There's a fair amount of "who goes first" or "who sees that it works end-to-end". My personal experience has been several situations where some piece of software that doesn't work, or is slow, suddenly works when I disable ipv6. That includes vpn client software I had to use for a job, dns configuration at another job, a mesh network for some hobby thing, etc.

Had I spent the time to dig into it, I'm sure I'd have found the issue. And it probably wouldn't have been directly a true ipv6 problem. But I had more important things to deal with, so it moved to number 11 on my "top 10 list".

I'm guessing I'm not alone in that. So while individual teams and products might be working to support it, end users often see that it doesn't, because of some peripheral thing that's misconfigured, doesn't have support, etc. So they give up, which reduces perceived demand.

If you don’t have AAAA records and you don’t have Interfaces listening to those addresses. You won’t “see” ANY “demand.” So since they don’t see ipv6 traffic, they think there’s no demand for it. It’s a self-fulfilling statistic.

It's far more likely the statement refers to a lack of user tickets, project requests, or compliance requirements as that's normally how IT finds out what to do next. I've never seen an IT staff with so little to do they are monitoring the network looking for packets for ideas of what they should implement next instead of implementing things they've been trying to get time for for the last 5 years. Link utilization maybe but that's a completely different beast.

Not to mention it's extremely hard to know how to check the statistic you described without becoming aware you don't have the things needed to generate the statistics so this reasoning kind of rules itself out with the exception of AAAA records - you'll actually see those requests even if all you have is A records on an IPv4 only DNS server.

Well of course your VPN won't work if the firewall isn't routing IPv6. That's a configuration problem and has nothing to do with IPv6 itself.

I'm unclear on how you suddenly know exactly what the issue was. I didn't say anything about a firewall.

I worked at an MSP during the peak of covid getting remote workers at many different companies settled in. When turning off IPv6 solved connectivity problems, 100% of the time it was because IPv6 DNS was taking precedence over IPv4. IPv6 DNS request gets sent over VPN, firewall doesn't know how to resolve it, and you can't get to anything on the network. Turn that off and the IPv4 requests are happily resolved. I'm not sure what else that problem could possibly be other than maybe misconfigured domain controllers, but that seems pretty unlikely if dual stack was enabled on the firewall as that is not the default in my experience.

Google, for example, "ipv6 anyconnect" and you will see issues that are solely on the PC before it ever gets to a firewall.

Yikes. Pushing IPv6 traffic through the IPv4 tunnel is just bad software design, seems like a bug. That's just bizarre. Incidentally, none of our clients used that. The issue is similar though, but different root causes.

Nothing wrong with doing that in the slightest. Just because the user's home internet is IPv4 does not mean corporate side v6 services should be unreachable. Either way the user is going through a tunnel to reach things, it doesn't matter if what's inside the tunnel is the same as what's outside it... it's a tunnel! Doesn't even have to be IP!

Now that doesn't mean things can't get misconfigured or poorly set up in that regard but by no means is the concept just wrong, I have several clients it has been useful for.

> Adding IPv6 has myriad advantages - no need for NAT, proxies or port forwards to share addresses, no need to renumber networks if allocations or upstream change, redundancy, valid security-through-obscurity (imagine port scanning a /64 looking for open ssh ports)...

problem is that adding ipv6 gives none of those. Removing ipv4 would do so, but realistically most people are going to run dual-stack of some sort for a while, and as long as that is the case then adding ipv6 is mostly just additive effort.

I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway.

The number one complaint I hear (and have myself) is that maybe I don’t _want_ all devices on my LAN to have public IP addresses. NAT makes security a lot easier to reason about.

> The number one complaint I hear (and have myself) is that maybe I don’t _want_ all devices on my LAN to have public IP addresses.

This isn't a goal in itself. The formerly problematic and unwanted side effects of NAT, namely a broken peer to peer relationship of hosts on the internet, are now understood as a feature. Machines were forced by this technology to be clients and the initiators of all connections to the internet. Historically this has interfered greatly with several internet protocols (ftp, IRC DCC, p2p file sharing, ...) all mostly dead now or reworked to operate in a world full of NAT gateways.

IPv6 would reverse this state of affairs. If machines need to be denied the server role, this can be enforced by a firewall. As far as tracking of clients by IP goes, dynamic address assignment via DHCP or IPv6 privacy extension take care of that.

> The formerly problematic and unwanted side effects of NAT, namely a broken peer to peer relationship of hosts on the internet, are now understood as a feature

A feature? I’ve never heard that. If you want to break the end to end nature of the net you can do that in your router, easily and more powerfully, without all the overhead of NAT.

The net has turned back to the old mainframe days, and things like NAT make it hard to go the other way.

> I’ve never heard that.

It was in the parent comment!

One can still have intentionally unroutable addresses in IPv6.

Sure, but then you're again on par with IPv4+NAT in the area of connectivity - no worse, but no better. So why switch?

Because you have all the overhead of NAT plus losing functionality that cannot operate through NAT. If all you want is to have addresses that done leave the local net, just do that.

