6 ms·

> Disable IPv6: this approach relies on ARP, which IPv6 doesn't use I wish more people would care about IPv6.

zbrozek 3y ago
Seems unlikely. The world has made its peace with NAT, and IPv4 is simpler and therefore easier to understand. IPv6 isn't happening.
- slashdev 3y ago
  Or is it just happening extremely slowly? I don't think we can count IPv6 out yet.
  - zbrozek 3y ago
    I hope you're right, if only so that cgNAT goes away someday. But I'm pessimistic on that front. cgNAT is too easy and works just well enough to make adopting something better too low a priority to ever happen.
- 2bluesc 3y ago
  Roughly 40% (and rising) of Google users use IPv6. https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
  - NoGravitas 3y ago
    Is that mostly mobile phones while on cellular data, perhaps?
    - soupbowl 3y ago
      I am sure a large percent of it is. That being said in my area I only have 2 choices in ISP and both support 'dynamic' ipv6 and have for 3-4 years.
  - petepete 3y ago
    Without realising and without having had to set it up themselves.
    - tzs 3y ago
      So? The vast majority of IPv4 users also do not realize and did not have to set it up themselves.
      - petepete 3y ago
        No, but the vast majority of people who understand enough IPv4 to set up a home or small office network still don't understand IPv6.
        MayeulC 3y ago
        There's basically nothing toconfigure with IPv6. With IPv4 you need an addres, a gateway, netmasks, DNS. On v6, as long as you have a working router sending RADV packets, clients will self-configure via SLAAC. Granted, same with IPv4 and DHCP. If you don't have a router, most things should work thanks to link-local+mDNS. You can easily pop a second router on the network to bridge two LANs, no need to reconfigure the DHCP. Gateways self-advertise, etc. The point I'm trying to make is that most people trying toconfigure their IPv4 network have a functional IPv6 network the moment they put the cables in (on Linuxes es at least, not sure about other platforms).
- samdcbu 3y ago
  The increasing prices of IPv4 address blocks will probably drive adoption of IPv6. The increased complexity will be outweighed by the elimination of scarcity that IPv6 brings. If we are still using IPv4 in 2100 that would be tragic. IPv4 block pricing: https://ipv4marketgroup.com/ipv4-pricing/ https://ipv4marketgroup.com/ipv4-pricing/
slashdev 3y ago
Who cares about IPv6 on a home server that you might not even want to expose to the public internet anyway?
- ale42 3y ago
  I do (and I guess I'm not alone...) -- have IPv6 exposed machines over a HE.net tunnel. Some of the things are ONLY accessible over IPv6 (because nobody needs them over IPv4, so that's enough).
- miyuru 3y ago
  I care. My ISP is deploying IPv6 only and with NAT64 translation and some of my servers hosted elsewhere does not even have public IPv4 to SSH.
JustSomeNobody 3y ago
I wish ISPs would care. CGNAT sucks.
- heywire 3y ago
  I’m behind CGNAT for the last 1.5 years without issue. What am I missing? I actually prefer my router not being bombarded by connection attempts all day.
  - r1ch 3y ago
    Try connecting to an SSH server for more than a few hours without passing traffic and then have the server be the one to send a message. Oops! Your ISP tore down the NAT association and you have no idea the server isn't sending anything until you try to communicate with the server and get a timeout / RST. NAT breaks TCP, but at least with consumer NAT you're in control of the timeouts on your router. With CGNAT you're at the mercy of an ISP that likely optimizes for HTTP and has low timeouts that you can't control.
    - heywire 3y ago
      I actually used to have that issue years ago at work. To work around that I just enabled a keepalive (ServerAliveInterval maybe?) setting in my ssh config. I don’t connect to any ssh servers outside my house for long periods of time, so I haven’t encountered that. Thanks for the heads up, good info!
      - r1ch 3y ago
        OpenSSH does enable TCP keepalives by default so that it can detect and close dead connections, but the keepalive interval is far too high to work around bad NATs. Kind of related to the OP, I spent a decent amount of time trying to have my SSH sessions survive a sleep on Windows. With keepalive disabled, proper Wi-Fi adapter sleep behavior and long enough DHCP leases, I was able to put my PC to sleep and come back the next day and still have my sessions active on resume. Unfortunately it wasn't too practical to disable keepalive as sessions that really do crash never get cleaned up.
ale42 3y ago
I came on the comment page just to write the same.
MrFoof 3y ago
Especially when the reality is… you can almost go IPv6 only nowadays if you wanted to. I went down the rabbit hole recently, switching my network to IPv6 primary with IPv4 as the fallback. The ultimate test was disabling IPv4 for a weekend to see what, if anything, broke. I had set up DNS64, NAT64 and 464XLAT. The only weirdness is how Windows clients handle IPv6 literals in UNC paths, which is super ugly, and how some applications (like Discord calls) will actually embed IPv4 literals. Discord apparently does that for the relay servers for calls. Those things — and the rare website not supporting it - aside, I could actually be IPv6 only. I have IPv4 enabled as a fallback now, but it’s no longer primary on my network.
- ninkendo 3y ago
  464XLAT should work fine with ipv4 literals, no? At least on macOS, this will get routed to a local 192.0.0.2 interface, which does the CLAT, translates it to an ipv6 64:ff9b::<ipv4> address, and relays it to your nat64 server. The ipv4-only software doesn't know any different, and the only traffic going on your LAN is ipv6. I'm not sure if windows works the same way though... (Edit: Looks like windows can do this, but it only configures it for WWAN interfaces, go figure: https://techcommunity.microsoft.com/t5/windows-os-platform/clat-for-464xlat-for-lan-and-wireless/m-p/1303881 https://techcommunity.microsoft.com/t5/windows-os-platform/c...)
  - MrFoof 3y ago
    Discord calls on Windows was the only exception I ran into, because as you found yourself, it functionally had to fallback on DNS64. In general, some peer-to-peer situations are the likely one of the few cases where it will end up falling back onto DNS64 for resolution. This isn’t something I entirely realized myself — I’m apparently far from the only person to discover this behavior (Discord embedding IPv4 literals for its relay servers). Discord has had tickets open about it for years so far. I appreciate my son being patient on that one, but he appreciated how seriously I dug into everything. Again, we have IPv4 enabled again as fallback, but the family agreed for an IPv6-only weekend as a test, and that was the only thing (outside of one website) that failed. Everything else worked perfectly, including tons of legacy devices and software, some of which had no concept of IPv6. For 464XLAT on clients, phones are actually the leaders here. It’s worked perfectly on at least iOS (and I assume Android) for a LONG time because of its built-in automatic tunneling. Mac OS had some recent improvements in Ventura to make things easier. Windows absolutely has some quirks, the biggest being IPv6 literals in UNC paths ending up using a domain Microsoft doesn’t actually own - a potential huge future attack vector.
xyst 3y ago
Especially when NDP covers all of the features of ARP
- j16sdiz 3y ago
  > Especially when NDP covers all of the features of ARP ... and more. and lots of options with varies level of support. Too many switch and flags to fiddle with. Someone in IEEE need to publish a Current Best Pratice list and deprecate all other options.
jonathantf2 3y ago
I wish I could care about IPv6 but I've never used it, my ISP doesn't provide it and I've never once seen it deployed in a business environment

