[flagged]
I recently enabled IPv6 on my home network, and roughly 30-40% of all internet traffic goes through IPv6. Things are noticeably faster, especially connection times to online games on Xbox Live.
My only complaint is that my ISP keeps changing the prefix every quarter or so, so my static addresses need to be updated in the firewall and other places. I am looking into link local addresses but the cocktail of tech is tricky.
Link-local can sometimes mean needing to append the interface name to your address and a bunch of other weirdness. If you pick a ULA prefix and announce it (or assign some statically) everything pretty much just works.
I’ve been using them internally for over a year and it’s been great, they basically feel like RFC 1918 addresses.
All of this is made much harder by ISPs actively fighting IPv6 adoption. They have the usual moat babble that users do not request it. But in my case they even blocked /protocol/ 40. This was not documented anywhere. Imagine the layers of support I had to work through. Imagine working with new technology and be sure enough that you have exhausted all other possibilities. So learning practical IPv6 has been an uphill struggle for me. Years ago I had a SixXS tunnel going before major adoption took off. Now I am living in another place and wanted to look at it seriously. SixXS was no more so I went with HE. To my dismay dark corners of the Internet have abused these offerings so I have my tunnel disabled most of the time as it gives too much grief. And I have even worked in operations at a large ISP in the 90s. Adoption is not easy even for the willing.
But the reason? No one here seems to mention it: Money. There are no technical excuses left. But it is surely a nice moat.
Sorry for the rant! A good up to date book recommendation would be appreciated :-)
SLAAC is still the way to go downstream, or upstream when you don’t have an ISP doing prefix delegation with DHCPv6. ISPs just want more downward control probably for money and maybe a tiny bit for legal/abuse/security reasons, so they use dhcpv6. secure neighbor discovery would probably be the non-dhcpv6 solution to having link-layer identity, would be cool if isps gave you slaac+send as an alternative to dhcpv6, but that would require average consumers to understand certificates and pki, so fat chance.
edit:
so there’s address assignment and addresses themselves. slaac and dhcpv6 are assignment mechanisms. global, ula, link-local are types of addresses. so the story isn’t really that people hopped from slaac to dhcpv6 to link-local to ula. it’s that slaac is how you configure ipv6 addresses in high trust environments and dhcpv6 came later when isps needed more control rolling things out. I actually don’t understand what problem dhcpv6 solves other than isps presumably wanting to spend less effort to work v6 into their existing systems than to write new utility that monitors their last mile segments for router solicitations and maps to customers that way. slaac is still the preferred mechanism.
then there’s the link-local to ULA transition . really it’s the site-local to ula transition. site local was the indended way to have a private network but had problems. so ot was deptecated. i think maybe before there was a ULA alternative, for link-local made sense in the scene for a hot minute, but now ULAs are here amd they are designed specifically for private site-wide addressing. so thats what is preferred for that.
slaac+ula for private home stuff
nat and dhcp are bad relics
whatever your isp supports/required to get a global prefix delegation. fun fact, you’re supposed to be handed a /48 by your isp so you can have the freedom of 65k subnets but few are so generous.
I never got IPv6 working well until I switched from pfSense to OpenWRT, due to my residential ISP switching prefixes very frequently.
For example, there was no way to get pfSense to not publish the public address of the router as the internal DNS, so every time the prefix changed internet effectively broke.
It was what I did when I had a router that announced only public IPv6 prefixes to the LAN.
Problem number two is that the fiber provider doesn't support native v6; it's actually a 6rd tunnel. Latency isn't great compared to v4.
I need to go figure out the ULA situation and do NPTv6. But last I checked, my firewall wasn't able to do NPTv6 with delegated ranges. That may have changed, but I've not found any substantial reason to actually put in the effort to figure out it when my v4 network works fine.
I believe all three large US mobile carriers use NAT64 at this point exclusively, and CG-NAT is quite common in DOCSIS cable networks.
The overwelming majority of IPv4 packets have the DF bit set. A large number of services drop inbound fragments anyway (if you get more than a couple a minute, it's almost certainly abuse).
https://www.prefixbroker.com/news/is-ipv6-faster-than-ipv4-a....
