Hacker News Reader

Comment by dsl | Hacker News Reader

Hamachi hands out IPs to clients that don't belong to them. Notably they tried to hijack all of 5.0.0.0/8 and 25.0.0.0/8

View on HN

They switch to IPv6 a while ago. That's one.

Two - the idea to use 5.x/8 came through me and it dates back to a dot-bubble era managed VPN company I worked for, called eTunnels. These addresses are used for routing inside of virtual networks, which is a separate routing domain, disconnected from the Internet. While this does create a routing ambiguity at the VPN client that wants to talk to the Internet address of 5.x.x.x, it doesn't mean these addresses "leak" to the Internet and somehow disrupt general network flow to/from 5.x.x.x.

Here is a forum thread from last month where an employee confirms the switch to 25.0.0.0/8 (which is not IPv6, FYI). http://community.logmein.com/t5/Hamachi/New-25-0-0-0-8-Netwo...

You might want to have a look at 100.64.0.0/10, the IANA allocation for carrier NAT implementations. Explicitly allocated to be non-unique and used within networks of private networks.

I'm not involved with Hamachi anymore, so I took what they told me privately about IPv6 at face value. I know the work on it started back in '09 and there were some v6-related bugfixes referenced in the release notes.

WRT 100.64.x.x. - back in '07 we pitched IANA an idea to have a dedicated class A network for VPN service providers. This was based on the assumption that while many people might use VPN networking, very few would be on two VPNs at the same time (which is neither too practical nor advisable). So having this space would've meant not needing to compete and resolve conflicts with 1918 addressing and it would also provide single direct-routed space within a VPN that natively supported OS broadcast traffic. Latter is a very big deal in Windows world, because of how a large chunk of Windows Networking works, and it's generally a useful thing to have for proper LAN emulation. IANA just waved us off.

(edit) Followed a link at the post you linked to and there's an official news release that says -

  We’ve added IPv6 support to Hamachi a while back, and you can 
  simply turn off the use of the 5/8 space, but we realize that 
  IPv4 is still very important to most of you.

It sounds like the IPv6 support is there, but the client defaults to IPv4 addressing. This has probably to do with user-facing issues of using IPv6 (like customizing passthru rules in firewalling software and such) rather than with an inherent inability of Hamachi to run outside of v4 space. It is capable of pure tap tunneling after all.

But aren't those addresses only routed within Hamachi itself?

Its the same as if I worked for Verizon and routed all the phone numbers for San Francisco to my desk instead. Sure it works fine for everyone using AT&T, Sprint, etc. but it breaks the spirit of how the phone network should work (a central registry hands out blocks of phone numbers just like the Internet) and is in general a douchebag thing to do.

No, that's not the same.

Having a 5.x.x.x address assigned to your machine doesn't make all Internet traffic for that address go to your box. You either don't understand the concept of routing domains or you just feel like trashing Hamachi in general.

At no point did I make that claim. Please re-read with a critical eye.

Hamachi is effectively null routing legitimate users of the space within their network.

Reply on news.ycombinator.com