Hacker News Reader

Comment by lmm | Hacker News Reader

> IPv6 for local networks, makes no sense is completely unnecessary, and is a hill I will die on. IPv4 is here to stay.

Why would you make everything gratuitously complicated by having two separate forms of addressing? All that IPv4 gains you is new and exciting ways to mess up your networking. Just give every device a normal public address (of course you probably want to firewall off inbound traffic from the WAN to the LAN, but that's got nothing to do with addresses) and have a normal network rather than some bizzare frankenstein mashup.

View on HN

Why would I want any of my devices on my network to have a publicly route-able address?

> Why would you make everything gratuitously complicated by having two separate forms of addressing?

How is IPv6 itself not "gratuitously complicated". You think I am going to remember the IP of my firewall, my network switch, if it is that mess of characters that is an IPv6 address? I can easily recall 10.10.10.1 is my gateway, or that 192.168.1.1 is my gateway. You think instead setting up local DNS server and domain so I can do myrouter.lan is somehow "less complicated"?

Hard pass.

Why would you need a DNS server? That's what mDNS is for.

Some people might have more than one subnet. Or road-warrior VPN and VPN-ing in. It is nice when your networks name resolution works, even if you are outside your network.

If you have multiple subnets, you almost certainly have an advanced enough router that it supports mDNS forwarding. There's no reason why it can't work across a VPN either.

mDNS forwarding doesn't work on Tailscale :(

mDNS has some downsides that can be important for some. For instance, the fact that you can more easily set the same host name on multiple machines, or the fact that it uses a lot of bandwidth.

fe80::1 is your gateway, fe80::2 can be your switch, fe80::blah can be your server. Let the device automatically get it's temporary public address it uses when talking through fe80::1, you shouldn't really need to know it or use it. If you really do feel free to use DHCPv6 or a static SLAAC offset or mDNS but you're just making more work for yourself if it's a home environment.

The main reason would be to do p2p without hacks / servers.

Why are you so militant against the idea?

Sunk cost fallacy.

>Why would I want publically routable addresses

Hate to break it to you but that is how the internet was intended to work for end-users. Firewalls are cheap and easy to install :)

I felt this way until I learned that the RFC1918s we all love (10. 192.168. etc.) have a nice v6 equivalent: fd80::1 fd80::2 ... etc.

https://www.ripe.net/participate/member-support/lir-basics/i...

My internal v6 addressing is as such:

fd65:<16-bit-mnemonic>:<vlan-id>::/56

The 16-bit-mnemonic is something memorable to me (e.g. b37a:7357 would be addressable l33tsp34k for "beta test" - that's not the one I use :P). In this case, VLAN 10 would be in the fd65:b37a:7357:10::/56. Gateway for it is fd65:b37a:7357:10::1.

It's really not harder than IPv4 for these cases.

Servers and services are assigned static IPs either via DHCPv6 or directly on the boxes (or both as I kinda use the DHCP table as a poor man's IPAM). Other devices internal IPs and globally routable IPs are assigned through SLAAC with privacy extensions where available.

> Why would I want any of my devices on my network to have a publicly route-able address?

So that your addressing works normally, and you don't have to deal with the same machine having two different addresses depending where you are (e.g. my photo server's address is the same whether I'm travelling or at home). Even if you only ever access your home network from outside via a VPN (which may well be a good idea), having globally unique addresses eliminates a whole bunch of possible issues - no more weirdness because the coffee shop you're in picked the same private subnet as you did.

> How is IPv6 itself not "gratuitously complicated".

IPv6 is needed for the public internet, there are just too many hosts for anything else. So you either learn IPv6 or IPv6 + another similar, but somewhat different thing.

> you probably want to firewall off inbound traffic from the WAN to the LAN

But all modem/routers are doing it anyway, they might as well do that on ipv6.

Effectively all router appliances (at home and soho level) are linux appliances, and the firewall is built into the kernel (and in use anyway).

Sorry I do not trust the likes of home router vendors to implement a linux firewall correctly

While people may say "NAT is Not security", it is in fact a layer (ahd huge one) in the security onion, that ipV6 is likely going to increase drastically the amount of ransomware and other malware on the public internet simply because that NAT layer is gone

I remember what it was like when lots more home computers were routable from the public Internet, because having a NAT router between them and there wasn't a nearly-100%-adoption thing yet. In fact, I worked at an ISP (dial-up and DSL) in that era.

It was indeed a shit-show. Adding a NATting router to those set-ups instantly increased their security tremendously. Sure you could use a proper firewall, but the router w/NAT Just Works.

I cant wait until all the printers, and webcams all showup on the public internet again....

