Moving to IPv6 (2002) | Hacker News Reader

Moving to IPv6 (2002)

web.archive.org

37 pointscommandersaki34 comments

This post is from 2002. Was just a proposal that never took off? Is this something that was implemented and in active use? Trying to figure out if this is valuable information about how the Internet works or if it’s a curiosity/novelty of the painful long road to IPv6.

Dual stack (run both and try to use v6 first) and NAT64 (run IPv6 only and NAT to v4 at the edge) are the main methods today. The former is more common inside homes/enterprises while the latter is more common in modern large carrier networks such as mobile phones since the alternative would be to CGNAT (double NAT) anyways and that creates more problems for clients than NAT64 (+more work to deploy).

Not to say CGNAT is unheard of, particularly if the network was large, old, and needed to expand.

How do v4 clients (dual stacked) connected to the Internet with v4 talk to a v6 server?

Some v6 networks are able to convert your v4 to a v6 address, but that's pretty spotty.

If you are v4 only, and the server is v6 only, you really don't have much hope of connecting.

And so we must rely on v4 addresses to cater for v4 only connected hosts. This is the point the article is trying to make - for a transition to actually happen there needs to be interoperability between v4 and v6, that is v4-only clients need to talk to v6-only servers, and v6-only servers need to talk to v4-only clients. That is a fundamental requirement for a transition plan which provides a straight-forward path from v4 to v6.

Which is dual-stack with a grandual phaseout of v4. We already pay for the bloat of the v4 routing tables, but nobody can even think of phasing them out until stuff actually starts using v6. But nobody wants to deploy v6 because everyone has this mistaken belief that it’s easier to stretch v4 out with more hacks to preserve addresses.

v4 only hosts are rarer than you would think. ISPs have been dual stacking for a while.

The Internet is mostly v4-only. What do you mean?

Do you have anything to back that up? I work in the Telco industry. The vast majority of ISPs and carriers both provide dual stacking at least, with some carriers making as much of their network v6 only.

Really the only thing that is largely stuck on v4 is large (and poorly maintained) corporate networks and cloud providers.

As I stated earlier v4 only means a network connected to the Internet via v4 without connectivity to v6.

This is the majority of networks on the Internet. Otherwise we’d see adoption greater than 20% or whatever it is.

My cloud servers from major players all have v6 address attached on launch.

There are multiple types of NAT which are simply named after what it is they NAT:

- NAT44 (what everyone is used to)

- NAT64 (what I just described)

- NAT46 (the opposite of what I just described)

- NAT66 (bad)

In this case NAT46.

CGNAT is default in our largest home ISP and on all mobile ISPs here in Brazil.

It's just a novelty, as my sibling comment mentions, nat64 and dual stacking allows you do everything you need.

Nat64 requires a static route added to your gateway or each node, requires a custom DNS resolver and a daemon which manages iptables on a secondary gateway host for rewriting packets to/from IPv4 destination. It's pretty clever since it uses a /96 (32-bits) on the secondary gateway to return AAAA record for all IPv4 addresses.

Dual Stack is more straight forward requiring only an additional IPv6 address to be allocated to each machine requiring access.

Someone suggested the same thing. I'll ask the same question:

How do v4 clients (dual stacked) connected to the Internet with v4 talk to a v6 server?

A IPv4-only client cannot talk to a IPv6-only server: a 128-bit address does not fit in a 32-bit address. In a dual-stacked network, you get an IPv4 and an IPv6 address, and the network speaks both IPv4 and IPv6. So you speak IPv6 to IPv6 servers and IPv4 to IPv4 servers.

NAT64 has your ISP be an IPv6-only network--you get an IPv6, no IPv4 address--and your gateway to the Internet is an IPv4 server that translates public IPv4 addresses to IPv6 addresses for you to talk to. The server at that IPv6 address translates the IPv6 address you requested into the original IPv4 address, and acts as an IPv4 client to the IPv4 server.

(First I want to make a point/clarification. When I say v4-only, I mean a dual stacked host connected to Internet only via v4. Likewise for v6.)

If you don't have v4 and v6 interoperability - that is v4-only cannot connect to v6-only and vice-versa, how does the Internet (mostly v4-only hosts) go to v6?

NAT64/DNS64 allow a v6-only host to connect to v4-only hosts. If you are a T-Mobile US customer this is literally how you have all IPv4 connectivity. Here are AAAA records I get for amazon.com from my T-Mobile iPhone:

amazon.com. 2S IN AAAA 2607:7700::19:0:1:cdfb:f267 amazon.com. 2S IN AAAA 2607:7700::19:0:1:b020:67cd amazon.com. 2S IN AAAA 2607:7700::19:0:1:b020:62a6

These are NAT64 addresses within TMoUS’ prefix, if I try to ping an IPv4 address it is rewritten automatically as well (though this is a feature of iOS).

