The question above for the most part, been reading up on it. Also want to it for learning purposes.
Definitely dual stack if you do. The real benefit of IPv6 is that, supposedly, each of your internal devices can have its own address and be directly accessible, but I don't think anyone actually wants all of their internal network exposed to the internet. My ISP provides IPv6, but only a single /128 address, so everything still goes through NAT.
Setting it up was definitely a learning process - SLAAC vs DHCP; isc's dhcpd uses all different keywords for 6 vs 4, you have to run 6 and 4 in separate processes. It's definitely doable, but I think the main benefit is the knowledge you gain.
Your ISP is doing it wrong, which I guess you already know. I get a /64 net via DHCPv6 for my LAN which is pretty standard.
+1 to dual stack. Too much of the internet is v4 only, missing AAAA, or various other issues. I've also had weird issues where a Google/Nest speaker device would fail 50% of the time and other streaming devices act slow/funky. Now I know that means the V6 net is busted and usually I have to manually release/renew. Happens once every few months, but not in a predictable interval.
Security is different, but not worse IMO. It's just a firewall and router instead of a NAT being added in. A misconfigured firewall or enabling UPnP is still a bad idea with potentially worse consequences.
Privacy OTOH is worse. It used to be that each device included a hardware MAC as part of a statelessly generated address. They fixed that on most devices. Still, each device in your house may end up with a long lived (at least as long as your WAN lease time) unique IP that is exposed to whatever sites you visit. So instead of a unique IP per household with IPv4 and NAT, it's per network device. Tracking sites can differentiate multiple devices in the house across sites.
This has me thinking I need to investigate more on how often my device IPv6 (or WAN lease subnet) addresses change.
I get a fat /48 network, just in case I need one septillion, two hundred and eight sextillion, nine hundred and twenty-five quintillion, eight hundred and nineteen quadrillion, six hundred and fourteen trillion, six hundred and twenty-nine billion, one hundred and seventy-four million, seven hundred and six thousand and one hundred and seventy-six individual IPs.
IPV6 is pretty wild, we could effectively give every service connecting to every client, in every direction, for every single individual bit its own dedicated address without getting anywhere near using that address space.
Just wait until IoT takes off and every key on your keyboard has a unique address
And the biggest disadvantage of IPv6 is that each of your internal devices has its own address and can be directly accessible from outside. So you need to completely rethink how you do security.
Isn't that what tburkhol addressed in their first paragraph? Or are you suggesting further steps than just putting those devices behind NAT? I am not at all trying to be snarky, I actually want to know more about this.
You don't need to use nat on ipv6. Most routers are based on Linux and there you have conntrack.
With that you can configure by default outgoing only connections just like nat and poke holes in the firewall for the ports you want specifically.
Also windows and I think Linux use ipv6 privacy extensions by default. That means that while you can assign a fixed address and run services, it will assign random ip addresses within your (usually) /64 allocation for outgoing connections. So people can't identify you and try to connect back to your ip with a port scanner etc.
All the benefits of nat with none of the drawbacks.
And can be identified/tracked individually by outside entities. In IPv4, a website sees both my device and my kid's device as the same IP. In IPv6 they're different so this just provides more ways for them to track you.
First of all they use much more than the device IP to identify individual devices. IPv4 is no longer all that useful for identification with things like CGNAT being common.
But with IPv6 they'll see my device IP, then they'll see the same device with completely different IP, then again. Same for my kid's device. But again, all of the above applies. It is a concern, but there are much better ways of tracking you anyways.
That's the reason for rcf 4941.
It randomises the host part of your IPv6 address.
There's a bunch of advantages. IPv6 can be useful since your devices can have the same IP both internally and externally. No dealing with port forwarding. No split horizon DNS (where you have different DNS entries for internal vs external). No NAT. No DHCP required for client systems (can just use SLAAC to auto-generate addresses). Much simpler routing. It's a bit faster. Proper QoS.
I used to use Comcast, who actually have very good IPv6 support. They were the first major US ISP to roll out IPv6 to everyone, around 10 years ago. Unfortunately my current ISP doesn't have IPv6, but they're aiming to roll it out this year.
How does that work, having the same IP internally and externally?
A good ISP that supports IPv6 will give you a /64 range. That's a huge number of IPs, 2^64. Easily enough for every device on your network to have a lot of public IPs. If you use Docker or VMs, you could give each one a public IPv6 address.
When every device on your network can have a public IP, there's no longer a reason to have private IPs. Instead, you'd use firewall rules for internal-only stuff (ie allow access only if the source IP is in your IPv6 range).
This is how the internet used to work in the old days - universities would have a large IP range, and every computer on campus would have a public IP.
Of course, you'd still have a firewall on your router (and probably on your computers too) that blocks incoming connections for things you don't want to expose publicly.
A good isp would give you something bigger than a /64 - /56 or /48. something that you can subnet.
wouldn't /64 still leave you with 64 bits for you to do whatever? Ipv6 has a 128 bit address. If you can do subnets with a small usable portion of 32 bits, then you certainly can with a full 64 bits
The smallest recommended IPv6 subnet is /64. The biggest issue you will encounter is that SLAAC will refuse to work on anything smaller, and it just so happens that Android still doesn't support DHCPv6 and will be left without a valid address.
til. Thanks
Android still doesnβt support DHCPv6 and will be left without a valid address.
RFC 7934 explains their reasoning, though it's not exactly an ironclad argument.
Good point - I should have said "at least a /64 range".
For LAN, no. If you have a router NAT'ting traffic and providing DHCP service there's really no need for ipv6. Almost every ipv6 enabled service provides both 6 and 4 usually and NAT figures it out, and many still provide only 4, meaning you can't just get rid of ipv4 entirely.
If your ISP has modernized and is actually providing an ipv6 address, I suppose there's probably a tiny benefit of being able to go ipv6>ipv6 when routing, bust most all devices nowadays can handle NAT translation from ipv4 to ipv6 and vice versa with no routing penalty.
I don't know if there are any ISP's out there who can provide static ipv6 addresses without a NAT router to your entire LAN though.
If you're buying a vps or something ipv6 is easier to get a static address for.
That of course leaves the last good reason: why not? If you're doing homelab hosting stuff why not experiment with ipv6 and fully modernize your network. They suck to type in but it's fun to know your stuff is brand new and using the "best".
I have currently an issue with a WebRTC SFU not working behind a IPv6 to IPv4 translation, at least I suspect that is the cause.
Depends on how you define "worth it". Most selfhosting is done not for worth, but for a hobby.
Hobbies are often worthwhile. Maybe not financially, but often psychologically.
Some times not financially or psychologically, and they also make my wife mad when I fat finger some config.
It's good to learn, because it will become more common as time moves on, particularly if you get into the datacenter/cloud/ISP industry. It's less important for the general home user, but it is important to understand how it works and how to use it safely.
Just treating it like IPV4 with more address space is dangerous though. you need to think differently about security and firewalls as it is as if every device has its own dedicated WAN address and could be open to the internet without you knowing.
Indeed it is good to learn: ipv6.he.net/certification is a free course everybody should take the first 2-3 levels of.
