Roses are red, violets are blue, everyone is using IPv6, why aren't you?
Context:
People have been asking for IPv6 Support on GitHub since years (probably a decade by now)
... and someone even got so annoyed that they decided to setup a dedicated website for checking this: https://isgithubipv6.live/
Working in computing for years and this is what I've heard
2000: IPv4 is about to dry up, we really need to start moving to v6!
2005: OH NO THE SKY IS FALLING IPv4 IS ALMOST GONE! IPv6 IN THE NEXT YEAR OR TWO OR THE INTERNET WILL DIE!
2010: WE'RE SERIOUS THIS TIME IPv6 NEEDS TO BE A THING RIGHT NOW! HELP!
2015: Yeah, okay, NAT has served us well so far, but we can only take it so far, we really need v6 to be the standard in the next 5-10 years or we're in trouble!
2020: Um... guys? IPv6? Hello? Anyone? crickets
2024: IPv6ers are now the vegans of networking
this may or may not be satire, just laugh if unsure
As a networker, ipv6 is the future. I'm a fan of it, but I don't really talk about it anymore because there's no point.
I threw in the towel after an ISP messed up so badly that I just couldn't bother anymore.
At a previous job a client I was doing some work for got a new internet connection at a new site, the ISP ran brand new fiber for it. This wasn't a new building or anything, but the fiber was new. They allocated them a static IPv4 thing as usual, and I asked the tech about V6, and they said we would have to take it up with the planning team, so I did. I was involved in the email chain at the end of the sales process to coordinate the hookup. So I asked. After many emails back and forth, I was informed the connection was allocated.
They allocated one single IPv6 subnet directly off of their device. I couldn't even.
For those that don't understand, the firewall we had connected to the device is an ipv6 router. What normally happens, especially in DHCP customer connections, is that the router will use DHCP-PD to allocate a subnet for the router to use on the LAN, and automatically set up a route to say "reach this subnet we allocated for this router, via this router" kind of thing. I'm dramatically simplifying, but that's the gist. In DHCP-PD, the router will also have an IPv6 address on the ISP-facing link to facilitate the connection. In the case of the earlier story, they gave us an entire subnet to communicate between the ISP and the router, and didn't give us a subnet for the client systems inside the network.
I did ask about this and I can only describe their reply as "visible confusion".
I know many who will still be confused by this point are people who have not used IPv6; to explain further: the IP on your local (LAN) systems needs to be a public IP address, because the router no longer does network address translation when sending your data to the internet. So the IP on the router has no bearing on your computer having a connection to the internet over v6. If your local computer does not have a globally unique ipv6 address, you cannot use IPv6. There are ways around this, NAT66 exists but it's incredibly bad practice in most cases. The firewall I was working with didn't really support NAT66 (at least, at the time) and I wasn't really going to set that up.
ISPs are the reason I gave up on IPv6.
I'll add this other story to reinforce it. I'll keep it brief. A different ISP for a different company at a different site entirely. The client purchased a static IPv4 address, and I asked about IPv6, as you do. To preface, I know this company and used them for my own connection at the time. They have IPv6 for residential clients via DHCP-PD. I was told, no joke, that because of the static IPv4 assignment, and how they execute that for businesses, that they couldn't add IPv6 to the connection, at all.
The last thing I want to mention is a video I saw, which is aptly named "CGN, a driver for IPv6 adoption" or something similar. It's a short lecture about the evils of carrier grade NAT, and how IPv6 actually fixes pretty much all the bs that goes with CGN, with fewer requirements and less overhead.
IPv6 is coming. You will prefer IPv4 until you understand how horrific CGN is.
Yep. It was mostly a joke. Mostly. The bungled adoption of v6 plus all the ways we can still leverage v4 is what's keeping v6 from being adopted any time soon, but one day we're going to have to rip off the band-aid and just go for it. Sure, v6 is going to bring its own issues and weirdness, but FUTURE!
I swear it's going to be a generational change where it takes a slow adoption by the younger network people as the older network people slowly retire. Kind of like how racism and sexism has diminished. It wasn't like we changed anyone's mind, just that people held onto it until they died and younger people just said, "The future is now, old man." and moved past it.
"IP address are four sets of numbers with dots in between AND THAT'S HOW I LIKES IT!" - Me, an old network guy
Honestly the fact that I can't remember or type IPv6 addresses is a big reason I haven't bothered figuring it out.
I imagine you sitting there like Scotty, "Give me an ip address, not no colon, not no hexadecimal, and not no bloody double colon. Just 4 numbers between 0 and 255 with a dot in between."
So, my argument here is.... Why the hell are you memorizing IP addresses?
Is your DNS so misconfigured that you're still punching in IPs by hand?
DNS is the solution. Going to "router.domain.local" or whatever your internal domain is, is easier to remember than.... Which subnet am I on again? Is this one 192.168.22.254? Or 192.168.21.1?
Stop punching in numbers like a cave man. Use DNS. You won't even notice if it's IPv6 after that
And what happens when DNS inevitably falls over and I need to fix it?
And when I'm watching IP addresses scroll by, IPv6 ones are a lot harder to read than v4
DNS, by its very nature is redundant. So DNS shouldn't just fall over. If it does, you're doing something wrong.