If you get people to v6 they can continue to access v4 with numerous transition tools like this, even if dual-stack isn’t an option. You can’t go the other way though.

So NAT64/DNS64 is really about connectivity to v4-only. This only adds more value to the v4 network by giving it more reach.

If you want to reach the v6 Internet, the best way is to have a transition mechanism for v4-only hosts to talk to v6.

Unfortunately that’s not possible, v6 has plenty of address space so you can carve a /96 out of your network to implement a transition layer so clients can be v6-only before the larger internet. There’s no way to represent the v6 network in 32-bit v4 addresses, so you have to start getting clients to v6 first.

v4-only means (as specified earlier) that connectivity is over a routable v4 address; a v4 host in a v4-only network can be dual stack, so it's possible to talk to v6 addresses, which this proposal actually addresses.

For all practical purposes, every OS networking stack is dual-stacked, so v4-only/v6-only is taken to mean that there is only a routable IPv4/IPv6 address.

v4-only and v6-only cannot in general talk to each other. There needs to be some intermediary to convert between IPv4 and IPv6 somehow. The transition from IPv4 to IPv6 is mostly progressing by having servers dual-stack (give them both IPv4 and IPv6 addresses) and dual-stacking the residential networks, or giving up on IPv4 for your internal network and using NAT64. You could in principle do the same thing for servers, but doing that 4-to-6 translation for the initial recipient of a connection request (i.e., the server) is more difficult than the initial sender (i.e., the client).

SOCKS and other forward proxies can allow IPv4-only clients to hit IPv6.

I’m still hoping one of these days we can just get on with everybody lighting up IPv6.

Enterprises continue to drag their feet with misguided knowledge of NAT as a security feature (it’s a glorified stateful firewall, enable the IPv6 one your network equipment is practically bound to have). SAAS solutions frequently fail to deploy IPv6 support still, even as major US mobile networks are IPv6-only. Email seems to be stuck in IPv4 land because we’ve put far too much into IP reputation, even though DKIM/SPF/DMARC and proper content-analyzing spam filters are a better and less brute force solution.

Don’t get me started on residential ISPs. CableOne STILL doesn’t support IPv6, and CenturyLink supposedly supports native IPv6 in my area (I ordered a static v4 w/ native v6 online) but nobody can tell me how to configure it.

Let’s get moving already! I’m tired of the hacks.

CenturyLink uses 6rd, at least on the fiber connection I used to have through them. This blog helped me configure it on pfSense: https://kdemaria.wordpress.com/2015/04/26/how-to-configure-p...

Yes, they have 6rd deployed - but in select markets they supposedly have native dualstack as well (this was the option I chose on their static IP portal when ordering mine). I have not been able to get either working correctly with my Sophos XG box which has rather infuriated me.

My understanding is that residential usage of IPv6 actually outpaces Enterprise adoption in the US.

This wouldn't surprise me at all.

My residential internet service has provided IPv6 for years. (I think it's 6rd, but I don't care — the company-provided router does the IPv6 router advertisement thing, and all the devices on my home network acquire IPv6 addresses. It's pretty transparent.)

And cell networks are now, as I understand it, mostly IPv6-native. IPv4 traffic goes through NAT.

NATs vs stateful firewall have different failure modes though; a NAT will fail closed, while many stateful firewalls will fail open.

NAT-as-poor-mans-firewall use case has fail-open failure modes too: the ambiguously addressed trafic ends up in egress/ingress routing outside the intended "local network". In practice this means someone else on the net sees your private-addressed traffic and can connect to your private-addressed network. This happens more frequently than you'd think, and may go on undetected for long periods of time if it's happening only in limited circumstances/context.

Only in this case you can't easily identify the traffic in your monitoring and logs because of ambiguous addressing.

As an enthusiastic 15 year old I presented at linux.conf.au 2003 citing 10 years as a more "likely" target for IPv6 adoption.

Boy how I was wrong :-)

It would've been hard for you to say "it could take 20 years" and you would've gotten laughed off.

Not this again. DJB's idea doesn't work but people don't realize that because it's presented in such a vague way. https://hackerfall.com/story/ipv6-non-alternatives-djbs-arti... https://news.ycombinator.com/item?id=10854570

Eh, I personally think the response in the foremost link is disingenuous. It says v4 can’t talk to v4+ (AutoIPv6 address). This would be true for non dual stacked systems; in whatever world you come up with. Obviously you need at least one host to be dual stack for interoperability.

Reply on news.ycombinator.com