hours ago | parent | prev [-]

Home routers with IPv6 should have this enabled by default, at least by law in Europe, and you can turn it off or add exceptions.

▲SV_BubbleTime a day ago | parent | prev [-]

I doubt any endpoints are entirely ipv6.

So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow.

I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for.

No human said “hey, networking sucks. Please make it much harder at my level!!”.

▲toast0 a day ago | parent | next [-]

> I doubt any endpoints are entirely ipv6.

Lte and 5G can be v6 only, usually they also have NAT64 and DNS64 so you can get everywhere, but the less stuff that needs v4, the smaller their nat boxes are.

▲tracker1 a day ago | parent | prev [-]

I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct.

like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated.

To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.

▲inigyou 7 hours ago | parent | next [-]

AFAIK this was one of several things that was tried, but failed for various reasons. It's called "TUBA" - TCP/UDP with Bigger Addresses - adding extra address bits at a layer above IP so that IP remains compatible.

I think one of the main problems with it is that you have to update the whole internet anyway, just like you do with IPv6, so you make the protocol stack stupider for no real benefit.

▲ianburrell 14 hours ago | parent | prev | next [-]

An alternate to IPv6 would have been to store the NAT addresses in IPv4 somehwere. But the IPv4 options are fragile and normal NAT would likely destroy them. It would still require rewriting all of the networking and software. It would have engrained NAT everywhere and made lots of routing problems, like is that your or mine 10. network.

▲pbhjpbhj 19 hours ago | parent | prev [-]

>limited to 10. and 102.168

I assume you meant 10.x.x.x and 192.168.x.x -- (and 172.16.x.x?), ie the standard subnets for home router-modems (which are non-routing and so can't be used on the internet).

▲inigyou a day ago | parent | prev | next [-]

you can use 1234 if you want, that's also unused space

▲Multicomp a day ago | parent | prev [-]

Agreed 100%! I know there's tough challenges to making this reality, but if https://serverspace.io/about/blog/ipv8-explained-what-we-kno... could be an IRL thing, I would buy company network equipment and use computer OSes that supported this draft standard.

It's a much better compromise and ergonomics to migrate from IPv4 to an IPv4 respecting successor, where IPv6 is just the academic snobbery and utterly alien mental model for not-enough benefits.

For the same reason Unix stuck around and beat up its own successor Plan 9/inferno. That inertia even decades later is the same reason IPv4 still beats IPv6.

IPv8 is more of a linux to unix than a plan 9.

▲inigyou 7 hours ago | parent [-]

ipv8 is a "vibe coded" specification from someone who doesn't understand the problem at all. Just like ipv6, you can't use ipv8 without upgrading the whole internet. The internet is mostly ipv6 capable and not at all ipv8 capable so why do you want to throw away that progress and reset the clock?

It's also just a worse design, centralising a bunch of things and trying to authoritatively define what counts as "a network" on both sides of the communication, unlike v4 and v6 where you just have raw bits and can interpret them how you want. I mean ipv8 defines the internet as a bunch of networks and a network as a bunch of computers. And a network is something that has an ASN. Your computers would be on your ISP's big network, not your small home network because you can't have a network inside a network. It also decreases the number of bits than we already have (in ipv6), limiting futureproofing. It also says every network device will log in with OAuth. Yes, really.