Hacker News Reader

Comment by api | Hacker News Reader

Anything extending the life of IPv4 is actively harmful.

(Like I said last time this was posted.)

The most important problem with IPv4 is that it mandates 1:N NAT configurations that break direct connectivity between devices on the Internet. Yes you can traverse NAT but it's an ugly and often unreliable hack. This of course is because the address space is too small for everything to have an IP, whether global or 1:1 NATed.

Difficult peer to peer connectivity means everything has to have a server. You can't just write communication apps that... communicate. The added cost here is enormous both in money and in privacy/security.

IPv4 is also too small for private networks. Corporate networks are often full of hideous hacks like multiple NATs that negotiate interoperability between networks with overlapping 10.x address spaces, "theft" of unused IPv4 space such as US DoD addresses, etc.

View on HN

> The most important problem with IPv4 is that it mandates 1:N NAT configurations that break direct connectivity between devices on the Internet.

Honestly, I don't think direct peer-to-peer connectivity will come back even after everything swutched to IPv6.

There is enough dangerous stuff out there that will actively try to exploit any device that is reachable on the internet that you usually don't want to have your devices reachable if you could avoid it in any way.

NATs have become de-facto firewalls, but in that property, they're quite important.

Modern P2P does not generally consist of hanging your whole system online with its pants down. They're specialized protocols with authentication, and Rust and Go are popular in the space because they are safe languages.

The problem is how consumer internet connections should be configured.

If you're an ISP, your choices are basically just that: Expose user networks fully and trust that all users have enough expert knowledge to put up their own firewalls - or put up a common firewall for all users.

Right now, the default is option #2. Unfortunately, this means that the ISP will configure the firewall to support the most common use case - which for consumer internet right now is a user without any technical knowledge who just wants to browse the web. So outgoing connections only, it is.

Switching to option #1 would mean that the networks of all users are exposed, whether they want to use P2P or not. And for anyone who is not an expert, this would mean exactly that: hanging your whole system online with its pants down.

What we'd really need is an ISP who lets you configure exceptions in the ISP's firewall yourself. However, this would mean significantly more effort for both the ISP and the user. I think it's unlikely, an ISP would offer such a feature without charging extra for it - and even if they were, it would mean that P2P software would still not work out of the box but would need configuration on the user's side.

To sum up: Right now, I don't see how P2P software is usable for non-expert users without opening up glaring security holes.

With "security holes", I mean everything else that runs on the user's network. The P2P software itself can be perfectly secure, but that doesn't matter if the cheap IoT device on the same LAN has a well-known RCE vulnerability and the vendor doesn't bother to patch it.

This all assumes an ISP who is fully on your side and doesn't have business interests on its own - such as actively blocking consumers from running servers at home because they also sell dedicated servers in a separate business unit.

What I can see as a pragmatic way forward is more along the lines of WebRTC and ICE: Make direct connections if possible, use a TURN relay server otherwise.

It sucks that you still need a control server to coordinate matchmaking between peers. I wonder if we could have something like "(almost-)serverless WebRTC" in the future, where we can exchange the control information through other means - e.g. QR codes, bluteooth, emails, etc.

I also really hope, we get back more LAN-only devices in the IoT space. Currently, it seems insane that my smart light switch has to talk to half a dozen cloud servers to activate my smart lightbulb half a meter away.

the role of ISPs are not to act as your firewall. that's your routers job. NAT does nothing to increase that security realistically since most routers are closed by default to inbound connections.

NAT as security is purely in the corporation realm of usefulness and afaik IP6 supports NAT just fine. it just wouldn't be a fundamental requirement for the internet to even exist.

> If you're an ISP, your choices are basically just that: Expose user networks fully and trust that all users have enough expert knowledge to put up their own firewalls - or put up a common firewall for all users.

This is a false dichotomy.