The login credentials you create for that website will allow you to login to their sister site tunnelbroker.net and claim a /48 delegation for your DDNS tunnel, also free, to promote the changeover to v6 from v4, especially for people with dynamic WAN IPS from their ISP and no IPv6.
Can confirm that HE course is good. They've even sent me a free t-shirt after I've completed it.
Nice to meet you, guru!
(Whoops, accidentally hit "Delete" instead of "Edit" and Lemmy doesn't ask for confirmation!! Boo!! I'll try to retype my comment as best I can remember)
I'll buck the trend here and say "Yes, for a home LAN, it's absolutely worth it.
In fact for a home LAN it is more important than in a data centre.
It is absolutely the bees' knees for home and is worth doing."
All of that depends on how your ISP does things.
When I did it, I got a /56, which is sensible and I think fairly common.
If your ISP gives you anything smaller than a /64, (a) your ISP is run by doofuses, but (b) it's going to be a pain and might not be worth it.
(I now live in literally one of the worst countries in the world for IPv6 adoption, so I can't do it any more)
The big benefit to it is that you can have your servers (if you want them to be) publicly reachable.
This means you can use exactly the same address to reach them outside the network as you would inside the network.
Just make one AAAA for them and you can get to it from anywhere in the world (except my country).
When I did it, I actually just set up 2 /64s, so a /63 would have been sufficient (but a /56 is nice).
Maybe you can think of more creative ways of setting up your networks.
Network configuration is a lot of fun (I think).
I had 1 /64 for statically-assigned publicly-reachable servers.
Then I had a separate /64 for SLAAC (dynamic) end-user devices, which were not publicly reachable (firewalled to act essentially like a NAT).
(Sidenote: if you do go to IPv6 for your home network, look into RFC7217 for privacy reasons.
I think it's probably turned on by default for Windows, Android, iOS, etc., these days, but it's worth double-checking)
Sigh... not an ISP, but the service I rent my server from only provides me with a /128. Yes that's right, exactly one IPV6 address and not one more.
Oof, thatβs a very obvious sign they do not understand how IPv6 is supposed to work. At all.
That's less fun.
I believe you've either got to put everything on one SLAAC network (no static IPs), or you've got to use DHCPv6 (with a smaller network size) instead of SLAAC.
Right, everything is on SLAAC. My ISP only delegates /48 ~ /56 to business customers (according to their customer service).
Thankfully, RFC 7217 made SLAAC-only networks sufferable - you don't to expose your MAC address to the entire world for stable addressing.
My ISP dynamically allocates a /64. I don't even know why they do that.
Not having to deal with split horizon dns or nat hairpinning is pretty nice, especially with so many things using DoH with public resolvers nowadays, like android or firefox.
I just put A and AAAA in public dns so things work either ipv4 or ipv6 on the outside. On the inside everything works on and prefers ipv6 so it just works on the inside too. Nothing ever even attempts to use the wrong (public) A record on the inside.
Dual-Stack is usually no problem, but going IPv6-only is a pain, because a suprising amount of services are v4 only. Even NAT64/DNS64 doesn't help everywhere.
IPv6 is the future so I'd say yes. Dual stack is the way to go. If you can get public address block from your ISP thats great. If not I'd recommend HE tunnel or something similar. Just remember to firewall as ever device is reachable in most configurations.
No, I like living in my nat cocoon so I don't have to worry as much about all the devices on my network. Jk it's turned on, but I don't usually enable it on devices
If you don't want your devices to be accessible from the internet, you want a firewall. Treating NAT like a firewall is a bad idea.
But still, if I understand correctly, with NAT you can just use one firewall for your router and with IPv6 you'd need a firewall for each of your devices. This seems like a lot more to manage, right? But maybe I still don't understand the concept of IPv6.
Edit: Apparently I don't understand the concept of IPv6.
That's not correct, but it shouldn't preclude you from applying defence in depth.
Firewall and NAT are separate concepts. You can still have a firewall on your router when using IPv6. I don't know how many consumer-grade routers handle it well though.
Get a firewall. Malicious STUN, ALG DoS attacks, just these things make your NAT router less secure than you think it is.
Thereβs another question: will we ever actually run out of IPv4 addresses, so that cloud providers and ISPs no longer offer them?
That's already happened, which is why some ISPs use CGNAT. CGNAT is "carrier-grade NAT" which means the internet provider does NAT on their network.
Only having CGNAT with no IPv6 is a pain since you can't do any port forwarding. It's double-NAT which slows things down a bit (you use NAT on your network, then your ISP uses NAT on their network).
Some cloud providers also have IPv6-only servers for cheaper. IPv4 address are still available but the price to acquire them is significantly higher than it used to be.
Ah, I never encountered that. I see. Is it mostly in remote areas?
I'm all for IPv6, it's just that there's always something extra you have to do to set it up.
It's really common in cellular connections as well as smaller regional ISPs. I work for a rural fiber co-op with about 50,000 members/customers and we do CGNAT for all our members by default because we only have about 36,000 IPs allocated to us. We also have full ipv6 support as well with every customer getting a /56.
To get a big enough block for all our enterprise/business/residential customers to do 1:1 NAT for ipv4 would probably require an entire /16 which costs somewhere in the neighborhood of 2 million dollars last I checked. And even then we would eventually run out because we are constantly expanding to cover rural areas that have been ignored for decades by the big ISPs. Right now if a member needs a static or routable we just charge 10$ a month, and we have enough in reserve for all our members to operating like this likely until the entire internet abandons ipv4.
Why do some ISPs charge a monthly fee and others a one off fee? I paid one off with my ISP several years ago for my static IPv4.
Honestly I don't have a good answer for that. The ones who charge a one time fee are honestly being pretty generous (depending on the price you paid) considering there are yearly dues to ARIN/RIPE/APNIC/etc for IP allocations depending on their aggregate block size as well as the fact that IPs are generally very valuable right now, and go up in value depending on the block size.
If they have a legacy registration they also don't have to pay those dues, though the downside is they don't get the newer features like RPKI without signing a LRSA/RSA (and therefor paying those dues) and getting their routes certified. Usually doesn't cause an issue as not many peers drop unvalidated BGP prefixes on IPv4.
That being said, if your ISP has been in the game for decades, they probably have owned their blocks for decades and got them for pennies on the dollar when ARIN and other registries were handing out IP addresses like candy. I know the last /24 my company had to buy cost us somewhere in the neighborhood of $14,000 when it was all said and done, and that was just for 256 IPs.
Eventually IPv4 addresses will become so prohibitively expensive, that is what will eventually push mass IPv6 adoption on the ASN side of things.
Thank you that was really informative. I paid <$50 for my IP address in 2015. My ISP has been around since 1990 so I suppose they may have been one of the lucky companies. Not sure if they do RPKI, first I'm learning of it. Maybe they're cross subsidizing from other areas of the business. Their monthly fibre fee isn't the most competitive but the service is reliable and haven't had anything to complain about.
They are a little behind in speeds though. They only offer 900mbps asymmetrical max, while you can get 2, 4 and 8gbit in my area from other providers. I don't need that kind of speed so I'm happy for now.
$50 one time is a great price. We charge our members $10 a month if they request a static. We're also a not for profit coop, so all that money gets either dumped back into network infrastructure and expansion plans, or capital credits for our members.
