Tell HN: IPv6-only still pretty much unusable

Re:Tell HN: IPv6-only still pretty much unusable by error503 on Wednesday December 07, 2022 @06:47PM (#33902059)

Why can't you use it as a firewall? It's weird, and against RFCs for your ISP to only give you a /64, but that should still be routed address space is routed through your router/firewall box, and therefore trivial to firewall with the normal tools. This is also pretty much the necessary topology, because if the box needs to do NAT for IPv4, it needs to terminate the address on the firewall too. You'd need separate interfaces to do some scheme where IPv6 was layer-2 to the ISP, and IPv4 terminated at the firewall.

Most/all such boxes, especially those deployed by ISPs, have a stateful firewall with an allow-out deny-in policy in place by default. I've never seen otherwise, but I guess it's possible?

Back in the day, cable modems didn't include a 'router' and lots of users plugged their Windows XP PCs into them and got compromised. Most weren't really blaming the ISP for this; go buy a router they said. And some providers will still just give you a public IP with full access by default when you plug into their demarc equipment; indeed many users want this because that's what Internet access should be. Security is on the end user. I don't see this situation as any different, though your ISP should know better than shipping insecure-by-default, this isn't really a problem with the protocol.

[ Parent | on HN ]

Re:Tell HN: IPv6-only still pretty much unusable by victorhooi on Thursday December 08, 2022 @01:59PM (#33911666)

I'm dealing with this now as well..=(

Do you happen to have a reference from the RFC, about it being against spec to hand out just a /64?

[ Parent | on HN ]

Re:Tell HN: IPv6-only still pretty much unusable by error503 on Thursday December 08, 2022 @04:13PM (#33913501)

Originally (2002) a /48 per site was recommended in RFC3177.

More recently (2011) RFC6177 took a more pragmatic / softened approach, but it does say:

      - it should be easy for an end site to obtain address space to
        number multiple subnets (i.e., a block larger than a single /64)
        and to support reasonable growth projections over long time
        periods (e.g., a decade or more).

I don't really understand why ISPs choose to be so stingy with allocations. An extra 8 bits of address space to allocate /56 instead of /64 costs them effectively nothing and has considerable operational benefits, simplifies CPE configuration etc. Just minds still living in IPv4 land I guess.

[ Parent | on HN ]

Re:Tell HN: IPv6-only still pretty much unusable by keiyakins on Friday December 09, 2022 @11:59AM (#33923605)

I suspect it's to make business plans artificially more appealing. After all, why offer a better service when instead you can just make your cheaper one worse?

[ Parent | on HN ]

Re:Tell HN: IPv6-only still pretty much unusable by Dagger2 on Thursday December 08, 2022 @04:47PM (#33914005)

It's not an RFC, but RIPE690 is pretty clear on the matter:

https://www.ripe.net/publications/docs/ripe-690#4-2-3--prefi...

[ Parent | on HN ]