If you absolutely need to go to IP addresses, they should be documented.
Unless DNS is outright wrong, there should not be an issue.
For scrolling: are you staring at active log files? Who isn't using a syslog aggregator? You can easily look up the IP of whatever device that is interesting and filter the log by that IP.
some super gigabrained chad linux nerd will have written a tool to automatically configure it and have open sourced it.
You could probably just use that. I think like most things in life, the answer is automation.
I wouldn't trust it unless I wrote it myself. And even then maybe not.
well then go and do it manually, surely you as a human wouldn't make any mistakes. Would you?
That's not what an IP is though, that's just dotted representation
All I want to say about this is that the technology specialists, especially in networking, are usually not this opposed to change. Things change for networking and systems folks all the time. We're used to it. Most of the time the hard sell is with the management folks who Green light projects. They don't want to "waste" money on something that "nobody wants".
Legitimately, one company I asked about IPv6 said to me that customers had not requested it, so they haven't spent any time on implementing it.
As if customers know what's good for them....
I see you've worked with my employer
Speaking of being an old man, let me tell you:
"The future is now old man" != "The future is now, old man."
I genuinely tripped over this sentence thanks to the lack of punctuation.
Fixed. Thanks!
Next up, the Oxford comma; Meet the strippers, Hitler and Stalin
The important bit is that almost every major web service is already running fully dual stacked. Azure, Amazon, Meta, CloudFlare, Google.... If it's a commonly known internet company, it's probably ready for IPv6.
There's still plenty that isn't ready, but most well known things have been ready for years at this point.
The fact that almost the entire internet is controlled by those evil companies is really fucking sad. I remember the old days when people, you know, hosted their own shit and used manual load balancing to keep large sites up and working.
I gave it the old college try about 6 months ago. Found out how to send the req for a subnet to my ISP. Configured my opnsense. When it worked, it worked. But it would randomly stop routing regularly. After a lot of troubleshooting determined it was the isp and have up.
Maybe I'll try again in another 6 months.
This is remarkably common. A major factor is how to handle renewals. There appears to either be bugs with the procedure or there's disagreement on how it should be handled. So it will work, for a while, until a renewal needs to happen, then everything goes to shit.
I've directly witnessed this in router/firewall logs. That there's an attempt to renew the DHCP-PD, which does not get a valid reply.
so is there just no standard for renewal? Or are ISPs just refusing to use the standard, for whatever reason?
I can't imagine we don't already have a standard for this shit. I'd be baffled if we didn't. So surely it's just ISPs being their usual, useless selves.
This is less to do with the ISPs and more to do with the implementation of DHCP-PD renewals on various software/hardware devices. I'm not going to point any fingers, but it seems that some vendors don't play very nicely with other vendors.
oh so it's a classic instance of shitty hardware vendors doing shitty software things.
Gotta love technology.
Always has been
CGnat is an abomination.
Thanks for the comment. Kinda confirms my approach (mostly out of laziness) of "I'll do it when the ISP starts pushing it" is the correct one.
I think tech advocacy generally doesn't work, and in the case of IPv6 I can't see it working at all unless they can convince the ISPs to devote a lot more resources to it. But since I'm not an ISP... meh, whatever I guess.
At least you can talk to someone at your ISP who can change things, in 10 years I was literally never been able to contact someone who knows anything about networks in any of the 3 big ISPs here.. all I get is this:
"oh you have speed issue? Let me "refresh" your connection"
"No sir i have no speed issues, I just need to be able to open IPv6 ports"
"Oh trying to changing the cable port?"
"Sigh.. can you transfer me to advanced support plz"
"Sure thing"
Advanced support: "So you having speed issues?"
"No i just need to be able to open IPv6 ports"
"Ah ports, you can do that from your router settings i think"
"No sir, you are the only ISP here where I can't open ports or receive any ICMP on my ipv6"
"Let me see.. i'll refresh your connections"
And it's the same of many different issues, you can't get a hold of anyone who can change anything in any layer about any config. Take it or leave it..
At most, the difference between your experience and mine was that the support I recieved at least understood what IPv6 was, which is likely a function of most of my stories being from business support, rather than residential support.
Almost every time I call I get nowhere. Which is why I've given up. Obviously, someone high up in the technical teams is trying to implement IPv6 with very limited success. So I'm just trying to be patient, as they navigate the hellscape of corporate approvals and get things working.
It's slow going, but at least it's going.
But new IPv4 allocations have run out. I've seen ISPs that won the lottery in the 90s/2000s (when the various agencies controlling IP allocations just tossed them around like they were nothing) selling large blocks for big money.
Many ISPs offer only CGNAT, require signing up to the higher speed/more expensive packages to get a real IP, or charge extra on top of the standard package for one. I fully expect this trend to continue.
The non-move to IPv6 is laziness, incompetence, or the sheer fact they can monetize the finite resource of IPv4 addresses and pass the costs onto the consumer. I wonder which it is.
Apparently it's still cheaper to buy IPV4 blocks than to upgrade all the equipment and IT staff to use 6.
Any (enterprise grade) equipment not capable of 6 that is still in use is a ticking time bomb.