Living in the APNIC region, we are kinda notorious for being the first region to run out of IPv4 addresses.
The top 3 mobile ISPs in my country here have been doing CGNAT since at least 2014. Cable ISPs are limiting public IPv4 according to plans since at least 2017, i.e. if the download speed of your plan is below 200Mbps , you get CGNATed.
We are severely out of IPv4 addresses.
You've very likely already encountered it if you have a device with a SIM card! Most any mobile provider routes via a CGNAT - it's exceedingly rare for phones to have public IPs.
Not sure which country you're in, but CGNAT is pretty common in some European countries. ARIN had a larger stockpile of IPv4 addresses than APNIC and RIPE, so CGNAT is less common in the USA and Canada. The US is also generally further ahead in terms of IPv6 rollout compared to other countries. One of the largest ISPs, Comcast, has been IPv6-enabled for over 10 years.
There aren't many benefits from using IPv6 on LAN, as far as I can tell, unless you need more addresses than are available in the private address ranges.
And that point you're not in a home, you're in a data center lmao
I mean, if you have around 17 million containers running services, maybe.
@BaldProphet
What's the smallest container around? How much RAM would that take?
edit: FROM scratch let's you run bare binaries on Docker.
Would be very interesting to see how far that could get. What sort of payload/task would be interesting for all those containers? @Sandbag@bdonvr
It's definitely an interesting hypothetical. Some homelabs that I've seen run crazy enterprise gear and are certainly capable of running thousands of very small containers, while others are running repurposed consumer equipment or SBCs like Raspberry Pis with less computing power and RAM.
Of course, in a self-hosted or homelab environment, there would be little utility to running that many network or web services. It would be a neat experiment, though. Seems like the kind of thing that Linus Tech Tips would attempt.
Doesn't need to be a "traditional" container. Modulo noisy-neighbour issues, wasm sandboxing could potentially offer an order of magnitude better density (depending on what you're running; this might be more suited to specific tasks than providing a substrate for a general-purpose conpute service).
@gedhrel
wasm sandboxes can take IPs? Regardless, if we're just talking density, I can put multiple IPs on a single interface or create a ton of virtual interfaces. That's boring, though.
Yes. The sandbox gets whatever capabilities you expose to it.
I'll buck the trend and say "yes, for a home LAN, it is the bees' knees".
I don't do it now because my country (and hence my ISP) does not do IPv6, but for most places it's worth doing.
It depends on how your ISP does it.
When I did it before, my ISP gave me a /56, which is pretty sensible and I think fairly common.
If you get smaller than a /64, (a) your ISP is run by doofuses, but (b) it's going to be a pain and maybe not worth it.
A /56 was much bigger than I needed.
I actually only used 2 /64s, so a /63 would have been fine, but network configuration is fun (I think), so maybe you can get creative and think about different ways of allocating your network.
I had 1 /64 for statically-assigned, publicly reachable servers.
And then I had a separate /64 for SLAAC (dynamic) allocated personal devices (laptops, phones, etc.) which were not publicly-reachable (firewalled essentially to act like a NAT).
(Sidenote, if you are going to use IPv6, I recommend turning on RFC7217 on your devices for privacy reasons.
I think these days it's probably turned on by default for Windows, Android, iOS, etc., but it's worth double-checking)
The big benefit to using IPv6 is that all of your home machines can be (if you want them to be) reachable inside your network or outside your network using exactly the same IP address, which means you can just give them a fixed AAAA and access them from anywhere in the world you like.
If you're into that sort of thing, of course.
It's a lot of fun.
Okay, so manu of these answers are just plain wrong. In short, you shouldn't care as the biggest impact will be to network admins. They are the ones who have to configure routing and handle everything else that comes with new addresses. The rest of the world simply doesn't know or notice whether they are using IPv4 or v6. Business as usual.
If the question is whether you should play with it at home. Sure thing if you have the desire to. It's the future and only a matter of time before it becomes a reality. Said network admins and ISPs have been delaying the transition since they are the ones who have to work it out and putting your entire user base behind single IPv4 NAT is simpler than moving everything to IPv6.
From network admin perspective, yes it's worth moving to IPv6 since network topology becomes far simpler with it. Fewer sub-networks, and routing rules to handle those. Less hardware to handle NAT and other stuff. Problem is, they made the bed for themselves and switching to IPv6 becomes harder the more you delay it. Number of users in past 10 years or so has skyrocketed. Easily quadrupled. We use to have home computers with dial-up. Easy enough, assign IP when you connect, release it on disconnect. Then broadband came and everyone is sitting online 100% of the time. Then mobile phones which are also online 100% of the time. Then smart devices, now cars and other devices start having public internet access, etc. As number of users increases, network admins keep adding complexity to their networks to handle them. If you don't have public IP, just do traceroute and see how many internal network hops you have.
Thereβs a pretty interesting series on the topic at Tall Paul Techβs YouTube channel (hereβs the most recent: https://youtu.be/WFso88w2SiM). He goes into quite a bit of detail over the course of a few videos about how he handled everything and highlights some of the trials and tribulations with the isp. Itβs not a guide per se, but definitely stuff worth thinking through.
The server I have with ovh has ipv6 setup, but only 1 of my VMS on it has an address. It's a lot harder to get your head around then it looks, no NAT. Firewall everything
yes, ill admit i didnt do it myself until recently when I didnt want to do yet-another-nat-entry and decided to join modern networking.
should have done it years ago.
What were the biggest pains? What was surprisingly easier than expected?
worrying my head off about security because in the old days IPv6 had some issues esp with bascially putting every device on your network on the public internet with no firewall.
learned that years ago hardware makers started defaulting to blocking all traffic from the outside when ipv6 is enabled. Once I felt comfortable just turning it on I found it pretty easy to grasp esp when the addresses stopped liking like random junk to my eyes.
Once I knew how things worked actually exposing a specific system or port set to the internet was super easy, much easier than NAT + firewall.
with my ISP. v6 unexpectedly brought a new level of privacy we had not had before. When you geolocate the IPs they show up in ISP datacenters all over the country. One day it looks like we are in VA, the next we are coming out of Seattle. We have yet to notice any speed or routing issues. IPv4 and IPv6 play well together though once you turn on v6 you might find yourself turning it on for more vlans than you planned because you want the features!
Thanks! That was really insightful. I guess I'll give it a try some day, for now everything runs in ipv4 and that runs well haha!
don't touch it till you need/want to. I had a system I wanted to expose to the internet on a vlan buried in my network, so ipv6 looked like the quicker of the 2 options. turned out to be right.
The possibility to have your packets passed through a shorter route compared to IPv4 packets is worth it imo. I have 280 ms ping to the US and I can cut it down to ~250ms by routing my traffic via certain countries with vpn. I really hope widespread IPv6 deployment would optimize global internet routing so my latency would improve even if just a few ms so I don't need to use VPN to override my route manually.
Maybe a silly question: any ideas why there are shorter routes using IPv6?
Fewer hops usually required when using IPv6, which means shorter latency.
Simplified header means less processing time needed to process IPv6 packets, which might improve latency on each hop.
It also supports multicast, but I'm not sure if it can be used to improve routing and latency.
