Hacker News Reader

Comment by cnst | Hacker News Reader

The best part about IPv6 is that it's now possible to SSH directly into your laptop if you're using a hotspot from T-Mobile US, for example — it gives you at least a whole /64, so, your laptop gets a fully-routable IPv6 address.

Which is kind of ironic, because you don't get that with most wireline connections, as they're all done through IPv4 NAT.

View on HN

This is my favorite bit about native IPv6 at home [0]. No more port forwarding to expose particular services -- I can just `ssh desktop.home.net` or `ssh other.home.net`, and they both get to run on default ports! (Of course, one probably wants a firewall -- I block inbound IPv6 by default except ssh.)

[0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option!

> [0] Comcast is surprisingly good here -- they'll give you a /60 (16 /64 networks) if you ask for it with the right DHCP option!

Can you go into more detail or point me to instructions? I'm on Comcast and would be interested in getting v6 at home.

I think Comcast is native dual stack across their entire footprint so long as you have new enough hardware

Sure! The keyword to look for is "DHCP-PD" (DHCP prefix delegation).

I run a little OpenBSD router and my dhcpcd.conf is here [1], but I've done this before on a Linux router box too -- here are some instructions from Arch's wiki [2]. IIRC, the stock firmware on my old consumer router was also able to request a prefix and advertise it on the network.

[1] https://gist.github.com/cfallin/e5865a6a93c75ace8d26d6a85287... [2] https://wiki.archlinux.org/index.php/IPv6#Prefix_delegation_...

I want to study about the technologies around this part of networking, prefix delegation, radvd, etc. Any materials you can recommend?

Hagen's _IPv6 Essentials_ covers the basics, Coffeen's _IPv6 Address Planning_ shows the amazing things you can do with IPv6.

Do you also have an IPv4 address that you can use for NAT for those things that cant use IPv6? (Also do you have devices that aren't capable of using IPv6?)

Yes, I have native IPv4 too, with the usual NAT. I think the default router that Comcast will rent to you actually is dualstack in this way too -- IPv4 NAT, and IPv6 prefix advertised for devices that want it.

I actually played with NAT64 for a bit (IPv6-only internally, all IPv4 space is mapped to a special /96 in IPv6-space and NAT'd at the router, and local DNS server on the router returns translated AAAA records for IPv4-only hosts), but dropped that when I simplified my router config. It works, it just takes a bit of config :-)

This may be a dumb question, but why does one need with a /60 ? Isn't a /64 already ridiculously huge to the point that I could never possibly use it all?

Not with that attitude.

IETF recommend a /64 as the smallest subnet size to use, as stateless auto address configuration (SLAAC) only works with that subnet size.

Any user that wants more than a single subnet at home is supposed to receive a /48 by the same recommendation base. A lot of ISPs settled on /56s. Comcast is a bit more stingy than some.

That introduces a whole other set of problems.

Not a dumb question at all! The smallest IPv6 subnet is /64, so a /60 lets you split your network into multiple subnets without all the software that assumes a subnet is /64 (like address autoconfig) breaking. Why might you need multiple subnets? Lots of reasons, common ones are for security. It lets you do things like split up a home office network from home from guest wifi from IoT/home automation. Also allows new services to be created that use that capability.

The RIPE guidelines at [0] line up with what I've heard as justification before: basically, /64 is the smallest you can go without lots of manual configuration (the way that SLAAC auto-assigns addresses from Ethernet MACs or random bytes only works when the host part of the address is 64 bits). There may be valid technical reasons to want > 1 subnet at a customer site.

And finally, the space is huge -- an ISP would typically get a /32 at least (Whois says that Comcast is using a /26 just for the Bay area), so if every customer gets a /60, that's 2^28, or 256M, delegations. (With the /26, Comcast could hand out 16 billion /60 delegations to their SFBA subscribers.)

[0] https://www.ripe.net/publications/docs/ripe-690#4--size-of-e...

