Hacker News Reader

Comment by krylon | Hacker News Reader

I have been getting native IPv6 from my ISP for nearly six years now. It is not quite as cool as it could be, because I get assigned a new prefix every 24 hours, but still, IPv6 is there, and it "just works".

When I connect to machines on my home network in any way involving avahi/zeroconf, the machines talk to each other via IPv6 by default.

At work, it's a different story. I have drifted from a sysadmin/helpdesk role into a programmer position, so that is no longer my concern. When it was, however, there was little incentive to use IPv6 - everything worked and continues to work just fine with IPv4, and sometimes there were even some rather esoteric problems with Windows' "Network Location Awareness" when IPv6 was enabled.

View on HN

>I have been getting native IPv6 from my ISP for nearly six years now.

Meanwhile Danish ISPs refuse to implement IPv6 because: There's no demand.

That completely missing the point and their responsibility in my opinion. There's never going to be any significant IPv6 demand from private users. At work however we have customers that have started to request IPv6 only devices and networks, because there's no need for IPv4 specifically, and in some ways IPv6 is just easier (for example there's no need to do NAT).

For IPv6 to be successful the ISPs need to role it out, regardless of demand. The issue isn't necessarily at the consumer end, but the ISPs are part of the Internet and they need to help develop it, regardless of profitability in the next fiscal year.

Elsewhere, the ISPs are doing the IPv6 rollout in the worst possible way imaginable: DS-Lite with no PCP for AFTR (i.e. no way to have incoming IPv4), and allocating only /64 subnet, where their CPE is mandatory in router mode, no way to switch it to bridge mode (thus losing control of your own gateway. I'm talking about you, UPC/Liberty Global).

For just consuming the web, it is fine. For switching from public IPv4, is is insufficient.

NAT traversal (hole punching) works for CGN well, doesn't it? sure you need a coordinator/RP between to CGNed users, but that is not really an issue as far as I know.

Hole punching works for applications that are designed for it, and can invoke the coordinator. Sometimes, you just want plain old incoming connection (in my case, VPN).

BTH, I've never tested whether it works with CGNAT or not. It would be additional hop to jump if I would give up my IPv4 address, which obviously I'm not going to.

End user residential connections usually need a DynDNS as there's no guarantee you'll get the same IP for any foreseeable time period. So dynDNS could be bundled with hole punching. (It just allocates a port on the CGNAT, due to cost concerns I'm guessing these are rather dumb TCP/UDP devices, so almost anything will work through them.)

Of course it's a lot messier than getting a static private address allocated.

This will not help you if you have something like an IP camera that you want to access from outside your home, since the address will change frequently.

The only good thing about UPC/Liberty global's implementation of DS lite (now "Ziggo" where I live) is that they will switch it back to IPv4 with a single phone call to the help desk. I can live without IPv6, I cannot live without being able to reach my home server and IoT things.

For SoHo stuff people already need a DynDNS, and they could bundle that with NAT hole punching pretty easily.

Though of course it'd be nice to get a private static address.

I don't think the success of IPv6 as a whole hinges on these residential ISPs. I think there is enough momentum for IPv6 already (mobile users especially) that we get a healthy coexistence of IPv4 and IPv6, where new stuff gets designed for an IPv6 fastpath and limited support for IPv4 legacy shims for the "long tail" of adoption.

I guess the ISP space isn't competitive enough that they will ever go "looks like our ipv4 users get shitty latency and more congestion on facebook than the competitor's ipv6 users, so we're gonna upgrade next year!", but their IPv4 setups will probably eventually succumb to attrition too and be replaced by IPv6 gear.

>> Meanwhile Danish ISPs refuse to implement IPv6 because: There's no demand. That completely missing the point and their responsibility in my opinion.

Responsibility to whom?

If there's no significant demand from end-users for something, then we're relying on there being a benefit for access providers.

>> For IPv6 to be successful the ISPs need to role it out, regardless of demand.

>> regardless of profitability

Can anyone give examples of a successful technology roll-out where there was no demand, and no profit to be made?

> Can anyone give examples of a successful technology roll-out where there was no demand, and no profit to be made?

Seat belts, airbags and other safety systems in cars (like ABS, VSC, etc). Emission control systems in cars.

If industries can't self regulate and play nicely, the big bad government will come with their regulations and I'm sure they won't like those.

What you're observing might be your operating system's behavior. There is a privacy feature of IPv6 called "privacy addresses" (or sometimes "temporary addresses").

https://tools.ietf.org/html/rfc4941

Some (most?) operating systems rotate the v6 privacy address daily or more often. The benefit of this is a) address not transparently based on permanent ethernet hardware MAC address and b) changes over time. Both are meant to hamper tracking.

If you're on a Mac and using IPv6, you can see these temporary privacy addresses stacking up over time if you type `ifconfig en0`. Old ones don't disappear immediately when rotated out since you need to be able to receive packets for a while. They are marked "deprecated" for some time before they disappear.

I can tell the difference between my prefix changing and adresses within a prefix changing.

Ah I see, the _prefix_ is changing. Wonder why your ISP is doing that … ?

Possibly because they charged more for static IPv4 addresses and wanted to continue to receive that income with IPv6.

> because I get assigned a new prefix every 24 hours

Which kinda defeats the purpose of having a globally reachable unique address in a lot of respects. How am I supposed to allow connections to this device in my firewall if the address is always changing?

There's advantages and disadvantages to this approach. When we're talking about residential networks, some consumers won't care about the inability to do that, some will. Those that do care also have to weigh the privacy concerns about the fact that they have a now static prefix for their networks, much like static IPv4 addresses.

Personally I'd prefer ISPs to take an approach like this by default, but allow the option for the consumer to have a statically assigned IPv6 prefix for free if they want it, who understand its implications.

> When we're talking about residential networks, some consumers won't care about the inability to do that, some will.

This prevents also to create products that need a public address. I think it is a real brake on innovation, who knows what could be invented if everyone had a public ip address ?

The address is public, you can use a dynDNS easily. Relying on fixed addresses never works.

[devils advocate] ISPs are businesses, they are also there to make money, those customers who want a static address may have to pay extra to get one. They know static IPs are more valuable so they won’t give them out by default, ipv4 was the same.

Exactly. There is more than enough address space to give a person a static IPv6 network.

Comcast is guilty of this. Verizon doesn’t even offer IPv6 on FIOS.

For both, I just set up an IPv6 tunnel to Hurricane Electric using pfSense.

>> There is more than enough address space to give a person a static IPv6 network. >> Comcast is guilty of this. Verizon doesn’t even offer IPv6 on FIOS.

Why would ISPs not deliberately(!) change address(es) for cheap/residential plans, to provide a reason for those customers to care about this to pay more for a pro/business plan with a static IP allocation?

For privacy purposes I hope most ISPs do this.

Looks like the wet dream of adtech, to have everybody use a static IP address. No thanks.

Most operating systems these days support IPv6 privacy extensions where a device will pick a semi-random address every 24 hours. IIRC, it is the default on macOS. You can have a static prefix and random addresses per device.

You will be tracked by prefix then.

> How am I supposed to allow connections to this device in my firewall if the address is always changing?

You don't. That's what ESP/AH with PKI is for.

Sounds like for privacy your ISP is shuffling the prefixes every day. They could also be doing this to upsell static IPs too, maybe a bit of both.

Reply on news.ycombinator.com