Portscanning for smb shares and webcams, LOL. Good times. Found entire offices routing their whole network publicly, back then, shared network drives and printers right there for use by anyone who stumbled on them. It was nuts. Worms spread like crazy. It was a real mess, and that's with the Internet being way the fuck friendlier than it is now.

What's ironic is that the IPv6 people will tell you you can do all of that with IPv6. Which is true, but if we NEED TO CHANGE because we're out of addresses then why go to something that doesn't use the address space?

The problem IPv6 seeks to address has mostly been engineered around for now.

> The problem IPv6 seeks to address has mostly been engineered around for now.

For now is the operative phrase. These are band-aids to keep IPv4 running, but they won't be effective forever.

> Sorry I do not trust the likes of home router vendors to implement a linux firewall correctly

Neither do I, but that's a fixable situation. Get an appliance router that lets you put DD-WRT (or similar) on it. Or use a computer instead of an appliance and set it up any way you like.

I am by trade a network administrator, and I run enterprise gear in my home.

I am not running a home router or dd-wrt. But I am not a typlical user going down to best buy to pick up the latest Belkin or Asus wireless AP / router combo they have on sale for $99 and hooking it up to my internet using default "wizard" settings from the mobile app...

Nor I am I trusting Comcast, or ATT to configure their residental rented equipment properly with proper firewall rules

My comment is not about me, I have enterprise grade nextgen firewalls that are $$

My comment is about Grandma that calls up comcast to have them set it all up, or Sally that is going into best buy for the "Geek Squad" so hook her up...

Large ISPs like Comcast already have enormous IPv6 networks, and have appropriate, default-deny firewall configurations for them.

I'm only familiar with the largest ISPs in Britain, but they also have default-deny configurations on the IPv6 routers they supply. Obviously.

> Grandma / Sally

Try avoiding the casual ageism and sexism.

>Try avoiding the casual ageism and sexism.

Try not to find offense in all things, feel free to refer to my comment thread from the other day about offense being a you problem not a me problem ;)

If I’m following your logic, you’re saying you trust tplink etc to keep Grandma safe, but only for IPv4, and not IPv6? Why?

I am not trusting them, behind a ipv4 nat inbound connections are by default inaccessible

ipv6 most configuration end up with all devices publically routable and must have a firewall deny policy inplace to block inbound connection

Shodan is filled with people with misconfigured ipv4 routers that end up with all kinds of device that should not be on the public internet (webcams, printers etc) out there for anyone to connect to. This requires a user to actively do something on the device (most likely following a bad online tutorial) in order to port something though the NAT.

with IPv6 this problem will get FAR FAR FAR FAR worse.

> I am not trusting them, behind a ipv4 nat inbound connections are by default inaccessible

No they're not. They're by default obscured, but anyone can guess your internal IP and send a packet for it, and the router will happily forward it on unless its firewalling tells it not to. And that's without even even getting into all the extra attack surface opened up by legitimate and not-so-legitimate workarounds for the issues NAT causes.

> that ipV6 is likely going to increase drastically the amount of ransomware and other malware on the public internet simply because that NAT layer is gone

malware has connected outwards to c&c servers for more than 20 years

This is one of the worst takes I've seen in this thread.

NAT is only kind of a firewall and there have been plenty of terrible router firmwares out there that have lead people to subvert it (UPNP being one of the most problematic).

If you in your other thread don't trust the ISP device, then don't trust NAT on your ISP device either. Quite often the ISP can have their modem route traffic from their internal 10 net to your internal network if they so choose to.

Instead IPv4, or IPv6 setup to drop NEW/SYN connections to your devices via a router that you provide.

>If you in your other thread don't trust the ISP device, then don't trust NAT on your ISP device either

There is no logic there. firewall configuration is much harder to secure than NAT configuration.

> There is no logic there. firewall configuration is much harder to secure than NAT configuration.

Disagree. Just the XML parsing logic required for uPnP alone is more complex than a basic firewall implementation.

uPnP seems a distraction from the topic. It's not necessary for networking to network -- my LAN intentionally does not support it at all. It is necessary for certain use cases, of course, but it's not mandatory in a network in the general case.

It's necessary for feature parity with IPv6 (or, equivalently, with the 2000s-era Internet). Even if you don't use uPnP, the amount of complex protocol parsing necessary to support/work around NAT (e.g. SIP is particularly tricky) is a larger attack surface than a full IPv6 stack.

Finally some sense. There are so many senseless IPv4 shills here. IPv6 always works, never had a problem with it.

Just switch to it alrready.

I'll switch when IPv4 stops working. Until then, I have no reason to switch.

> It's costing ISPs

I hate my ISP so this is actually a feature. If they add an IPv4 surcharge to my bill then I'll reconsider.