Oooh is that why ipv6 adoption is so regional ( Based on https://www.google.com/intl/en/ipv6/statistics.html ) . Like france ,germany or india having more than 70 % while italy or poland hanging below 20% ? Also judging from this site it seems like ipv6 is actually getting adopted at quite the rapid pace. Even if some regions are faring way worse than the others.
I mean, at least over here, a white IP has been a paid service for as long as I can remember. Absolute majority of people don't need a static IP, which is why we haven't had internet "breaking" because of IPv4 running out.
But this is another interesting thing. Dynamic IP addresses made sense, when we were dialling up for internet, and the internet wasn't the utility it is now.
Back then we'd dial up for a few hours in the evening or weekend. Businesses that didn't have a permanent presence would connect in the day to send/receive emails etc. So, you could have 500 IP addresses to around 1500 users and re-use them successfully.
But now, what is the real point in a dynamic IP? Everyone has a router switched on 24/7 sitting on an IP. What is the real difference, in cost in giving a static IP over a dynamic one? Sure, CGNAT saved them IP addresses. But, with always on dynamic just doesn't make sense. Except, that you can charge for a static IP. The traffic added by the few people that want to run services is usually running against the tide of their normal traffic. So, that shouldn't really be an extra cost to them either.
If everyone that ran a website did the extra work (which is miniscule) to also operate on IPv6, and every ISP did the (admittedly more) work to provide IPv6 prefixes and ensure their supplied routers were configured for it, and that they had instructions to configure it on third party routers, IPv4 would become the minority pretty soon. It seems like it's just commercial opportunity that's holding us back now.
From what I understand about the providers, they really don't like it when you're generating outbound traffic. Sure it's advertised to be symmetrical, but the actual hardware they place here can get bogged down if you start hosting a popular site (or seeding too much).
And of course, if they can charge you for a static IP then defaulting to dynamic is imperative, isn't it? Pretty sure they'd try that with IPv6 too just to keep the income stream.
Regardless, the actual issue with IPv6 around here seems to be that the providers either don't know how to or don't care to implement it properly. Sure I can tick on "IPv6" in my router, but that doesn't mean I have an unbroken chain or routing hardware that supports it connecting me to the great internet.
I've mentioned it elsewhere. Some ISPs here in the UK have a dynamic IPv6 prefix. Want a static one? Sure, pay up.
I suppose to an extent this kind of thing is akin to low cost airlines. Sure you can "technically" get a flight for €15. But once you've made it even remotely bearable you'll be paying around the cost of a full service airline. But, it does make it very hard to have a website doing a proper price comparison.
I suspect it's the same here. I pay a bit more than most ISPs. But for that, I get decent in country support, fixed IPv6 prefix and static IP (I actually have a legacy IP block, but you don't get those included in the base price any more). Whereas plenty of other providers charge less, but will charge you for anything beyond the most basic of connections. It means my ISP always appears at the expensive end of price comparisons.
Yeah, I just checked, getting a static IPv6 here in Russia from my ISP costs ~.4 eur per month. IPv4 is ~1 eur, so you get a discount if you go for v6! Oh and despite my ISP saying they support v6, connection I got doesn't have it at all. Probably whatever hardware they got in my house doesn't know what it is.
a combination of all of these, most likely
IPv4 dried up a long time ago. But it's different for every country. Countries like US and UK simply took over large blocks of IPv4 addresses and countries like Brazil got fucked. So, if you're in a country with a large pool, you won't notice any issues today, but if you're not so lucky, a lot of internet services are not accessible to you because some dickhead got IP banned and that IP is shared by thousands if not millions of users in your country.
The adoption of IPv6 on some segments of the Internet has lessened the crisis around IPv4 availability.
Imho
Ipv4 and peak oil are similar.
We're constantly running out; but every fes years, we figure out a new way to extract more oil/make do with the addresses we currently have.
Someone sells of their underused block, or more people move to the services with excess IP addresses if they need one.
It's a supply and demand situation. We run out of things not only when they are physically exhausted, but also when it's not economically viable to find ways to make more. But when demand increases enough, it will eventually become economically viable again.
critical difference here was also the consumption of oil. It's gone down significantly since then as processes have moved to other materials and more efficient methods of manufacturing, due to the price increase of oil. Likewise, our oil consumption has gone down, and our ability to extract it HAS gone up, just not all that much. The big difference is that there's just more oil that we know about now, than there used to be.
IPV4 addresses are a static pool, that never changes, the only thing that changes is the adoption of them, as certain things move to IPV6 they're still likely to hold IPV4 in some capacity, as IPV6 isn't fully rolled out almost anywhere.
Do you have a source for that? Because this seems to suggest fossil fuel and oil demand might of roughly plateaued the last few years, the dip looks pretty welly correlated to Covid.
IPv4 addresses are a static pool, yes. But we're continually using them more efficiently, the same as Oil. The difference being that Oil has a limit on the amount of energy contained in its chemical bonds, but you could quite happily host 1,000 or 10,000 websites on a single server.
yes sorry, what i meant to say was "the expected usage of oil over time" When a lot of the early to late 90's "we're running out of oil stuff was happening, a lot of predictions would've been based on continued increased usage of oil. Rather than it just randomly plateauing. It's likely that the predicted curve would've have been significantly more exponential than presented.
