this post was submitted on 08 Jun 2024
485 points (97.5% liked)

Memes

45660 readers
1285 users here now

Rules:

  1. Be civil and nice.
  2. Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.

founded 5 years ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] henfredemars@infosec.pub 76 points 5 months ago* (last edited 5 months ago) (8 children)

All consumer and enterprise equipment made in the last 10+ years natively support IPv6.

I object to this statement. You can buy name brand routers today that don’t implement it properly. Sure, they route packets, but they have broken stateless auto configuration or don’t respect DHCPv6 options correctly, and the situation is made worse because you don’t know how your ISP implements IPv6 until you try it.

God help you if you need a firewall where you can open ports on v6. Three years ago I bought one that doesn’t even properly firewall IPv6.

I tested a top-of-the-line Netgear router to find that it doesn’t support opening ports and once again doesn’t correctly support forwarded IP DHCPv6, which even if that works correctly, your Android clients can’t use it 🫠 Decades later there’s no consensus on how it should function on every device. This is a severe problem when you are a standard.

The state of IPv6 on consumer hardware is absolute garbage. You have to guess how your ISP implements it if at all, and even then you’re at the mercy of your limited implementation. If you’re lucky it just works with your ISP router. If you’re not, it’s a PITA.

EDITs: spell corrections and clarification.

[–] Blaster_M@lemmy.world 17 points 5 months ago (1 children)

You shouldn't be forwarding anything - lan devices are directly accessible from the internet with ipv6. The router's job now is to firewall inbound ipv6 packets. You should be able to simply open the inbound port for that device in particular.

[–] henfredemars@infosec.pub 16 points 5 months ago* (last edited 5 months ago) (1 children)

Right, that’s how it should work. Unfortunately that’s not how it actually works most of the time in consumer.

Many devices don’t provide an option in the UI to open an inbound port on IPv6. For example, the latest and most expensive Linksys gaming router blocks all inbound connections and there are no options for different behavior. It doesn’t support opening any ports for v6.

The most recent TP link device I tested for my dad doesn’t even have a firewall. If you know the global IP, you can connect to any port you want.

[–] Blaster_M@lemmy.world 6 points 5 months ago (1 children)

And that's why I abandoned cheap consumer routers many years ago... closest devices to implement ipv6 port management firewalling even half good was/is the ASUS devices. I got fed up and went pfsense and/or unifi one day and never looked back.

UDM handles ipv6 real good, and pfsense can even get /64 subs from an ATT router for all its lan interfaces.

load more comments (1 replies)
[–] CosmicTurtle0@lemmy.dbzer0.com 13 points 5 months ago (4 children)

Omg...I thought I was doing it wrong. I was trying to map ports on my router and it just wouldn't do it properly.

Networking is not my strong suit so I assumed I was being an idiot and reverted back to IPv4.

[–] Blaster_M@lemmy.world 5 points 5 months ago

IPv6 does not do NAT - you allow the ports for a device instead in the firewall.

load more comments (3 replies)
[–] Melody@lemmy.one 7 points 5 months ago* (last edited 5 months ago) (5 children)

This is why I use PFSense and Hurricane Electric as a v6 tunnelbroker. I have working functional IPv6 with SLAAC and DHCPv6 and full Routing Advertisements on my LAN running side-by-side so that no matter which the device implements how poorly; it gets an IPv6 address and it works and is protected by the firewall.

load more comments (5 replies)
[–] riodoro1@lemmy.world 6 points 5 months ago

This. Ipv6 on all house routers are for scrolling facebook only. Want to do anything more? Switch back to ipv4

[–] AVincentInSpace@pawb.social 3 points 5 months ago

Comcast has finally gotten around to giving hosts inside the firewall publicly routable IPv6 addresses, but port forwarding (which, by the way, can only be done through Xfinity's website or mobile app which then connect to and configure the router through the ISP interface -- if you go to the port forward configuration in the router's webui, all you'll see is a message that it's now "easier than ever" to configure port forwards) can only happen on IPv4. Want to open a hole in the IPv6 firewall? Well that's just too fucken bad.

load more comments (3 replies)
[–] davel@lemmy.ml 58 points 5 months ago* (last edited 5 months ago) (1 children)

As Snowden, Assange, and other whistleblowers have shown, in The Land of the Free™ the carriers are in bed with the government. I doubt it’s all that different in other Five/Nine/Fourteen Eyes countries.