I only need a /100. More internet addresses than Europe has in IPv4. I can statically assign devices their own individual addresses.

That was one of my motivations to try IPv6 at home, only to quickly get disappointed because my ISP gives me a new prefix change very often (in stark contrast to my IPv4 address for some reason).

I have this issue too, so I use Ddclient-curl to do dynamic dns via cloudflare.

DDNS is something that I once thought would be an artifact of a less civilized time, but ISPs gotta upsell, I guess.

Main problem for me is that my router doesn't update firewall rules when prefix changes, and I can't get it to not advertise its public ip for the DNS resolver running on the router which of course breaks when the prefix changes.

Hmm. I run pfsense, it advertises its own v6 address as a DNS resolver, and I've never had any issues with it breaking. Admittedly, I don't know it isn't just falling back to v4 for a period when the prefix changes. But I did just check and my PC is getting the correct v6 addr of my router as DNS resolver.

> Admittedly, I don't know it isn't just falling back to v4 for a period when the prefix changes.

At the very least, IPv4 fallback takes a few seconds for each DNS query, and I've experienced it failing completely in some cases (can't recall if I ever figured out why). So regardless it's a PITA when it happens.

I tried disabling the option for it to advertise itself as a DNS and instead insert the local IPv4 address in the DHCP options but to no avail, clients still ended up with public IPv6 as main DNS.

After a few hours of trying to fix it I just turned off IPv6 again.

Yes, you probably should have a firewall but the sheer size of IPv6 means that whereas I'll have several idiots banging their heads on my SSH services at any one time on IPv4 I'm not sure I've ever had one trying on IPv6 in the years that I've had service available on both public IPv4 and IPv6.

If you set a machine to try just one IP address per second in IPv4 you'll explore a significant fraction of the whole public address space per year. In IPv6 doing that is extremely unlikely to find even a single valid address to connect to in a human lifetime.

Theoretically, yes.

Practically, my laptop is in some Wifi network and has an IPv6 address, but that isn't accessible from the outside because the Wifi/router box blocks incoming connection. That is a wise decision overall, but unforunately replaces the "can't connect because NAT" by "glorious IPv6, bit still can't connect".

And I'm not the owner of those boxes.

It depends.™

I've had a static IPv4 subnet allocation from AT&T on AT&T U-verse, and tried using it on a couple of consumer routers for the local network. Well, guess what — all these devices from major brands that are called "routers" don't actually route between the interfaces, after all — all they did was NAT between my public IPv4 allocation and the main IPv4 address assigned by DHCP. And disabling the NAT simply disconnected the networks — instead of rounting one interface to the other. I actually opened up a support ticket with ZyXEL, which got escalated to their engineering managers, and they did confirm my finding that their routers had a bug in sysctl settings that stops them from routing the interfaces (e.g., sysctl net.ipv4.ip_forward not set to 1).

Anyhow, back to T-Mobile US IPv6 on a hotspot — when I originally tried ssh'ing back to my own box via the public IPv6, things didn't work, either; but I then found out that it was some sort of a local policy on the local machine, because another laptop without a firewall was able to receive connections on IPv6 from the internet without any issues.

Were they all just selling NAT-ing bridges instead of routers? This is a serious fraud.

Was the former more secure? Most people don’t want their laptop exposed with a fully routable address.

That's why you have firewalls. You're already often exposed to all the other users in your coffee shop anyways.

SSH is normally not enabled, either.

If you are on Ubuntu, you can run

sudo ufw default deny incoming

and your laptop is now secure.

NAT is not a security measure. You want a firewall regardless of whether you’re running IPv4 or IPv6

What do you do for something like printers? I highly doubt Epson's "firewall" is totally secure.

Your home has a gateway router.

You can configure firewall rules on that.

In fact, the default is almost always to disallow all inbound and allow all outbound.

IMO, the "right" answer is that printers go on their own subnet. Access control is managed on their default gateway.

Reply on news.ycombinator.com