Thanks! Is there something about the larger area space which means there are fewer hops?
I suspect it's more like the workaround used by network operators to scale up IPv4 to serve billions of users necessitate more and more layer of nodes to route your packets through.
Absolutely. I use ipv6 so I can directly reach all my servers. For public facing things I put it on an ipv4 address but for my own internal stuff, ipv6.
Iβm lazy and donβt want to remember more than three digits in an IP address or secure all my devices like theyβre publicly routable so Iβm sticking with IPv4
Same, so I use DNS and a firewall.
DNS
You mean like ~/.ssh/config?
Setup mDNS and you don't have to remember IP addresses anymore.
ssh orangeboats@orangeboats-router.local is thousand times better to memorise.
You could assign short addresses like fd00::1
The number of short IPv6 addresses is smaller than the number of IPv4 addresses, so that's defeating the entire purpose of IPv6. Sooner or later you have to start using the long addresses.
At home? No! Or use fd00::1:1 or fd00::1:1:1
Thank you! I just want to say, I've also been curious about ipv6 every now and again for a long time, and this thread has helped me to understand more.
You're asking if you should use it, while my ISP was working on it in 2017 and then it all got canned when they got bought out :( .
Because devices in your LAN will all be accessible from the internet with IPv6, you need to firewall every device.
It becomes more of a problem for IoT devices which you can't really control. If you can, disable ipv6 for those.
Haha, no not really. IPv6 has the ability to provide public IP address for each device, but that doesn't mean it will have to. Other than number of possible addresses, nothing is different. Routing, firewalls, NATs, etc. All remains the same.
IPv6 doesn't support NAT... Or am I woefully out of date.
But your home router will just firewall like it does already but you don't have NAT as a simple fall back for "security". It does make running internal services much easier as you no long need to port forward. So you can run two webservers on port 80 and they be bother allowed inbound without doing horrible load balance or NAT translation.
IPv6 has NPTv6, which allows you to translate from one prefix into another.
Useful if you've got dual WAN, and can't advertise your own addressing via the ISP. You can use NPTv6 to translate between your local prefix and the public prefixes. But NPTv6 is completely stateless. It's literally a 1:1 mapping between the prefixes.
IPv6 has both NAT66 and NPTv6. (Note that NPTv6 was once called NAT66 too, but I am referring to the "stateful, one-to-many" NAT66 here. Yeah, it's confusing.) NAT66 is more like the traditional stateful NAT that all of us know and understand.
Ipv6 doesn't need NAT
The router does have a firewall but it blocks everything inbound by default. Some routers (at least mine) do not offer the granularity to filter traffic for certain devices (no NAT either). It's either allow all in or nothing.
When you enable IPv6 and switch off the firewall (since you can't host anything otherwise), every device becomes exposed to the internet.
Then unless the devices have a firewall themselves, all is exposed. Not just the web services, ssh and the rest as well.
There was a way around it however but not something everyone will be able to do with their home router. I had to ssh to the router using ISP admin credentials leaked on the internet, then create a file in init.d that loads a custom iptables file with the firewall rules I needed for IPv6. NAT for IPv6 however was not supported by the kennel used for my router.
It's not necessary to firewall every device. Just like how your router can handle NAT, it should be able to handle stateful firewall too.
Mine blocks all incoming connections by default. I can add (IP, port range) entries to the whitelist if I need to host a service, it's not really different to NAT port forwarding rules.
So even though the device has a public address, the route is through the firewall, hence the ability to filter traffic?
Right. Packets still have to go through your router, assuming that your router has firewall turned on, it goes like this:
Your router receives a packet.
It checks whether the packet is "expected" (a "related" packet) - by using connection tracking.
For example, if ComputerA had sent something to ServerX before, and now the packet received by router says "from ServerX to ComputerA", then the packet is let through - surely, this packet is just a reply to ComputerA's previous requests.
If step 2 fails - we know this is a new incoming packet. Possibly it comes from an attacker, which we don't want. And so the router checks whether there is a rule that allows such a packet to go through (the assumption is that since you are explicitly allowing it, you know how to secure yourself.)
If I have setup a firewall rule that says "allow packets if their destination is ComputerB, TCP port 25565", and the received packet matches this description, the router lets it through.
Finally, the packets that the router accepts from the previous steps are forwarded to the relevant LAN hosts.
I understand this part :) I use a fairly complex firewall at work though I only know bits and pieces from reading different manuals. I think the part I didn't understand was how exactly the routing worked differently in IPv4 vs v6. I get that because NAT happens in IPv4, packets can't be routed at all without the firewall/router but I wasn't sure what was the mechanism by which v6 made sure that packets went through the router, especially when you have stuff like v6 DHCP relays.
Ah, I misunderstood your original comment, oops! But yes, IPv6 packets are routed just like IPv4 ones, just without the NAT'ing process i.e. the packet remains untouched the entire trip.
Yes, the firewall is still your transition point from your internal network to your ISP network. Just like with ipv4, you should be configuring your ipv6 firewall to only allow designated traffic into your network from the internet.
The argument for IPv6 that there could be a unique address for 200 devices for every person living on the planet was much more compelling when network security was a more simple space.
Nothing has changed about why that is compelling: NAT sucks and creates nothing but problems.
Network security is almost the same with IPv6.
If you rely on NAT as a security measure you are just very bad at networking.
I mean that, when IPv6 started filtering out to non-specialists, network security wasn't nearly as complex, and nor was the frequency of escalation what it is today. Back when IPv6 was new(ish), there weren't widespread botnets exploiting newly discovered vulnerabilities every week. The idea of maintaining a personal network of internet-accessible devices was reasonable. Now maintaining the security of a dozen different devices with different OSes is a full time job.
Firewalling off subnets and limitting the access to apps through a secured gateway of reverse proxies is bot bad networking. That's all a NAT is, and reducing your attack surface is good strategy.
Wait, ipv6 doesn't require port forwarding to expose something to the internet?
Port forwarding is exclusively a NAT phenomenon.
In IPv6 every device should in theory have a public address - just like how every computer had a public IPv4 address back in the 1980s ~ 1990s.
However, most sensible routers will have a firewall setup by default that blocks all incoming connections for security reasons. You still need to add firewall rules.
This is correct. My router however doesn't have that level of firewall. It's either all allowed or nothing is.
There's no "should in theory". It's only a possibility due to sheer number of possible combinations. No one was ever going to make every device public. It makes absolutely no sense. Why would your company's printer be online or isolated networks or VPNs? There's no point.
IP addressing is just a way to give a globally unique number to each device. It's just a number.
And there wasn't a real public/private distinction when the Internet was still in its infancy. Printers were indeed given "public" addresses because people needed a number for it.
If you don't want your printer to be reachable by the public Internet, use a firewall to block outside connections. If you can use NAT, you certainly can use a firewall. Heck, they are almost the same thing if you have been using the Linux kernel (iptables/nftables handle firewalling and masquerading with the same tool!)
Routability is not the same as reachability. With NAT transversal you can reach my "private" hosts all the same, although you can't route to me because I don't have a public address.
Definitely dual stack if you do. The real benefit of IPv6 is that, supposedly, each of your internal devices can have its own address and be directly accessible, but I don't think anyone actually wants all of their internal network exposed to the internet. My ISP provides IPv6, but only a single /128 address, so everything still goes through NAT.