[–] Kusimulkku@lemm.ee 5 points 5 months ago* (last edited 5 months ago)

I'd imagine it's more or less the same all over, as long as the government can put pressure (or directly owns) the ISP.

[–] Railison@aussie.zone 48 points 5 months ago* (last edited 5 months ago) (1 children)

Wasn’t the point of IPv6 to remove the need for CGNAT?

[–] jelloeater85@lemmy.world 24 points 5 months ago

Yes, that was the idea...

[–] Blaster_M@lemmy.world 32 points 5 months ago* (last edited 5 months ago) (2 children)

It's amazing how many internet providers still won't enable IPv6, even though it is hugely beneficial to their own networks (more efficient routing = less router overhead = more bandwidth and less power usage = SAVE MONEY).

IPv6 was pernanently turned on for the Internet in 2011. That's THIRTEEN YEARS AGO.

All consumer and enterprise equipment made in the last 10+ years natively support IPv6. There is no excuse anymore. You can enable dual stack and setup / get your v6 block and go for it. The v6 routing tables are much simpler than the v4 routing tables, as it only has to point to the prefix network for any address, and prefixes are handed out so the ISP gets a contigious prefix block. The routers sort the rest out.

IPv6 has the 2000::/3 range for internet traffic. That's 2^125 ip addresses possible. We're not running out of those even if we have an internet on every planet in the solar system.

IPv6 Prefix Delegation works like DHCP but for IPv6. It's not indecipherable magic runes.

Router asks for a v6 range -> ISP router gives the range -> Router then either further subdivides into subnets, or uses DHCPv6 to give out v6 addresses. Simple.

But of course, nobody wants to do it the simple way... AT&T and your strange subnetting spec-breaking routers.

Odd that Comcast/Xfinity, the company that somehow manages to have even worse service than AT&T, implements IPv6 near perfectly. They give prefixes when your router asks. Their own gateways give prefixes to routers behind when requested. It works. If the arguably worst internet company can deploy IPv6 this well, any company can.

In addition, every device also has its own link-local ipv6 (fe80::/16) that is not routed, but can be called directly and it normally doesn't change, as it is based partly on the network card's MAC address. Need to connect your printer by ip address? Use the link local v6 and stop having to play the DHCP or static IP charade.

[–] r00ty@kbin.life 11 points 5 months ago (2 children)

I've seen a few isps here in the UK doing some weird pointless stuff with ipv6. Like dynamic prefixes. Why? What's the point?

But you can get good ones. I've had the same /48 prefix for 10 years now.

[–] sep@lemmy.world 7 points 5 months ago (2 children)

I am 50/50 between incompetence. Or so they can keep on charging extra for a static ip.

load more comments (2 replies)
[–] henfredemars@infosec.pub 3 points 5 months ago

Oh my God disgusting. My ISP uses dynamic prefixes also, which reflects a lack of understanding of the most basic IPv6 fundamentals.

[–] Melody@lemmy.one 7 points 5 months ago

I get a free /64 and /48 directly from Hurricane Electric using their TunnelBroker and use PFSense to deploy that v6 locally on my LAN. Everything in the house has a v6 and is protected by the necessary firewalling too.

[–] DontRedditMyLemmy@lemmy.world 25 points 5 months ago

Now the ISPs can charge us if we want a public IP, so really this is a win for big ISP... not sure why you guys aren't appreciating that! /s

[–] smileyhead@discuss.tchncs.de 22 points 5 months ago

Privacy fans, choose wisely:

  • have CGNAT on carrier side and add little tiny more work to track people
  • have public IP, making it easier to selfhost, to build P2P networks, to use anonymizing network like I2P, to host Tor nodes, to reach out to friend without central approved big tech cloud, that you can still hide with your own NAT or by using VPN
[–] umbrella@lemmy.ml 21 points 5 months ago (3 children)
[–] qaz@lemmy.world 8 points 5 months ago (1 children)