Given that ISPs now overwhelmingly give you some router to plug stuff into, they can very easily have an opt-out firewall configured on the box they give you. That is in fact what i have seen most ISPs do. The incentives for network filtering etc have nothing to do with "protecting the user", this is both easy to do and actually done, frequently the right way (with user-controlled fw).

There are protocols to ask the CPE (which is where the firewall usually is) to temporarily open a specific inbound port to a specific host, like UPnP, and many P2P software already know how to use it. So you can have a "deny inbound by default with state tracking" firewall, while still allowing P2P software to work without relay servers and similar tricks.

> Honestly, I don't think direct peer-to-peer connectivity will come back even after everything swutched to IPv6.

Statefull firewalls still exist with IPv6, so by default connections from the general Internal cannot connect to your 'internal' systems.

Hole punching still needs to be done with UPNP/PCP

* http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf

* https://en.wikipedia.org/wiki/Port_Control_Protocol

The advantage of IPv6 is that you no longer have to have things like STUN, TURN, etc. (Remember Skype super-nodes?)

Your client knows its own IP(v6) address, gets the IP address of the other end, and then tells your firewall to allow connections between just those two addresses. Once your session is done the ACL is deleted and you're completely default-blocked from the outside again.

> Anything extending the life of IPv4 is actively harmful.

> Yes you can traverse NAT

Not always. My ISP uses CGNAT, which means I have absolutely no straightforward way to break out.

I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed.

I'm not a network engineer. But I've yet to see a good way to protect ipv6 network. I don't want my local webserver develop on to be exposed to the internet. It's my understanding that default router configuration will do just that. I don't see a good way to deal with privacy issues. Ipv6 essentially gives a unique identifier for every computer in the household by default.

protecting ipv6 Networks works just the same as ipv4 networks. by using firewalling.

NAT is not a security mechanism. most consumer routers seem to block any incoming traffic from the outside world by default anyways.

I'm not trying to be aggressive here. But what's the actual end user difference between NAT and firewalled ipv6 for me and my local network then? I assume I could route now than one addresses for a specific port. On the other hand I have to pay for domain record to access my local resource without a struggle.

Should I use ipv6 at home when my doesn't have one?

I honestly struggle to find good information on the protocol that's decades old. It's either to deep for me to care for my needs or too shallow to understand why and how should I just it. Scaremongering is what I find on the internet. And no real benefits for me to update my hardware or find ISP that has ipv6.

I can kind of relate to the feeling of IPv6 being "new and scary" to back in 1995 when I barely grasped IPv4 routing... everything becomes clear eventually with experience and exposure... hopefully eventually I'll understand more IPv6 concepts with time. I "want to believe". :)

But I do fully get that firewall without NAT is perfectly fine (great) in an IPv6 world - but may be necessary in simpler multi-ISP routing scenarios...

The difference is that traversal protocols like UDP hole punching work deterministically almost 100% of the time in an IPv6 environment but are flaky in an IPv4 NAT environment.

It also means that you never experience port exhaustion on large networks, which is a problem for large IPv4 NAT deployments.

You'd setup your firewall to protect your IPv6 network. This policy says do this, firewall defaults to no traffic pass. Same as you have now.

IPv6 privacy extension (been around for many many years, and default on at least MacOS and others for many iterations), gives you a new IPv6 address every time period, and rotates through them transparently.

just want to make it clear, usually you are assigned a prefix which you can announce to your network and then nodes will pick random addresses from that prefix. its still easy to determine the packets came from your network just not clear from which device exactly much like current NAT setups lets say...

... unless your ISP would change your prefix regularly (like every day), like it's now the case for those who have a public dynamic IPv4. If they give you a static IPv6 prefix, it's like giving you a static IPv4 now, i.e. something ISPs would probably want to monetize as a premium service. So I'm pretty sure we'll end up with regularly changing prefixes... which is probably good for privacy.

In most countries, the ISP is legally obliged to keep records at which point in time has a customer had an address. Usually a court can order an ISP to hand over those records. In other cases, the police, secret service, copyright lawyers etc. can talk directly to the ISP.