You’ll lose weight in a famine but nobody would suggest it as a diet plan.

> Because you have all the overhead of NAT

What overhead does NAT add compared to a L4 firewall?

> plus losing functionality that cannot operate through NAT.

What functionality does NAT prevent that a L4 firewall doesn't?

You can simply not route a specific range, no firewall needed.

NAT, on its own, doesn't provide security. At best, it provides obscurity. At worst, it breaks security [2]. NAT needs a properly configured firewall to provide security [1]. In this sense, NAT vs a Firewall is a false dichotomy.

[1] https://tailscale.com/blog/how-nat-traversal-works/

[2] https://www.computerworld.com/article/2556611/nat-traversal-...

edit: formatting

I wasn't claiming NAT is adding security. A combined IPv4 NAT/firewall will not necessarily be less performant than an IPv6 firewall - that was my claim.

Also, GP claimed that certain services that don't work because of NAT would work on an IPv6 network. I was curious which services those might be, that don't work because of NAT but wouldn't be affected by a firewall.

If you're behind CGNAT then generally you won't be able to accept any inbound connections, so even things like a basic webserver aren't doable.

These stateful devices have to look at all the traffic and maintain connection data for every transaction. That takes space and time and is bounded in volume.

The same is true of firewalls, so I don't get your point. Even in IPv6, your router-level firewall will need to know if a packet with dst_port=31536 is part of an existing connection or not, which means it has to monitor all traffic and maintain connection data for every transaction, no different from a NAT device.

What is the point of a perimiter firewall in the modern Internet? Those TV and lightbulbs are attack vectors inside the firewall. And there are (and will be more) plenty of devices that bridge the cellular networks and the LAN.

You need a defense at depth, not a crunchy perimeter with a squishy inside.

NAT doesn’t improve security if port numbers are easy to guess, which is usually the case.

If you wanna block inbound connections, just drop them with your firewall. Most home routers already do this by default and if yours doesn’t, you better enable it for IPv4 too.

“Block everything” works as long as you aren’t actually opening any services on the local network.

If I want to open up a device with a single port, I should open that in the firewall. But wait, my IPv6 addresses aren’t stateful, so they can change any time.

And then suddenly someone decides to just open port 80 and 443 on the main router, and bam! I’ve just opened up those ports for _all_ IPv6 clients in my LAN.

You think all those IP cameras and ring doorbells were vulnerable when they are behind a NAT? Just wait what happens when they all get assigned public IPv6 addresses.

I’m not saying that these problems are unsolvable. But I think it’s important to at least recognize that, yes, this is different than how we did things with NAT, and you now have more tools to shoot yourself in the foot with.

> you now have more tools to shoot yourself in the foot with

And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world).

Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default).

IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6.

Honestly I just don't really see IPv6 replacing IPv4. It introduces too many problems and offers too little benefit. Whatever actually replaces IPv4 will either need to be 10x better than IPv4 in every way or be a completely transparent migration that works with IPv4 "but with more addresses".

> Hell I'm pretty sure comcast's cable modem doesn't even have IPv6 firewall capabilities and if they do it is default wide open. Thats not what I want. I have no interest in outsiders being able to ping hosts on my network or even know of their existence. I have no interest in letting random IoT devices expose open ports to the entire world (by default).

Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Your CPE (customer premises endpoint) is where the firewall lives.

> IPv6 is cool and all, but no consumer gear sets it up even remotely secure. At least with NAT a "script kiddy" grade attacker won't see what is behind your router. NAT isn't perfect but it solves a lot of problems. Not so with IPv6.

Most newer consumer gear that does IPv6 blocks all in-bound traffic on IPv6, just like it does on IPv4.

> Comcasts cable modem also doesn't have any firewall for IPv4... it's a cable modem, it passes packets.

Most of the new stuff comcast ships is an "all in one" device that acts as an access point, a router and a cable modem. You can buy third party cable modems that do what you describe but what comcast gives you is much more fancy.

You should almost always buy a 'dumb' cable modem and have your own router that you manage behind it. These devices are commonly behind on firmware and may have completely insecure settings that you'll never have insight into.

Having an outdated firmware (which could be solved by mandatory updates from the ISP, which appears to be the direction AT&T is going) is still much better than having no firewall at all. An incredible minority of people, who “manage” their household internet access are aware of any of this.

If your firewall has exploitable outdated firmware, I might argue it's worse than no firewall because now you potentially have malicious code living on your network. Whereas if you don't have a firewall (on a home network) there generally isn't anything someone could get into anyway. "Oh I see port 22 is open." Great, there's nothing to SSH into anyway, who cares?

Surprisingly, it probably does have a firewall. Cable modems are really odd devices.

That said, the relevant part is the router (which may be part of the same physical device these days), and that part certainly does have both a v4 and a v6 firewall, configured securely for both.

> And the tools for managing IPv6 firewall rules suck on "SMB grade" stuff like ubiquiti and are virtually non-existant on any consumer grade router. If I have to SSH into the router and treat it like a "real" router to set up IPv6 firewall rules... it is never gonna fly for anybody who isn't proficient with "real" routers (i.e. >99% of the world).

