Hacker News Reader

Comment by sliken | Hacker News Reader

Seems pretty huge to me. I could give just about every person on the planet (call it 8 billion or 2^33) each their own personal IPv4 (2^32) worth of IPs.

I've got a larger then normal home router with 6 ports. I can have a /64 for each, and still have a bunch left over if I want to split up wireless into more secure, medium secure, less secure, and least secure networks.

I'm all for more address space, but I'm at a loss as to why a normal even a sophisticated home user needs more than a /60.

I wouldn't turn down a /48, but realistically I've got 30 or so IPs in use. Sure recently I added an IP for a wristwatch, TV, and a stereo. Clearly cheaper devices are getting Wifi. It's becoming more common in appliances, thermostats, door locks, electrical outlets, light bulbs etc. But 2^64 pennies is quite a bit, and I doubt anything will be consuming more than one IP per $0.01 of cost anytime soon.

View on HN

That's not how IPv6 works. In IPv6 the lower 64 bits are essentially random, and the most significant 64 bits are used for routing. Each additional level of routing must use up one bit, except because of over-provisioning concerns, and to keep everything nice, you are supposed to use a nibble (4 bits).

A /64 can't be subnetted any more (one host, NO VMs!).

A /60 can support one level of extra routing.

A /56 can support two levels of extra routing.

If you plan to run VMs on your laptop, you need a /60 on your laptop, which means you need a /56 from your ISP. If you want to keep everything nice and future proof, that is, if you want to fuck up with special configurations, you can use your /60 from your ISP, and give a /62 to your laptop, then each laptop can have 4 networks for VMs. But that is limiting and a PITA to set-up.

> A /64 can't be subnetted any more (one host, NO VMs!).

Why not directly bind all VMs to laptop's NIC? This way, they can get IP from the same /64 subnet. On firewall, only enable public access to those VMs that are needed.

I do have a home lab, but every VM is directly bridged to NIC and gets its IP from home router. So a single /64 is sufficient for me.

Sometimes it's fine to do that, other times it isn't. If you plan to test network topology, firewalls, you can't do that. If you plan to run untrusted VMs, you also can't do that.

I'd use a unique local address network (/32) for this

https://tools.ietf.org/html/rfc4193

That's fine for some scenarios, but in general for my use cases, I wouldn't, because most often I want my VMs to be accessible from the Internet.

At this point I'd argue your case is a bit special and you may need special arrangements. If it is that critical for you to have a gazillion of IoT devices and untrusted VMs accessible from the internet via IPv6, get a /48 tunnel from he.net

To be fair, his special case just works on IPv4, but not on IPv6. So it’s a regression in functionality without the right prefix size.

Reply on news.ycombinator.com