Hacker News Reader

Comment by bratao | Hacker News Reader

Please Cloudflare, I'm a paying customer and have some IPv6 only users that are very frustrated every time they see a Cloudflare challenge page. Your provider, HCaptcha still do not support IPv6. I have to use workarounds like an alternative domain without CF and this is very frustrating.

View on HN

If you only care about the CDN parts, you can change the security level in the Cloudflare firewall settings to Off and it won't serve any captchas.

HCaptcha is the absolute worst, their captchas are consistently harder, the datasets are impossible to decipher and the failure rate is much higher, even if I'm sure that I chose the right options. My parents had no chance last time they ran into one.

CF should have just rolled their own captcha service instead of buying into someone else's public ML training program again.

reCaptcha is definitely worse, but it goes easy on people logged into a google account.

Settings » Firewall » Settings » Security Level (Set to "Essentially Off")

It's a little hard for me to believe that there are IPv6-only users out there. Who are these people?

edit: I realize there are plenty users behind NAT64 gateways etc, that's the point: how many users out there have no IPv4 connectivity at all?

It’s super common for cellular networks. Apple even has a rule for the App Store to reject any applications that don’t work in an IPv6-only environment because of this. They’ve had this rule for six years.

Must be smaller providers doing this? In the US, we've got CGNAT IPv4 and regular IPv6 for cellular.

It's driven mostly by adoption outside of the US, particularly in Asia. In 2019 over half of the connections in India were IPv6 (of 475 million devices, 52.49 percent are IPv6 devices, according to the APNIC report).

That’s not the whole story. Your service doesn’t need to be accessible through ipv6. Just over 464XLAT. That won’t be a problem if you use high level system apis to make connections. All of my servers are ipv4-only and I haven’t had any apps rejected by apple.

You're partially right. Your apps need to support IPv6 because the internet connections can be IPv6 only. I believe T-Mobile is a big one does this. They do translation for their clients to the IPv4 internet, so they'll be hitting your IPv4 server through a translation layer. The client is still IPv6 only.

That doesn't make sense. If I hit amazon.com on my browser, which is IPv4 only, t-mobile needs to provide a (private) IPv4 IP to the phone to make that possible.

Edit: was totally wrong about this: https://www.internetsociety.org/resources/deploy360/2014/cas...

iOS (since IOS 12) and Android have native clients that can tunnel IPv4 requests over an IPv6 only network that are used for providers like T-Mobile.

Not necessarily.

T-Mobile could respond to DNS requests with an IPv6 address that includes an encoding of Amazon.com's IPv4 address in it so that when you try to connect it it, the gateway knows what IP address you're looking for and can do the NATing there.

Of course, this is just conjecture about a possible way of making it work, and it could easily get broken if you configure your phone to use a different DNS server.

Thanks, that's a good point. Apple talks about it here: https://developer.apple.com/library/archive/documentation/Ne...

People on mobile networks, especially outside of Europe and the US

Most users from KPN (largest dutch telco) are stuck with just a IPV6 address. Phoning home is often quite a bit of a challenge.

I think the parent poster isn't asking whether you only get an ipv6 address, but rather you only get an ipv6 address without some sort of CGNAT for ipv4

This is quite common in countries with lots of people and not enough IPs.

ipv6+nat64

Why don't they use IPv4 with CGNAT in addition to IPv6? That's what the US providers do.

NAT64 and NAT44 are both forms of CGNAT; NAT64 can be simpler to deploy.

You don't need two nats, you don't have to track two types of ip addresses per customer, for most of the traffic, you don't even need nat at all (youtube, facebook, etc, all support native ipv6), and statless nat64 can be simpler and less resource intensive than cgnat

> It's a little hard for me to believe that there are IPv6-only users out there

Why is this hard to believe?

IPv4 ran out a while ago depending on which part of the world you are in. New networks do no longer get IPv4 by default. Some can get very small allocations that are barely enough to operate nat64 gateways for a few thousand users. Quite a few networks decided to not invest in legacy IP any more and better spend their (limited) resources on other activities.

> Who are these people?

me + non 1st-world countries.

IPv6 without any transition mechanism is not Internet access. It's more like a tenth of the Internet. If an ISP has to buy a few addresses to run NAT64 that's a cost of doing business.

What happens when there are literally truly no IPv4 addresses left for sale? Not today’s reality, but the clock is ticking.

There will always be IPv4 for sale just as there is always land for sale.

This is the “oil will never run out” argument. Technically true, but irrelevant.

I chose my analogy carefully. Oil is consumed but land and IP addresses are not.

You can't really just "find" more IPv4 though. Cloud platforms are eating blocks for breakfast, lunch and dinner, and while it's always going to be for sale, there's no reason to expect you'll be able to afford it.

Fortunately, if you can't afford IPv4 then no one else can afford it either, which means the incentive to adopt IPv6 is extremely strong and thus you no longer need IPv4.

Existing large ISPs and cloud providers with remaining IPv4 addresses and no IPv6 support are not going to have a strong incentive until after the damage is already done.

Why won’t Google, Cloudflare, AWS, etc. simply own all most IPv4 addresses and leave all end users using NAT (or even CGNAT) to access them? This cements their businesses, since then nobody can reasonably host their own servers except through them.

It works both ways though, doesn't it? If you are IPv4 only, you can't access/can't be accessed from the whole internet. If you are IPv6 only, same applies.

No, because there is nothing interesting that's IPv6-only.

That depends a great deal on what country / language is your norm.

Which country/language has interesting IPv6-only content?

Your comment has been unfairly downvoted. There are IPv6-only users, but they can access IPv4 servers just fine through transition techniques. Otherwise they’d be unable to access most of the internet. You probably interpreted it as no IPv4 connectivity at all, which as you assumed is impossible.

Reply on news.ycombinator.com