Hacker News Reader

Comment by neom | Hacker News Reader

IPv6 is something we get asked about a lot, and it's on the way. Unfortunately it's not something we can just "turn on" - We have to make sure it's build out properly and also fits in with some of our other roadmap items that our community will love in the coming year.

So yeah, love the feedback and actively working every day to bring any suck to zero.

View on HN

IPv6 is a must for my use case. Currently, I have to use an IPv6 tunnel which is OK, but definitely less than ideal.

Can you disclose what kind of allocation each instance or each customer will get? Hopefully, you guys will be much less stingy with them than Linode, and give each customer a /48 to allocate freely between the individual nodes.

I am a very happy customer currently and am looking to use DO for my next project which involves heavy use of your API and lots of concurrent instances. As a customer I can testify that your product is a fantastic value for the price. Keep up the good work!

Totally get the ipv6 tunnel being a pain.

I think our allowances will have to be sorted out a little down the road but /48 is easy to acquire (unlike ipv4 where we have to wait till we're at 80% capacity before we're allocated more IPs). ipv6 gets a little sticky when you start talking about the internet of things, there are a lot of new concepts introduced that we have to take into account when we're managing what is closing in on a million of the worlds public hosts. I don't see ANY reason why we won't allow a least one /48 per droplet. Part of our slowness on things like CDN, load balancing, failover etc are because we want the system to be really well build out to accommodate both ipv6 and the future of internet protocol addressing. While I can't speak for other providers, for us it's something we take seriously, but need to test all our systems together to make sure cloud 2.0 if you will works really we..

As I'm sure you know, we've scaled massively in the last 8 months and unfortunately the "lets just pop in a feature" becomes a lot more complex as the complexity and stability needs of our customers increase.

What I can say with 100% confidence is that there is a group of really amazing engineers working on this stuff and it's all in a roadmap, we just have to make sure everything is simple, stable and safe before we roll out.

I hope you can appreciate your measure in this matter. :)

That's great to hear. I actually envision a situation where the allocation of the /48 would be per-customer or per-customer-per-datacenter. That way I could do things like firewall off hosts easily. For example I could tell my DB hosts to only allow incoming connections from my /48 and nothing else. Having no common prefix for all my droplets would make this harder where I would have to list all allowed hosts.

I definitely appreciate that DO is doing things the right way and that this isn't going to be a rollout of "well, this host on this router supports IPv6, but that load balancer upstream does not".

This sounds like the way to do it - being able to get a /48 for every data centre and then being able to use addresses and subnets out of that, or a separate /64 for each droplet.

I wonder if we could eventually get virtual routers between subnets without having to use droplets (like the virtual networking that VMWare/OpenStack are doing)

You mentioned Linode's IPv6 allocation, but they gave me a /48 routed to my small $20/mo server by filing a ticket, no questions asked.

I did not realize this was a possibility. In either case, I am no longer a Linode user mostly because of the relative cost difference with DO.

So when will the bullshit about custom kernels be cut out?

I have a stupid question: Why do people need IPv6? What do they use it for?

Next generation P2P apps is one great addition. Though we've yet to see it in the wild, the theory is that you don't need to port forward any more (just make allowances in the Firewall). Will come with it's own set of security issues. Someone here probably knows a lot more about it that I do.

To build the next generation of the Internet of course! :)

On a practical level, IPv6 is easier to administer since in a lot of ways it's more straightforward. For home use it's great since every device gets its own globally unique address (I can `ssh home.example.com` from any IPv6 enabled host).

Firewall rules become simpler if you have a common prefix vs lots of individual IPv4 addresses.

There are already lots of users who have IPv6 enabled: http://www.google.com/ipv6/statistics.html: TL;DR: over 2% of Google's traffic is over IPv6. Running dual stack servers lets you reach more customers.

I guess to an extent asking what people use IPv6 for is similar to asking what people use IPv4 for. You don't normally use IP. You use applications that run on top of TCP/IP or UDP/IP. Having a public IP address makes writing and managing those applications easier.

Edit: Also IPv6 addresses are cheap. An additional IPv4 address will run you about $1/month with a lot of providers. A billion IPv6 addresses is one billionth of the minimum allocation you will get for free. So in the long run, the cheapest DO droplet might cost as little as $4 instead of $5 :).

