Hacker News Reader

Comment by unethical_ban | Hacker News Reader

The CCENT and CCNA certification books have chapters dedicated to IPv6 and I think they do a good job talking about it.

edit: Some little tips about it.

* The smallest subnet should be /64. Anyone making a smaller subnet than that is doing it wrong (looking at you, every ISP that assigns me an address)

* Subnets should be created in four-bit chunks. You should always make /64, /60, /56, etc. for readability. That's because 4 bits make up one hex character in the address.

* If you want to have private (non-internet-routable) IPv6 space, create a ULA. https://www.unique-local-ipv6.com/ Imagine never having to worry about address overlap with VPNs or routing between two internal networks.

View on HN

This a thing which boggles my mind. Does this mean everyone gets /64 addresses to circumvent IP bans?

IPv6 banning would likely happen at that subnet level, not individually.

Ah right. But it will be a bit problematic, since the subnet size may vary between different ISPs, no?

I don't know how things are being done by global consumer ISPs... Whether they are handing out /56 or /60 commonly. Even then, you're talking about dealing with a few hundred /64 sized nets to potentially block, rather than the quadrillions initially feared.

The general approach is to gradually expand the size of a block to cover more subnets if needed, e.g. three /64s banned from the same /60 -> ban the /60, and three /60s banned from a /56 -> ban the /56, or whatever thresholds work. You already need to do this in v4 to cover people with dynamic IPs anyway, so it's not a new concept.

While your device will rotate privacy addresses within a /64, online service operators can ban your /64.

Doesn’t ULA have an issue with the priority of IP addresses, though?

Not sure what you mean.

Like native from ISP will be preferred over ULA.

Oh, not sure.

I know that my ISP only gives my WAN router a single address (/128) so a private local network is a requirement for me.

Really? Can’t imagine how that is possible it doesn’t fit the standard and I’d think it’d get berated. Are you sure they don’t give you a /64 or that you can request one

Reply on news.ycombinator.com