Hacker News Reader

Comment by sylware | Hacker News Reader

IPv6 will rid us from the abomination of domestic NAT.

IPv6 will, finally, enabled the real internet: all p2p protocols will start to work seamlessly. I am thinking a super simple no-dns IP (audio|video) phone protocol listening only on tcp 1 port, new bittorrent like protocol for live streaming, etc.

Since IPv6 has been almost everywhere in my country for years: enjoying ssh session everywhere (ipv6 mobile internet), without any domestic NAT to configure.

But, still... steam... github... and some "rogue" (:P) smtp servers.

That said for HN, where is the champagne?

View on HN

Those of us who were supporting Windows machines in the ‘00s remember when 100% of Windows machines not behind NAT were pwned in minutes, while those with NAT were fine indefinitely. Should a firewall have been doing that job? Yes. Were firewalls doing that job, in practice? No, NAT did, and it was very, very effective.

I have… concerns about removing NAT from everyone’s house now that IOT is a thing. Could it be done safely? Yes. Will it? Signs point to no.

Have you looked at what's actually getting deployed? It's mostly no NAT and firewalls, so the signs actually seem to be pointing to "yes".

Even without a firewall, a /64 is an extremely large amount of space. It's nearly impossible to find active hosts by port scanning, compared to v4 where it's trivial to scan the entire address space. We won't end up in the same situation we were in on v4 back when nobody used firewalls, and that's not just because our networks mostly have firewalls these days.

> IPv6 will rid us from the abomination of domestic NAT.

But won't that also have disadvantages? NAT obscures which natural person is responsible for any given household traffic, which makes user tracking and surveillance harder.

> obscures which natural person is responsible for any given household traffic

IPv6 has roughly the same level of privacy; your client device's IPv6 address changes every few hours. Yes there's a minor loss since an association can be made during those hours, but arguably with the generally low number of people sharing a household internet connection I don't think it's a huge difference.

If mobile internet carriers get a specific IPv6 address slice and do what they already do with phone numbers, you could have a mobile non-changing IPv6 routed roughly efficiently, that globally.

Actually, this should be a base service of mobile internet. The various carrier peerings will define how "efficiently" your traffic is routed (realtime audio/video...).

The blocker is the billing scheme I guess (as usual...).

You're kidding yourself if you think NAT was obstructing data collecting and targeting in any way. Browser fingerprinting makes it a complete non-issue.

Is it possible for me, or worse, a normal person, to claim or request an ipv6 address that they can keep and use like a phone number? I'm used to dynamic allocation for residential ipv4 addresses and never bothered to beg ARIN for some or rent since from an ISP. Having an address you could keep and bring with you would be great and avoid a lot of the difficulties of DNS.

Hurricane Electric gives out free ipv6 blocks that you can assign however you want.

I get an ipv6 for my phone through Wireguard that way.

> Is it possible for me, or worse, a normal person, to claim or request an ipv6 address that they can keep and use like a phone number?

Yes. You also have to get an ASN though, and an ISP which which will advertise both over BGP.

You don't strictly need an ASN in order to request address space, at least with ARIN. It's possible to have your own IPs, and arrange for someone else to announce them on your behalf, or use them on your local network without routing them globally.

(If you qualify for one, there's little downside to requesting it at the same time as your IPs, though)

An IP is not a global phone number. You cannot port the same "number" from one carrier to another.

If we want that, global orgs in charge of the global phone number mapping must coordinate around some slice of the IPv6 address space (what they already do with international roaming of phone numbers). This will be very hard to operate safely, very probably.

There remain the trappings of what was designed to be static IPv6 addresses that would dynamically route to the network that device was - https://en.wikipedia.org/wiki/Mobile_IP

I don't know if it's actually being used. IIRC since then everything has moved to a higher layer.

I cannot tell neither how things would work in that IPv6 address slice, but "peer synced" sub-slices would be needed.

Theoretically possible? Yes: https://chown.me/blog/getting-my-own-asn

A good idea? No.

IP addresses are used for routing. Every provider-independent block of addresses needs its own entry in the global routing tables, which are stored on basically every BGP router in the world. There's a limit to the size of these tables, as they need to be stored in special TCAM memory.

Note that IPv4 currently has many more routes than IPv6 not only due to higher adoption, but also due to higher fragmentation: some providers are obtaining many small non-consecutive blocks from different sources (buying addresses wherever they are cheapest), which results in a large number of routing entries. The increase in the overall table size means all other ISPs have to buy new hardware sooner than they would have without the increase caused by fragmentation. Everyone having their own personal address block would cause even worse fragmentation issues.

Like the siblings said, Provider independent IP assignments are available, for v4 and v6 (although to get a v4 assignment in many jurisdictions, you're going to have to go on a waitlist for a long time, or buy addresses from the previous holder). However, most ISPs will require a higher tier connection if you want to bring your own IPs, so it's not something you can usually do on a residential connection.

The processes involved wouldn't really scale if normal people were going to do it either, but if it's something you care deeply about and are willing to spend the time on, it is possible.

As another poster said, you can get a tunnel from Hurricane Electric, or some other tunnel brokers, and that works too, although it's not as flexible --- HE tunnels are not geographically flexible, you pick where your tunnel is assigned, and those addresses will always be routed through that location. If you move far away, you'll likely want to setup a new tunnel in a new location for performance reasons.

Reply on news.ycombinator.com