Umm, the IPv6 firewall interface is exactly the same as the IPv4 firewall interface on UniFi[1].

1. https://i.imgur.com/waISjwe.png

You should use one of your PDs as a DMZ not putting your externally exposed web server in the same subnet as your IOT or other outbound only devices. If you're hosting a lot of things™ you should be using a static DMZ, same as you would on IPv4.

For the more general user case ("I want to host a game session with my friend") I'm not sure if there is something like UPnP for dynamically registering allowed ports without needing to actually do any NAT work but that would certainly seem useful.

NAT sucks but is harder to misconfigure.

I’ve never accidentally let something through NAT.

But accidentally not configuring a firewall? Everyone does that and has done that and will forever do it.

I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.

Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet.

Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies.

"DevOps" gets a request from an app team to open a port between subnet A and subnet B.

DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit).

Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations.

The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time).

The requester asks for the wrong port. Too bad, so sad, you're waiting another week.

The app team asked for the wrong port. Same outcome as the DevOps person.

The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.

What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.

I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.

Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear.

At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.

My consumer router has vlan support…

As far as consumer routers go, wouldn’t it be trivial to re-tool the usual port forwarding interface to simply accept connections to a specific address-port? That combined with a internal block-all-inbound rule would be quite hard for a user to footgun themselves horribly with.

From a quick search, UPnP seems capable of automating this for user convenience, especially with stateless addressing.

Are you sure you haven't? NAT in fact doesn't stop connections, so if you accidentally didn't configure the firewall then you won't be saved by NAT.

Odds are that there weren't many people in a position to connect to you, and probably nobody actually did so, but it would certainly have been possible without a firewall in place.

there's plenty of instances of shitty applications setting up massive port forwarding rules using upnp

It's not just about inbound connections, people also generally don't want to have their outbound devices clearly visible by counting unique IPs, or MAC addresses (and thus manufacturer) of devices sent out with every packet when MAC is used to generate the address, or another globally unique identifier for ad networks to track.

I think all major OSes have privacy extensions enabled by default, and therefore use random addresses that change regularly.

They 100% most certainly don't. I would have no idea what anything is on my network if every workstation's MAC addresses was constantly changing. Some OS's do randomize per SSID, but it doesn't constantly change, it would break DHCP by using up all the addresses. You can't just constantly change your L2 address.

This is in IPv6, not v4. I highlight that because you mention DHCP, which generally isn’t used there. And it’s not the MAC address that changes, but the 64-bit interface identifier. Ethernet would probably stop working if the MAC address changed with any regularity. You can read more about this at https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad...

From that article written in 2014, these OSes have privacy extensions enabled by default:

- All versions of Windows after Windows XP

- All versions of Mac OS X from 10.7 onward

- All versions of iOS since iOS 4.3

- All versions of Android since 4.0 (ICS)

- Some versions of Linux (and for others it can be easily configured)

With IPv6 and SLAAC your external IPv6 address changes on a schedule using privacy extensions...

Mine at home is configured to change every 30 minutes.

As sibling points out, that’s already covered by the IPv6 privacy extensions, which every major OS has some support for [1]

1: https://datatracker.ietf.org/doc/html/rfc4941

This is why I haven't swapped, but I didn't realize they've accounted for this at the client level. Makes sense, still makes me think about IoT devices though and things I don't have 'control' over like my chrome cast.

> I think most corporate network should be able to do pure IPv6 internally, and then tunnel to IPv4 at the gateway.

With the amount of legacy applications and systems populating the typical internal network that idea won't be going far.

Where IPv6 actually can be used and should be deployed in addition to v4 is in the perimeter networks. Offering or being able to use services on the internet over v6 (via proxy) overcomes the real shortage of ipv4 addresses in the internet at large.

I expect internal networks to be last places to be moved to IPv6 only.

This simple workflow, a new internal network deployed on IPv6 only

Edge Firewalls -- source natting to allow access to IPv4 networks

Edge Firewalls -- destination natting to allow access from IPv4 to a service hosted on IPv6

Doesn't seem to widely adopted. It's all dual stack stuff, which means more work and more things to go wrong for no benefit.

Of course there's then the renumbering of your entire internal network every time you change ISP because you're using public IPs rather than private ones

NAT actually makes security harder to reason about.

For example, did you know that NAT doesn't prevent inbound connections? At least in v6 people are more likely to realize that, yes, they do need a firewall.

IPAM, subnetting and firewalls still exist, though. That's just a lazy excuse.

You can get many of the benefits by adding v6 and then ignoring the v4 for some things. For example, sometimes you might need to allow an inbound connection on v4, but if all potential clients have v6 then you can just ignore v4 for that server. It's not necessary to remove v4 immediately, although v6 provides ways to help do that when you want to.

When you run dual stack, the v4 is there as backwards compatibility. It's lovely that people will simultaneously complain that v6 doesn't have backwards compatibility, _and_ also use the backwards compatibility it does have as a reason to not deploy it...