Sure, but keeping logs for legal reasons doesn't mean transmitting those logs to all the web sites you visit. I think the point here was untrackability by websites rather than pure anonymity.

In general, the level of privacy/ anonymity should be pretty similar with IPv4 or IPv6 in the real world. You will be better off at some hacky, local IPv4-only ISP behind a huge "CG"NAT because they may not keep all the records or not for so long or whatever. You might be better off at a large mobile provider with IPv4 as a service over an IPv6 network, because the prefixes can change often and IPv4 is again basically a huge gateway hiding you to some degree. If you really need to be as anonymous as possible to most services online, use TOR or a series of VPNs/ SSH tunnels in different countries or whatever and a number of other anonymizing tools, browser plugins etc. Having IPv4 or IPv6 will not play a role as people usually leave huge amounts of traces all over the place. For websites, for all these reasons, it is way more interesting to fingerprint you with multiple different aspects of your online presence. E.g. look here: https://amiunique.org/ or here: https://robinlinus.github.io/socialmedia-leak/

For most people and websites, IPv4 vs IPv6 for fingerprinting isn't very interesting because websites have better means and people usually don't really know/ care and most ISPs think they have a great business model handing out dynamic prefixes/ IPs and combining all that with CGNAT or NAT64/ DS-Lite or other gateways. Privacy extensions and local NATs of various kinds also don't help in having more visibility into that chaos. Actually, in my experience, most tracking currently is really, really dumb to such a degree, that I cannot be reliably tracked even if I want to (e.g. when using navigation like Waze) because for some reason, the app cannot get my position using GPS even after tens of minutes. The app still hasn't figured out, I live somewhere else now and hasn't offered me a new home address. It also doesn't recognize any pattern in my routine quite obviously. That would actually kind of be the point of the app, wouldn't it - it would make it more comfortable for me and it could serve me much better targeted adds, e.g. for good coffee in the morning? I also don't get very meaningful suggestions or adds for anything and I only use an add-block plugin. For those reasons, I don't think most websites are able to track me effectively and I don't worry about law enforcement much - I am not a journalist, nor a dissident, nor have I done anything in regards interesting to law enforcement or such.

I think, we all should worry a bit less and focus on fixing stuff all over the place so that tracking is more easily detectable and can be mostly disabled in such a way as to not hinder useful functionality. IPv4 and IPv6 as currently deployed are mostly "boring" in a good way. IPv6 tends to work just fine in places that want to make it work. So for most things, talking IPv4 vs IPv6 is like vim vs emacs or some other endless and rather pointless discussions. Not very informative or useful. We should be using what makes sense. IPv6 starts to make sense in most places, because it becomes easier to set up each day and IPv4 becomes more expensive to maintain. The real problems of IT are really elsewhere now and they are so plentiful.

You would laugh, but just doubling the amount of RAM in the computer today is an undertaking. You cannot get RAM with the same frequency and timing as is built into a computer just a few years old. Higher speed RAM doesn't "just work". No, you have to update the BIOS/ UEFI because they have support for newer RAM standards as it turns out and set the frequency by hand to enforce a downclock of the newer RAM - not really something a regular user would know how to do at all. All of this just adds up and the IT field is so complex nobody can reliably navigate it nor give any dependable estimates about anything. You have similar things way up the stack. Just try updating dependencies in a project (mentioned at length on the front page just a few days ago https://news.ycombinator.com/item?id=29106159). If engineers have to solve stuff, that should have taken 10 minutes for 2 hours instead, we have a major problem - we are just not getting stuff done, because we have been let down by otherwise solid assumptions.

Anecdotal, but I manage connections from AT&T and Comcast and both have had stable IPV6 prefixes since they were installed multiple years ago.

That's true for IPv4 too. I've had the same IPv4 from my ISP for months.

The truth is that if you are not tunneling over some kind of VPN or using onion routing your IP is public, period.

