IPv6 Support for EC2 Instances in Virtual Private Clouds
aws.amazon.com
aws.amazon.com
This is one of those that's more of a "about damn time," features that'd I'd care about if I already didn't go with Digital Ocean/Linode instead just because of IPv6 support.
Looking very forward to trying this out.
As long as AWS is both widely used by existing users, and is a likely option for new users evaluating alternatives, these AWS posts are always relevant on HN.
It's sorta like the network neutrality argument, except you're talking about limits on who can offer services to everyone vs those with newer IPv6 devices and ISPs. You can end up with two different Internets.
Everything we've done assumes an IPv6 network - trying to squish large device networks into IPv4 is just a losing battle for a huge number of reasons (address mobility, address conflict, large number of downstream devices (20,000+) per network segment, etc...)
Medical devices of some kind? Just guessing.
Both of them lend themselves well to mesh networking application, and mesh networks, in which any one of the 5mm+ deployed devices might appear in any one of the 10,000+ network segments, and in which we just want to concatenate the MAC address and Network segment to get a network address (basically SLAAC) - really makes IPv6 a pretty good fit.
If the app backend is not also available from a network where IPv4 is completely blocked, the app is rejected.
At the same time, AWS does not let new accounts to create EC2 instances outside of VPC, and only provided IPv6 support in the non-VPC classic stack (only available to old AWS accounts that signed up years ago).
So for the last few months, AWS has been unusable as a backend for iOS apps unless you have an old classic AWS account.
https://developer.apple.com/library/content/documentation/Ne...
I don't think your description of Apple's requirement is accurate.
If I'm running a small startup that's available as a website, how does IPv6 support matter to me? (Assuming that I can otherwise get IPv4 addresses for hosting my site, which I can.)
In addition, I think you overestimate the difficulty of conversion. Most backend servers run on 10.x.x.x networks and that doesn't need to change. You just need a proxy in front of them that can speak IPv6. Installing a new proxy does not sound like a hard job. It sounds trivial.
And as mentioned, the reason there are so many AWS posts this week is because they save up all their announcements for the conference going on right now. I sorta wish they'd spread the stuff out more, myself, but these are mostly HN-front-page quality announcements. It's just a year's worth of work dumped all in two days.
Which only makes it more baffling that AWS still doesn't support IPv6 everywhere.
IPv6 is 8 years older than AWS. AWS is a decade old. Given that the inevitability of IPv6 is long known and that it's well known that as a rule changes get more difficult the bigger you get, I would have expected Amazon to start IPv6 deployment much earlier, back when AWS was much smaller.
Strange that GCE doesn't support it, given their usage elsewhere.
You can argue that behind NAT there is still IPv4 connectivity with public internet, but it is actually closer to proxying (i.e. having some device talk to internet on your behalf) than to routing (i.e. have some device pass your packets on).
Long story short, there is (for a long time already), no IPv4 public internet. There is IPv4 public interconnect between millions of isolated IPv4 islands. And a lot of hacks and shady engineering to make packets traverse from interconnect to islands and back.
However, as a whole, the lack of native IPv6 support in EC2 certainly held back the global deployment cycle. It's the chicken and the egg problem: Without support for servers that use IPv6, there is no reason for last mile providers to implement it in households. With this update, a huge swath of sites will get support, hopefully leading to quicker adoption for end users.
* for most applications. This is certainly trivializing a subset of applications where this could be useful.
Your firewall may start with a simple "deny all incoming SYN packets" rule, but IPv6 gives you the option to open up holes in the firewall to any device or devices on your LAN (port forwarding only works once per port through a NAT).
The real benefits probably don't exist yet. There are entire categories of network software that have remained unknown and unexplored because it didn't work behind a NAT. There were several projects I wanted to write ~15 years ago that I never even started because it required a real internet connection, not a NAT "party line".
But see.. I can already do that with IPv4 and Nat. Oh I want to run a ftp server on my backend? Open up port 8000 on my firewall and forward to port 21 on my FTP server.
I find it weird I am making this argument, as I am normally progressive. I push Python3 over Python2, because it is the way of the future. Even though it causes me pain sometime. For some reason, I just do not see the (for me personally) reason to care about ipv6.