And we're also talking on a more local scale here, so this would be more centric around a single country, or north america specifically. Or perhaps assuming that third world countries would start industrializing or something. There are any number of factors that could have influenced the potential consumption predictions.
another interesting tidbit, this was also just after the time we thought we were going to build a lot of nuclear power, so arguably that influenced the older variants of the graph as well as the modern consumption of oil for power production, for example.
Yeah but idk about this one. Perhaps at the scale of CDNs and proxy distribution, but generally, i don't see this being very possible, simply because in order for a site to be supported strictly by IPV6 it must be supported by all connecting clients, and considering that most clients today are uh, not IPV6. If you want your service to work, it's going to need to be IPV4. I mean sure internal communications, but those aren't real so you can use any subnet range you want, it makes no difference.
it depends on what you classify as a server, what you define a website as, and how you define the usage of it, but yeah generally, ignoring the fact that this is irrelevant, it's about that simple.
North America is an interesting example here, because North America HIT peak oil once, way back in the 80's, and it was only with the invention of Fracking that it came back.
Once upon a time people debated if virtual hosts were best practice or if that would affect their SEO. We've definitely progressed since then, both to conserve IP addresses, but mainly because DDOS prevention is best done centralised (Looking at you Cloudflare).
it's y2k, but not 2k, it's just y.
The perpetual chicken egg problem of IPv6: many users don't have IPv6 because it's not worth it because everything is reachable via IPv4 anyways because IPv6 only service don't make sense because they will only reach a subset of users because many users don't have IPv6.....
Yes but IPv4 is becoming expensive and it's annoying having to use a middleman to clone github repos on a v6-only VPS
IPv6 is not hard, there is no excuse not to have it
I mean, yes and no. For an individual or individual systems? No, it's not hard. But I used to oversee a WAN with multiple large sites each with their own complex border, core, and campus plant infrastructure. When you have an environment like that with complex peerings, and onsite and cloud networks it's a bit trickier to introduce dual stack addressing down to the edge. You need a bunch of additional tooling to extend your BGP monitoring, ability to track asynchronous route issues, add route advertisements etc. when you have a large production network to avoid breaking, it's more of a nail biter, because it's not like we have a dev network that is a 1-1 of our physical environment. We have lab equipment, and a virtual implementation of our prod network, but you can only simulate so much.
That being said, we did implement it before most of the rest of the world, in part because I wanted to sell most of our very large IPv4 networks while prices are rising. But it was a real engineering challenge and I was lucky to have the team and resources and time to get it done when it wasn't driving an urgent, short timeline need.
Or one could use alternative hosters, or maybe even selfhost git services.
Yeah let me self-host other peoples github repos because github doesn't have IPv6 lmao dude
How about "Let me selfhost my own repos, so other people working with my stuff can use IPv6, as well as be sure no large corporation known for being cancer stands behind it and monitors every thing I do."?
I do 🥰
That doesn't solve the problem of me needing other peoples githubs repos on a VPS with no v4
Honestly this isn't even true anymore. Most major ISPs have implemented dual stack now. The customer doesn't know or care because it's done at the CPE for them.
I use a browser extension which tells me if the site I'm at is 6 or 4 or mixed. In 2024 most major sites support V6. A lot of this is due to CDN supporting it natively.
The fact that GitHub doesn't is quickly becoming the exception.
May I ask which extension you are using?
IPvFoo
https://addons.mozilla.org/en-US/firefox/addon/ipvfoo/
There is a chrome version too.
Thanks.
IPv6 traffic is globally steady at around 37%. So it isn't a majority by far.
https://www.google.com/intl/en/ipv6/statistics.html
Globally it's at about 47% and growing at about 4% per year. If the rate remains unchanged it'll be about a decade for >95%.
But the reality of it is, you don't need global adoption out of the box. You just need majority adoption in the countries you visit, which for me are western countries (north America and Europe) which now have a majority adoption.
If IPv6 is done right you don't even know you have it. If you use a cell phone or a home Internet, there is a high chance you are already using IPv6.
If your ISP supports it
Sure, but my point is that if it is implemented right, you won't even know you're using IPv6 until you check network configuration.
This sums it up. I'm too lazy and there's too little incentive.
I don't have IPv6, but I can still reach IPv6 only sites if I use MullvadVPN (and probably also with other VPN providers).
I’m not using it because by and large it’s not implemented properly on consumer hardware, and my ISP doesn’t care if their IPv6 network is broken.
I've tried multiple times to go IP6 only. I mostly thought, despite my reasonable understanding of IP4, that I was the problem in trying to set it up. I found my dns host was being forgotten multiple times a day, set to something invalid, then it would time out and revert back to the working one. I couldn't figure out how to connect two computers together for Minecraft.
Now I hear it was just garbage consumer hardware and software? Fuck me. So much wasted time and effort to say nothing of believing I had turned into a tech idiot.
You’re not an idiot. You’re using tools that don’t really do what they claim because it wasn’t considered an important use case.
IPv6 is great, but we haven’t seen enough pain yet to really drive adoption on the home LAN.
