5 ms·

I've worked in the cloud hosting industry for a decade and a half. The entire time, we were warned about the IPv4 shortage and how we needed to switch to IPv6 s

by wu_187 5y ago

I've worked in the cloud hosting industry for a decade and a half. The entire time, we were warned about the IPv4 shortage and how we needed to switch to IPv6 soon(tm). Well, things haven't changed. Everyone is dragging their feet on IPv6 adoption from hosting providers, ISPs, hardware manufacturers, and software developers. I predicted this years ago and always said that it would require a government mandate to move on from IPv4. I honestly believe we are going to ramp up NAT in the coming years before really doing away with IPv4.

xvilka 5y ago
Some countries did exactly that, China for example. Most of the infrastructure, ISP networks, even user applications here is now IPv6 or ought to be in a few years [1]. [1] https://www.theregister.com/2021/07/26/china_single_stack_ipv6_notice/ https://www.theregister.com/2021/07/26/china_single_stack_ip...
- toxik 5y ago
  To be fair, this is exactly the type of thing you’d expect China to be good at, unilateral decision making.
  - syntheticnature 5y ago
    Also, when your country's population is such that the entire IPv4 address space could only allow three addresses per resident, with that ignoring all reserved / multicast restrictions...
  - vmception 5y ago
    Benevolent leader is the best case of government, it is just improbable and of course it is too risky for any dissenter, and the successor is never as good. So people go for inclusive forms of government, which produces average case results more often.
nousermane 5y ago
NAT is ramping up on client side. Many home-internet connections are now NATted twice - in CPE, then again in CGN. On the server side, in contrast, NAT is winding down. 15 years ago, it was common to have either DMZ-style NAT, or on AWS you had to have NAT (they call it EIP). Nowadays, having a CDN or could-native load-balancer in front of your server is increasingly common. And behind those, that server just don't need a public IP (maybe only a shared outboud NAT for OS updates). That is - if you have a server at all (and not moved to lambda, S3, etc...)
- athrowaway3z 5y ago
  Yesterday i spend 2 hours trying to figure out why i couldn't ping my home router, only to find out this is probably the reason. Luckily i had created a reverse ssh tunnel on a vps before leaving.
  - innocenat 5y ago
    ISP blocking ICMP might be a more probable reason than CGNAT. At least where I live.
    - lazide 5y ago
      It’s hard to tell sometimes what is going on. I just learned for instance that the cable modem provided by Comcast switched to NAT - and my router is also doing NAT - and my business firewall also does NAT. So at least 3 layers now. If they are doing CGNAT further into the infrastructure, how would I even be able to tell at this point? I’m assuming someone would also block ICMP just so it would be less embarrassing, but who knows. Comcast does generally seem to be moving towards IPv6 at least, which is helpful.
      - innocenat 5y ago
        > If they are doing CGNAT further into the infrastructure, how would I even be able to tell at this point? Check the IP on your WAN interface of your modem? I mean, that's how I have always been checking for CGNAT.
api 5y ago
All this is because IPv6 addresses are too long. If they’d made it 48 or 64 bits we would be fully converted by now. We are dragging because people hate using it. I’ve been saying this for years. Nobody gets it because geeks don’t get ergonomics.
- mgkimsal 5y ago
  I've said it for years too. It's not JUST because they're long - years ago (and maybe even today?) there's still some hardware issues with keeping large sets of addresses for routing (I'm not an expert on this - I seem to remember reading about this years ago - larger ISPs not being able to keep all their routing rules in memory because of IPv6 address sizes - maybe I'm WAY off). But, yes, generally, you're right. It's been seen from the very beginning as "a big move". If every address A.B.C.D was addressable as 0.A.B.C.D, and we opened up another 255 * 4 billion addresses... we'd have been converted a long time ago. And we'd have been better at actually implementing 'upgrades' because they'd be already done/completed - it wouldn't be a 'monumental task(tm)'. We don't need every atom in the universe to be able to have 16 public addresses.
  - p1mrx 5y ago
    > We don't need every atom in the universe to be able to have 16 public addresses. IPv6 isn't even remotely that big. There are about 10^38 IPv6 addresses, 10^50 atoms on Earth, and 10^80 atoms in the universe.
    - robbedpeter 5y ago
      So you could probably address every grain of rice throughout all of human history, but not every atom on the planet.
  - api 5y ago
    In designing ZeroTier I put a ton of effort into creating a secure P2P layer with addresses that are only 40 bits long. This effort continues with new solutions being worked on to maintain security while allowing more openness and federation. It would have been much easier to use long addresses that are long hashes of keys. Having only 40 bits means we need two layers of defense in depth to prevent intentional collision: a work function to make the cost substantial (about USD $8M per collision on today’s public cloud) and a single source of truth for lookup that still supports federation. You could punt on all that with 128 or 256 bit addresses. Yet I did it because I was quite aware that it was very necessary for usability. I have had many people tell me they love that they can type a ZeroTier address. I would bet anyone that if the addresses had been gigantic we’d have 1/10 the adoption. Software is first and foremost for people to use. Most of the complexity in software exists for this reason.
technofiend 5y ago
I just don't get it. We already have regular hygiene programs to remediate legacy stuff - remove weak encryption methods, scan for CVEs and patch old versions, etc. IPV6 isn't any harder to use than IPV4 except for storing a larger IP address. Really, there's no excuse and that goes double for anyone using a modern stack instead of legacy.
dekhn 5y ago
I spent some time trying to upgrade my home network to primarily-IPv6 (mainly so I could more easily address internal computers from the outside). I was pretty unimpressed with the results; I expect to have to run dual stack for the foreseeable future.
JakeBrander 5y ago
Highly unlikely we will ever see the day IPv4 is not used at all. There are too many legacy systems in place, so dual stack will always be required. The value of IPv4 may drop as it related to the price people pay, however, it will play a key role for decades to come. As for the government mandate, also not possible. It would take our major ISPs over a decade to make this work, and the lobbyist would never allow it. With that said, the DOD did make an interesting decision to move 175 Million IPs recently in routing tables. You can read a short blog post here: https://brandergroup.net/2021/06/175-million-ipv4-addresses-transferred-mysteriously-by-pentagon/ https://brandergroup.net/2021/06/175-million-ipv4-addresses-...