I meant "ISP's use CGNAT over IPv6" as ISP's use CGNAT instead of IPv6 to solve IPv4 address limit issues, not as using IPv6 through CGNAT, although some do use IPv6 through CGNAT for backwards compatibility with IPv4 only devices.

load more comments (1 replies)
load more comments (2 replies)
[–] aldalire@lemmy.dbzer0.com 18 points 5 months ago (4 children)
[–] qaz@lemmy.world 41 points 5 months ago* (last edited 5 months ago) (1 children)

There is IPv4, it's an internet address that points to a specific computer, or at least it's supposed to. IPv4 supports up to 4294967296 addresses, which might seem like a lot until you realize how many devices are connected to the internet. Almost the entire IPv4 range is full, and ISPs have resorted to letting 1 IP point to multiple computers also known as NAT. It's what your router does, and why your laptop and phone all connect to the internet using your routers' IP address. Carrier Grade NAT takes it one step further and allows hundreds or more home networks to connect from a single IP address.

CGNAT kind of sucks because you can't run servers behind them because it doesn't know which of the hundreds of computer traffic has to go to. IPv6 would solve this entire mess, but ISP's won't invest in it because they don't want to spend the money and just delay the inevitable until they have to.

True ELI5: We ran out of signs for house numbers and instead of getting new ones we started giving everyone in a street the same house number

[–] aldalire@lemmy.dbzer0.com 10 points 5 months ago (3 children)

Thank you. So in a way if the carriers upgrade their infrastructure there would be a decrease in privacy because then it’s a one-to-one correspondence between IP address and customer, but then the customer would have the ability to host servers? The one scenario where the industry dragging their heels on upgrading is actually good for the consumer (in some respects) lol

Adding commas to that number: 4,294,967,296 addresses. More humans that IP address seems like a huge miscalculation in the internet infrastructure

[–] harry315@feddit.de 8 points 5 months ago (1 children)

Who could've thought in 1981 that more than a few thosand universities would ever like to connect to the then 250 machines big ARPANET. With 4 billion addresses, there was plenty of headroom at the time.

In 50 years, when the last ISP finally switches to IPv6, we'll be wondering how short sighted we were as now every pencil has an IP address in the interplanetary compu-global-hyper-meganet.

[–] confusedbytheBasics@lemmy.world 10 points 5 months ago

We planned for that. We should be fine at least until we are an interstellar species. We could assign an IPV6 address to EVERY ATOM ON THE SURFACE OF THE EARTH, and still have enough addresses left to do another 100+ earths. It isn’t remotely likely that we’ll run out of IPV6 addresses at any time in the future.

[–] sep@lemmy.world 6 points 5 months ago (1 children)

Goverments (depending on juristiction) have laws requiering isp's to keep track of cgnat port combos. So not only is there no privacy from ipv4 cgnat. Now the isp must also spend a lot of money on the nat state tracking database.
If you need that kind of privacy, use a vpn and the tor onion network.

[–] aldalire@lemmy.dbzer0.com 3 points 5 months ago

Ah of course i was gonna say even with a cgnat they would have some way of identifying the traffic.

[–] frezik@midwest.social 5 points 5 months ago

It's a bit more complicated than that. Governments still spy on an IPv4 address, but because that address is shared, it's spying on everyone behind it. At least with IPv6, it'd be targeted.

[–] mako@discuss.tchncs.de 10 points 5 months ago

Usually the NAT is at home in the router and every customer has their own IPv4 address. NAT at the ISP means several customers share an IPv4 address. If the authorities are now investigating the activities of an IPv4 address, it is difficult to say which customer it was because multiple of them shared the IP address.

[–] ChillPill@lemmy.world 5 points 5 months ago

I know very little about ipv6, but CGNAT is Carrier Grade Network Address Translation.

NAT (Network Address Translation) is how your home router takes your one public IP address and is able to simultaneously allow your phone, your PlayStation, and your smart fridge use the internet.

CGNAT is basically the same thing expect on a much larger scale and controlled by you ISP.

