Hacker News Reader

Comment by jasonjayr | Hacker News Reader

I bet Residential ISP's turn to CGNAT before they roll out IPV6.

I recall hearing a while ago that those who were early adopters of CGNAT (predominantly mobile providers) are backing away from it due to problems, and shifting more rapidly to IPv6.

(And apparently the police are not big fans either, as it makes it more difficult to track down miscreants).

Would be interested in hearing more about the problems.

From a consumer standpoint the problems I've run into and heard about are:

1. Can't use port-forwarding anymore since you can't configure the ISPs router doing the NAT

2. A bad neighbor sharing your IP can get you IP banned on sites that still think IP address is a good way to block/throttle bad players

3. Connections can be unstable if there's a lot of connections going on, so prime-time can often run into issues.

2 is an interesting point. Let's say you want to rate limit login attempts to help reduce brute force attacks. How would you recommend doing it if not by ip? You can tie it to the specific username being requested but this has other downsides, ie. you can DOS someones account by sending fraudulent login attempts to it, and it also doesn't prevent attacks where people just test previously leaked username / password combos against your site.

This is where CAPTCHAs come in, unfortunately.

> How would you recommend doing it if not by ip?

Not at all, it's a stupid idea. You are trying to nail down an identity without authentication, that can not work. If you use credentials with sufficiently high entropy, which you should do anyway, you don't have a problem that this could be the solution to.

Rate limiting by IP is trivial to work around. If you’re doing something white/grayhat there are plenty of services that will allow you to affordably "lease" as many IP addresswas as you need for very short amounts of time. For blackhat purposes it’s only slightly more effort and even cheaper to do the same thing, illegally of course.

Depends on the country. Whenever I visit Belgium I get IPv6 in random guest houses. Google sees nearly 50% adoption. https://www.google.com/ipv6

In Finland 2 out of 3 mobile operators give you IPv6 by default (and mobile data usage is very high).

Why is the graph so perfectly periodic?

Weekend vs workdays. Shows that IPv6 penetration for residential ISPs is higher than IPv6 adoption at corporations.

Exactly. And you can see Christmas. As soon as a paid network administrator is involved IPv6 seems to be a problem :)

They are alaready doing so. IPv6 test enviroments has been a disaster in the ISP I work for, too many devices don't support IPv6 in the domestic market and solution to router IPv4 over IPv6 are problematic.

Very interesting, thanks for sharing. What kind of devices are they? IoT type stuff, smart TVs, etc?

Right now IoT devices use a communications model that overcome's NAT by tying the device to a service endpoint in the cloud. The device registers itself as an IoT device in aws and then your local hosts hit the device by going to the device endpoint in the cloud. I don't know if this model will hold up when IPv6 more widely supported though.

The largest ISP in the US, Comcast, has deployed IPv6 on 100% of their network. If they can do it, why can't you?

To the best of my knowledge, Comcast is running dual-stack v4 and v6. The GP was talking about running a purely v6 network, and pointing out that it wasn't yet feasible. Your example of Comcast doesn't really fit the bill because Comcast already has a v4 network to all of their customers, and they are not migrating customers to a solely-v6 network.

This is the chicken-and-egg problem that all new networks are facing with regard to IPv6 adoption. In order to have a usable network, you have to support IPv4 to all endpoints. But once you have v4 at all endpoints, the incentive to run v6 is greatly diminished.

As always, v6 needs a "killer app" that Grandma wants to use that is unavailable over the v4 internet, and then network administrators could use the actual demand from their customers as a justification for moving to v6. Unfortunately, at the moment, the list of v4-only must-have apps is still greater than the list of v6-only must-have apps.

v6 with DS-Lite/464/MAP is going to be cheaper than v4-only because it allows the ISP to sell off (or not buy) most of their v4 addresses while also using less equipment. T-Mobile has already adopted this architecture.

> The GP was talking about running a purely v6 network, and pointing out that it wasn't yet feasible.