Since you seem to know what's going on, my question is: how can I seamlessly use ipv6? And how can I do that with Windows and Linux?

What a good looking question!

The idea is that you want a dual stack environment where IPv4 and IPv6 coexist. Mac, Linux, and Windows all support this and do the right thing: if IPv6 is available on the client and server they try that first, if not they use IPv4.

Since you are asking I am assuming your ISP does not provide native IPv6. If you have a public IPv4 address that does not change more frequently than every several hours, the best solution is to set up a 6in4 tunnel (ignore any docs that refer to 6to4, different beast). Sign up for an account at TunnelBroker.net and create a regular /64 tunnel. What this will do is that your router will encapsulate your IPv6 packets inside IPv4 packets and send them to a Tunnel Broker router. That router will then strip the IPv4 header and send the packet off as a pure IPv6 packet. In most cases latency is measured in milliseconds and you might actually see lower latency since IPv6 servers and routes are currently less utilized. YouTube is certainly faster.

After you have your account and tunnel set up, it is best to set up your tunnel end point on your home router that supports TunnelBroker.net. Anything that runs OpenWRT does this, as do some commercial router firmware. OpenWRT is great for many reasons so you should use that anyways, this is just a bonus.

After your router is able to reach IPv6 hosts (google.com), you would set up and enable a service called radvd (router advertisement daemon) on your router. This will automatically give all the hosts on your LAN instant IPv6 connectivity.

Lastly, you would set up an HTTP ping to Tunnel Broker to let it know if your IPv4 address changes. Once again, OpenWRT does this out of the box.

I am writing this from my phone, so I cannot provide much specific advice, but email me at igor <at< igorpartola.com and I will answer any specific questions you may have.

Wow, this is really useful information, thank you!

Since I wrote my original comment, I went out and started doing more research into this. At this point, I have my main home server[0] now accessible via IPv6 using freenet6. However, I did apply for SixXS, so I can hopefully put my entire house on it (my router's an Asus WL-520GU, which currently has DD-WRT on it, but is compatible with OpenWRT). Though I'll be looking more into the Hurricane Electric service.

I'm really liking this, since now I can access my devices directly, without having to try to negotiate firewalls and weird subnets!

Thanks very much for the advice!

No problem! Very happy to convince someone new to try IPv6. Please feel free to get in touch if you run into trouble.

Re: DD-WRT, last I checked it did not come with an IPv6 firewall, ip6tables. I ended up recompiling it using what seemed to be Voodoo magic (match the arch, release, kernel version, etc.) OpenWRT comes with the firewall on by default and a web GUI to control it.

As for the different tunnel brokers (of which TunnelBroker.net is one), I should not assume you are in the US. Freenet6 is great. So is SixXS, though watch out to not lose credits and have your tunnel cut off. TunnelBroker.net is run by Hurricane Electric, has been rock solid for me and their support (for this free product) is fantastic.

Also, check out dns.he.net to set up reverse DNS, or just use them as your DNS provider. This service is also very nice and free.

Even as an avid IPv6 fan (at home, tunneled, and awaiting my new modem to take part in Comcast Business trials), I have to question this:

"Running dual stack servers lets you reach more customers."

Is there a single ISP in the world that is IPv6 -ONLY- to the end device?

You got me. Currently, I am not aware of any. However, from what I understand IPv6 first will become a thing pretty soon especially in the regions where RIR's are getting close to exhausting IPv4 addresses.

There aren't any real ISPs with no IPv4, but there are a few that support IPv6-only "on the wire", where IPv4 is either translated to IPv6 using NAT64 (e.g. T-Mobile US) or tunneled over IPv6 using Dual Stack Lite (e.g. Unitymedia in Germany).

The main advantage to running v6 on your servers (aside from being a good citizen) is that it allows you to distinguish individual customers for abuse detection, who'd otherwise be NAT'd to the same IPv4 address by their ISP. And ISP NATs are going to become more prevalent, because there just aren't enough IPv4 addresses to go around.

What IPv6 provides is an escape hatch; a path that avoids the NATs and tunnels.

I came across an article [1] that mentions load balancing as an upcoming feature. Is there a chance you could elaborate on the feature spec or provide a rough ETA?

[1] http://www.enterprisenetworkingplanet.com/datacenter/digital...

Hey Stanley, see above. :)

Reply on news.ycombinator.com