> I'll switch when IPv4 stops working. Until then, I have no reason to switch.

IPv4 has stopped working for a lot of people already, especially if they're not with a fancy-pants ISP with lots of legacy IPv4 addresses already 'in the bank'. From another discussion:

> I've actually run into this [CG NAT] helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo.

* https://news.ycombinator.com/item?id=35046929

IPv4 is also not working for the Indian reservation mentioned in the article: they had to spend >$200K to support these Roku devices.

Sure, I get that. But it's their problem, not my problem. I'll only switch when it becomes my problem.

So, because I don't want to change something that works and whose predictions of demise have been grossly overstated by decades I'm a shill?

"Just switch to it." Sure, pal, You pay all of the transition costs for everyone and you got a deal.

Not everything needs or should have a public IP address much less a bunch of IOT garbage. I suspect you, like everyone else who just says, whY aReNt We On IpV6 yEt??!11 imagine that most people's security practices are like yours and most people's ability to maintain software and security practices are like yours.

They are not.

I'm holding out for a modern address space extension conceived this century that doesn't suck, or at least a naming convention that doesn't suck. But no one will change until it's really needed and "hack" that improve the Internet, even if by accident, like NAT, can't fix it.

> Sure, pal, You pay all of the transition costs for everyone and you got a deal

Except at this point the costs are reversed - IPv4 costs more than IPv6. Just look at the article we're commenting on - supporting IPv4 clients is costing them a lot more. At the same time more and more cloud hosts are charging more for IPv4. In 2023 it's supporting IPv4 that costs more, not IPv6.

> Why would you make everything gratuitously complicated by having two separate forms of addressing?

If it ain't broke, don't fix it? If IPv6 brings no benefit to my LAN, why should I spend all the effort needed to shift it to IPv6? I can just make the connection to the internet IPv6 and leave everything else alone.

Although I have additional friction in my case, in that I have numerous devices that are IPv4-only. So no matter what, I'd have to at least have one LAN segment that is IPv4.

Because that's not the way TCP was designed in the first place. Instead you're used to hack on top of hack to make IPv4 not explode in a ball of flame there are far more billions of end points than IP addresses.

The thing is you really don't realize how shit your network experiences are because of this. Everyone is just attempting to tunnel more services via HTTP/HTTPS and the particular fun problems that entails rather than having byzantine hacks built in to their NAT routers. IPv4 is no longer fit for purpose.

If I don't realize how shit it is, I don't think it's a shit experience. I don't care how it was designed and what you call a "byzantine hack" I call a feature that saved the Internet about 20-25 years ago. Having everyone on a public addressable host is not good. (Yes, I know you can do this on IPv6, but then it's like you're just applying Byzantine hacks to get the security feature you already had on IPv4.)

> Having everyone on a public addressable host is not good.

We had every host on an IPv4 address at the University of Washington back before 1998 and NAT was actually banned by the CAC Department since they billed by number of nodes on the network, so NAT was a way to cheat their billing system.

I learned quite a lot of internet security from having 1998-era Unix servers hanging directly off onto the internet with no firewall or NAT.

> to make IPv4 not explode in a ball of flame there are far more billions of end points than IP addresses.

But in my LAN, there is no IP address exhaustion. I have orders of magnitude more IP addresses than I'll ever use. IP address exhaustion applies to the internet at large. I'm not talking about that.

In the internet at large, IPv6 has to happen. In my LAN, I don't see a need for it. I can route between the IPv4 endpoints in my LAN and the IPv6 endpoints on the internet.

And because I have IPv4-only hardware on my LAN, I need an IPv4 segment to support it at the very least. So why not keep the entire LAN IPv4?

> But in my LAN, there is no IP address exhaustion. I have orders of magnitude more IP addresses than I'll ever use. IP address exhaustion applies to the internet at large. I'm not talking about that.

As long as you never VPN into or out of another network whose administrator thought the same thing. But yes.

> And because I have IPv4-only hardware on my LAN, I need an IPv4 segment to support it at the very least. So why not keep the entire LAN IPv4?

v6 uplink is going to increasingly be cheaper and/or faster than v4 uplink (as with the issue in the article), so presumably you'll want to run v6 on your LAN at least for the devices you game/stream from (and sooner or later there will be v6-only services that you want to connect to). I would think that any device not supporting IPv6 is so obsolete/unsupported as to be dangerous to connect to the internet, so you already need to deal with having two distinct segments on your LAN. But sure, if you've got good v4 uplink at a reasonable cost then no need to migrate yet.

A pipe dream, but the best case seems to be a total standardization on v6

Reply on news.ycombinator.com