Hacker News Reader

Comment by e12e | Hacker News Reader

This seems like a good place to ask: has anyone got experience with going ipv6 only?

I am (or effectively have) inheriting (-ed) an aging small campus network. No external services, and no core internal services (beyond DHCP). We'll have to get all new core switches (still on 100mbit...). If my isp gives me a /64 ipv6 net, and I firewall off windows filesharing (and take other measures appropriate for placing user devices on the routable Internet) - can I expect most things to just work?

I'm fine with demanding windows 10, recent Linux, iOS or Android for wired/WiFi access - and plan on moving to/requiring 802.1x for access (which means setting up some form of auth/authz back-end, possibly Azure Ad - more likely a Linux directory server). Can i live the dream and just go for ipv6? Am I crazy because I'm considering it?

View on HN

most websites won't work with v6 only, so you will need to be dual stack. For your internal services, going v6 only should be mostly fine I think. If you are running a campus network, your ISP should give you a /48 though, definitely not a /64 only since you will not be able to subnet that.

By dual stack you mean something beyond nat64?

If you've got nat64 and dns64 setup, you should be ok for most things, but in many environments it's easier to dual stack - do both 4 and 6 on end hosts, rather than setting up nat64.

Right. I suppose the time still isn't right, and I'll have to stick with private ipv4 subnets and NAT :/

(granted, nat64 is also nat - but on paper, it would be so nice to just stick to ipv6...)

You also need DNS64 which basically adds DNS NAT on top of the IP NAT making it an even worse hack (also breaks DNSSEC if you care about that). NAT64 may be a valid option for large, complex networks but on a smaller scale simply add v6 on top of the NAT setup you already have.

Someone here (or maybe it was on Reddit) set up his internal network to be pure IPv6, he used DNS64 which translated all DNS websites that had only IPv4 addresses to IPv6 and NAT64 which translated IPv6 address to IPv4.

The thing is that there are still many websites that are only accessible from IPv4, and in order to access it either you or your ISP would have to translate IPv6 address to IPv4 (NAT64) and make connection to it. If you will be the one doing the NAT then you will need to have at least a single IPv4 address.

It just occurred to me that perhaps a socks5 proxy could bridge from ipv6 to ipv4? Sadly, even if I set up "automatic" proxy configuration, I pretty sure there'd be enough edge cases and things breaking that "forcing" local users on ipv6 wouldn't be feasible.

Many thanks to all the "nay sayers" in this sub-thread. Helps me manage my expectations, if nothing else :-)

I personally would like to make my home network IPv6. Just for learning purposes, but my issue is that my ISP doesn't even provide IPv6. And there isn't any official private address range.

That's a problem that I struggled with for four years (multiple IPS, one DSLAM for ADSL, that ran some ancient crap that they refused to upgrade to support ipv6...).

But now, this new network is my home network. So if I want ipv6, I have to maintain it myself :-) (This is, assuming that the upstream ISP here that provides the fiber line will be able to provide ipv6, but I'm fairly certain that shouldn't be a problem)

You can get free IPv6 tunnels, e.g. from he.net: https://tunnelbroker.net/

Private addresses are discouraged, please use public addresses (you will have plenty) and filter them correctly. If you must, you can use link local (fe80::) or unique local (fdXX:XXXX:XXXX::/48) addresses.

What about rando devices (e.g. IoT light bulbs, TVs and the like)? I just looked at my cheapo Brother printer and though it does support V6 (yay!) it is only with a static address. My TV doesn't support v6 which is a feature to me!

Reply on news.ycombinator.com