The IPv6 Transition
potaroo.net
potaroo.net
I have even implemented an IPv6-Only network. It fully works, including accessing IPv4 only websites like github.com via DNS64 and NAT64 at my router.
The only practically useful thing about my IPv6 enabled network is that I can run globally routable services on my lan, without NAT port mapping. Of course, only if the client is also IPv6.
Other than this one use case, IPv6 does nothing for me.
It doesn't work from most hotels, nor from my work lan, nor many other places because most "managed" networks are IPv4 only. It works better at Cafes because they are "unmanaged" and IPv6 is enabled by the most common ISPs, like ATT and Comcast and their provided routers.
Based on this experience, I think IPv6 is less valuable than us HN audience thinks it is. Private networks, NAT, Carrier Grade NAT are good enough, and internet really doesn't care about being completely peer-to-peer.
I think the adoption rate reflects this--it's a linear growth curve over the last 25 years. It should have been exponential.
I think cost of IPv4 reflects this--it is now below the peak, and has leveled off.
As surprising as it seems, IPv4 exhaustion has not been a serious problem. Internet marches on. IPv6 is still a solution looking for a problem, and IPv4 exhaustion wasn't one of them.
I don't need to forward any ports but seemingly because I share an IP with a billion people I get Captchas everywhere (Google, Cloudflare etc.). I was even blocked from accessing Reddit without an account at some point.
They now support IPv6 but only with dynamic address allocations so you don't get a lot of advantages from it.
The User Terminal issues a router advertisement (RA) and my gateway gives itself an address in that /64 via SLAAC in addition to assigning itself an address from the /56 prefix.
If not using prefix delegation each host's address is dependent on their SLAAC policy - if not preferring stable addresses (e.g: EUI64) then of course the public address will vary (be dynamic) when using temporary "privacy" addresses.
My gateway delegates /60 sub-prefixes of the /56 and bare-metal hosts then either delegates /62 or advertises /64s from the /60 to VMs, containers, network namespaces and so forth.
As someone else described, I have my gateway also delegate ULA prefixes by changing just the first two octets of the public delegated prefix to fddc (fd = ULA, dc = "data center :) but otherwise identical and likewise on the bare-metal hosts, etc.
ULA is used for internal services; ISP delegated prefix for anything that needs public access.
Multicast-DNS takes care of internal hostnames; everything is ${hostname}.local
There's a separate VLAN for legacy IPv4-only devices that does NAT64 using a ULA prefix.
DNS64/NAT64 for the laggards like github.com that can't grok 128 bit addresses :)
The only time I have problems with web services is when their DNS advertises an AAAA resource record but their firewall/load-balancers/servers are not configured to allow/listen on it.
I’m asking, because I’m an advocate of having your gateway advertise a separate, stable ULA /64 in conjunction with the globally-routable dynamic /64.
This gives you a stable set of addressable LAN IPs, and you can usually ignore the dynamic globally routable IPs.
Granted this won’t work for everyone, but if dynamic global addresses are an issue, you should be requesting a plan that supports a static delegation from your ISP anyway.
A couple of other practically useful things:
- You never get address collisions when connecting to someone else's VPN, or connecting to your home network via VPN from someone else's private network (if you've set that up)
- If there are two people living in your home, they can play online games against a mutual friend who doesn't live in the home without anything breaking
I think you're right that IPv6 isn't a game-changing improvement for most people. It gets rid of some annoyances, it's the obviously correct thing to do for new networks (and cheaper than setting up CGNAT), but fundamentally the pile of hacks on IPv4 is "good enough" for most use cases.
I don't play online games, don't use VPN, have a couple of services on my local RPi that has port forwarded on router and that's it...
ipv6 could be handy when testing some service on my laptop and trying with external services but this happens so rarely that it's not an issue... on the flipside, whenever I enable ipv6 I usually run into problems :|
Our current patterns of internet behaviour are limited by IPv4, so almost by construction nobody does things that need IPv6.
Few people made international journeys before deep water navigation; watched live streams before Twitch; or had pizza delivered at 4am before dominos.
One, the most obvious, is actually having distributed net and serving content from your own machine and in the ancient times like 15 years ago Opera tried that by bundling sort of local http-server (?!, can't even remember the name of the project…) but it floped... I'm not sure that ipv4 was the issue or rather the fact that people don't usually have or want their machine work 24/7...
for calls we have to rely on STUN/TURN but than again some consider this a feature as it hides external IP... which with ipv6 would be even more privacy invading?
Would people want to own such a server? I don't know, but as it stands currently, only the centralised players in the internet sphere can afford to serve content. Perhaps our relationship to these companies would be different if there was no barrier to entry for competition. Perhaps our entire conception of the internet would be different without that fundamental limitation. Or perhaps nothing would change. The central model has its advantages, but I'd also like to be able to own my own website.
You are too optimistic. Poeple can't be bothered to migrate off the google to some alternative provider (also free) and you expect them to buy a "usb stick" for local (mail) server? And then have to keep their machines up all the time and also connected constantly? (not everyone lives in the USA and have FTTH)...
I already mentioned that Opera tried something like "personal pod" 15-20 years ago and it flopped...
> No more centralised mail, you just have a small server in your house that does it for you. The same of social media, etc.
"social media" case seems interesting but again - we had mastodon for distributed social media and it's adoption is lukewarm... and now we have bluesky, which is also distributed and anyone host it and whatnot and it's userbase skyrocketed... and everyone use single instance.
All in all - people don't care about it, they want convenience and nothing else...
IPv4 exhaustion is a real problem, it's just not enough to motivate people much.
For better or worse, IP blocks are still very common. It's easy to complain about this, but there aren't really any good methods to deal with persistent abuse.
Well, its only really a problem if you're poor. Rich people don't care - IPs are still cheap enough when you live in a wealthy country & have a decent job.
The people affected by IP address exhaustion are largely the exact set of people who can't do anything about it.
Its very common for whole streets or neighbourhoods to collectively share a single IPv4 address. Its required, as a result of simple math.
You'll even see this in some parts of the US and UK.
The truth is that people who care about port forwarding are such a small minority -- especially now that P2P file sharing has lost its hype -- that they don't make a visible dent in the rate of IPv4 exhaustion.
Last I checked (a few years ago, I suppose), AWS APIs were incapable of using IPv6 internally, so a VPC still needed to dual-stack it in order to use AWS cloud features. That may have changed by now.
The reason that IPv6 is so lightly used is that it’s cheaper to use IPv4 + workarounds.
I’m not saying this is a good thing or a bad thing, or making any value judgment about IPv4 vs IPv6.