> What's interesting is how much resistance there is to adding IPv6 which comes from entrenched IT. People who never learned (much) about IPv6 seem to be afraid of it

Right, you're only suggesting that they change out a fundamental part of the network for no benefit that they can see; why would they possibly object except out of fear and ignorance? After all, their fears are totally unfounded; most, probably all, of the random breakage and slowdowns that happened last time they tried to enable v6 have been fixed now.

I mean, yes, plenty of people don't want to learn new things for bad reasons, but plenty of people have insufficient time and have to make cost/benefit decisions - and you not liking their conclusion doesn't make them wrong - and there are a fair number of people who were all on board with upgrading a decade ago and got bitten by the then very real problems with IPv6 (which mostly boiled down to "not everything supports it properly, and lots of things fail ungracefully and create weird breakage").

Well put. I’ve been shocked by the elitist attitude by many commenter who don’t see the issue IPv6 has for _most_ non-IT professionals.

Facts are these: IPv6 is a failure; it didn’t provide a way to conexist with IPv4 [1] and it did _not_ have a _compelling_ benefit to most people. The benefits cited makes no difference to most.

[1] https://cr.yp.to/djbdns/ipv6mess.html

I wonder if people will ever stop bringing that article up...

v6 provides lots of ways to coexist with v4. There's dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how can you argue it doesn't?

> My favorite is, "we have no record of people trying to use IPv6" - yes, that's real :D

Have you ever worked at a IT department for a medium to large company? It’s usually a total shit show. IT gets blamed (justly or unjustly) for any issue with computers. As a result they become rather thick skinned and incredibly conservative in the projects they undertake.

So it’s not surprising that folks are unwilling to spend time on something they don’t have prior art for, haven’t operated before, and doesn’t offer significant benefits over what they already have.

100%. Anytime something happens to a PC it's either the sever, internet, or the network is down! Or all 3!

Right. Our entire network is down and IT has no idea, thanks for the help Karen.

You learn to keep things simple and make as few changes as possible so you can't be blamed for other departments mistakes. "Network is up, haven't made a single change to infra in a month. Find someone else to blame."

It’s easy to blame IT, but usually they have either business objectives assigned to them or they need to justify it to the business.

So I see the “if it ain’t broke don’t fix it” more of a business problem and not an IT problem. I worked at one organization where for any networking work, you had to bill that time to a business project (which was usually a customer contract). proponents of IPv6 inside a business probably seem to the business like they’ve got excited over pointless science projects with nothing to ‘bill’ their time against

The benefit of switching doesn't outweigh the costs yet. The switch to ssl was largely over google rankings vs greater security. What is going to be the reason people switch?

Many think cost of ip4 addresses but that hasn't panned out with solutions like NAT.

So basically if Google added IPv6 support into its ranking algorithm we would get adoption virtually overnight.

No, because isps dont care about page rank. I have to operate a small isp. IPv6 solves nothing for us and just makes even more problems. The comments in here keep saying that ipv6 will fix everything but it is hogwash. It just means I have to support two things instead of one. IPv4 on the internet will not go away even if I do the ipv6 transition perfectly.

It is one of the more frustrating parts of trying to explain why we don't all just jump to do this.

That’s fair. My ISP not only doesn’t provide IPv6 but actively blocks using 6to4/6in4. They claim they don’t but I can clearly see that they do. It’s bad.

Cable modem? Some Intel Puma 6 modems have a bug, where traffic over protocol 41 (6in4) is very slow.

No modem. I have fiber with Frontier and my router (OPNSense) is connected directly to their ONT.

What problems do IPv6 cause for your small ISP?

I have an IPv6 block from ARIN. Now what?

Think of all of the hours I have to spend researching the following and implementing it:

1. Does all of the intermediate equipment support it

2. Does my IPAM support it

3. How do I even give ipv6 addresses to my ONTs?

4. How do I keep track of all of the address assignments for x months

5. Does my staff even understand how ipv6 works?

6. Does the off hours call center understand it?

7. Build the servers and add them to all of the monitoring, backups, do updates on them

8. What if I do this and the choice for ipv6 dhcp was wrong and in a year I have to redo it all

etc etc

There are no good answers for any of this that I have seen. There are sometimes 5+ options for everything to do with ipv6. How do I even weigh the pros and cons of approaches I have never used before.

Its hundreds of man hours at a minimum for no benefit other than to be ideologically on the correct side of technology. It will continue to work as it is now with absolutely no hours or risk for 10+ years at least.

I completely understand that it’s a huge amount of work. But v6 has been around for 20 years. Spread across decades the work becomes a much smaller lift.

Isn’t it incredibly expensive to get your own block?

Since we already have an ASN, its free basically. I already have one. Its at least a /32 and maybe a /28.

My upstreams support it, my ONTs support it but there isnt a nice ipv6 dhcp server with logging and a lookup interface that I have found yet. It probably exists but I don't know what it is.