Clearly the more backbones that support it, the better. It at least gives us the OPTION to use it later. Not totally sure what good it will do still though ;)
funny you mention FTP where that is distinctly not true as the application level protocol encodes IP addresses and ports to either (depending on PASV mode) peer to open for the data transfer.
If your server is behind a NAT and the user is using passive mode, it'll tell the client to connect to some internal ip address, so unless the NAT router does deep packet inspection and alters your packet on the go, that won't fly.
Conversely, if you disable passive mode, a NATed client would have the same issue because in that case it would tell the server to connect to some internal IP on the client's side which too won't fly.
Same issue for all other protocols that have IP addresses in their payload. There are very few of them these days for precisely this reason, many early media streaming and VoIP protocols were doing this too.
Also somewhat related: Port forwarding from one public address only gives you the ability to forward to one specific server. What if you want to run two different HTTP servers on your backend? What if you want to run different SMTP servers on your backend.
Now you're again down to needing packet-contents inspection or you need multiple public IPs in the first place plus a more complicated NAT table. With v6, all you need is to open a few ports.
And these were the technical issues.
There's also a political issue: As v4 addresses get more and more scarce, so increases the control entities with addresses get to have over what services they do and to not allow on the network.
Do we want to live in a place where no new service gets to participate in the internet? Where the next Netflix can't launch because none of the providers want to have yet another service competing against their own content business?
In order for the internet to continue to grow, we need an abundance of addresses and the only way to get that is to have wide-spread v6 support. And in order to get there, every single bit counts: Every service that can offer v6 should. Every provider that can offer v6 should. Only this way we can avoid one big cause for a very much locked down internet in the hands of the providers and the old guard.
v6 plays a very important role for both technical and political reasons to the point where we really need to fight the "v4 works fine for me" attitude. Having a v4 address to run a service on is a privilege. Don't argue from a privileged position based on lazyness.
> ftp server ... port 8000
Of course there are workarounds. This one requires specifying a non-standard port every time you want to use your server. That may be easy[1] now, but it becomes increasingly problematic the more times you create these workarounds.
The bigger issue is that hosts behind the NAT are not first-class citizens of the internet. They require an imprimatur[2] to publish. If you live in a privileged area that has a static v4 address, this isn't a huge problem. If you live in China behind 3+ layers of NAT, getting a port forwarded to your host isn't going to happen. As NAT becomes more complicated with more layers, even the insane hacks[3] we have to punch holes in NAT (which already require a 3rd party's permission (imprimatur)) start to fail. This will become an increasingly common problem as competition over v4 addresses increases[4].
> Not totally sure what good it will do still though ;)
It will enable the development of new network software that doesn't work over NAT. This type of benefit isn't immediately useful, so think of it as an investment.
It will let more people gain the benefit of being able to publish without needing the permission of a 3rd party. You may not find that important personally, but impartial media access is one of the most important properties of the internet. If we are not vigilant and robust in defense of every peer's right to publish, we will loose it. This isn't a theoretical concern, given how centralized the internet has become in the era of Facebook and Google.
[1] modulo the serious problems that FTP has with NAT that pilif already mentioned
[2] While I don't agree with everything in the essay (some things have changed since 2003), John Walker (co-founder of Autodesk) wrote a very insightful warning about the trend towards requiring an imprimatur to publish: https://www.fourmilab.ch/documents/digital-imprimatur/
So I have a router that connects to a NATed subnet, which is plugged into another router which provides DHCP to a different private address space for my devices. Granted, in theory all these media hops could've been handled by (more) ethernet level bridging - but if I had simply had native routable ipv6 on my lan, routing through a couple of boxes would've been rather simple - as would exposing ssh or samba on my desktop to the lan or the Internet.
As it is, it's a terrible hack, that sort-of works...
It's sort of like asking "Why should I connect to the Internet, if everyone I know already has a telephone?"
What about UDP packets?
routing v6 directly is completely stateless. It can easily be done completely in hardware possibly not even requiring to store the packet anywhere, nor needing any knowledge of the protocols wrapped inside of the IP packet.
To do NAT, you need to know about TCP and UDP and about the various ports which means you need to look into the IP packet. To route v6, you just look at the IP packet.
Well there better not be because we're totally not ready because of shit like this. That's why it's needed.
I recently discovered my home IP is ipv6 and have started to realize that it is more than just a larger address range. e.g. arp is replaced with ndp. While I haven't yet found a guide that has more depth than the very basics, but isn't a full on Cisco manual.