People and businesses don’t spend money on technology upgrades where the benefit is not measurably better than what they already have.
This is just common sense; no one wants to throw away money.
If you want people to use IPv6, then IPv4 has to fail first. As long as people keep making it work then the benefits of changing will never outweigh the costs.
BTW this is exactly the same situation as clean energy vs fossil fuel, etc. In that situation governments are actively putting their thumb on the economic scales in all sorts of ways. Again, I’m not offering a value judgment, just an observation.
Ipv6 is hard. I had to learn quite a bit to make it work and not only I see no value, but it is significantly more difficult to use dire to the address length.
I think IPv6 is a missed opportunity, it was probably designed by experts that did not take into account the population that will use it (not the one users who do not care, but the layer above them)
That said, I think the difficulty of IPv6 is in the UI of the home routers that implement it, and a lack of sane defaults.
The ISP should give every SOHO/residential customer a /60. The router of a simple IPv6 should do prefix delegation. The router should default to SLAAC for local IP addresses, and configuring DNS with Router Advertisements. And residential routers can be set up to have an internal DNS server which populates the ".internal" domain with hostnames from the network.
As a network admin, you have to learn new things like the uses of IPv6 multicast, and ND, the lack of ARP, and some other things. Home users shouldn't have to care about that.
If we are to have a transition to IPv6, and I am very much in favour of this, then by all means make the addresses be globally routable, but force people to select the ports and addresses to be shared in their router. Otherwise we end up with another mess ala "open wifi".
Just as today people have to adjust NAT as kind of an implicit inbound policy, a proper home IPv6 router defaults to drop for inbound traffic.
Now, a home router should probably have a stateful firewall that's on by default, but that's a different matter.
EDIT: I also understood the GP comment to be getting around the problem of long IPv6 addresses and not actually making every machine globally accessible.
The ISP should give every residence 295 quintillion IPv6 addresses? I know there is an abundance of ipv6 addresses but that seems like a lot of waste.
Even assigning a /96 would provide 4.3 billion ipv6 addresses (which is the same number as all ipv4 addresses in existence)
And since available ipv6 space is basically 4.3 Billion^2, assigning an ipv6 /96 would be like assigning a /32 in ipv4 terms of total ipv6 space utilization.
Anything larger (usually /56, sometimes even /48) gives the customers a chance to segment their LAN.
You could always place a small NAT-enabled router between your ISP's device and your home network.
The only problem I could see would be the lack of a (semi-)static public IPv4 address, which one could solve by renting a VPS.
When I replace DHCP/DNS with Pihole I need to account for that. While this is not a complex setup once you understand IPv6 you still need to learn it.
I work in IT so I tried to get myself to IPv6 several times but never had any reason to do so (despite self-hosting a lot and generally being a nerd). I had to do that this time and my uninformed opinion is that it could have been done so that it is much simpler for advanced users (but not yet networking experts)
How does a device with a 32-bit-sized addressing scheme construct an IP packet to a device with an address in a 128-bit-sized addressing scheme?
If I want to use Pihole for DHCP (because it handles internal registration well) and DNS (because if offers filtering) I need to disable DHCP on the ISP router. But since the TV is handled through IPv6 I need to understand it to make sure that that stack is correctly implemented.
Then I have two mesh networks (tailscale and Wireguard as a backup because I manage family networks that are not available from internet) and a docker stack which has its own surprises.
I would love to put a linux box as the egress router and handle everything there (the fiber, DNS, DHCP, etc.) but it is not possible with the provider because the SFP is proprietary (sort of)).
I am really happy to have a relatively stable 1 Gbps fiber connection so I am not complaining - but doing things exactly as I would wish is not always possible.
CGNAT would cripple every customer I've ever had, going back to the beginning of broadband. Everyone one has had something on-premises that needs to be accessible. Nearly always, it's multiple things that are critical to operations.
However. if someone wants to forever keep 100% of their accessible data in someone else's silos...
and be forced to pay 3rd parties to access anything located on their own premises (ex:cameras)
then imprisonment behind CGNAT might feel 'good enough' to them.CG-NAT adds a cost that not everyone can easily afford:
> We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices.
> First off I despise both Apple and that other evil empire (house of mouse) I want nothing to do with either of them. Now with that said I am one of four individuals that suggested and lobbied 15 other tribal nations to offer a new AppleTV device in exchange for active ROKU devices. Other nations are facing the same dilemma. Spend an exorbitant amount of money to support a small amount of antiquated devices or replace the problem devices at fraction of the cost.
* https://community.roku.com/t5/Features-settings-updates/It-s...
* "Roku devices don't support IPv6 in 2023 and it's costing ISPs", https://news.ycombinator.com/item?id=35047624
Something to do with Router Advertisement intervals being too short, though I don't get why that only affects her ~5yo android phone. And IPv6 is so complex, I haven't figured out if the RA interval is something I can or should tweak, whether that comes from the PiHole or whether I'd have to flash OpenWRT on my router, or whether my ISP ultimately controls that upstream. Like, I can't figure out as easily where the boundary between me and "the internet" ends with things like the /64 prefixes and SLAAC and RDNSS and all the other acronyms.
Yeah, yeah, I should RTFM, and eventually I might figure out what makes a "good" home IPv6 network. But I can't be arsed to do that in my free time yet, and neither can most software companies cough cough Google/Android and that one guy causing IPv6 drama in the android team
Like.... Ehhh... I'll come back to it in a few more years. "Are we IPv6 yet?"
Who knows, maybe I dreamed it.
Nonetheless, I disabled IPv6 again and that, somehow, was the smoking gun that solved the "my phone always runs out of charge overnight when I stay connected to your wi-fi" problem.
Most? I have not seen a _single_ hotel that supported IPv6. Not one. And I always check, just for fun.
I've been to one hotel (in Menlo Park) that used to give out public IPv4 addresses automatically, and several hotels (The Venetian, Bellagio) where you could request a public IPv4 as needed.
BTW, I'm also looking for a SIP provider that supports IPv6. So far I haven't found any in the US.
Doing NAT64 runs into MTU issues and the behavior I observed is chrome would resend the request but only after 30s, firefox and other programs entirely failed to resend requests that were rejected due to MTU issues. Once I got the rejection, retrying in firefox or whatever would work though, so it seems like the path MTU was cached somewhere at the OS level. Reducing MTU manually seemed to fix the problem, but isn't that supposed to be automatic? Why didn't the kernel do the resends?
Old iPads, Androids just don't work, I'm not sure why. My iPhone 11 would connect to the network but declare itself disconnected after 24h or so (some lease or dns expiry which it doesn't renew?).