IPv6 blocks are usually quite reasonably priced. You might even get them for free, if you're already paying maintenance on an IPv4 block (which are expensive to obtain these days)

That's only one side of the issue, the server side. There's also the client side to consider. Carrier-grade NAT for mobile/home use is expensive and harder to run than just giving everyone an IP address, and generally means a lower quality connection so you can't charge as much as an ISP, which is why ISPs are increasingly using IPv6. They otherwise need a lot of IP addresses!

ISPs are also making it more difficult to themselves: if there is a support for IPv6 at all, it is DS-lite, not full dual stack.

So let's say I'm willing to migrate to IPv6, but I still need IPv4 for some reason (maybe I need to do the migration with multiple independent ISPs and every single of them is traveling at different speed wrt IPv6). This approach makes it impossible for me to switch where it would be possible, I cannot drop IPv4 yet, CGNAT-ed connection is unusable, but also I cannot use IPv6 where I otherwise could.

So I stay with IPv4.

> What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit.

For example see the video "T-Mobile’s path to IPv6 Only":

* https://www.youtube.com/watch?v=nNMNglk_CvE

Wow, interesting to see such a video coming from T-Mobile. We have a DSL connection with T-Mobile Netherlands and they still don't support IPv6. Any inquiries about this on their community forums are met with a reply of 'there are currently no plans for IPv6 support'.

T-Mobile here in the US is a mobile provider, they don't have any landline service.

They used to be just a mobile provider here, but a number of years ago they acquired Vodafone's DSL division. They don't actually own any DSL lines though, they just rent line access from KPN (the country's incumbent telco).

Different countries' T-Mobiles are quite different, especially the US one..

> "we fear change"

Regardless of the IPv6 situation, IT departments take this position for a reason. It might be obvious to individual engineers how to safely deploy IPv6 on their home network if they fully understand all the moving parts. But large corporations with deep legacy to maintain don’t have the luxury of running a fully understood system. Isn’t that a big risk? Hell yeah, and of course they’ve all got modernization projects running. But in the meantime, they fear change - legitimately.

NAT is a very simple idea that works very well. In fact for my private network with 20 odd devices I'd prefer to keep it.

The problem is, it is NOT a simple idea, but one that requires a lot of relative heavy lifting with deep packet inspection for a lot of protocols that have to deal with the spaghetti that is NAT.

Yeah but even if it isn't simple it is mostly a solved problem at this point. NAT has been around for, what, 15 years now?

And quite honestly the default configurations for IPv6 on consumer routers is "wide the fuck open"--which is not at all what I want. But if they don't make it "wide the fuck open" suddenly you are asking normal people to learn how to punch holes in their firewall.

NAT has fundamental flaws that simply can't be solved, and even when it can be made to work it's still an extra layer of completely unnecessary complexity. It does work surprisingly well despite all that, but it's not something to build the entire future of the internet around.

The default config for most routers is to deny inbound connections, for both v4 and v6. I'm certain you can find routers that don't do that, but it's not common.

I have never seen a consumer IPv6 router without a restrictive firewall enabled by default. Could you give some examples where this is not the case?

Pv6 and NAT were developed in the mid-90s. They've both been around for far longer than just 15 years.

More like almost 30 years.

I can't go v6 only, so why double my workload by supporting ipv4 and ipv6.

You wouldn't be doubling your workload. Most of your work applies equally well to both protocols without any additional effort, and even if you can't remove v4 completely you can often ignore it for some things, which saves you some workload.

If I want to communicate with v4 hosts I have to support v4. If I want my v4 clients to talk to me I have to support v4. What can I drop? I still need an IP, distributed by DHCP, I still need the subnets, I still need to manage the routing internally, I still need to have boundary nat, both out and in, I still need to have A records in DNS.

I have to do all of that in v6 land (perhaps my user interface will allow me to manage the firewall rules together, but I'm still doubling my testing). On top of that, if I change my ISP, I have to renumber my entire internal network rather than just change the public IPs.

It's not even common practice to have a v6 only network and nat from v4 to v6 at the edge, and more crucially it seems from this thread that v6 removed it's v4 compatability layer (so I can't type "ping 1.2.3.4" and have it translate that to "ping -6 ::ffff:1.2.3.4", with my 6:4 gateway handling the nat

Until people start using v6 only, where's the benefit in increasing my workload?

Calling people ignorant because you don’t agree with their opinions or reasons is a non starter for constructive discussions. Using IPV4 has never ever caused me a problem and I will never ever run out of addresses. I prefer to focus my time on real issues that actually affect end users and improve their experiences.

> no need for NAT

Yeah everyone says this but I can't access any ports on my IPv6 address from outside my home network.

Back to IPv4 + NAT + port forwarding, I guess.

I have bigger problems I need to solve in my life right now. When one day I can just ssh <my-ipv6-address> from the outside I'll do that. Thanks.

Also, there's the DNS problem. I can remember 10.0.0.3, 10.0.0.20, etc. pretty damn easily. I can't remember 8cef::fasd:8000:c00a:::99aa:::::81/42:8fe that easily.