My solution uses the ISP box to deliver stateless auto conf, and bridging a consumer router. I can’t open ports but at least I get an IP.
Do you have an example? Because it works great on openwrt, dd-wrt, pfsense, opnsense, unifi, mikrotik....and then if you're using the isp equipment it works out of the box.
You’re using open source third party firmware and higher end networking gear as an example. Of course they work. Shitty consumer grade brands aren’t in the same class
You think an asus, linksys, netgear,etc doesnt handle ipv6???
tplink handles it badly ootb, youd need openwrt/ddwrt.
my isp's modem cant handle it well either.
i doubt older asus/linksys/etc devices handle it well either.
TP-link can’t open ports in the v6 firewall neither can Linksys and it doesn’t support DHCP forward so literally was incompatible with my ISP implementation. Some current TP Link router sold at Walmart don’t even have an IPv6 firewall.
Open source works great. Can’t speak to unifi never seen it for sale here.
That is not the case for every country though. In France and Germany for example almost 3/4 of google requests are via IPv6.
That’s good to hear! Very encouraging!
"Everyone is using IPv6"
It's barely supported. Most providers here "offer IPv6", but each has a different gotcha to actually using it, if it works at all and they didn't just route you through hardware that doesn't know what it is.
What's “here”? Here in Germany, mine has it for maybe 10 years or so. Basically since launch day.
And new ISPs only have v6 since all legacy (v4) blocks have been sold years ago.
While you may have IPv6 it doesn’t do anything if the services you utilize don’t support it.
MANY major websites and domains have no IPv6 support. https://whynoipv6.com/
Mordor itself, Russia. Technically, most ISPs support IPv6 here but as I said each has something weird in config that makes using it... Fun. I don't remember specifics since I'm mostly looking at it from consumer side, but I could try finding the article (in russian) that talked about it.
My current connection doesn't have IPv6 at all according to https://ipv6-test.com/, although I'm not 100% if it's because of provider or Cisco AnyConnect blocking shit.
When you when you sign up for internet here, you get a dynamic IP, it's been that way for... As long as I can remember, really. Definitely more than ten years. I know in Moscow people used to get white IPs way back when, but that's long gone. Not really a problem since most people don't host anything.
what do you mean by this? Static IPs?
Yeah, I guess that's a local slang.
huh, weird.
I did not know about that page. Thanks.
It's becoming more and more of a problem I'd think. Blocklists just become longer, so the more an IP is used by random people the less useful it becomes.
I might be completely wrong about this though.
Well, kinda-sorta. I've yet to hit ip block when browsing without a VPN, but VPNs and proxies definitely are getting blocked pretty consistently.
And seeing how wonderful the situation here is right now, I'm pretty familiar with VPNs at this point.
Not at all only. At times you have both IPv6 and IPv4 and other times you can still get IPv4 at no additional cost like when you run your own router or modem. The layperson will be given IPv6 by default, but it's not the only thing you can get.
Yes only. Note that I said “new ISPs”.
The older ISPs already own all IPv4 blocks, so while they can still give them out to private or professional customers, it would be stupid to sell the blocks to competitors.
Why should we care? So address space may run out eventually - that's our ISPs' problem.
Other than that I actually don't like every device to have a globally unique address - makes tracking even easier than fingerprinting.
That's also why my VPN provider recommends to disable IPv6 since they don't support it.
Because people in countries with ISPs that are unable to provide IPv4 (e.g. too expensive) can't access GitHub easily.
than*
Auto-"correct". Thanks, fixed.
the only reason i can think of is cgnatting ipv4 because of depleted pool. otherwise yea.
i believe you can NAT ipv6 too, i mean so you use the router's address only?
Yes you can.
You'd better hope that you can NAT ipv6 because if you aren't behind a CGNAT and then your LAN is completely exposed without a NAT you're very likely going to have devices exploited.
NATs on people's boundary has been doing pretty much all of the heavy lifting for everyone's security at home.
The word you are looking for is firewall not NAT.
NAT does not provide security whatsoever. If the NAT mapped your (internal IP, internal port) to a certain (external IP, external port) and you do not have a firewall enabled, everyone can reach your device by simply connecting to that (external IP, external port).
I haven't seen routers that do not come with IPv6 firewalls enabled by default.
to be fair thats the setup most people run when they open ports.
No the word I'm looking for is the NAT. It was not designed for security but coincidentally it is doing the heavy lifting for home network security because it is dropping packets from connections originating from outside the network, barring of course, forwarded ports and DMZ hosts because the router has no idea where to route them.
Consumer router firewalls are generally trash, certainly aren't layer 7 firewalls protecting from all the SMB, printer, AD, etc etc vulnerabilities and definitely are not doing the heavy lifting.
By and large automated attacks are not thwarted by the firewall but by the one-way NAT.
[Citation needed]
They are literally piggybacking on the netfilter module of Linux. I don't see how that's trash
They are not layer 7 firewalls for the network which are going to be where most the majority of attacks are concentrated. No citation needed unless you believe they are layer 7 firewalls or using something like Snort.
Added some clarification in my first sentence so it makes a bit of sense.