Steam hardcodes an ipv4 address for login... !! I'm not sure what to make of that, and the fact that it was reported around 10 years ago and they still haven't fixed it. Is it even using TLS?
I needed to make docker dev containers use host networking, because otherwise they'd get ipv4 addresses and try to do ipv4 traffic which couldn't be tunneled by default over ipv6.
Other than that it basically worked.
There's fundamentally only two different ways ipv6 can be configured from an ISP: SLAAC with no delegation, so you essentially share a network with other customers, or DHCPv6 delegation. Unlike IPv4 which has a million different offerings: PPPoE, DSLite, MAP-E, DHCP, etc etc and many of those aren't supported by linux.
I signed up with an ISP that claimed to support NAT64 (Biglobe) but they only support it on their SLAAC ipv6 + PPPoE ipv4 setup, not on their DHCPv6 PD + MAP-E setup, so I had to switch back to SLAAC. At this point in time the NAT64 support seems to be have been a lie... But anyways, to control my network DNS settings despite that I made a program to rewrite RA (and various other packets) with my own DNS server information.
If GooG/FB/Amazon force IPv6 how long will it take for ISPs to switch? I think in one week where some people cannot reach GooG/FB and any ISP that was dragging his feet has implemented IPv6 by the end of the week.
I expect IPv6 adoption will blow up any time now as past performance is not indication of future changes ;) because there is much more required on the server side than it was ever before. ISP and home use could live with NAT but servers not really even if you can handle bunch of services on a single IP address, there is just limited traffic you can squeeze onto a single server.
Internet (I mean, the IETF) does care a lot about the end-to-end principle, however. It is true that "misbehaving" NATs break e2e badly. It is also true that IPv6 can also be put behind such NATs.
What did you use to implement that? I found it surprisingly difficult to find software to do NAT64 on Linux.
I could have written this message in 1999. That's 25 years ago (as you alluded to). That's a long time to hold your breath.
Also, you're speaking from the privileged perspective of a first-world country- many other countries missed the boat on IPv4 addresses and are limited to IPv6, which also probably explains why global uptake continues upwards despite the US stagnating.
I have never gotten github access from my IPv6-only Hetzner-hosted machine. I don't have control over their router(s) and I am not an experienced network admin who would know how to set up something that would let me simply fucking "git clone" from that machine. I would end up having to set up something janky. The fact that Github is IPv4-only in 2024 is atrociously bad and hopefully handing over business hand-over-fist to their closed-source and open-source competitors.
I love having access to all my internal machines over IPv6 from anywhere without having to use janky hacks. I'd be able to self-host boutique and portfolio websites for example (at least from IPv6-enabled clients), without having to use (and pay for) an external host just for the sake of access.
The fact that hotels and work LANs don't permit access is a "hotel and work LAN" problem, as well as a chicken-and-egg one. If enough people request it (perhaps work people want some cheap Hetzner hosts for dev environments and traveling devs want access to the same machines), the Sysops That Be will make it happen- They are certainly educated enough in the space to enable it.
You are neglecting the cost savings and the non-Western perspective, as well as the "simple developer, not devops expert" perspective.
IPv4 is "good enough", but we could do some things to extend its usage further.
First, adopt service location in DNS, and being to retire it at the TCP port-number layer. Then we could run more than one website per ip address, and this would significantly increase resilience against censorship. Rotating ports for censored websites is a significantly easier task than rotating IPs for them since it does not involve routing changes. This could be done with "here and now" technology.
They are not useful, as you can't depend on them.
You need to add the source IP/port into the mix. But they alone are in practice enough for decent load balancing.
I think this is mostly the way it is because of all the NAT headaches that come with IPv4.
We regularly see the limitations of Dropbox/Google drive when we just want to share that large birthday video with our friends/family. Imagine them having a secure link to your device that you can revoke any time.
Same with all the home automation / iot devices / cctv cameras that have no excuse not to be local first/need you to install an ad infested app.
As it might be wise to banish those devices into an isolated net anyways that might not matter too much — but a transition to IPv6-only has many places where hard- and software is the blocking factor.
IPv6 was not created for you, but it benefits you. NAT is computationally expensive and it does have a real impact for large organizations with thousands and tens of thousands of devices. Such as large universities or you know ISPs.
99% of the top 100 mobile applications in China are on IPv6. China Mobile's backbone is now IPv6 only.
* https://www.theregister.com/2024/10/14/vietnam_digital_infra...
Because "it's the Internet" and has been a standard since the year 2000 doesn't seem to be sufficient reason to bother...
Even if it's not strictly true, that seems like a solid justification. Though obviously that won't work for the general public.
We should absolutely not be pointing to this as a success or a model for other countries.
You are describing as if the IPv6 network within China is completely blocked off from the wider network. It's not.
Even if NAT will be gone one day, the stateful firewalls won't. Every every home router would still ship with "deny all incoming" by default, and every corporate network would have the same setting as well.
Same as IPv4, IPv6 serving would still need registration with border device, either manual by user, or via UPnP-equivalent.
People naively assume the large IPv6 address space somehow hides your computer on the internet. That isn't true. Both because v6 host discovery is a solved-ish problem for attackers, and worms have near unlimited resources to throw at the wall.
But the effect of proliferation of cheap Wi-Fi routers with cheap dynamic NAPTs in conjunction with UPnP did to XP-era PC security - 100% agreed, it was like sunlight self-disinfecting brass door handles.
It’s already a thing. These unique per-service addresses are called “ports” in IP protocol.
Also, the IP protocol does not care about ports at all. Ports are a thing for UDP and TCP.
You can't trivially host your own blog, for example, without going to your ISP and requesting a static address, and then configuring port forwarding. This is why everyone got stuck on social media, because they need someone else to run their website essentially.
Is it unimaginable that someone uses a HTML editor like microsoft word or something to write a blog and then copies it into the folder of a static web server? I'm sure it would be way simpler if people had the time to figure out P2P and the associated UI, it's not fundamentally super complicated versus client-server.
I’m suggesting that the way you build an app is shaped by the prevalence of NAT, the same way the apps you build are shaped by how much bandwidth home users have for devices.
Some types of apps benefit from p2p functionality, and those hit obstacles for normal users due to port forwarding requirements, and are largely impossible which CG. I don’t think NAT is a villain, just something that does affect what and how we build stuff.
There's a lot of interesting thought in the second half about what the Internet fundamentally is and where it's going. The author argues that the use of TLS and SNI has fundamentally changed the internet from a number based routing network to a network based on DNS names and SNI where the numbers involved don't really matter anymore.