Which is an issue when things like 'foobar.local' don't work half the time. I have the IPv4 addresses of all my internal machines memorized thanks to the the fact that .local just doesn't work, period.

You are using it wrong.

You can't access a service on a server on your local network using your router's global IP. You should use server's global IP address (and open the port for that IP on the firewall).

If your server uses SLAAC, it will always use the same local address (whether using EUI-64 or stable privacy), or you can configure it manually. In either case the address won't change.

NAT made you think in a different way, but if you started with IPv4 before there was NAT, this setup is exactly the same as it was with IPv4 a long time ago.

Too much work.

If I type ifconfig on my machine I only have one 'inet6' address and it isn't reachable from the outside.

The relevant people who want to popularize IPv6 should make that "just work". Until then IPv4 works for me, and a port forward is easy to understand, I don't need to google what SLAAC and EU-64.

They advertise it as "oh you don't need a NAT" but in reality IPv4+NAT is easier to deal with.

Most of us have actual jobs and don't have time to also be devops people.

I realize this sounds like a shitpost, but this UX is exactly why IPv6 isn't popular yet. If you want something to be popular, you need to make it easier not harder than the current thing everyone uses.

Half the discussion is FUD that a consumer router wouldn't have an IPv6 firewall.

Your router, like every other, has a default deny firewall for IPv6. You'll find the settings near to where you set up IPv4 port forwarding. My router calls it "pinholing" or something.

Then you can SSH directly to the servers you allow access to, using port 22 for all of them if you wish.

I tried enabling IPv6 on my router just now. It asked me for a delegation size. How TF do I know. I just randomly put in 60. It's what a google search told me to put in. Save changes.

Go to main screen. Still only shows my IPv4 WAN address. No IPv6 "pinhole" setting near the port forwarding.

Back to making breakfast and doing what I needed to actually do.

I use a UDM Pro by the way.

Sorry, I thought you were asking about a home broadband connection with the typical basic router supplied by the ISP.

The UDB Pro looks like something for a small/medium business, so you presumably have a business connection. You'd need to ask your ISP for the configuration, as it will depend on what service they're providing. (Just like for IPv4 you'd need configuration if the ISP is providing you with 4, 16, 32, ... IPv4 addresses -- also a common situation.)

If ifconfig is showing IPv6 addresses starting with fe80:, these are local/private, a bit like 169.254.x.y IPv4 addresses.

So far, all global/routable IPv6 addresses begin with 2.

(And for most home users, IPv6 is just as easy as IPv4, i.e. they don't know anything about either. After a test period, ISPs that support IPv6 generally enable it for all the normal home users -- it saves them money! That it is the default is how we got to 35% of Internet users using IPv6.)

> I tried enabling IPv6 on my router just now. It asked me for a delegation size. How TF do I know. I just randomly put in 60. It's what a google search told me to put in. Save changes.

Sorry but how is that any different to IPv4?

> I tried enabling IPv4 on my router just now. It asked me for a CIDR range. How TF do I know? I just randomly put 143.156.200.0/8. It's what google search told me to put in. Save changes.

If you (the royal you, as in people) don't know how what they are you expecting it to work?

Totally agree. The UX for IPv6 sucks. Every time I poke with it I get worried I'm exposing the guts of my internal network onto the internet. With NAT, at least I know nothing is getting in without me intentionally punching a hole. With IPv6 to do the same I have to go fiddle with the router's command line interface and rules by hand. And even then who knows if I fucked something up or missed something... its just a lot of work.

There is no web UI for managing IPv6 firewall rules but there is for IPv4. On the consumer grade routers I've touched there isn't even a way to configure the IPv6 firewall rules (and again, they all offer web UX for IPv4 rules).

The interface on the router provided by the UK's largest ISP is almost identical to the interface for IPv4 port forwarding: https://imgur.com/a/NXqwoA6

Awesome!

I wish my edgerouter had something like that...

    fd::1
    fd::2
    fd::3

Easy enough to memorize.

You can even do:

    fd::10.0.0.1
    fd::10.0.0.2

... and have each host assigned the matching IPv4 address as well.

.local not working might be your router trying to be helpful and snoop multicast to limit it to pairs of devices. Something about iptv optimization or whatever I don't really understand. Since I turned this feature off .local works as it should.

> "we fear change" IT people don't realize they're already using IPv6 on their phones every day,

Is that US specific? Because as far as I am aware only 5G "purposed" ( I am not sure if it mandatory ) the use of IPv6. 5G requires the support of IPv6, but not usage.

Wait, if my phone is IPv6, then what does it mean that a site 'supports' v6? I can get on HN just fine.

Does your phone only have a v6 address though? If it did, you would need some kind of proxy (6to4 [1], the most likely example) connecting to HN's IPv4 address on your behalf.

As the sibling points out, if both site and device support v6 the intermediate translation isn't required.

1: https://en.wikipedia.org/wiki/6to4

That's exactly what it is. There is always a proxy, which negates part of the argument, but is a very useful tool in transitioning over the next 2 other decades at least... the way this is going.

