What problems would occur if we were just nat-ing everyone behind those 4 billion IPv4 addresses?
I run a popular website and I have never heard anyone being unable to use it because it is IPv4 only.
I just tried test-ipv6.com and it gives me a score of 0/10, saying "You appear to be able to browse the IPv4 Internet only.". I basically live in the internet. And I am not aware of any problems this causes me.
Because we're running out of IPs even with NAT, so entire ISPs have to implement it:
* https://en.wikipedia.org/wiki/Carrier-grade_NAT
There are entire swaths of IPv4 addresses (100.64.0.0/10) reserved just for ISPs to assign to their customers' WAN interface which will not interfere with the RFC 1918 addresses people use on their home networks:
* https://datatracker.ietf.org/doc/html/rfc6598
We're doing NAT-upon-NAT.
Good luck doing hole punching on your personal firewall to allow connections in for games or VoIP.
That way you don't have to worry about dynamic addresses, ISP blocked ports, buggy router firmware. It all just works. Things like ngrok can do it really easily for http traffic.
Right, but that only works if the other end has an address, and they're increasingly scarce/expensive.
You can implement one of those kludges. Or you can make the effort to restore the end-to-end principal originally envisioned for the Internet.
I'd prefer if people try to work towards the latter over the long term.
The benefit of the VPN option is that it requires cooperation from no one and rips right through all the obstructions the ISP and routers put in the way. People hosting at home are an extreme minority so there is basically no chance we will go back to when every single computer was directly connectable.
Perhaps, much like many of the other standards we've settled on despite the existence of technically superior alternatives, this solution is good-enough, and it was easier to implement, and it was here first. Sort of like how we still use UNIX instead of Inferno.
Even with NAT'ing we're running out of IPv4 addresses.
Now I NAT on IPv4 at home, even though my router/ISP supports IPv6. First thing I do on any Linux install at home is get rid of IPv6. I don't see where the problem is. I really don't see why my home machines should have an IPv6 IP: the outside world sees my router's IP and that's it. Now I'm certainly misunderstanding all the benefits and security that IPv6 would bring me at home but meanwhile I'll stay on IPv4 and I really don't see what the problem is either.
Benefits-wise, your devices are addressable on the Internet, so it becomes simpler to create peer-to-peer connections, firewall traffic, and create segregated subnets.
Security-wise, your devices are addressable on the Internet, so all the workarounds to punch through NAT with terrible security implications aren't needed (I'm thinking UPnP mostly, but STUN/TURN/ICE are easy to get wrong). Essentially, under IPv4+NAT, your devices are already "addressable" via a combination of your router's IP and some form of session token, but securing such traffic depends on the successful implementation of a NAT-traversal protocol by a third party.
Nope. By default home routers (e.g., Asus) will block incoming connections just like with IPv4. It may allow pings (ICMP) in, but that's usually it.
You have to manually go in and tell the router to allow new connections in (either generally, or per service/port), just like the "DMZ" functionality with IPv4 many routers have.
IPv6 doesn't solve the problem of everything in the internal network being unable to accept incoming connections. With a NAT you need to set up port forwarding. With IPv6 you need to punch a hole into your firewall. Either way, home users will not be doing it by hand... we'll invent some protocol to do it and that protocol will have security issues.
We don't have to. UPnP works just fine with ipv6 already. (upnp v1.1, appendix A)
I sure hope it does. Blocking ICMP can cause TCP connections to hang due to inability to do MTU size detection.
With IPv4 this is usually not as visible, but with IPv6 if you block ICMP your connections will block as soon as you try to transfer a large block of data.
At some point, that will go away due to CGNAT. A lot of people have to share their public IPv4 address these days, which means no inbound port forwarding, and potentially getting banned from services if their "neighbors" misbehave.
On the other hand, CGNAT does improve privacy to some extent.
1. Extra latency in voice/video calls which have to go through the TURN-like endpoint rather than directly between the callers.
2. Extra cost of hosting your services, because even on the hosting side we're running out of cheap addresses.
3. P2P networks dying - which means we'd be stuck with centralised providers. (Or at most "effectively federated" networks)