> Where is this heading in the longer term? We are pushing everything out of the network and over to applications. Transmission infrastructure is becoming an abundant commodity. Network sharing technology (multiplexing) is decreasingly relevant. We have so much network and computing resources that we no longer have to bring consumers to service delivery points. Instead, we are bringing services towards consumers and using the content frameworks to replicate servers and services With so much computing and storage the application is becoming the service, rather than just a window to a remotely operated service.
I'd still love to have a dedicated IP address associated to the house so I didn't need a contract to dish up a blog & photos for my 3 friends. I'm sure P2P would make it much harder to extract money from people.
Sure, I could have hacked my way through it. But, that was more work than just paying the extra few cents a month for IPv4.
I'm not kidding. For example, Android doesn't support stateful DHCPv6. And DHCPv6 doesn't have the _basic_ feature of DHCPv4: hostnames. You can't easily use it to do a quick survey of your network.
Then you have that @#&(^(&!@^ that is ULA.
With IPv4 we have a very useful pattern: you create an "internal" network that is stable and predictable. It's routed to the outside world through NAT. If the external connection goes down, the internal network is unaffected.
With IPv6 you're supposed to have ULA and the global routed addresses in parallel. So now the external connection goes down, and the router withdraws the prefix from the router advertisement. Half of the hosts lose their external addresses, but keep the ULAs. Half of the hosts don't implement prefix withdrawal, and keep both their ULAs and the normal addresses. Congrats, now these hosts can't talk to each other due to the ULA addresses being less preferred.
And of course, IPv6 hasn't improved on the PMTU. So if you're running an Internet service, you need to use something like 1400 MTU to make sure some of the misconfigured tunneled clients don't get shafted. There's now an RFC that makes it useful: https://datatracker.ietf.org/doc/html/rfc9268 , but it's Experimental and it'll need ~20 years to be deployed anyways.
IPv6, a story of recursive utter failure at all levels...
Just skip DHCPV6, just use SLAAC. Plus I've never seen DHCP hostnames work.
Now I just ping ff02::1 multicast to see what devices are on my network. Unfortunately much software makes it a pain to use link-local addresses but they're really convenient as they normally don't change across networks.
> Half of the hosts don't implement prefix withdrawal, and keep both their ULAs and the normal addresses. Congrats, now these hosts can't talk to each other due to the ULA addresses being less preferred.
I've had similar issues with crappy devices not relinquishing DHCPv4 IPs properly. Always fun trying to figure out why your laptop is dropped off your network after 20 minutes because it honors DHCP.
The lack of proper prefix widthdrawl sucks. Though it's something software should be able to handle by preferring ULA addresses when communicating locally.
Over half the workstations at my office use DHCP hostnames and they work just fine. In fact I'll say exactly the opposite: I've never seen DHCP hostnames not work.
How does that help? I don't want a list of IPs, I want to reach my devices by name (which DHCP makes easy).
Wasn't this disabled for IPv4 for being a security concern? See the Linux net.ipv4.icmp_echo_ignore_broadcasts sysctl.
I wonder if this will stay enabled for IPv6.
Here's how a part of my IPv4 network looks in my router's control panel: https://imgur.com/a/xZDUfqw , I can easily set up permanent local IPv4 addresses for the fixed infrastructure, and I can easily see which hosts are alive.
Yes, it's not 100% perfect, but it works most of the time just fine. Even with crappy IoT devices.
Here's how it looks for IPv6 and SLAAC: https://imgur.com/a/DiUNqTC - good luck trying to make sense of it.
I just wish routers had better / easier support for local DNS. Also a true tld reserved for internal network names would be awesome. Technically `.internal` is undefined.
That said, I do use ipv4 for easy local addresses just because local DNS is such a PITA to setup. Though I use ipv6 in my hosts file for setting reliable access to specific hosts where the ip doesn't change.
How? There is no way to associate hostnames with addresses in IPv6 that works unversally. Stateful IPv6 is _not_ _supported_ by Android, for example.
And since _each_ _device_ handles its own address selection, there's no central way to say "hey, this is an IP camera, let it have a static ::1:2:3:4 address suffix".
Moreover, with IPv6 I'm losing an ability to do quick checks of the network health.
Yeah, you see a bunch of MACs and... what next? How do you get the names?
What do you mean by this? Are you taking about mDNS still referencing the withdrawn prefix?
> Are you taking about mDNS still referencing the withdrawn prefix?
That too.
…but the graph below that text shows 40% of traffic is IPv6, so the v4 space is only shared across 12e9 devices?
In my experience the big holdouts these days are corporate networks. All my domestic ISPs (cell, home, data centre) provide IPv6 and most devices use it by default. Meanwhile at the office we’re struggling to bring up a new internal service because our v4 IPAM is a legacy mess where the most you can calve off is a “class A” /27.
I switched to Vodafone which is cheaper and double the speed and got me IPv6. I think it might just be Virgin sitting on a large amount of IPv4 addresses and not wanting to spend any money on supporting v6 when they can just overcharge their loyal customers.
On the upside, a lot of the UK is getting small fibre companies rolling out 1G symmetric lines all over the place now. I've got that in my new place and it's been great (IPv6, CGNAT IPv4 by default but you can pay £5 for a static IPv4 too).
On a side note, there seem to be ways to get out of CGNAT when you got condemned to use it: It is sometimes an annoying source for client VPN instabilities and from what I heard, users can just ask to be switched over from DS-Lite to classic dual stack to improve application compatibility.
Sure, when the RIRs were built they were assigned roughly equal shares of the remainder of IPv4 space, but it certainly failed to account for those early years of early adopter allocations, which did accidentally favor the US heavily.
The consumers are not expected to need a public address where they can be reached - in fact, having a public address is actually a security and privacy risk.
> having a public address is actually a security and privacy risk.
Services can be turned off or a firewall instructed not to pass traffic from the internet (by default). That represents exactly the same attack surface as having a service enabled and nobody being able to get to it from the internet because of NAT.
The privacy risk is mitigated by RFC4941 "Privacy Extensions for Stateless Address Autoconfiguration in IPv6". Granted that does not deal with the (delegated) prefix staying the same and when there are only one or very few users in that prefix, some individual behavior could be inferred. Because of that at least in Germany we have the peculiar horror of getting the IPv6 address and all delegated prefixes changed on every redial. That eliminates all privacy concerns while also continuing to make residential internet connections useless for hosting any services.
Anyway. The internet is already way down the road of functioning only as the delivery conduit for a few cloud / service providers mediating all user communication and access to content.