Wait, why are we talking about Layer 7 when NAT and firewalls are Layer 4 at best?
Because, as I said:
The NAT doesn't have to operate at layer 7 to be effective for this because
The point is that the SPI firewalls are not protecting against the majority of the attacks we've seen for decades now from botnets and other arbitrary sources of attacks, except, perhaps targeted DDoSing which isn't the big problems for most home networks. They must worry about having their OS' and software exploited and owned in the background, which doesn't get much of an assist from a router's firewall.
Obviously, this is however true for the NAT since the NAT are going to drop connections originating from outside the network attempting to communicate with that software to exploit it
How is this "dropping packets" not applicable to firewalls, then? You are not just going to casually connect to my IPv6 device as we're speaking. The default-deny firewall in my router does the heavy lifting... just like what NAT did.
Honestly, it just sounds like you need to brush up on networking knowledge. Repeat after me: NAT is not security.
Are you saying that everyone's router's firewall drops all packets from connections that originate from outside of their network?
It's a stateful firewall. It simply drops unsolicited packets.
That's the dumbest thing I've read today... Your ISP is fleecing you and you're happy with it.
What the fuck are you talking about? My ISP supports IPv6 just fine, but following my VPN's advice I disable it (on certain devices at least) for privacy concerns. And it makes exactly zero difference in functionality.
OK, not your ISP, but your VPN is shit.
It's Proton VPN. Lack of IPv6 support is a downer but I wouldn't call them shit.
Edit: maybe elaborate why you deem IPv6 so crucial? As I said: everything works just fine without.
My ISP doesn't provide an IPv6 connection.
Mine provides a connection, but doesn’t expose ports on v6. So I can access v6 services but can’t self-host any.
Huh? With IPv6 you get your own IP address, the ISP doesn't need to know shit about ports. Your address is not behind a NAT anymore, and ports don't need to be forwarded.
Perhaps you mean the ISP set up a firewall that blocks incoming connections? In which case, maybe you can have that firewall disabled? ISP firewalls and "safe browsing" packages are always shit.
To be honest though there might be some aspect to this I don't know.
Honestly, I was there the first time round, when everyone raw dogged the internet on a single modem per PC. I remember Blaster, and talking people through removing it in 60 second bursts as their PCs shut down over and over.
It was carnage. The average user doesn't need open ports on the internet, and they'll only get their elderly machines infected instantly if they did.
No option to disable… that I found, that is.
Time to shift providers. Vote with your wallet
Not always possible. In Spain IPv6 adoption is at like 5%. There's literally no ISP that offers it. I don't even know how that 5% got it, maybe special deals.
Yes just had a look, according to Google countrywide it's 10%. Very low, sadly. Neighboring France at 74% IPv6. Interesting to see the difference even with neighbouring countries.
You have more than one provider in your area?
Sure, in the UK we have very strict rules around competition law and broadband access. Here, fibre businesses lay fibre to premises (and are paid to do so). Then, a customer can order from any number of broadband providers, and the company who originally laid the fibre lease that line out at wholesale prices. The broadband operator runs 'over the top' of whoever installed the fibre.
That way, the fibre installer makes money over time, gently and progressively. All broadband companies and smaller 'Alt-Nets' as we call them, have an equal opportunity to a customer base. Finally the customer has the choice to find services matching their needs and price points. Pay a lot get a lot, pay less get less.
I think I have a choice of 6. Names which come to mind are EE, Vodafone, Virgin, Trooli, Cuckoo and Orange.
Meanwhile, in the US, the government paid ISPs for fiber to be ran and they just pocketed it instead.
Now we've got smaller companies running fiber and charging less for synchronous gigabit than you'd pay for copper 500mb down 5mb up, and ISPs are panicking a bit.
All the fiber maps have big empty zones where apartment complexes are, sadly.
Here in Greece, we have three providers, but I don't want to change, since we pay very little money to the one I am in right now in return of slower speeds (5 Mbps download, 0.5 Upload).
5Mbps? OMG...
While I agree that it's awfully low nowadays, kudos to them if they know that's all they need.
Oh no, a cheap offer! 🙀
5 Mbps is slow enough that it should be considered a free tier, like, basic service for being alive tier.
move providers? Where, to who? There is currently one provider where i live, soon potentially to be two. Though it's not finalized yet, nor constructed, so for all intents and purposes, it's just the one provider.
As soon as fiber covers the final < 0.5% of my city with fiber (🤞 but I doubt it will happen) I'll switch off of cable. Until then I can use cable with one provider or DSL with another.
rose are red, violets are blue, money is the reason we can't have nice things.
Roses in summer, violets in spring, it’s trivially easy this rhyming thing
shitposting properly is the objective, regardless of my rhyming imperative. My post must be shit, in order to get the hits.
Roses are red, violets are blue, sod off.
This is why I hated r/boottoobig
Just remember we got rid of TLS 1.0 the same thing can be done with IPv4. It's time for browser makers to put "deprecated technology" warnings on ipv4 sites.
IPv4 isn't depreciated, it's exhausted. It's still a key cornerstone of our current internet today.