It definitely wouldn't be 6to4; that requires a v4 address.

It'll be NAT64.

Ah you're right, 6to4's a 1:1 IPV6 to IPv4 translation.

It's a bit more than 1:1. 6to4 tunnels a /48 to every v4 address.

> Wait, if my phone is IPv6, then what does it mean that a site 'supports' v6? I can get on HN just fine.

It means that the phone doesn't have to talk through a network-translation box, which may add latency. For some things (gaming?) this may be important, while for others it may not be.

Further, the price of each IPv4 address is going up, and so having your hosts on IPv6 may allow for the lowering of your costs, which you can pass onto your customers or add to your margin.

About a year ago they were US$ 30/IPv4, and they now seem to be in the $50 range:

* https://auctions.ipv4.global

* https://auctions.ipv4.global/prior-sales

We use VPS from tilaa.com and they charge 2 Euro per extra IPv4 and for the third etc. address per server one needs to submit a technical reason for doing that that they manually review.

Websites have separate DNS records for ipv6 (AAAA record) and ipv4 (A record). Since ipv6 is not universally supported, the de facto expectation is that if website has ipv6 DNS record, it should also have an ipv4 one for the users who can't talk ipv6.

Your device's network stack first learns if your mobile ISP supports ipv6 or not, and based on that and DNS reply decides how to connect to a given website.

You establish a TCP session with the IPv6 address of that site instead of its IPv4 one by way of getting its AAAA record and your phone having dual-stack networking enabled.

(Most US carriers have IPv6 enabled and issue IPv6 addresses to their phones.)

> What's really interesting is how many of these "we fear change" IT people don't realize they're already using IPv6 on their phones every day, with a majority of the sites they visit.

Not true on my german mobile carrier O2. They only provide IPv4 behind a CGNAT.

Telekom is v6-only (464XLAT), Vodafone and o2 are dualstacking (with CGNAT for v4). You might need need to manually update your APN settings if your phone was set up before they enabled it though.

If I provided users with an IPv6 block to allowlist for my apps, I think most IT directors' heads would explode, but _everything_ works with 32 bit CIDR ranges.

I certainly support it, but I'm not sure we'll see an end to NAT for some time, even with an IPv6 option.

"Comparison of IPv6 support in common applications"

https://en.wikipedia.org/wiki/Comparison_of_IPv6_support_in_...

Some big nation should decide to switch off IPv4 over a course of maybe a month and maybe we will start seeing servers deploying IPv6 then.

Why and how would they even do that?

I'll admit to not understanding this position. Without NAT, you could do the same sort of firewalling, where the inbound allow list is driven dynamically. The only thing I can think of is that not using NAT exposes more detail about an internal network. Is that the reason you're hinting at, or is the reason something else?

It's extremely funny how a network with NAT needs hole punching in the firewall and network without NAT sudenly doesn't have firewall at all. Like OK, in 1995 a router would have been a dedicated machine or appliance, but since 2005 anyone can buy a sub $30 device which routes, firewalls, provides a bunch a of (unnecessary) services... but suddenly incapable of firewalling if IPv6 is involved.

> but suddenly incapable of firewalling if IPv6 is involved.

It's been a few years but I've yet to see a consumer grade router that lets you mess with IPv6 firewall rules. I don't even know what these routers use for a default policy.

They all seem to have web ui's for IPv4 firewalls and port forwarding though...

Ever seen an average IPv6 firewall, even on $500 devices?

You can have dynamic prefix that can change with every moment on your wan interface, but then you have static IPv6 rules and you cannot specify something like use current prefix there.

So I understand if the first reaction is screw that.

Not OP but that’s how I think of it.

If my internal network is 10.0.0.0/8 and I have 100,000 hosts and a single IPV4 address that they all appear to be to the public Internet, I’ll sleep a lot better than if I had all 100,000 hosts with public routable IPV6 IP addresses attached to them.

Yes, you can depend on a firewall to protect you but at the very least it exposes information about your internal network and at worst opens you up to future firewall flaws.

I remember the days when people used to have every system have it’s own public IP address. People would scan for broadcast addresses of their networks and we got Smurf attacks as a result. Obviously those wouldn’t work with properly firewalled hosts but it still scares me.

This is why we have firewalls. My pfSense router e.g. blocks external access by virtue of it being a firewall with sensible defaults.

All routers w/ firewalls will/should have them.

Firewalls are fine but having the ability to make machines unroutable is even more powerful, no?

While I get that firewalls are probably safe like 99.99% of the time… I’ve gotta say, I just don’t trust software to not have vulns of some sort that someone important already knows how to break. So eg for a corporate network I would be hesitant to do this, for my personal network not so much (unlikely that a 3 letter agency gives a shit about what I do).

Additionally. Firewall changes can sometimes fail for whatever reasons so you might have accidentally exposed a node publicly for some time.

Making those nodes not reachable from the internet seems prudent. It’s like your office building has a public address but your office assignments don’t need to be public.