This is oh so very German.
In normal times it is massively overkill. I have to wonder if, heaven forbid, the things these sort of German things are meant to mitigate come to pass again if they will make any difference or if they are a largely symbolic act designed to demonstrate ideological opposition to such things.
I strongly disagree with this. Privacy (not that it's a big deal imo) is well handled by the temporary address extension, and security is not an issue if you run a firewall. And you should be running a firewall even if you use v4, because NAT is not an acceptable security measure.
Normal NAT as seen with home internet routers provides zero privacy, because you still have a predictable public IP.
People also think that IPv4+NAT provides security, but IPv4 is such a tiny address space that all public IPs are scanned daily by various malicious bots. Meanwhile IPv6 is so enormous that unless you register your address in some public way, you're completely invisible to port-scanning bots by default!
I have a friend who works in the networking division of a telco in my country, their team had to spend significant time and effort educating a PM who was dead-to-rights convinced that IPv6 was “less secure” and seemed to think that IPv6 didn’t have subnets and that NAT’s were the same as firewalls and refused to be convinced otherwise.
People like that make any forward progress extremely difficult.
100% of consumer routers and OS level firewalls deny new inbound connections by default. There are upsides and downsides to static vs dynamic ISP-provided addresses, but the only difference between IPv4 and IPv6 in this regard is that IPv6 has a vastly larger address space and offers an ISP far more capacity to randomize a customer's host address for a far lower cost than IPv4. CGNAT is available for 4 or 6 if such is desired.
That may indeed have been an assumption of the original architecture, but it's orthogonal to the end-to-end argument in Internet design, which is about moving logic out of the network entirely and into applications (more precisely, about recognizing that the boundary between network and application is productively debatable, and had, up to the point where Saltzer and Clark and Reed wrote the paper, been defaulting too much towards the network). An end-to-end-architected networking application can be oblivious to its addressing, or even the network layer below it.
If anything, my intuition is that the unreasonable effectiveness of CGNAT --- which is exactly what Huston is writing about --- is strong evidence that the end-to-end paper was deeply correct.
Additionally, like a sibling comment notes, a home hobbyist has full control over at least half, often more, of their addresses and can easily choose addresses for their network that are as short or shorter and easier to remember and organize vs a v4 network where you have no letters to work with much more strict subnet size rules, etc.
IPv6 is a dream for home hobbyists! The complaining from them about “unmemorable” addresses just makes no sense.
Well, the non-trivial percentage of large orgs that have literally run out of RFC 1918 space would disagree.
But yes, you're right. There's a weird Stockholm syndrome thing some people have with NAT.
It'd be hard to have so many devices that even in 10.0.0.0/8, you run into a need to have letters as part of the network addresses.
My home network is larger than most and I while I use multiple subnets for fun, I could it all of it into a single /24.
Thus ULA is a must on the inside, and DynDNS is still required for anything internet facing.
In the real world, people who design and operate large networks are the very same people who staffed the working groups who designed IPv6. It's their design.
E.g.: If I want to deploy a cloud VPC (or vNET), then I have to go find "the guy with the spreadsheet" and peel off a tiny(!) private IPv4 address space. If he's away from his desk or on holidays, my 1-minute automation script will now take 1-10 working days until he's back and responding to requests. With IPv6 this just disappears as a bottleneck.
This is not the kind of glowing endorsement you think it is, if you're expecting your technology to see widespread adoption
> Gave up, never again its just not worth it.
Maybe when you upgrade your router to one that cares about IPv6 it will work. Never say never. Also...
> I moved to another hosting service that didn't charge.
That's not going to last. The price of having an IPv4 address must go up over time since demand will continue to increase and it will (already is at some places such as Hetzner and other managed hosts) cost more than IPv6 which is usually a free address.
And that is the point of this article, for most participants of the internet the benefits don’t presently justify the involved cost.
Peer to peer networking is important to rare users like me so I can do things like host a private Minecraft server from my house for my brothers and I to play on, but this is not yet a problem for me on IPv4.
Interestingly a few years back while I was moving and had no internet for a few weeks I temporarily moved the Minecraft server to my brother’s house and we discovered he was on CG NAT which was a total nonissue before then.
I sent an email to the ISP saying we wanted to expose a port and asked how to do so and they changed my brother’s account to be given a public IP no questions asked or extra costs. And I found this policy okay because probably 99.999% of internet users don’t do anything over the internet where a public IP would make any difference to their life.
I expect once enough of the internet is on IPv6 the cost benefit pendulum will swing the other way, but we're not there yet and it’s not clear when it might happpen.
Fastest way to get IPv6 going in the US is to mandate all government usage be IPv6 only by 20XX. Any supplier or vendor must work over IPv6. You'll see the industry fall in line very quickly, no one wants government money to be shut off.
It's a problem for me now on IPV4
If you want the government to mandate standards, vote with your feet and move to China where it has been mandated.
I thought the point of the article is that perhaps IPv6 is ultimately unnecessary: worse is better?
Why are we engineers so attracted to authoritarianism? The idea of just telling everyone to use the new version seems attractive to me too. Then again I often deeply admire practical engineering compromises. (edited: clarified)
For example:
- require support for ipv6 in order to qualify for government grants to ISPs to build or expand
- Require ipv6 support from any SaaS sold to the government
- require government websites to be served on ipv6, possibly exclusively on ipv6 by a certain deadline, although that might be too aggressive.
- grant tax exemptions on costs to upgrade equipment to support ipv6
- levy a tax on ipv4
None of those removes your freedom to use ipv4, they just provide incentives to use ipv6.
One less thing to ship with every bit of network software.
One less learning outcome taught in every networking course.
One less piece of organisational complexity in every ISP.
Fewer rent seekers in the IP address space.
But these benefits are network effects and we only achieve them once IPv4 is relegated to the archaics of the internet tech stack.
That doesn't sound like agreement.
Agreement is how we have arrived at the imperfect solution we have now... Agreement between various technical and non-technical parties.
Forcing people to use it is authoritarianism.
One day it'll be worth my time to figure out the problem, but I predict that day is far in the future.
In the meantime, we figured out how to make things work without the extra address space. And the dream of a point-to-point Internet turned out to be a terrible idea after all. IPv6 pushers love to hate on NAT, but it’s actually a really good design choice that’s fundamental to basic network security.
Please explain how NAT on IPv4, as used in practice, does not increase security vs connecting machines each directly to a publicly accessible Internet address?
I’m having a hard time understanding how this statement can possible be true.
And more high-level explanation as well: https://www.f5.com/resources/white-papers/the-myth-of-networ...