See https://community.cisco.com/kxiwq67737/attachments/kxiwq6773...
Everything about v6 is over engineered with sharp edges.
For me, IPv4 doesn't break the privacy barrier, IPv6 blasts a huge hole straight into each and every household, office and IoT device on the planet. No, privacy fixes put into IPv6 do not work.
Until browser fingerprinting is addressed, there will be no real privacy.
What exactly is the problem with the privacy fixes that were put into IPv6? Why don't they work?
You are correct that this isn't a big issue. SLAAC addresses are generally changed fairly frequently by the OS. As for stateful DHCPv6, well I turn it off for both this reason and the fact that Android doesn't support it.
You can change that, of course, and switch addresses every minute if you want to, but I do find the default a little high.
Identification to the level of IPv4 can still be done with IPv6 by using the /64 where you would previously take the /32, but with IPv6 you also get identifiers from within the network as well.
With how much IPv6 space is available, I'm not sure why SLAAC-based networks don't just assign different IP addresses to different use cases. I can see this becoming a problem on large company networks, but in home networks you could generate a random IPv6 address every hour for every website you visit and still never run out of address space.
Operating systems aren't exactly geared up for per-application outgoing IP addresses, and perhaps handling tens of thousands of IP addresses will bog down the kernel somehow, but in terms of privacy protection we could be doing a lot more than what IPv6 Privacy Extensions are doing right now.
I run a very small site for a local club from an AWS Nano instance. Minimum cost is important. When AWS announced that they would begin charging for public IPv4 addresses, I enabled IPv6 on the subnet (which was tricky), updates the DNS record, and removed the IPv4 address.
In my case, no one notices or cares because they almost always access the site through their cell phones.
I'm turning 40.
The next few months will be fine.
> Eschew flamebait. Omit internet tropes.
The simple reason people have to start paying AWS for them is that it isn't easy or cheap for AWS to buy large ranges anymore. If it was just "fill out a form telling someone I need 4 million more IPs" then AWS would have some cheap junior technician doing that, but now they need to rake in money to cover the expenses to get IPs and customers that need v4 needs to pay for it.
You can check the rate of handing out v4 ips in 2012* and see that it was never going to be sustainable. The solution to the known-in-advance problem of ipv4 running out was not to .. not hand them out and just leave internet as it looked in Jan-2011 when IANA ran out of networks to hand out. So while it may be fun to state "I heard this long long ago", it just means others had better vision than you.
*) https://en.wikipedia.org/wiki/IPv4_address_exhaustion#/media...
But nowadays the effect is more than visible (especially in my region, Asia-Pacific), with more and more ISPs putting their customers behind a CGNAT. Let me write a parody of one of the classics:
First, they put cellular users behind CGNAT, which is fine because mobile phones don't host services.
Then, they came for residential users on cheaper plans, which is fine because they are not powerusers and so are unlikely to host services.
After that, they put all residential users behind a CGNAT.
...
It is actually what I experienced throughout the last decade in Southeast Asia. Are the ISPs here doing this because they are being cheapskates? No. It's because we are genuinely running out of IPv4 resources forcing people to share them. We did not have the luxury of Western ISPs who were assigned millions of addresses, and buying the addresses is a costly endeavor nowadays with /16 IPv4 block literally costing millions today.
And if you think CGNAT is good, think again: (quoting one of my previous comments)
[...] you can't really build a truly-P2P network nor self-host a service on Internet when everyone is behind CGNAT. At some point, as IPv4 resources get scarcer, only corporates will have the ability to host services on the Internet, and I don't think it is in their interests to host Tor nodes, for example...
The world in which IPv6 was a good design (2017) - https://news.ycombinator.com/item?id=37116487 - Aug 2023 (306 comments)
The world in which IPv6 was a good design (2017) - https://news.ycombinator.com/item?id=25568766 - Dec 2020 (131 comments)
The world in which IPv6 was a good design (2017) - https://news.ycombinator.com/item?id=20167686 - June 2019 (238 comments)
v6 is designed the way it is precisely because it needs to run on the same networks that v4 does, and v6 is a better design than v4 in our world because our world has completely outgrown v4.