Only older accounts (from before december 2013) have the ability to create EC2 instances that aren't in a VPC.
That said, I think it's a great signal to the industry, and I'm excited to try to use IPv6!
I think everyone who needs IPv6 is just not using AWS (anymore).
One of the original motivations for IPv6 was that it would provide enough address space for every device in the world to have its own unique IP address. Then devices could communicate with each other directly, without worrying about intervening NATs. If you're using IPv4 publicly, then you've already lost that advantage.
Concerning private networks, IPv4 offers more than enough address space within its private ranges for your private network. The 10.0.0.0/8 block provides 16 million addresses, and there's also 172.16.0.0/12 and 192.168.0.0/16. There are certainly enough addresses in these ranges that running out is not a concern, so it does not seem that IPv6 would provide a benefit when applied specifically and only to private networks.
[1] meaning your network locations, not your private datacenter (necessarily)
See this presentation about IPv6 at Facebook: https://www.facebook.com/groups/2234775539/10152303014725540...
> IPv4 offers more than enough address space within its private ranges for your private network
While theoretically true from a raw numbers standpoint, it breaks down at Facebook's scale when you have many gigantic data centers all over the world and start thinking about how you assign the addresses and manage the network that uses them.
As the presentation says, there was lots of wastage due to racks being /24 and clusters being /n (where n < 24).
You can relatively easily map IPv4 addresses into IPv6 range: just pick a /96 prefix and append the 32 bit IPv6 address. This is a relatively easy translation, that does not require the machine doing the translation to keep state !!! (so you can send traffic to a random one and it can do the right thing, no need to have connections stick to one). It is thus quite easy to make an IPv6-only network deal with IPv4 clients. With decreasing IPv4 usage, your network naturally adapts since it only becomes easier.
The reverse is not easily possible for serving IPv6 clients from an IPv4 network: you can't map IPv6 1:1 to IPv4, so your gateways have to be more like traditional NAT and keep state tables around, which makes operation in general and load-balancing/fail-over in particular harder. The more and more IPv6 clients you have, the more resources you need for the translation. And at some point in the future, you are going to want to switch.
You could alternatively run your entire DC on IPv4 and IPv6 double-stack, but that adds a lot of unnecessary complexity. Your routers now have to keep routing tables for both around, behavior could differ for both, your applications (logging, fraud prevention, ...) have to understand both, ...
If you are in a position where you control everything you run (so you can make sure there aren't any stragglers that require IPv4 because their vendor doesn't care or something like that), the IPv6 model can be attractive. Do the switch and be done with it for the future, limit your dealings with two protocols to the very edge.
> The 10.0.0.0/8 block provides 16 million addresses
> and there's also 172.16.0.0/12 and 192.168.0.0/16.
> There are certainly enough addresses in these ranges
> that running out is not a concern
The only appreciable benefit i can see right now is that everything moves back to be a routable internet, no more NAT / nat scaling issues for EC2's sending large quantities of data directly to the public internet?
It might be finally possible to reach things floating out there on the internet which have an IPv6 address.
I mean, you can get IPv6 on a bunch of low-end budget VPSs. Why couldn't Amazon do it? And why cant GCE do it?
Is it a lot of work?
Notably, even low-level stuff may still be difficult to make with IPv6. For example, Linux supports IP equal-cost multipath routing for IPv6 since 2012. Quagga, a popular routing daemon, still doesn't support that. BIRD, another open-source routing daemon, just got partial support for it this year. If your network is relying on this, it's an additional burden to deploy IPv6.
https://www.youtube.com/watch?v=0gjuVhph520
Granted, that isn't necessarily a pre-requisite for going dual stack (aka: just attaching a v6 address to a machine), but it shows the fun problems you run into.
Or, moreover (and this is a bit of a pipe-dream, but it's something I've been hacking on to make possible) picture running something like an Erlang node on a box, where each Erlang process gets its own IPv6 address, fully Internet-routable. This effectively makes Erlang into an SDN vswitch for ephemeral, featherweight virtual machines (which would be oddly similar to AWS's just-announced "Lambda@Edge".)
Basically I have a fiber connection in the US, which on it's own is pretty mindblowing, but no IPv6 address...