So everybody is using IPv6 in their home networks without problems.
ISPs realize that selling their old squatted IPv4s to Amazon/Google/Azure more than pays for the transition to IPv6 + CGNAT with a tidy profit on the side.
Then to save more money, they cheap out on the CGNAT so that IPv4 connections have poor performance.
Customers complain to the slow websites (since google/cloudflare sites all load quickly, it must be the site's fault) and they have to adopt IPv6 for that reason.
My mobile provider doesn't allow IPv6 connections.
So ironically, to be reachable from everywhere, I had to turn off IPv6.
I don't agree with this take. I think it's actually quite a bit more complex, and this is a large part of the reason adoption has been slow. In retrospect, I think it would have been better off in practice to just literally extend the size of IPv4 addresses, and make it as simple as converting all IPv4 systems to hold a larger address.
The urgency of IPv6 adoption was predicated on the assumption that every connected device, both server and client, needs a unique and stable IP address. Back when IPv6 was first discussed, you couldn't even host two HTTPS sites on the same IP/port combination! That was such a colossal waste of IP addresses.
Another thing that changed on the server side was that, thanks to AWS and the like, it became trivial to set up a massive private network. Nowadays you can have a cluster of thousands of virtual machines that communicate with one another entirely within a VPC. Only machines that need to communicate with external entities get a public IPv4 address. This kind of setup not only frees up a /20, but also has the benefit of being more secure.
Meanwhile, on the client side, the rise of mobile internet means that devices can no longer assume that it will have any given address for any length of time. Even if we had plenty of addresses to go around, like with IPv6, what can we do when the device moves across the country? It's easier to assign a new address than to try to route the old address to an entirely different ISP. Reducing the complexity of the routing table was one of the goals of IPv6, after all. Insisting on a unique and stable IP address for each mobile device would defeat that purpose.
As a result, most new applications are being built with the assumption that the IP address doesn't matter. You rent a few ports on someone else's IP for a few minutes to fire off a bunch of requests, just like you'd rent CPU cycles on someone else's machine to run some functions.
This is something that people who are too deep in the weeds of legacy networking don't realize. The future is to not use IP at all within enterprise and not use the Internet at all for B2B communication. In fact the future is to not use any networking abstraction at the application layer.
To start with every device can be in VPCs with the same private /16 because they can easily communicate securely within the cloud environment via services like VPC lattice or using S3/API gateway both within and across companies. Let the cloud provider handle the undifferentiated heavy lifting of figuring out how to get data from one device to another. In time third parties will establish cross provider bridges.
Then you can start to ask yourself why your applications need the "networking" abstraction at all. If you want to send some bits to an application either within or across companies it should be just a matter of putting the bits in some location the receiving application has access to and the cloud providers can figure out how to actually make the bits accessible to the other application. Think writing to an S3 bucket using a VPC endpoint but with less HTTP/TCP/IP cruft in the middle.
As a benefit the identities on both sides will be established by the cloud providers so you don't need to worry your devices are reachable by malicious actors. Then you can start to get rid of all this cyber security nonsense that has grown up around the ridiculously insecure protocols that were developed in the 70s for connecting trusted machines and somehow are still in use today.
Internet service providers and cloud providers may or may not use IPv6 but enterprises, schools, and end users certainly won't need to.
Except it turns out that most organizations see no need to give internal devices globally routable IP addresses, much less expose their MAC addresses. If anything, it's a vulnerability, not a feature.
On the other hand, going too far along with your idea would look like a dystopian future where everyone is corralled into one corporate walled garden or another. So it's understandable that there's a strong gut reaction against it. Fortunately, there are enough IPv4 addresses to support both corporate walled gardens and a reasonable number of independent operators.
This is not actually a real problem, we do just fine without it, it can be solved at higher or lower layers. But it would have been nice to have.
Multipath/homing, with different IP addresses, exists with TCP and SCTP:
* https://en.wikipedia.org/wiki/Multipath_TCP
* https://en.wikipedia.org/wiki/Stream_Control_Transmission_Pr...
In the 19th century, New Yorkers worried that the city would soon be buried in horse shit because of increasing demand for transportation. The horse shit apocalypse never materialized, because transportation evolved in a way that stopped relying on horses. Now we have a different problem, of course.
> This exercise predicts that we’ll see completion of this transition in late 2045, or some 20 years into the future.
Anyone willing to place a bet on this?
> While the design of IPv6 consumed a lot of attention at the time, the concept of transition of the network from IPv4 to IPv6 did not.
> Given the runaway adoption of IPv4, there was a naive expectation that IPv6 would similarly just take off, and there was no need to give the transition much thought. In the first phase, we would expect to see applications, hosts and networks adding support for IPv6 in addition to IPv4, transforming the internet into a dual stack environment. In the second phase we could then phase out support for IPv4.
I really don't understand this, how do you not make a transition plan the #1 requirement for selecting the next IP. (But the article goes on to say...)
Ill bet against it. The tail on this one is going to be super long.
There are embedded systems today that are shipping in things expected to last 30 years with IPv4 only.
The logistics of the bet are going to be hard. I do see a world where IPv6-only becomes the default for ISPs and IPv4 becomes an add-on you pay for either from your ISP or from another via a tunnel. Does that world mean v4 is dead yet?
Only global IPv4 matters. If in fifty years there's still a device that insists on speaking IPv4 with the address 10.20.30.40 that will still work and it still won't matter to the Internet any more than it does now.
The appropriate comparison is leaded gasoline.
In my country this was never formally banned. You can't buy a new car which consumes it of course, they banned that, but the fuel itself is legal and for a while enthusiasts would travel to a retailer which still sold it, there might be one in the next town, or the next. Of course with fewer customers the price went up, further reducing customers and squeezing more retailers out, soon enough you might have an hour's drive to buy fuel. The wholesalers were next, if you sell a tanker of ordinary unleaded every five minutes, and a tanker of "high performance" unleaded every hour, why bother making the leaded fuel that shifts only one tanker per week across the whole market? It's not even worth reconfiguring your mixers to make it. So you mark it "No longer available" and gradually across the market the retailers can't buy more and there is no more leaded gasoline.
You can make your own leaded gasoline, but the volumes involved mean it no longer makes any meaningful difference, you could make your own lead paint too, if you're crazy, it doesn't make a noticeable difference to the world.
We’re talking about the logistics of a bet, it’s the only thing that matters in this context.
The big transit providers pay very little to carry ipv4 prefixes. They will never even consider cutting it as long as there are any semi large content providers offering v4. Transit cores are prefix-free with segment routing so the cost is basically just the device that peers at the exchanges with other peers.
