Embrace IPv6 before its too late | Hacker News Reader

Embrace IPv6 before its too late

hackaday.com

30 pointsguiambros31 comments

A lot of sites out there are still not supporting IPv6 because ... you'll never guess, but dealing with DDoS on IPv6 where your attackers can rotate through addresses quickly is not easy. Amazon Cloudfront and Cloudflare have recently failed to block simple IPv6 attacks for us lately which would not have happened if we only ran IPv4

This is interesting. If you only had IPv4, you’d block a ddos by filtering ip ranges. If some of those ranges were CGNat, you’d be cutting access to possibly millions of innocent addresses or even entire countries.

As IPv4 addresses become more scarce and more people get on IPv6, so more people end up behind IPv4 gateways to reach your IPv4 only service, the greater the chance that they’d be cut off for someone else’s bad behavior.

> cutting access to possibly millions of innocent addresses or even entire countries.

It seems to me, that everybody fine with this, and they don’t care. Even without DDoS. Using VPN or just using Apple’s relay can cut you from large parts of the internet.

> A lot of sites out there are still not supporting IPv6 because ... you'll never guess, but dealing with DDoS on IPv6 where your attackers can rotate through addresses quickly is not easy.

Sure it is. You block the /64.

So now everyone should acquire as many IPv6 addresses as possible so they can spread their services over many /64s so if their server gets compromised and put on a blacklist somewhere they can just burn that /64 and move on to another?

No, everyone should secure their servers... IPv4 hoarding isn't happening for the reason you propose so why would it for IPv6?

Nobody blocks entire /24s because of one bad address

The only way to guarantee your server is secure is to never connect it to a network.

Aren't most of these spoofed addresses anyway?

I wish coffee shops would start letting wi-fi users have ipv6 addresses. What is holding up the captive portal vendors from allowing ipv6?

Mostly that the coffee shops are the customer of the captive portal solution and the shop runners don't know, don't care, some combination of both that the coffee shop users have IPv6 right now so there is no incentive for the captive portal software or vendor to push the matter. Typically at this point "allowing IPv6" also really means "running two versions of the captive portal and intercept stack" rather than "moving from IPv4 to IPv6".

You get what you pay for. Non-revenue generating services are setup and maintained as cheaply as possible. They're not going to buy extra IT labor to test IPv6. In fact they go in the opposite direction by locking down ports to just ports 53, 80, and 443. Other ports are blocked because non-web traffic includes bandwidth hogs like BitTorrent & Zoom, spam over port 25, and copyright infringement letter generating activities. The most annoying networks even force DNS and HTTP through a proxy leaving TCP 443 as the sole pinhole to the Internet.

10.x.x.x has over 24 million addresses. Nobody has that many IoT devices.

“640KB ought to be enough for anyone”

NAT is a workaround, not a fix.

Doesn't 10.x.x.x only have 255x255x255=16 million addresses? Still a lot through.

Yes. In between thinking about it and writing it down I confused “24 bits” and “16.78 million.”

My ISP forced a switch maybe a year ago or so. Everything broke and I couldn't connect to anything. I had to change the router and I think then my computer (though that doesn't make sense in hindsight, maybe I just needed a reboot) to force v4 again. I'll hold out as long as I can.

ISPs cannot "force" a switch to IPv6. If they could we'd be on 90% adoption now.

Maybe you need to troubleshoot more and confirm it's actually IPv6 and not just your router failing to e.g. establish a PPPoE session for your IPv4 connection.

Buddy idk what to tell you. One day ai came home from work, nothing could connect out, all my devices had ipv6 addresses and my router (which I rent from my ISP) was set such that every 4/6 option was 6. I don't know why you think the poorly regulated almost-monopolies can't do whatever they want to the router they have remote access to.

Just switched off IPv6 on home network…and that fixed multiple hard to troubleshoot issues I’ve been having. (Eg specific parts of some iPhone apps not loading)

As much as I want to love it…still more hassle than it’s worth

I wonder how whether it's that turning off IPv6 actually improved your connection or just the good old restart-o-jutsu showing its powers again. Many routers soft-reboot or, at the very least, reestablish internet connection which often fixes stuff.

I have enabled IPv6 for years and my conclusion is that IPv6 is never the problem. People simply never consider whether there is a confounding variable involved, and immediately jump to the conclusion that disabling IPv6 == problem solved.

I tried rebooting all the network gear before that.

And yeah also had it on for years. Dunno what changed

My ipv6 was likely misconfigured but I have no idea how to troubleshoot that so now it’s just off

Neither hackaday.com nor gist.github.com seem to support ipv6, so this seems pretty ironic.

Good for unique address assignments for IoT I suppose, but still seemingly terrible for a user agent.

Yeah, I was going to make the same point.

Rediscovered the GitHub version of the problem recently when setting up some new IPv6-only VMs. They couldn't pull any code from our GitHub repos, making those VMs entirely useless.

They're only "entirely useless" if you're willing to give up at the first hurdle.

Meanwhile, in the real world, the rest of us use nat64 proxies, take advantage of git's decentralised model etc. etc.

> Meanwhile, in the real world, the rest of us ...

Wow. Sounds like someone got out of bed on the wrong side today. ;)

Before it's too late? When would it be too late?

When you can't look up IPv6 guides because they're only available through IPv6.

When Cloudflare blocks you because your CGNAT IP address has a bad reputation.

a.k.a. the Great Firewall of the United States of America

Nonsense.

I have 4-5 several fixed IPv4 addresses and they're inexpensive compared to the hassle of using IPv6.

Reply on news.ycombinator.com