Setting it up was definitely a learning process - SLAAC vs DHCP; isc's dhcpd uses all different keywords for 6 vs 4, you have to run 6 and 4 in separate processes. It's definitely doable, but I think the main benefit is the knowledge you gain.
Your ISP is doing it wrong, which I guess you already know. I get a /64 net via DHCPv6 for my LAN which is pretty standard.
+1 to dual stack. Too much of the internet is v4 only, missing AAAA, or various other issues. I've also had weird issues where a Google/Nest speaker device would fail 50% of the time and other streaming devices act slow/funky. Now I know that means the V6 net is busted and usually I have to manually release/renew. Happens once every few months, but not in a predictable interval.
Security is different, but not worse IMO. It's just a firewall and router instead of a NAT being added in. A misconfigured firewall or enabling UPnP is still a bad idea with potentially worse consequences.
Privacy OTOH is worse. It used to be that each device included a hardware MAC as part of a statelessly generated address. They fixed that on most devices. Still, each device in your house may end up with a long lived (at least as long as your WAN lease time) unique IP that is exposed to whatever sites you visit. So instead of a unique IP per household with IPv4 and NAT, it's per network device. Tracking sites can differentiate multiple devices in the house across sites.
This has me thinking I need to investigate more on how often my device IPv6 (or WAN lease subnet) addresses change.
I get a fat /48 network, just in case I need one septillion, two hundred and eight sextillion, nine hundred and twenty-five quintillion, eight hundred and nineteen quadrillion, six hundred and fourteen trillion, six hundred and twenty-nine billion, one hundred and seventy-four million, seven hundred and six thousand and one hundred and seventy-six individual IPs.
IPV6 is pretty wild, we could effectively give every service connecting to every client, in every direction, for every single individual bit its own dedicated address without getting anywhere near using that address space.
Just wait until IoT takes off and every key on your keyboard has a unique address
And the biggest disadvantage of IPv6 is that each of your internal devices has its own address and can be directly accessible from outside. So you need to completely rethink how you do security.
Isn't that what tburkhol addressed in their first paragraph? Or are you suggesting further steps than just putting those devices behind NAT? I am not at all trying to be snarky, I actually want to know more about this.
You don't need to use nat on ipv6. Most routers are based on Linux and there you have conntrack.
With that you can configure by default outgoing only connections just like nat and poke holes in the firewall for the ports you want specifically.
Also windows and I think Linux use ipv6 privacy extensions by default. That means that while you can assign a fixed address and run services, it will assign random ip addresses within your (usually) /64 allocation for outgoing connections. So people can't identify you and try to connect back to your ip with a port scanner etc.
All the benefits of nat with none of the drawbacks.
And can be identified/tracked individually by outside entities. In IPv4, a website sees both my device and my kid's device as the same IP. In IPv6 they're different so this just provides more ways for them to track you.
First of all they use much more than the device IP to identify individual devices. IPv4 is no longer all that useful for identification with things like CGNAT being common.
But with IPv6 they'll see my device IP, then they'll see the same device with completely different IP, then again. Same for my kid's device. But again, all of the above applies. It is a concern, but there are much better ways of tracking you anyways.
That's the reason for rcf 4941. It randomises the host part of your IPv6 address.
https://datatracker.ietf.org/doc/html/rfc4941
There's a bunch of advantages. IPv6 can be useful since your devices can have the same IP both internally and externally. No dealing with port forwarding. No split horizon DNS (where you have different DNS entries for internal vs external). No NAT. No DHCP required for client systems (can just use SLAAC to auto-generate addresses). Much simpler routing. It's a bit faster. Proper QoS.
I used to use Comcast, who actually have very good IPv6 support. They were the first major US ISP to roll out IPv6 to everyone, around 10 years ago. Unfortunately my current ISP doesn't have IPv6, but they're aiming to roll it out this year.
How does that work, having the same IP internally and externally?
A good ISP that supports IPv6 will give you a /64 range. That's a huge number of IPs, 2^64. Easily enough for every device on your network to have a lot of public IPs. If you use Docker or VMs, you could give each one a public IPv6 address.
When every device on your network can have a public IP, there's no longer a reason to have private IPs. Instead, you'd use firewall rules for internal-only stuff (ie allow access only if the source IP is in your IPv6 range).
This is how the internet used to work in the old days - universities would have a large IP range, and every computer on campus would have a public IP.
Of course, you'd still have a firewall on your router (and probably on your computers too) that blocks incoming connections for things you don't want to expose publicly.
A good isp would give you something bigger than a /64 - /56 or /48. something that you can subnet.
wouldn't /64 still leave you with 64 bits for you to do whatever? Ipv6 has a 128 bit address. If you can do subnets with a small usable portion of 32 bits, then you certainly can with a full 64 bits
The smallest recommended IPv6 subnet is /64. The biggest issue you will encounter is that SLAAC will refuse to work on anything smaller, and it just so happens that Android still doesn't support DHCPv6 and will be left without a valid address.
til. Thanks
RFC 7934 explains their reasoning, though it's not exactly an ironclad argument.
Good point - I should have said "at least a /64 range".
old post, but I so wonder why you got downwoted for saying it like it is. a good isp will give you a /56, the minimum best practice. a great isp will give you a /48 you'r router will also participate in the wan /64, but that is just the uplink, and not something that will be used on the lan. https://www.ripe.net/publications/docs/ripe-690/#4--size-of-end-user-prefix-assignment---48---56-or-something-else-
For LAN, no. If you have a router NAT'ting traffic and providing DHCP service there's really no need for ipv6. Almost every ipv6 enabled service provides both 6 and 4 usually and NAT figures it out, and many still provide only 4, meaning you can't just get rid of ipv4 entirely.
If your ISP has modernized and is actually providing an ipv6 address, I suppose there's probably a tiny benefit of being able to go ipv6>ipv6 when routing, bust most all devices nowadays can handle NAT translation from ipv4 to ipv6 and vice versa with no routing penalty. I don't know if there are any ISP's out there who can provide static ipv6 addresses without a NAT router to your entire LAN though.
If you're buying a vps or something ipv6 is easier to get a static address for.
That of course leaves the last good reason: why not? If you're doing homelab hosting stuff why not experiment with ipv6 and fully modernize your network. They suck to type in but it's fun to know your stuff is brand new and using the "best".
I have currently an issue with a WebRTC SFU not working behind a IPv6 to IPv4 translation, at least I suspect that is the cause.
Depends on how you define "worth it". Most selfhosting is done not for worth, but for a hobby.
Hobbies are often worthwhile. Maybe not financially, but often psychologically.
Some times not financially or psychologically, and they also make my wife mad when I fat finger some config.
It's good to learn, because it will become more common as time moves on, particularly if you get into the datacenter/cloud/ISP industry. It's less important for the general home user, but it is important to understand how it works and how to use it safely.
Just treating it like IPV4 with more address space is dangerous though. you need to think differently about security and firewalls as it is as if every device has its own dedicated WAN address and could be open to the internet without you knowing.
Indeed it is good to learn: ipv6.he.net/certification is a free course everybody should take the first 2-3 levels of.