> The appropriate comparison is leaded gasoline.
It is not. The price dynamics make it so cheap to keep supporting ipv4 that it’s nothing like the unleaded switch. That’s before you even consider how dumb “banning the sale of new IPv4 devices” is.
To some extent, Postel's Law suggests the only viable transition plan for the internet is "no transition plan"; expect both to continue to exist as long as they both need to and do your best not to break things or step on each other's toes.
Relatedly, a slow "dual stack" IPv4 to IPv6 transition is as much validation for Postel's Law, and that is has been applied to a useful extreme, as anything else: traffic shifts as traffic needs to shift; the internet not only survives, it thrives; most users don't notice nor care.
The range check should be in the form of "isIPInRange(ip, cidr)", e.g. isIPInRange("192.168.0.255", "192.168.0.0/24").
It is trivial for IPv4, but not so trivial for IPv6.
If you are wondering why I am not asking LLM this, that is because when (at the time) I did attempt, it failed spectacularly, plus hey, it is HN, someone may find it useful and the more eyes the better anyways (to spot bugs, issues, what have you).
Every company I've ever worked for has completely disabled IPv6 on the corporate network. My own ISP still doesn't offer it. Disabling it is often the quickest fix for a variety of networking issues.
At some point we must admit failure. There is no conspiracy to limit IPv6 adoption. If the technology was truly useful, you'd see far more in our profession advocate for it.
In a way, you disabling it now is the reason why others are disabling it later. A lot of IPv6 deployment issues are precisely caused by middleboxes/clients disabling or misconfiguring it.
You quickly assuming IPv6 is a "shitty technology" means that you are part of the problem. Congratulations, you just proved my point.
>the one we're using now
The one we are using now is held by a bandaid. It's insane that, for me to connect to other computer, I need a middleman (STUN or other coordination services) to help me with it.
I am curious though: my IPv6 network begins with 2600::, which I feel is not an accident or mere coincidence. For a long time, Facebook would never "trust" my device, and I suspected it was because of the IPv6 thing.
Now, "2600" is actually a hex number and doesn't mean 2600 decimal, but 2600 is an interesting prefix for a stable address. Could it mean that my ISP has permanently branded me as some sort of "hacker", and "2600" is network admin code for "please don't trust these devices"?
We should compare notes and see if other HN users have come up with stable prefixes like this, or different prefixes that aren't "2600".
https://www.iana.org/assignments/ipv6-unicast-address-assign...
Currently Denmark has worse support than I expected:
> Liste over danske udbydere (List of Danish providers)
> Internetudbydere på listen: 41 (ISPs on the list)
> Internetudbydere med fuld IPv6-understøttelse: 17 (41%) (ISPs with full IPv6)
> Internetudbydere med delvis IPv6-understøttelse: 10 (24%) (ISPs with partial IPv6)
> Internetudbydere uden IPv6-understøttelse: 14 (34%) (ISPs with no IPv6)
source: https://ipv6-adresse.dk/
For ipv4, I have a DHCP server on the same machine as my DNSH server, which lets me configure my network in a single place. With IPv6 I'm still not sure exactly how to configure this. It seems like if I use SLAAC for a ULA, at least some hosts will still apply RFC 4941 (or maybe 8981; I'm not sure), which makes DNS unfeasible. So I guess maybe DHCPv6 is the answer (short of manually configuring each host)?
So there usually is a stable ULA or link-local that you can put in a local DNS AAAA record.
The PITA is that many services prefer GUA over ULA if available and don't gradually fall back to ULA if the WAN goes down. And you will still need dynDNS to VPN into your network because ISPs are allergic to stable IPv6 prefixes.
Why should any enterprise company move to it? Why should any enterprise (at least) double the cost by having to support two protocols when most problems can be solved by various types of NAT?
ZScaler is a burning piece of privacy-violating garbage that as a developer rather get rid of than have.
Nice for non-IT collegues who were previously protected by the corporate proxy server while working in the office, now work at home or other places, and are prone to scamming and visiting forbidden [by the employer] sites.
As a developer a system-wide MITM SSL-decrypting proxy server is a major pain in the ass. Every runtime of developer tools, python, Node, .NET, Docker, Linux (WSL) flavors, etc have their own way to trust root certificates, and as a web developer you do tend to touch a lot of different tools. Secondly, when you do a bit of devops, you can't even check basic things like checking if a website has the correct (valid) SSL certificate without RDP-ing to some server which doesn't have ZScaler installed.
Sorry for my rant. But I'm not allowed to disable ZScaler - but am forced to live with it.
Frontier, Optyx, Sumo, Evolution, Intellipop, Starlight, Legacy, Yandoo, Voonami, Infinity all serve this area. Zero have IPv6.
The point being that ISPs remain a primary stall-point of IPv6 adoption. There is eagerness to hand-wave that away - and that is part of the reason IPv6 stays underdeployed.
What's he referring to here?
- GitHub does not support IPv6.
- Docker containers do not have IPv6 by default.
- Many programs default to listening on 0.0.0.0 or 127.0.0.1 when they start, which means they only listen on IPv4. On Linux, listening on :: defaults to listening on both IPv4 and IPv6 simultaneously, but few programs do this. Python asyncio even disabled this feature[1].
- I've always heard that using IPv6 can sometimes lead to high latency or low bandwidth on certain websites, or even resource loading failures. Why isn’t there a convenient tool to compare these differences? It would be great if browsers could switch between IPv4-only, IPv6-only, and dual-stack modes. I’d like to seriously compare the effects on some websites rather than being silently affected.
- Two large ISPs, Hurricane Electric and Cogent, do not have IPv6 peering[2], so they are not interconnected, and many other ISPs have similar issues.
- Very few VPS providers offer /64 IPv6 addresses, which would allow different containers to be assigned freely within a machine. Some only provide a single /128, while others offer very few addresses per machine.
- Many people might only know how to use iptables/nftables for firewalls and forget about IPv6, leading to situations where using IPv6 can bypass the firewall. I’m not talking about issues caused by the lack of NAT (NAT is not a good firewall!), but more generally about cases where you want to disable forwarding between two network interfaces.
I stumbled upon two old posts that I found quite amusing:
In 2011, someone said[3] “It's not terribly useful to have IPv6 only websites at the moment. Check back in 5-10 years though ;)”
In 2014, someone said[4] “The Internet is growing really fast, in a few years, the IPv6 network will be bigger than IPv4, so, with IPv4, you'll be out of the real Internet. Go ahead man! Upgrade your IP!! Change is a good thing.”