Amusingly that's how mobile/smartphones are supposedly run: the devices get IPv6-only, and if they need to hit an IPv4-only address they are CGNATed.

* https://www.internetsociety.org/resources/deploy360/2014/cas...

* https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mob...

Ah, so that explains it. I just switched from Sprint (which always gave me an IPv4 address) to T-Mobile (which gives me an IPv6 address).

My Verizon iPhone has both a public IPv4 address and a public IPv6 address.

They certainly could be using CGNAT, but that seems like a weird way to do it.

> My Verizon iPhone has both a public IPv4 address and a public IPv6 address.

How are you able to tell with IPv4? You cannot run ifconfig on an iPhone, so how are you determining that?

Seriously? On Android it's just settings->about phone

There are apps like "Network Analyzer" that give you this info. (My MVNO puts me behind CGNAT, no IPv6)

Really? My Verizon Android gets RFC6598 space.

Holy cow, I don't know how I was never aware of RFC6598. When I saw the address starting with 100, I simply assumed it was an actual routable IP.

Maybe you just don't get to know what problems it causes because they don't talk about it. Dual stack is currently under testing and afaik higher ups are not very happy about it.

Maybe we've done too early (it was about five years ago maybe, I don't really remember exactly) and now tooling is better, idk

Both BT & Sky have managed to deploy IPv6 in the UK, so the problems must be reasonably easy to solve.

Unfortunately Virgin Media (my ISP) are still dragging their heels but have decided to go with DS-Lite.

Maybe the smaller ISPs.

Many large cable ISPs in the USA have been running IPv6 internally for years now. They likely have some of the largest deployments if you account for all their IP managed gear.

Of course, these are the same ISPs that already provide a dual-stack gateway to their customers.

> Many large cable ISPs in the USA have been running IPv6 internally for years now.

CableOne/Sparklight says hi, because they have zero intention on deploying v6 for the foreseeable future.

Not sure I would classify CableOne/Sparklight as a large cable ISP. Their website says they service about 900k customers. Even if all of these customers had internet service this would put them fairly far down the list of ISPs. I would more classify them as a medium sized ISP.

There's one big issue with CGNAT for ISPs: compliance.

At least in Poland, you must provide law enforcement with information about your subscriber for any given 5-tuple at a given time (timestamp, {src,dest}{ip,port} and protocol). If you're CGNATing everyone, you have to either:

- log all outgoing connections (which is a GDPR hazard)

- design your CGNAT to use static outgoing ports for a given customer (but then you're running out of ports pretty fast, if you're doing anything close to >=500 subscribers)

With IPv6, you can just immediately tell who the subscriber is based on the IP address, and as such don't have to log anything.

Crikey, the amount of storage required to keep that will be insane. What's the retention period?

One year but not a day more (data protection laws).

If you need consistent ports, you could assign many internal IP’s to the NAT to support more ports for your NAT.

Does the GPDR override the data retention law? I was reading some stuff about VPNs which suggested it might.

No. The GDPR explicitly doesn't concern matters of lawful interception, intelligence, police and justice.

Look to the mobile networks as a sign for things to come. How much money do you think network operators are going to invest in a highly available and performant IPv4 CGNAT experience? I know of one large mobile network that said they're constrained on CGNAT capacity and their plans arent positive.

My fiber ISP gives you overloaded PPPoE for the legacy "dedicated dynamic IP" experience, IPv6 is carried over more modern and performant IPoE infrastructure, and if you want you can use DS-lite for IPv4 to trade CGNAT for performance

Most of the stuff regular people care about performance for is on CDNs that support IPv6 (or is YouTube, Netflix etc)

This is already happening in Australia.

https://www.aussiebroadband.com.au/help-centre/nbn/tech-supp...

The correct answer is "both". IPv4 CGN is inevitable because there are more people than addresses. Native IPv6 lets people bypass the CGN.

Reply on news.ycombinator.com