Hacker News Reader

Comment by yrro | Hacker News Reader

> IPv6 has no subnet masks

What? no...

I _think_ I see where the author is coming from, but the assumption that your ISP will hand out a single /64 is evidence of IPv6/NAT-style thinking.

The minimum an ISP _should_ hand out to a customer is a /48 <https://www.ripe.net/publications/docs/ripe-690/>. Out of this, a customer router should advertise a /64 on each interface, for devices on networks that only want a single address, and hand out /56s or /60s via DHCPv6 IA_PD for devices that want more (e.g, a developer who wants to give a /64 to each of the virtual networks on their laptop for VMs/containers to use).

> IPv6 provides no benefit to end-users

God no. Getting rid of hole punching, port forwarding and source-address-obscuring masquerading _are_ benefits.

View on HN

> Out of this, a customer router should advertise a /64 on each interface, for devices on networks that only want a single address, and hand out /56s or /60s via DHCPv6 IA_PD for devices that want more[...].

That said, support for this in the type of router you see on small networks is non-existent. My Ubiquiti EdgeMAX EdgeRouter, for instance, is perfectly capable of requesting a prefix, and assigning a /64 out of the assigned prefix to each other interface for clients to use. But there's no support for, for instance, splitting the prefix up into subprefixes and handing _them_ out via DHCP6 IA_PD; the generated dhcp6c configuration file has a hardcoded sla-len value of 8.

And even if there was, and devices on my network were able to get their own /56s, east/west traffic would have to go via the router instead of being switched directly to the device hosting the virtual network; or the device would have to transmit its own RAs for the delegated prefix, which is a bad idea for security... a lot of assumptions about how we build networks need to be re-visited.

(Sadly Ubiquiti's Unifi line has even worse support for IPv6... and I can't in fairness find documentation suggesting that Mikrotik is any better in this regard... any other suggestions please make them!)

Correction, Mikrotik might support this after all if I understand https://wu.renjie.im/blog/network/ros-dhcpv6/#enable-dhcpv6-... correctly!

Specifically push notifications provide a nice use case for server to client connections, for which you currently need to use an additional service that also inspects and censors your notifications for your safety.

Also how should I secure the vms? VirtualBox provides NAT and port forwarding settings, but not firewall settings, and I guess it bypasses the host firewall, so I should configure guest firewall?

Not following the point for push notifications sorry.

Securing VMs: if your hypervisor is now routing packets between your virtual networks and your physical network then you need a packet filter on the hypervisor AND a packet filter on the guest (belt and braces).

Damn that's terrifying.. I rather obfuscate my traffic inside my network down to a single node at home.

Indeed, I believe most end-user devices should use RFC 8981 (Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6) to avoid pervasive monitoring. However you must bear in mind that this does nothing to prevent web browser fingerprinting, so the effective loss of privacy if temporary addresses are not in use is arguably pretty minimal.

The should is the problem. I've not looked into this in a couple years but I've read plenty of stories of people getting some weird stuff, down to just 1 ipv6

Indeed, regulators need to take so-called ISPs to task and mandate provision of at least a /48 to each customer.

Isn't router already a NAT? The profit is that it's a configurable NAT unlike draconian CGNAT.

No. NAT should be non existent (or purely optional) in IPv6.

In IPv6 the idea is your computer's local IP address is globally routeable.

Reply on news.ycombinator.com