We still have "modern" hardware being deployed with piss-poor IPv6 support (if any at all). Until that gets fixed, adoption rates will continue to be low. Adding warnings will only result in annoying people, not driving for improvement.
Given how poorly adoption has gone so far this might be the only way to get actual fast support rolled out. Piss people off, get change
exhaustion probably also constitutes as "deprecated" once the utility of a system designed to be, well, useful no longer meets the usefulness quotient that it previously provided. Suddenly It's "deprecated technology"
IPv4 should be deprecated, but it's not
genuine question, any reason not to just actually deprecate it then? Like just stop producing hardware that routes IPV4. Chances are there's enough that'll already do IPV4 it won't be a problem, and im sure if you really needed to, you could figure something out.
I'll start using it after I migrate to Wayland.
How do you guys remember IPv6 addresses?
You shouldn't need to remember IP addresses, they invented DNS to solve that problem lol
Even so, the addresses can be even easier to remember because we get a-f as well as digits, my unique local subnet is fd13:dead:beef:1::/60 cause I like burgers haha
You do need to know it when you're working with subnets and routing tables.
Unless you have anything but a flat network structure with everything in one subnet, working with IPV6 is a giant PITA.
I'm curious how you normally deploy since there's a couple of ways to do it, I've mostly dealt with requesting a number of prefixes from the upstream router and delegating to each subnet/VLAN as appropriate, and each time I've done it it's been a breeze
Even if you need static addressing you can just set it manually and DAD will handle it if it ever conflicts with a DHCP address, at least in my experience
It's when you have to set static routes and such.
For example I have a couple of locations tied together with a Wireguard site-to-site VPN, each with several subnets. I had to write wg config files and set static routes with hardcoded subnets and IP addresses. Writing the wg config files and getting it working was already a bit daunting with IPv4, because I was also wrapping my head around wireguard concepts at the same time. It would have been so much worse to debug with IPv6 unreadable subnet names.
Network ACLs and firewall rules are another thing where you have to work with raw IPv6 addresses. For example: let's say you have a Samba share or proxy server that you only want to be accessible from one specific subnet, you have to use IPv6 addresses. You can't solve that with DNS names.
Anyway my point is: the idea that you can simply avoid IPv6's complexity by using DNS names is just wrong.
Yes. However I can just avoid using ipv6 by NATing the fuck out of my network lol. Kick that can!
You don't even have to NAT the fuck out of your network. NAT is usually only needed in one place: where your internal network meets the outside world, and it provides a clean separation between the two as well, which I like.
For most internal networks there really are no advantages to moving to IPv6 other than bragging rights.
The more I think about it, the more I find IPv6 a huge overly complicated mistake. For the issue they wanted to solve, worldwide public IP shortage, they could have just added an octet to IPv4 to multiply the number of available addresses with 256 and called it a day. Not every square cm of the planet needs a public IP.
Assign a DNS name
Is it possible to do that for router/access point running OpenWRT?
I have to try it when I'll be back home.
Edit: turns out that all devices connected to router are accessible from
.lan. I don't remember setting it up, tho.Probably, look into dnsmasq? I believe that was the easiest way with openwrt back in the day.
Thanks
hosts.txt
dns, VPN setups. ETC we live in 2024, there are solutions to this problem.
You can shorten them sometimes, the neatest trifk I saw was putting leetspeak words in the address.
CAFE, BABE, BEEF, DEAD, and of course, 1337.
I'm actually bit sad that I had to move onto a ISP which has zero IPv6 support, as I previously did have IPv6. The last thing I did on that connection was to debug the hell out of my IPv6 code I had developed.
I feel you, moved ISP maybe 3 months ago, only to find out I'm behind CGNAT and no IPv6..
That should simply not be allowed. Cgnat for ipv4 is fine if they also provide proper ipv6
I just upgraded my Lemmy instance's hardware and finally got IPv6 support :D
My isp does t even support ipv6
Cause none of my choices of ISP supports it...
I’m not. I disable it on all Linux machines I manage. And we do not use it at work either.
Last year my ISP forced v6 and disabled the option to set v4 only. I lost the Adgurd Home DNS configuration in all devices. But then learnt a few things and able to use internal ipv6 address for dns although still unable to configure ipv6 in Docker :/
I wish my ISP had ipv6 support to be honest
People use IPv6?
I still don't know anything about it
Just under half of the Internet: https://www.google.com/intl/en/ipv6/statistics.html
You do as well, if you run any operating system newer then the last 10 years.
Same. I have disabled it on my devices since it mostly just causes problems.
I'm using ipv6 when I occasionally connect to Yggdrasil.
And I think I'll use ipv6 if we ever need to build a new earthnet.
It's a fine technology.
What do you do on the yggdrasil network?
Google some sites, visit some empty IRC channels, dream of the future for a bit, then turn it off
I wish there was something more interesting to do there.
whats the problem with IPv4?
IPv6 changed some things. First and foremost it has a huge address space:
Then they simplyfied some things:
And much more
They went just a teeny tiny little bit overboard with the address space. Ipv4 is four groups between 0 and 255, ipv6 is eight groups of four digit hex, 0000 to ffff - e.g the Google DNS ipv4 address is 8.8.8.8. the ipv6 one is 2001:4860:4860:0:0:0:0:8888 (thankfully at least some devices allow using :: to skip all the zeroes, so it's "just" 2001:4860:4860::8888)
But we now have enough ipv6 addresses to give more than 10 billion ipv6 addresses to every single grain of sand on earth, and still have some left over.
