Hacker News Reader

Comment by eqvinox | Hacker News Reader

I guess my first question is, why is this built on IPv4 rather than IPv6...

Yeah, great question. This came up at the beginning of design. A lot of our customers specifically needed IPv4 whitelisting. For example, MongoDB Atlas (a very popular database vendor) only supports IPv4. https://www.mongodb.com/community/forums/t/does-mongodb-atla...

The architecture of vprox is pretty generic though and could support IPv6 as well.

I guess that works until other customers need access to IPv6-only resources… (e.g.: we've stopped rolling IPv4 to any of our CI. No IPv6, no build artifacts…)

In a perfect world I'd also be asking whether you considered NAT64, but unfortunately I'm well aware that's a giant world of pain to get to work on Linux (involving either out-of-tree Jool, or full-on VPP)

Yeah, you hit the nail on the head. We considered NAT64 as well and looked at some implementations including eBPF-based ones like Cilium.

Glad to know that IPv6-only is working well for you. "In a perfect world…" :)

It is what it is :/ … I do periodically ask these questions to track how v4-vs-v6 things are developing, and they're moving, albeit at a snail's pace.

(FTR, it works for us because our CI is relatively self-contained. And we have local git mirrors… f***ing github…)

At my company (Fortune 100), we've been selling a lot of our public v4 space to implement... RFC1918 space. We've re-IP'd over 50,000 systems so far to private space. We just implemented NAT for the first time ever. I was surprised to see how far behind some companies are.

Progress is coming from the weirdest corners… US DoD and NATO require IPv6 feature-parity to IPv4 nowadays, no full IPv6 = no bidding on tenders…

(I would already have expected this to be quite effective in forcing IPv6, but tbh I'm still surprised just how effective.)

Reply on news.ycombinator.com