Hacker News Reader

Comment by csdvrx | Hacker News Reader

Using LD_PRELOAD for IPv4 seems to me like using the wrong tool for the job.

> "Most of the apps I use support IPv6 but there are some cases when lack of IPv4 connectivity on my machine negatively affects experience."

Just install clatd to get 464XLAT so hardcoded ipv4 get routed to 192.0.0.1 (the clat iface is the default gw for ipv4) which does NAT64 through tayga too.

IMHO the best strategy is a mix of strategies:

- 1. Clatd doing 464XLAT (RFC 6877) so:

- 1.1 Stateful protocol translation (RFC 6146) at CG-NAT64

- 1.2 Stateless protocol translation (RFC 6145) at the UE

- 2. DNS64 (RFC 6147) mechanisms at the DNS server returning padded AAAA for A only entries

- 3. IPv4 embedding into IPv6 addresses (RFC 6052 section 2.2)

View on HN

The main idea of my experiment was to run IPv6 only setup without any IPv4 connectivity: sudo ip route get 8.8.8.8 RTNETLINK answers: Network is unreachable

So I intentionally decided not to have IPv4 connectivity system wide to catch apps with issues in IPv6 only environment and then carefully evaluate issues and report them to authors: https://github.com/mozilla-mobile/mozilla-vpn-client/issues/... https://github.com/signalapp/Signal-Desktop/issues/4121

Dual stack setups tend to hide IPv6 implementation issues and may create illusion that app is IPv6 compatible but in reality it's not.

Clearly my setup is too hostile for home users but as developer I enjoy it a lot.

I've been operating IPv6-only networks for enterprise and domestic use since late 2019, with DNS64/NAT64 on the gateway. Since 2021 some networks are behind Starlink CGNAT so I tunnel those networks over Wireguard to the gateway.

Like you I've detected a handful of applications that couldn't cope without local IPv4 - if they couldn't be patched they got dropped.

The issue I do hit - and report - from time to time is services that advertise both IPv6 and IPv4 addresses in DNS but do not respond to IPv6. Those are really annoying and even when I manage to get a response from the admins very rarely do they fix it either by accepting IPv6 connections or dropping the DNS AAAA record.

Another solution when emergency IPv4 is required (e.g. if the gateway has died!) is an IPv4 in IPv6 tunnel on the local network to the local IPv4-only gateway - think Starlink terminal.

This article made me put into a script the code I had for setting those tunnels up to make it easier, and avoid forgetting!

https://gist.github.com/iam-TJ/135b47d29bd8ee4e0f3330aef7324...

Oh I may have misunderstood the purpose then!

> Clearly my setup is too hostile for home users but as developer I enjoy it a lot.

If you want to discover which apps need IPv4, that's indeed a great way!

I have idea of even more hostile environment in my mind. My plan for next phase is to get rid of 127.0.0.1 on lo interface. I've tried it once and I had to reboot my machine as all things stopped working.

As another angle to make it even more interesting but on network scale I've implemented option for Unbound to suppress A records even if they do exist: https://github.com/NLnetLabs/unbound/pull/819 and push dual stack apps to be IPv6 only.

127/8 is fun!

I'm using it to run electron-like apps, abusing Bonjour to provide .local domains with reverse (ex: spreadsheet.local could go to 127.1.2.3 if you forge and send the right mDNS packet on port 5353)

Unfortunately, I haven't found a way to do the same in IPv6: fec0::/10 for site-local address precedence 1 was deprecated by RFC3879

See my proof of concept https://github.com/csdvrx/PerlPleBean/blob/main/experiments/... and the IPv6 explanations around line 70

For your usecase, if you don't want to be restricted to ::1/128 you could maybe replace the 127/8 by fc00::/7 but it would require setting the link up while I want everything to be automatic

Reply on news.ycombinator.com