Genuinely curious: how do you maintain a local DNS to make sure you can always designate 'printer' and 'intranet' by name?

Multicast DNS, e.g. Bonjour.

Even now I doubt many home users have a local dns server for reaching their printer by name. I think Windows uses NetBIOS for this purpose, which should work fine over IPv6 too.

Some models of home routers do run an internal DNS server which makes things accessible under a subdomain with whatever name you've set for that device in the router's configuration.

printer.local

Things in IPv6 land can have multiple IP addresses - you can have a fixed address or use a fixed link-local address for an entry DNS if you're not using something like multicast DNS, but it can still initiate connections using a privacy extension address.

dnsmasq, requests for a new DHCP lease contain the hostname which it duly registers.

I haven't seen a single IPv6 network configured to behave like that by default. Just because it has a globally unique address doesn't mean it's reachable.

New home routers (the kind that ISPs give out to clients) with IPv6 support include default deny firewall on externally-initiated connections, precisely for that reason.

If you think NAT gave you any privacy benefits... at best it made for easy "household mapping" of people.

> I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed

As you can see, It's because not many people understand IPv6.

Also there are many devices that would stop working. There is no clear path for adoption, everything is "switch and let's see if it breaks". Many systems are legacy systems. Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6.

ISP's are unwilling to implement it as there are not so many qualified workers that even understand IPv6, big companies like Google straight refuse to fully implement DHCPv6 and so on.

IPv6 is IT's esperanto.

Also IPv6 was officially ratified 2 years after all IPv4s were exhausted. IPv6 was designed in 1998 when total number of internet connected devices is estimated to be equal roughly our daily increase of internet connected devices.

> Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6.

Mainframes are a _lot_ more maintained than you think they are, but overall this is a bit of a weird statement as Mainframes talk TCP/IP for compatability reasons anyway, Mainframes talk amongst themselves using a protocol called SNA/APPN. (Which, can be encapsulated in arbitrary IP frames, but is not required and doesn't require support of the mainframe)

IBM Mainframes, for various reasons including how IBM structured the pricing tend to run pretty recent versions of software.

In case of IPv6, all supported OS versions work with v6, the limits involved are also somewhat no longer valid outside of very locked down intranet-only setups.

> IPv4 is also too small for private networks. Corporate networks are often full of hideous hacks like multiple NATs that negotiate interoperability between networks with overlapping 10.x address spaces, "theft" of unused IPv4 space such as US DoD addresses, etc.

IPv4 is perfectly adequate as long as you're the only one using the e. g. 10.0.0.0/8 range. I don't think that overlapping private networks were ever designed into the use case.

Does IPV6 actually allow any two devices from anywhere in the world to connect directly to one another without requiring port forwarding?

Yes.

Of course, firewalls are usually configured to prevent that. By default, on a home router.

But changing roles in the firewall is simpler without the need for port forwarding.

Is it? Okay, so you don't have to specify the external-to-internal port mapping (and routers might offer you a default of external port = internal port anyway), but other than that it still seems like more or less the same procedure to me.

And at least my own home router does indeed use the same configuration interface for both IPv4 and IPv6.

If you have more than one device which needs similar external access, you won't have to use a non-standard port.

I have three devices at home which I'd like SSH access to. Because I only have IPv4, two of them aren't on port 22, and sometimes the non-default ports I've chosen are blocked by hotel Wifi etc.

Similarly, I'd like two different webservers to be available, but I can only have one on my single port 80.

For the more typical user, it can mean only one person playing a particular game etc.

Yes, that is of course a benefit, but what I was trying to get at was that you'd still have to dig around within the router config, so it'd still not quite be the radically easy, absolutely hassle-free peer-to-peer communication world.

Rendezvous across a firewall is easy in the absence of 1:N IPv4 NAT. You just do an exchange like NAT traversal but it always works. Administratively opening a port is also easy.

Yes, because port forwarding is a feature of NAT, which isn't needed for IPv6.

Reply on news.ycombinator.com