>Firewalls are fine but having the ability to make machines unroutable is even more powerful, no?

For the whole world there is absolutely no difference betwen routable address, non-routable address or even an absense of the machine... behind a firewall with drop all on a public interface.

Your statement doesn’t address the point you are responding to so it makes me think you completely missed the point you are replying to.

You are correct in theory. What you don’t seem to be taking into consideration are firewall vulnerabilities or other unknown things that could happen that make it different from a practical standpoint.

I started an ISP from the ground in 1996. I’ve seen a lot of weird stuff. You seem to just hand waive it away like firewalls are this perfect bastion of security.

Maybe you have more experience than I do?

where do you think the NAT and associated connection tracking is occurring exactly?

Anything smaller than a IPv6 /48 is effectively unroutable. Your ISP has to route smaller blocks, like /64s, privately (because only /48s hit public bgp). And then you have to route the /64 they assign you privately once again.

No. There is no difference between the two from a security point.

Even firewalls are just a last resort defense IMO. The primary thing is not having any crap listening on ports in the first place.

IPv4 with nat is effectively routing your 100,000 hosts through one of 4,294,967,296 possible IP prefixes (a /32).

IPv6 with a /64 routes one of 18,889,465,931,478,580,854,783 possible IP prefixes to your router. Everything that happens behind that is opaque. There are so many IPs in that prefix that people can't even guess which ones you're using. It's easier to guess internal IPv4 NAT addresses.

The internet can't see your IPs. "Publicly routable" doesn't mean much when you're talking about prefixes.

Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing.

And anyways, when you have a NAT you're probably routing traffic through a level 4 balancer or jumphost or using a VPN somewhere in your LAN.

We assign IPv6 deterministically. Incrementing them is the most boring way to use IPv6 space.

You can also just start in the middle of a block and make a sequence of 10,000 IPs effectively unguessable.

I don't buy that keeping addresses private has much value, but IPv6 still isn't worse than NAT in that respect.

> Unless you're planning to assign random IPv6 addresses for each connecton then it's not at all the same thing.

SLAAC

SLAAC has an option to randomize, but it's a lot slower than per-connection.

As soon as one of the computers in the subnet initiates traffic outside the network, its IP address becomes public knowledge though, right? Doesn't matter how large the space is, that information leaks, whereas with NAT it doesn't.

Modern OS change their outgoing IPv6 address fairly often. They could grab 10,000 from the pool and rotate between them every second.

IPv6 addresses can be ephemeral? What, DHCP is assigning a whole range to each client? Didn't know that.

Pretty weird. For internal stuff I would be using IP addresses to identify peers. Ephemeral IP addresses in logs aren't very useful.

Some of our service providers require us to provide the IP addresses of our services to them for them to safelist. It’s stupid, but it’s not something we can control.

Rather than constantly update them as our servers change, we route through a NAT. I wouldn’t know how to do it with IPv6. Maybe the service provider could safelist a subnet?

They probably wouldn’t support that. Most non software heavy companies outsource these sorts of projects and to make changes to their systems requires a bunch of upfront capital costs which can be expensive so they will push back against changes unless you are big enough to force them to or you convince them of the merits of such changes.

Depending on the type of connection it's fairy easy to set up squid as a proxy for outbound connections so everything appears to come from the squid box which can have a static address and can be added to an allow list

>Maybe the service provider could safelist a subnet?

Yes, thats what prefixes are for. Although its unpractical in IPv4 world, in IPv6 it is the way to whitelist a range of ips.

Yes, of course.

Exposing your LAN confguration for the world to see is insanity, it's like hiding your private SSH keys in a password-protected Excel file.

And yes, you need both NAT and firewall. They're complimentary technologies and do not replace each other.

I mean, the original purpose of NAT was to let you move hosts between networks without renumbering them. No one really does that though, your laptop or phone happily renumber themselves when you move networks.

No one's going to use NAT for keeping IPv6 between networks.

Default deny from external access isn't an IPV4 NAT-only feature, but it does come out of the box.

The same would need to be set up for IPv6 and move on past that.

It's a firewall issue, not a protocol issue.

The devices I've seen have default deny for IPv6 as well.

Do you know you can have DENY FROM ALL by default in any IPv4 firewall?

Do you know what you would be hardly pressed to find a router without firewall not only in the year 2022, but in the year 2012 too, when there was 10G *switches* capable of routing AND firewalling traffic almost at the line rate?

Firewall and NAT are orthogonal. You need both.

Exposing your LAN configuration for the whole world to see is insanity. (Yes, we sometimes do this, but only because we still don't have sane VPN solutions here in the year 2022.)

> You need both.

No you don't.

You can have the public IPs on everything in your LAN... and still it would be completely inaccessible to the outside world. Because you know, firewalls exists.

> Exposing your LAN configuration for the whole world to see is insanity

Bullshit. BGP doesn't 'expose' your internal routing configuration and there is absolutely no other way for someone to see how exactly the things in your network. OSPF could be used for it, but it requires: 1) being right next to your router 2) be configured to send on the external interface.