The login credentials you create for that website will allow you to login to their sister site tunnelbroker.net and claim a /48 delegation for your DDNS tunnel, also free, to promote the changeover to v6 from v4, especially for people with dynamic WAN IPS from their ISP and no IPv6.
Can confirm that HE course is good. They've even sent me a free t-shirt after I've completed it.
Nice to meet you, guru!
(Whoops, accidentally hit "Delete" instead of "Edit" and Lemmy doesn't ask for confirmation!! Boo!! I'll try to retype my comment as best I can remember)
I'll buck the trend here and say "Yes, for a home LAN, it's absolutely worth it. In fact for a home LAN it is more important than in a data centre. It is absolutely the bees' knees for home and is worth doing."
All of that depends on how your ISP does things. When I did it, I got a /56, which is sensible and I think fairly common. If your ISP gives you anything smaller than a /64, (a) your ISP is run by doofuses, but (b) it's going to be a pain and might not be worth it. (I now live in literally one of the worst countries in the world for IPv6 adoption, so I can't do it any more)
The big benefit to it is that you can have your servers (if you want them to be) publicly reachable. This means you can use exactly the same address to reach them outside the network as you would inside the network. Just make one AAAA for them and you can get to it from anywhere in the world (except my country).
When I did it, I actually just set up 2 /64s, so a /63 would have been sufficient (but a /56 is nice). Maybe you can think of more creative ways of setting up your networks. Network configuration is a lot of fun (I think).
I had 1 /64 for statically-assigned publicly-reachable servers. Then I had a separate /64 for SLAAC (dynamic) end-user devices, which were not publicly reachable (firewalled to act essentially like a NAT). (Sidenote: if you do go to IPv6 for your home network, look into RFC7217 for privacy reasons. I think it's probably turned on by default for Windows, Android, iOS, etc., these days, but it's worth double-checking)
Sigh... not an ISP, but the service I rent my server from only provides me with a /128. Yes that's right, exactly one IPV6 address and not one more.
Oof, thatβs a very obvious sign they do not understand how IPv6 is supposed to work. At all.
My ISP delegated me only one /64.
That's less fun. I believe you've either got to put everything on one SLAAC network (no static IPs), or you've got to use DHCPv6 (with a smaller network size) instead of SLAAC.
Right, everything is on SLAAC. My ISP only delegates /48 ~ /56 to business customers (according to their customer service).
Thankfully, RFC 7217 made SLAAC-only networks sufferable - you don't to expose your MAC address to the entire world for stable addressing.
My ISP dynamically allocates a /64. I don't even know why they do that.
Not having to deal with split horizon dns or nat hairpinning is pretty nice, especially with so many things using DoH with public resolvers nowadays, like android or firefox.
I just put A and AAAA in public dns so things work either ipv4 or ipv6 on the outside. On the inside everything works on and prefers ipv6 so it just works on the inside too. Nothing ever even attempts to use the wrong (public) A record on the inside.
@duncesplayed
You can always tunnel if your ISP won't play nice: https://tunnelbroker.net/
@Sandbag
Dual-Stack is usually no problem, but going IPv6-only is a pain, because a suprising amount of services are v4 only. Even NAT64/DNS64 doesn't help everywhere.
IPv6 is the future so I'd say yes. Dual stack is the way to go. If you can get public address block from your ISP thats great. If not I'd recommend HE tunnel or something similar. Just remember to firewall as ever device is reachable in most configurations.
No, I like living in my nat cocoon so I don't have to worry as much about all the devices on my network. Jk it's turned on, but I don't usually enable it on devices
NAT is not a security feature.
Thank you!!
If you don't want your devices to be accessible from the internet, you want a firewall. Treating NAT like a firewall is a bad idea.
But still, if I understand correctly, with NAT you can just use one firewall for your router and with IPv6 you'd need a firewall for each of your devices. This seems like a lot more to manage, right? But maybe I still don't understand the concept of IPv6.
Edit: Apparently I don't understand the concept of IPv6.
That's not correct, but it shouldn't preclude you from applying defence in depth.
Firewall and NAT are separate concepts. You can still have a firewall on your router when using IPv6. I don't know how many consumer-grade routers handle it well though.
Get a firewall. Malicious STUN, ALG DoS attacks, just these things make your NAT router less secure than you think it is.
Thereβs another question: will we ever actually run out of IPv4 addresses, so that cloud providers and ISPs no longer offer them?
That's already happened, which is why some ISPs use CGNAT. CGNAT is "carrier-grade NAT" which means the internet provider does NAT on their network.
Only having CGNAT with no IPv6 is a pain since you can't do any port forwarding. It's double-NAT which slows things down a bit (you use NAT on your network, then your ISP uses NAT on their network).
Some cloud providers also have IPv6-only servers for cheaper. IPv4 address are still available but the price to acquire them is significantly higher than it used to be.
Ah, I never encountered that. I see. Is it mostly in remote areas?
I'm all for IPv6, it's just that there's always something extra you have to do to set it up.
It's really common in cellular connections as well as smaller regional ISPs. I work for a rural fiber co-op with about 50,000 members/customers and we do CGNAT for all our members by default because we only have about 36,000 IPs allocated to us. We also have full ipv6 support as well with every customer getting a /56.
To get a big enough block for all our enterprise/business/residential customers to do 1:1 NAT for ipv4 would probably require an entire /16 which costs somewhere in the neighborhood of 2 million dollars last I checked. And even then we would eventually run out because we are constantly expanding to cover rural areas that have been ignored for decades by the big ISPs. Right now if a member needs a static or routable we just charge 10$ a month, and we have enough in reserve for all our members to operating like this likely until the entire internet abandons ipv4.
Why do some ISPs charge a monthly fee and others a one off fee? I paid one off with my ISP several years ago for my static IPv4.
Honestly I don't have a good answer for that. The ones who charge a one time fee are honestly being pretty generous (depending on the price you paid) considering there are yearly dues to ARIN/RIPE/APNIC/etc for IP allocations depending on their aggregate block size as well as the fact that IPs are generally very valuable right now, and go up in value depending on the block size.
If they have a legacy registration they also don't have to pay those dues, though the downside is they don't get the newer features like RPKI without signing a LRSA/RSA (and therefor paying those dues) and getting their routes certified. Usually doesn't cause an issue as not many peers drop unvalidated BGP prefixes on IPv4.
That being said, if your ISP has been in the game for decades, they probably have owned their blocks for decades and got them for pennies on the dollar when ARIN and other registries were handing out IP addresses like candy. I know the last /24 my company had to buy cost us somewhere in the neighborhood of $14,000 when it was all said and done, and that was just for 256 IPs.
Eventually IPv4 addresses will become so prohibitively expensive, that is what will eventually push mass IPv6 adoption on the ASN side of things.
Thank you that was really informative. I paid <$50 for my IP address in 2015. My ISP has been around since 1990 so I suppose they may have been one of the lucky companies. Not sure if they do RPKI, first I'm learning of it. Maybe they're cross subsidizing from other areas of the business. Their monthly fibre fee isn't the most competitive but the service is reliable and haven't had anything to complain about.