by wu_187 5y ago

xvilka 5y ago

Some countries did exactly that, China for example. Most of the infrastructure, ISP networks, even user applications here is now IPv6 or ought to be in a few years [1]. [1] https://www.theregister.com/2021/07/26/china_single_stack_ipv6_notice/ https://www.theregister.com/2021/07/26/china_single_stack_ip...

toxik 5y ago
To be fair, this is exactly the type of thing you’d expect China to be good at, unilateral decision making.
- syntheticnature 5y ago
  Also, when your country's population is such that the entire IPv4 address space could only allow three addresses per resident, with that ignoring all reserved / multicast restrictions...
- vmception 5y ago
  Benevolent leader is the best case of government, it is just improbable and of course it is too risky for any dissenter, and the successor is never as good. So people go for inclusive forms of government, which produces average case results more often.

nousermane 5y ago

NAT is ramping up on client side. Many home-internet connections are now NATted twice - in CPE, then again in CGN. On the server side, in contrast, NAT is winding down. 15 years ago, it was common to have either DMZ-style NAT, or on AWS you had to have NAT (they call it EIP). Nowadays, having a CDN or could-native load-balancer in front of your server is increasingly common. And behind those, that server just don't need a public IP (maybe only a shared outboud NAT for OS updates). That is - if you have a server at all (and not moved to lambda, S3, etc...)

