Hacker News Reader

Comment by inigyou | Hacker News Reader

It's literally impossible to avoid long addresses being long or short addresses running out. One of those is a worse problem.

View on HN

The length isn’t the only thing that makes the ergonomics suck. The lack of backwards compatibility sucks. The “you don’t have to use NAT anymore” is great theoretically, but it renders a lot of casual network maintainers mental model of network security obsolete without a clear and simple alternative. The shorthand is not intuitive (though it’s not CIDR-level counterintuitive). Really, there’s way too much about working in IPv6 that’s not intuitive with even very solid IPv4 network knowledge.

So yeah, having to relearn a bunch of basic network knowledge that worked just fine for decades is a PITA, and I’m 100% positive a design process that focused more on the people that need to configure networks could have yielded a much friendlier, and therefore a much easier to adopt standard.

you fling around words like "network maintainers" quite casually, dont you? :)

its really extremely simple, just dont NAT, is that really so hard? just because you dont NAT, doesnt mean you have to let the traffic pass through, that is also an extremely simple concept, no?

Fling it around?

There are a shitload of people who maintain networks, like home or small business networks, that aren’t network administrators. Most of those people are not prepared to have their Chinese WiFi cameras, myriad smart appliances, and heck, even home computers easily individually accessible from the internet. It’s an extremely simple concept, no?

NAT is good. It's CGNAT that's bad, because that's NAT imposed on subscribers, and not NAT that they control.

NAT is bad. CGNAT is worse.

> NAT is good.

It isn't. Routing is good though.

Lack of NAT doesn't imply lack of firewall, though.

And home routers have firewalls that block inbound connections by default -- including with no-NAT IPv6.

But lots of people want to do things like open up a few ports for a gaming console. You can obviously do it, but the inside network/outside network/poke a hole/simple ip addresses mental model makes it harder for people to just get frustrated and disable it. Of course absolutely nothing is impossible or more difficult from a technical networking perspective using IPv6. People want to learn as little as humanly possible to solve their problems. If the default easiest path is ‘disable the firewall, and suddenly you can use the LAN pvp mode with your 6th grade classmate’ then you better fucking believe that’s exactly what they’re going to do. The “well it’s not really that complicated” perspective is the main reason adoption of user-facing FOSS is lightyears behind commercial options.

how is it a different mental model? instead of opening the port in NAT via forward feature, you open the port in the firewall. it is in fact significantly simpler while overall being the same actions you take when you want to "forward"

You’re right. That’s why everybody uses it and nobody is confused by it.

Everyone whose ISP offers it uses it, yes.

Do they manage their ISP’s network? Don’t be pedantic.

ridiculous, the vast vast majority of people just plug in what the ISP provides them, and thats it.

perhaps you could explain how its such a new paradigm and mental model that it simply confuses people? because I dont buy it, its without exaggerating a smaller difference in so far as this goes, than when people get a new microwave oven, and substantially less difference than when people switch phone brands.

I have ipv6 here in Europe. The router firewall configuration works basically the same as IPv4 port forwarding. You can add a firewall exception as easily as you can add a port forward. You can also turn the firewall off, globally or per device.

nobody suggests they should be, the ONLY difference is that the routers will block inbound connections by default, and you open your port in the firewall section instead of the shitty router instead of the nat/port forwarding

Actually I think most people really do want that stuff accessible from the internet. Currently that requires a central server and a subscription, but imagine if it didn't. Imagine if you could log into your washing machine from anywhere instead of only when you're at home, and it would keep working even if LG went bankrupt.

Instead of forwarding a port to a specific machine on the NAT page, you allow incoming traffic on that port to that machine on the firewall page. You'll want to add a stable IP to the host (in addition to the SLAAC rotating privacy IP if it already has one. One interface can have multiple addresses). That's pretty much it, except now you can allow the same port to multiple machines, where previously you could only forward to one (helpful for gaming, voip, etc. Wherever p2p works well). Firewall should already default deny incoming traffic just like ipv4.

That sounds easy, but I think you just inadvertently demonstrated the quagmire that many seem to perceive.

Suppose I've got a machine on the LAN and I want to open it up to the world on port 1025 with IPv6.

This can't happen with SLAAC? It has to be a new address? Does the ISP pick the prefix for that address? And one can't centrally-manage that address (because people keep saying that DHCPv6 isn't worth stuffing around with)? What happens when the router fails over to a backup ISP? How does dynamic DNS fit in with all of this?

Those questions don't really exist with IPv4, wherein: One can just set up a static DHCP assignment, forward port 1025, and [optionally] set up dynamic DNS -- and this all happens within the confines of a single home router.

If it's MAC based SLAAC, it'll be stable, so you could use it. Otherwise you add a stable address. You could use DHCP if you want. If you're using a backup ISP with dynamic DNS, your failover should be the same as ipv4. You can already have ips from both prefixes on the interface. You're also way past clueless home user stage if you have that setup at all, so I can't imagine ipv6 is the stumbling block.

Things would be nicer if NAT66 were used by default for home users though so the question of prefixes would disappear, and it'd perhaps match the "more advanced" home user ipv4 mental model. You'd just use e.g. fd00::2 as your server address.

But v6 _is_ backwards compatible though? It's got dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how is this not backwards compatible? You could make a reasonable argument that it has too many backwards compatibility methods, even.

> The “you don’t have to use NAT anymore” is great theoretically, but it renders a lot of casual network maintainers mental model of network security obsolete without a clear and simple alternative

If your mental model of security relies on NAT then your mental model was wrong, and obsoleting it was the right thing to do.

If v6 made you realize this, then it seems it's more intuitive than v4+NAT was for you.

Reply on news.ycombinator.com