They are a little behind in speeds though. They only offer 900mbps asymmetrical max, while you can get 2, 4 and 8gbit in my area from other providers. I don't need that kind of speed so I'm happy for now.
$50 one time is a great price. We charge our members $10 a month if they request a static. We're also a not for profit coop, so all that money gets either dumped back into network infrastructure and expansion plans, or capital credits for our members.
Living in the APNIC region, we are kinda notorious for being the first region to run out of IPv4 addresses.
The top 3 mobile ISPs in my country here have been doing CGNAT since at least 2014. Cable ISPs are limiting public IPv4 according to plans since at least 2017, i.e. if the download speed of your plan is below 200Mbps , you get CGNATed.
We are severely out of IPv4 addresses.
You've very likely already encountered it if you have a device with a SIM card! Most any mobile provider routes via a CGNAT - it's exceedingly rare for phones to have public IPs.
Not sure which country you're in, but CGNAT is pretty common in some European countries. ARIN had a larger stockpile of IPv4 addresses than APNIC and RIPE, so CGNAT is less common in the USA and Canada. The US is also generally further ahead in terms of IPv6 rollout compared to other countries. One of the largest ISPs, Comcast, has been IPv6-enabled for over 10 years.
we already did, quite a while ago actually
There aren't many benefits from using IPv6 on LAN, as far as I can tell, unless you need more addresses than are available in the private address ranges.
And that point you're not in a home, you're in a data center lmao
I mean, if you have around 17 million containers running services, maybe.
@BaldProphet
What's the smallest container around? How much RAM would that take?
edit: FROM scratch let's you run bare binaries on Docker.
Would be very interesting to see how far that could get. What sort of payload/task would be interesting for all those containers?
@Sandbag @bdonvr
It's definitely an interesting hypothetical. Some homelabs that I've seen run crazy enterprise gear and are certainly capable of running thousands of very small containers, while others are running repurposed consumer equipment or SBCs like Raspberry Pis with less computing power and RAM.
Of course, in a self-hosted or homelab environment, there would be little utility to running that many network or web services. It would be a neat experiment, though. Seems like the kind of thing that Linus Tech Tips would attempt.
Doesn't need to be a "traditional" container. Modulo noisy-neighbour issues, wasm sandboxing could potentially offer an order of magnitude better density (depending on what you're running; this might be more suited to specific tasks than providing a substrate for a general-purpose conpute service).
@gedhrel
wasm sandboxes can take IPs? Regardless, if we're just talking density, I can put multiple IPs on a single interface or create a ton of virtual interfaces. That's boring, though.
Yes. The sandbox gets whatever capabilities you expose to it.
I'll buck the trend and say "yes, for a home LAN, it is the bees' knees". I don't do it now because my country (and hence my ISP) does not do IPv6, but for most places it's worth doing.
It depends on how your ISP does it. When I did it before, my ISP gave me a /56, which is pretty sensible and I think fairly common. If you get smaller than a /64, (a) your ISP is run by doofuses, but (b) it's going to be a pain and maybe not worth it.
A /56 was much bigger than I needed. I actually only used 2 /64s, so a /63 would have been fine, but network configuration is fun (I think), so maybe you can get creative and think about different ways of allocating your network.
I had 1 /64 for statically-assigned, publicly reachable servers. And then I had a separate /64 for SLAAC (dynamic) allocated personal devices (laptops, phones, etc.) which were not publicly-reachable (firewalled essentially to act like a NAT). (Sidenote, if you are going to use IPv6, I recommend turning on RFC7217 on your devices for privacy reasons. I think these days it's probably turned on by default for Windows, Android, iOS, etc., but it's worth double-checking)
The big benefit to using IPv6 is that all of your home machines can be (if you want them to be) reachable inside your network or outside your network using exactly the same IP address, which means you can just give them a fixed AAAA and access them from anywhere in the world you like. If you're into that sort of thing, of course. It's a lot of fun.
Okay, so manu of these answers are just plain wrong. In short, you shouldn't care as the biggest impact will be to network admins. They are the ones who have to configure routing and handle everything else that comes with new addresses. The rest of the world simply doesn't know or notice whether they are using IPv4 or v6. Business as usual.
If the question is whether you should play with it at home. Sure thing if you have the desire to. It's the future and only a matter of time before it becomes a reality. Said network admins and ISPs have been delaying the transition since they are the ones who have to work it out and putting your entire user base behind single IPv4 NAT is simpler than moving everything to IPv6.
From network admin perspective, yes it's worth moving to IPv6 since network topology becomes far simpler with it. Fewer sub-networks, and routing rules to handle those. Less hardware to handle NAT and other stuff. Problem is, they made the bed for themselves and switching to IPv6 becomes harder the more you delay it. Number of users in past 10 years or so has skyrocketed. Easily quadrupled. We use to have home computers with dial-up. Easy enough, assign IP when you connect, release it on disconnect. Then broadband came and everyone is sitting online 100% of the time. Then mobile phones which are also online 100% of the time. Then smart devices, now cars and other devices start having public internet access, etc. As number of users increases, network admins keep adding complexity to their networks to handle them. If you don't have public IP, just do
tracerouteand see how many internal network hops you have.Thereβs a pretty interesting series on the topic at Tall Paul Techβs YouTube channel (hereβs the most recent: https://youtu.be/WFso88w2SiM). He goes into quite a bit of detail over the course of a few videos about how he handled everything and highlights some of the trials and tribulations with the isp. Itβs not a guide per se, but definitely stuff worth thinking through.
Here is an alternative Piped link(s): https://piped.video/WFso88w2SiM
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source, check me out at GitHub.
The server I have with ovh has ipv6 setup, but only 1 of my VMS on it has an address. It's a lot harder to get your head around then it looks, no NAT. Firewall everything
yes, ill admit i didnt do it myself until recently when I didnt want to do yet-another-nat-entry and decided to join modern networking.
should have done it years ago.
What were the biggest pains? What was surprisingly easier than expected?
worrying my head off about security because in the old days IPv6 had some issues esp with bascially putting every device on your network on the public internet with no firewall.
learned that years ago hardware makers started defaulting to blocking all traffic from the outside when ipv6 is enabled. Once I felt comfortable just turning it on I found it pretty easy to grasp esp when the addresses stopped liking like random junk to my eyes.
Once I knew how things worked actually exposing a specific system or port set to the internet was super easy, much easier than NAT + firewall.
with my ISP. v6 unexpectedly brought a new level of privacy we had not had before. When you geolocate the IPs they show up in ISP datacenters all over the country. One day it looks like we are in VA, the next we are coming out of Seattle. We have yet to notice any speed or routing issues. IPv4 and IPv6 play well together though once you turn on v6 you might find yourself turning it on for more vlans than you planned because you want the features!
Thanks! That was really insightful. I guess I'll give it a try some day, for now everything runs in ipv4 and that runs well haha!
don't touch it till you need/want to. I had a system I wanted to expose to the internet on a vlan buried in my network, so ipv6 looked like the quicker of the 2 options. turned out to be right.
The possibility to have your packets passed through a shorter route compared to IPv4 packets is worth it imo. I have 280 ms ping to the US and I can cut it down to ~250ms by routing my traffic via certain countries with vpn. I really hope widespread IPv6 deployment would optimize global internet routing so my latency would improve even if just a few ms so I don't need to use VPN to override my route manually.