They never wanted to worry about address space size again. And this makes subnetting much easier. I have a /56 allocation so I could do 256 /64 subnets. I hope that at some point home routers will have the option for seperate subnets built in. This way you could easily have guest, IoT, work or whatever networks without NAT.
One thing you have to consider though is that the minimum network size that allows autoconf is /64 and that because of the privacy extension a device usually has 3-4 IPv6 adresses.
as is seemingly standard for bit range increases. y2038 is now y2,900,000,000 due to added a silly amount of bits.
In my opinion NAT is a hack that makes lot of things harder than they should be. STUN and TURN are services that are created because there is no easy way to connect two hosts between different NATs. UPnP for port forwarding is another. CG-NAT is even worse. I have heard of so many people having problems with it.
Breadcast is messy. It is like screaming into a room and waiting for an answer. Multicast lets the computer decide if it wants and needs to listen to a specific group message.
IPv4 didn't have cidr from the beginning. They only had classes. IPv6 was designed with complex routing and sub routing in mind.
Their ranges are running dry. Nearly all address spaces are taken, so we will need to migrate eventually. However, since almost everyone still supports both, and ipv4 is much easier to read and maintain, adoption of IPv6 has been slow.
IPV4 has a static ceiling for how many addresses can exist. We're concerningly close to that ceiling already. If we were to run out, internet suddenly becomes a fucking nightmare.
I use IPv6 at home, I selected my last few ISP's because they had IPv6. Left one ISP when they removed IPv6 🤦‍♂️ .
If you can choose ISP choose one that offers IPv6 and let them know why.
Because I can remember an IPv4 address and not a V6 address!
At least they could have added an extra octet to v4 instead of making it garbyremoved looking
You are not expected to remember a v6 address - or even v4 for that matter. They are designed for machines. DNS is designed for humans.
This is a good (and fair) point.
However they still look ugly and scary and intimidating :)
Interesting, github websites/pages support ipv6
github.com doesn't have a AAAA DNS entry. So it's not serving anything directly over IPv6. Likewise, ping -6 github.com fails. So, what are you seeing that is supporting ipv6?
Websites hosted by github pages, like https://2009scape.org or https://pytorch.github.io
That is interesting. I figured they would be something like cloudflare/other redirection for github pages. But the IPv6 address space is github registered.
So, really not sure why they don't have the rest of their site enabled.
Yeah bit of a head scratcher
I would like to use IPv6 but google and MS are having a dick waving contest with competing implementations, as I understand it. So fuck it.
Retardistan is hogging the biggest portion of the IPv4 addresses for themselves. That's why they have the worst IPv6 support. The need arose last in this part of the world.
what
Who??
I think he means the USA
Roses are red, violets are blue, everyone is using IPv6, why aren’t you?
Roses are red, violets are blue, IPv6 costs extra, and that just won’t do
As far as I can tell it's the other ways around: IPv4 is getting more costly
Example: AWS started to charge for IPv4 addresses a few months ago - a IPv4 address now costs around $3.6 per month
Might just be my host. Maybe I need to find another one
"everyone", tell that literally to every isp my country that doesn't even provide ipv6 support.
In the USA they charge extra for IPv6? I'm in the UK and while there are some ISPs that don't provide IPv6 at all, and some that do shitty things like dynamic prefixes on IPv6, I've not seen anyone charging for it.
Likewise, server providers generally don't charge for it. In fact, they will often charge less if you don't need IPv4.
No don’t take shitposts literally. I’ve been using ipv6 for a decade at home now in the USA and I don’t pay extra for it ever. Also why are you assuming this post refers to the us?
There's been other posts about IPv6 and the TL;DR is that while there are shitty implementations everywhere, the USA seems to be ahead of the game of doing it badly, if at all.
The USA is ahead of most nations at about 50% so not sure how you’re coming to that conclusion based off of evidence. Outside of maybe Brazil in the americas on both continents our ipv6 adoption is better than the rest, Canada included.
I reckon I see most IPv6 complainers are from the US though...
In my country, turning on IPv6 is not really something ceremonial, it's just literally clicking on the IPv6 checkbox. The default configurations set in the router are good enough for an average home user, firewalls and all that security jazz are enabled by default.
The DNS didn't break just because I enabled IPv6, nor did my phone apps stop working. Life goes on, and I have gotten rid of that terrible CGNAT. Somehow this is not the case for many US users across multiple ISPs, I have heard IPv6 horror stories from Verizon, Comcast, and AT&T. Like how did you manage to do that?
I mean I’ve been using native dual stack for over a decade and I’m most definitely American. A fun anecdote was I was having issues with clicking on links from Google once and turned out ipv4 was busted but 6 worked fine for half a day. And there really isn’t any turning on ipv6 I get it by default and it’s with the most hated isp Comcast. They’re actually really good about v6 support I’ve not moved off them because of it. It’s literally 10ms faster than 4 lilely due to cgnat.