athrowaway3z 5y ago
Yesterday i spend 2 hours trying to figure out why i couldn't ping my home router, only to find out this is probably the reason. Luckily i had created a reverse ssh tunnel on a vps before leaving.
- innocenat 5y ago
  ISP blocking ICMP might be a more probable reason than CGNAT. At least where I live.
  - lazide 5y ago
    It’s hard to tell sometimes what is going on. I just learned for instance that the cable modem provided by Comcast switched to NAT - and my router is also doing NAT - and my business firewall also does NAT. So at least 3 layers now. If they are doing CGNAT further into the infrastructure, how would I even be able to tell at this point? I’m assuming someone would also block ICMP just so it would be less embarrassing, but who knows. Comcast does generally seem to be moving towards IPv6 at least, which is helpful.
    - innocenat 5y ago
      > If they are doing CGNAT further into the infrastructure, how would I even be able to tell at this point? Check the IP on your WAN interface of your modem? I mean, that's how I have always been checking for CGNAT.

api 5y ago

All this is because IPv6 addresses are too long. If they’d made it 48 or 64 bits we would be fully converted by now. We are dragging because people hate using it. I’ve been saying this for years. Nobody gets it because geeks don’t get ergonomics.

mgkimsal 5y ago
I've said it for years too. It's not JUST because they're long - years ago (and maybe even today?) there's still some hardware issues with keeping large sets of addresses for routing (I'm not an expert on this - I seem to remember reading about this years ago - larger ISPs not being able to keep all their routing rules in memory because of IPv6 address sizes - maybe I'm WAY off). But, yes, generally, you're right. It's been seen from the very beginning as "a big move". If every address A.B.C.D was addressable as 0.A.B.C.D, and we opened up another 255 * 4 billion addresses... we'd have been converted a long time ago. And we'd have been better at actually implementing 'upgrades' because they'd be already done/completed - it wouldn't be a 'monumental task(tm)'. We don't need every atom in the universe to be able to have 16 public addresses.
- p1mrx 5y ago
  > We don't need every atom in the universe to be able to have 16 public addresses. IPv6 isn't even remotely that big. There are about 10^38 IPv6 addresses, 10^50 atoms on Earth, and 10^80 atoms in the universe.
  - robbedpeter 5y ago
    So you could probably address every grain of rice throughout all of human history, but not every atom on the planet.
- api 5y ago
  In designing ZeroTier I put a ton of effort into creating a secure P2P layer with addresses that are only 40 bits long. This effort continues with new solutions being worked on to maintain security while allowing more openness and federation. It would have been much easier to use long addresses that are long hashes of keys. Having only 40 bits means we need two layers of defense in depth to prevent intentional collision: a work function to make the cost substantial (about USD $8M per collision on today’s public cloud) and a single source of truth for lookup that still supports federation. You could punt on all that with 128 or 256 bit addresses. Yet I did it because I was quite aware that it was very necessary for usability. I have had many people tell me they love that they can type a ZeroTier address. I would bet anyone that if the addresses had been gigantic we’d have 1/10 the adoption. Software is first and foremost for people to use. Most of the complexity in software exists for this reason.

technofiend 5y ago

I just don't get it. We already have regular hygiene programs to remediate legacy stuff - remove weak encryption methods, scan for CVEs and patch old versions, etc. IPV6 isn't any harder to use than IPV4 except for storing a larger IP address. Really, there's no excuse and that goes double for anyone using a modern stack instead of legacy.

dekhn 5y ago

I spent some time trying to upgrade my home network to primarily-IPv6 (mainly so I could more easily address internal computers from the outside). I was pretty unimpressed with the results; I expect to have to run dual stack for the foreseeable future.

JakeBrander 5y ago

Highly unlikely we will ever see the day IPv4 is not used at all. There are too many legacy systems in place, so dual stack will always be required. The value of IPv4 may drop as it related to the price people pay, however, it will play a key role for decades to come. As for the government mandate, also not possible. It would take our major ISPs over a decade to make this work, and the lobbyist would never allow it. With that said, the DOD did make an interesting decision to move 175 Million IPs recently in routing tables. You can read a short blog post here: https://brandergroup.net/2021/06/175-million-ipv4-addresses-transferred-mysteriously-by-pentagon/ https://brandergroup.net/2021/06/175-million-ipv4-addresses-...