Maybe a silly question: any ideas why there are shorter routes using IPv6?
Thanks! Is there something about the larger area space which means there are fewer hops?
I suspect it's more like the workaround used by network operators to scale up IPv4 to serve billions of users necessitate more and more layer of nodes to route your packets through.
Absolutely. I use ipv6 so I can directly reach all my servers. For public facing things I put it on an ipv4 address but for my own internal stuff, ipv6.
Iβm lazy and donβt want to remember more than three digits in an IP address or secure all my devices like theyβre publicly routable so Iβm sticking with IPv4
Same, so I use DNS and a firewall.
You mean like
~/.ssh/config?Setup mDNS and you don't have to remember IP addresses anymore.
ssh orangeboats@orangeboats-router.localis thousand times better to memorise.You could assign short addresses like fd00::1
The number of short IPv6 addresses is smaller than the number of IPv4 addresses, so that's defeating the entire purpose of IPv6. Sooner or later you have to start using the long addresses.
At home? No! Or use fd00::1:1 or fd00::1:1:1
Thank you! I just want to say, I've also been curious about ipv6 every now and again for a long time, and this thread has helped me to understand more.
You're asking if you should use it, while my ISP was working on it in 2017 and then it all got canned when they got bought out :( .
Because devices in your LAN will all be accessible from the internet with IPv6, you need to firewall every device.
It becomes more of a problem for IoT devices which you can't really control. If you can, disable ipv6 for those.
Haha, no not really. IPv6 has the ability to provide public IP address for each device, but that doesn't mean it will have to. Other than number of possible addresses, nothing is different. Routing, firewalls, NATs, etc. All remains the same.
IPv6 doesn't support NAT... Or am I woefully out of date.
But your home router will just firewall like it does already but you don't have NAT as a simple fall back for "security". It does make running internal services much easier as you no long need to port forward. So you can run two webservers on port 80 and they be bother allowed inbound without doing horrible load balance or NAT translation.
IPv6 has NPTv6, which allows you to translate from one prefix into another.
Useful if you've got dual WAN, and can't advertise your own addressing via the ISP. You can use NPTv6 to translate between your local prefix and the public prefixes. But NPTv6 is completely stateless. It's literally a 1:1 mapping between the prefixes.
IPv6 has both NAT66 and NPTv6. (Note that NPTv6 was once called NAT66 too, but I am referring to the "stateful, one-to-many" NAT66 here. Yeah, it's confusing.) NAT66 is more like the traditional stateful NAT that all of us know and understand.
Ipv6 doesn't need NAT
The router does have a firewall but it blocks everything inbound by default. Some routers (at least mine) do not offer the granularity to filter traffic for certain devices (no NAT either). It's either allow all in or nothing.
When you enable IPv6 and switch off the firewall (since you can't host anything otherwise), every device becomes exposed to the internet.
Then unless the devices have a firewall themselves, all is exposed. Not just the web services, ssh and the rest as well.
There was a way around it however but not something everyone will be able to do with their home router. I had to ssh to the router using ISP admin credentials leaked on the internet, then create a file in init.d that loads a custom iptables file with the firewall rules I needed for IPv6. NAT for IPv6 however was not supported by the kennel used for my router.
It's not necessary to firewall every device. Just like how your router can handle NAT, it should be able to handle stateful firewall too.
Mine blocks all incoming connections by default. I can add (IP, port range) entries to the whitelist if I need to host a service, it's not really different to NAT port forwarding rules.
So even though the device has a public address, the route is through the firewall, hence the ability to filter traffic?
Right. Packets still have to go through your router, assuming that your router has firewall turned on, it goes like this:
Your router receives a packet.
It checks whether the packet is "expected" (a "related" packet) - by using connection tracking.
For example, if ComputerA had sent something to ServerX before, and now the packet received by router says "from ServerX to ComputerA", then the packet is let through - surely, this packet is just a reply to ComputerA's previous requests.
If step 2 fails - we know this is a new incoming packet. Possibly it comes from an attacker, which we don't want. And so the router checks whether there is a rule that allows such a packet to go through (the assumption is that since you are explicitly allowing it, you know how to secure yourself.)
If I have setup a firewall rule that says "allow packets if their destination is ComputerB, TCP port 25565", and the received packet matches this description, the router lets it through.
Finally, the packets that the router accepts from the previous steps are forwarded to the relevant LAN hosts.
I understand this part :) I use a fairly complex firewall at work though I only know bits and pieces from reading different manuals. I think the part I didn't understand was how exactly the routing worked differently in IPv4 vs v6. I get that because NAT happens in IPv4, packets can't be routed at all without the firewall/router but I wasn't sure what was the mechanism by which v6 made sure that packets went through the router, especially when you have stuff like v6 DHCP relays.
Ah, I misunderstood your original comment, oops! But yes, IPv6 packets are routed just like IPv4 ones, just without the NAT'ing process i.e. the packet remains untouched the entire trip.
Yes, the firewall is still your transition point from your internal network to your ISP network. Just like with ipv4, you should be configuring your ipv6 firewall to only allow designated traffic into your network from the internet.
The argument for IPv6 that there could be a unique address for 200 devices for every person living on the planet was much more compelling when network security was a more simple space.
Nothing has changed about why that is compelling: NAT sucks and creates nothing but problems.
Network security is almost the same with IPv6.
If you rely on NAT as a security measure you are just very bad at networking.
I mean that, when IPv6 started filtering out to non-specialists, network security wasn't nearly as complex, and nor was the frequency of escalation what it is today. Back when IPv6 was new(ish), there weren't widespread botnets exploiting newly discovered vulnerabilities every week. The idea of maintaining a personal network of internet-accessible devices was reasonable. Now maintaining the security of a dozen different devices with different OSes is a full time job.
Firewalling off subnets and limitting the access to apps through a secured gateway of reverse proxies is bot bad networking. That's all a NAT is, and reducing your attack surface is good strategy.
Wait, ipv6 doesn't require port forwarding to expose something to the internet?
Port forwarding is exclusively a NAT phenomenon.
In IPv6 every device should in theory have a public address - just like how every computer had a public IPv4 address back in the 1980s ~ 1990s.
However, most sensible routers will have a firewall setup by default that blocks all incoming connections for security reasons. You still need to add firewall rules.
This is correct. My router however doesn't have that level of firewall. It's either all allowed or nothing is.
There's no "should in theory". It's only a possibility due to sheer number of possible combinations. No one was ever going to make every device public. It makes absolutely no sense. Why would your company's printer be online or isolated networks or VPNs? There's no point.
IP addressing is just a way to give a globally unique number to each device. It's just a number.
And there wasn't a real public/private distinction when the Internet was still in its infancy. Printers were indeed given "public" addresses because people needed a number for it.
If you don't want your printer to be reachable by the public Internet, use a firewall to block outside connections. If you can use NAT, you certainly can use a firewall. Heck, they are almost the same thing if you have been using the Linux kernel (iptables/nftables handle firewalling and masquerading with the same tool!)
Routability is not the same as reachability. With NAT transversal you can reach my "private" hosts all the same, although you can't route to me because I don't have a public address.