[–] Sonotsugipaa@lemmy.dbzer0.com 4 points 5 months ago (1 children)

IP addresses ran out, IPv6 adds more addresses than we may need, ISPs decide to take away the user's ability to host servers (more or less (more less than more)) rather than upgrading the infrastructure

[–] uid0gid0@lemmy.world 4 points 5 months ago

My take is they had to upgrade the infrastructure for CGNAT, why not just implement IPv6.

[–] Meowie_Gamer@lemmy.world 15 points 5 months ago (1 children)

I still dont have ipv6, WHY NOT?! What’s my ISP doing?!

load more comments (1 replies)
[–] frezik@midwest.social 13 points 5 months ago (2 children)

I tried an IPv6 AWS Lightsail instance recently. It had a private IPv4 address, but it's not behind NAT and won't route outside the network.

Which would be fine if all the software packages you need can access things over IPv6 on their servers. One that doesn't is WordPress, because of course it doesn't. That means no plugins or updates except by manual downloads.

But hey, who would ever want to run WordPress on a cheap Lightsail instance?

load more comments (2 replies)
[–] pingveno@lemmy.ml 10 points 5 months ago (1 children)

My university is still mostly on IPv4 for our infrastructure. We got in early on the IPv4 address gold rush, so we got a full /16 block. Not quite MIT's 18.0.0.0/8 block, but enough so there's little pressure to move. It can be a little embarrassing, feeling like an institution that should be breaking ground is instead trailing behind. At the same time, our IT department is chronically understaffed, so I can understand not doing the switch. It's not as simple as just flipping a switch, there are many ramifications of IPv6 that aren't immediately obvious.

[–] r00ty@kbin.life 8 points 5 months ago (1 children)

There's literally nothing stopping a moderately skilled IT team from integrating ipv6. You can run any site easily using both. The exceptions are few and even those aren't that hard to deal with.

Source: been running dual ipv4/ipv6 Web servers for over 10 years (maybe 15 would need to check) . Likewise had ipv6 dual stack at home for a similar amount of time, initially using tunnels and then native.

Almost every server provider will give you ipv6 for free. There's really no excuse these days not to run your services on both protocols now.

[–] jrgd@lemm.ee 5 points 5 months ago (1 children)

The worst gotchas and limitations I have seen building my own self-host stack with ipv6 in mind has been individual support by bespoke projects more so system infrastructure. As soon as you get into containerized environments, things can get difficult. Podman has been a pain point with networking and ipv6, though newer versions have become more manageable. The most problems I have seen is dealing with various OCI containers and their subpar implementations of ipv6 support.

You'd think with how long ipv6 has been around, we'd see better adoption from container maintainers, but I suppose the existence of ipv6 in a world originally built on ipv4 is a similar issue of adoption likewise to Linux and Windows as a workstation. Ultimately, if self-rolling everything in your network stack down to the servers, ipv6 is easy to integrate. The more one offloads in the setup to preconfigured and/or specialized tools, the more I have seen ipv6 support fall to the wayside, at least in terms of software.

Not to mention hardware support and networking capabilities provided by an ISP. My current residential ISP only provides ipv4 behind cgnat to the consumer. To even test my services on ipv6, I need to run a VPN connection tunneling ipv6 traffic to an endpoint beyond my ISP.

[–] r00ty@kbin.life 3 points 5 months ago

You can get non VPN tunnels. I used both Hurricane electric (https://tunnelbroker.net) and sixxs (https://www.sixxs.net). I believe sixxs stopped offering services in 2017 though.

I'm lucky that I have a choice of multiple ISPs all offering service on gigabit symmetric fibre. I've managed to keep my old setup of a /29 IPv4 allocation and /48 IPv6 allocation. But before IPv6 was available, I used tunnels at the point of the router with no problem. As such, the internal network doesn't need to know there's a tunnel and gets native IPv6.

[–] Sam_Bass@lemmy.ml 9 points 5 months ago

Pardon if i dont cry about it

[–] aldalire@lemmy.dbzer0.com 6 points 5 months ago

Oh boi i didn’t know ipv6 was this spicy

load more comments
view more: next ›