[1]: https://github.com/python/cpython/blob/5f5c0b9c23238dc0a1fdb...
[2]: https://adminhacks.com/broken-IPv6.html
[3]: https://www.reddit.com/r/ipv6/comments/gnh69/what_ipv6only_w...
[4]: https://askubuntu.com/questions/309461/how-to-disable-ipv6-p...
IPv6 looks so Rube-Goldbergy to my eyes that if I squint just a little tiny bit and put a very thin thinfoil hat on, I could nearly swear this complexity is there by design. For example so backdoors allowing exfil through ICMP are impossible to detect.
IPv6 is chatty. So chatty.
There are networks where a single unaccounted for packet means something abnormal is going on (and at the very least requires enquiry): how does that work with IPv6?
An issue with these big design-by-committee thinggies is that often one or two in the committees are little rats working for the man.
Firewalls stopped sending RST packets (or any other kind of error) by default on all ports more than a decade ago. This is great for Internet-facing security, but has converted from easily diagnosed instant failures on internal networks to 30 second timeouts... which are indistinguishable from "host is down".
Don't worry! Just ping the host... err... can't do that either because of overly paranoid admins like you mentioned.
Next, spend a week trying to figure out why packets seem to go only one way through a cloud VPN only to discover that Path MTU Discovery uses ICMP and without which VPNs are basically broken.
Fun.
The Portal now loads for me on IPv6, which then blocks me from accessing certain PaaS resources because they only work with IPv4 rules in their firewalls.
Speaking of which, it grinds me gears that every Azure PaaS service implements firewall rules in a unique and special way. The syntax is different, the parameters are different, the capabilities are different, and the output logs are also incompatible just for extra fun.
It's called "Named-Data Network".
Start by looking at routers for IPv6 support. And what do you see? Total crap across the board. Here's some of the issues I've seen. Routers that have no IPv6 support (common for ISP provided routers.) Routers that have NO FIREWALL for IPv6. Routers that crash every 3 minutes after assigning an address. Routers that don't support the exact combination of network details to setup IPv6 on your network (there are multiple ways to deploy IPv6.)
What about if you want to use features like UPnP with IPv6 (something that would probably be useful for some software given that IPv6 is supposed to give you public addresses but firewall it on the router.) What I've found is there's really just one UPnP library that every router uses even though it sucks. miniupnpd. This is a library that can barely manage to handle different types of addresses. It's really a mixed bag whether an IPv6 firmware will have miniupnpd enabled and if its built for IPv6 (and if anyone bothered to test it.) The odds go down dramatically.
If you manage to get a router with IPv6 at home working alongside other useful Internet standards made for it (since 2010) color me impressed. You probably buy a lottery ticket at that point. Because if testing IPv6 deployments for the past 2 years has taught me anything: its that no one really cares about this shit. Present day, present time. You still hear people telling others to turn IPv6 off for some vague reason ('security', 'bad', 'problems.') These people don't really have a clue. It's all just a massive cope because they tried to get it to work and failed. And after the shit I've said I can't say I blame them. But I also want to note that their conclusions are BS.
Even the mini router I bought for 15 bucks five years ago does IPv6 addressing just fine. Just announcing a prefix (or two, local network stuff over ULAs and all that) is enough to make SLAAC do its thing. Never had any problem with DHCPv6 PD for automatic subnetting either.
I haven't looked into UPnP on IPv6 much, but the ones that did UPnP all seem to do IPv6 fine after 2015 or so. I usually turn it off because I don't want random crap manage my firewall unauthenticated (and many router manufacturers have had vulnerable implementations that would accept UPnP packets from the internet so screw that).
Brands that I've successfully used IPv6 with without any hassle include TP-Link, D-Link (don't buy from them), AVM, Mikrotik, and Netgear.
The most annoying part I find about routers is actually that they don't let you disable ALGs anymore it seems. Every few years Samy Kamkar writes up a way to bypass most IPv4 firewalls by abusing the hackery we've accumulated around NAT and the easiest fix ("let FTP/SIP/H363/PPTP be broken on IPv4") doesn't seem to come with routers anymore.
It took a while, but router manufacturers seem to have realised that the world is moving towards "CGNAT or IPv6" and not having usable IPv6 breaks networks in those cases.
The most broken IPv6 deployments I've seen were from people who tried to turn it off though weird hacks like firewall rules which subsequently got IPv6 from their ISP. Had they actually disabled IPv6 they would've just been stuck OK IPv4 like regular, but their weird hacks made half the TCP connections need to time out before they could access the internet.
Added as an appendix in 2011:
* https://upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1....
Now you gave me an excellent reason to make my home network v6-only.
My conspiracy theories about why v6 hasn't taken off are: people make money off v4 leases, and email spam blacklists become pretty useless in v6. But again, very naive here.
Heck, I work on embedded, and having a dual-stack system is just a PITA to deal with. If v6 would have been fully retro-compatible this wouldn't have been something to think about, but you can't drop v4 and there's no future in sight where v6 will be the only choice (we'll have dual-stack for a looooong time), so we just push the problem up the chain.
There are plenty of systems being developed _now_ which are still v4 only as a result.
Why bother, when I could just do TLS SNI reverse proxying via nginx?
* Some services don't use TLS, or even TCP.
* A reverse proxy is yet another intermediary in the chain.
* Plain IPv6 routing is simpler than reverse proxying, and I already need a network layer anyway.
There are downsides:
* some software doesn't support IPv6. I haven't experienced this on the Linux servers I run.
* in a dual stack network, now you have two networks! I use NAT64/PREF64 like https://labs.ripe.net/author/ondrej_caletka_1/deploying-ipv6... to have most clients only be on IPv6. They get IPv4 connectivity over IPv6 via NAT64.
* If I'm in another country then I often don't have IPv6 connectivity. In this case I use any VPN that offers IPv6 (and have one available via my home, via Wireguard).
* Learning IPv6 takes time, but not much. It's one-off. It's not more complex than IPv4, but it is different. If anything, it's simpler. (SLAAC rather than DHCPv4; IP reachability rather than NAT/port forwarding).
You could make a reasonable argument that it has too many ways of being backwards compatible, even.
Of course, my home network's IPv4 space uses the same 10 block as the subnets I worked with most of my time there.
Where pressure is still lacking is in "small" enterprise type case (like most businesses, regional health systems, local government facilities, and so on) where the difference isn't really that much vs networks with 100 million or more clients riding). Only when corps get to the size of e.g. Microsoft do they really start seeing similar value at the moment. Everyone else can scrape by just getting that small bit of IPv4 and forgetting about it for now.