Seems unlikely. The world has made its peace with NAT, and IPv4 is simpler and therefore easier to understand. IPv6 isn't happening.

slashdev 3y ago
Or is it just happening extremely slowly? I don't think we can count IPv6 out yet.
- zbrozek 3y ago
  I hope you're right, if only so that cgNAT goes away someday. But I'm pessimistic on that front. cgNAT is too easy and works just well enough to make adopting something better too low a priority to ever happen.
2bluesc 3y ago
Roughly 40% (and rising) of Google users use IPv6. https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
- NoGravitas 3y ago
  Is that mostly mobile phones while on cellular data, perhaps?
  - soupbowl 3y ago
    I am sure a large percent of it is. That being said in my area I only have 2 choices in ISP and both support 'dynamic' ipv6 and have for 3-4 years.
- petepete 3y ago
  Without realising and without having had to set it up themselves.
  - tzs 3y ago
    So? The vast majority of IPv4 users also do not realize and did not have to set it up themselves.
    - petepete 3y ago
      No, but the vast majority of people who understand enough IPv4 to set up a home or small office network still don't understand IPv6.
      - MayeulC 3y ago
        There's basically nothing toconfigure with IPv6. With IPv4 you need an addres, a gateway, netmasks, DNS. On v6, as long as you have a working router sending RADV packets, clients will self-configure via SLAAC. Granted, same with IPv4 and DHCP. If you don't have a router, most things should work thanks to link-local+mDNS. You can easily pop a second router on the network to bridge two LANs, no need to reconfigure the DHCP. Gateways self-advertise, etc. The point I'm trying to make is that most people trying toconfigure their IPv4 network have a functional IPv6 network the moment they put the cables in (on Linuxes es at least, not sure about other platforms).
samdcbu 3y ago
The increasing prices of IPv4 address blocks will probably drive adoption of IPv6. The increased complexity will be outweighed by the elimination of scarcity that IPv6 brings. If we are still using IPv4 in 2100 that would be tragic. IPv4 block pricing: https://ipv4marketgroup.com/ipv4-pricing/ https://ipv4marketgroup.com/ipv4-pricing/

slashdev 3y ago

Who cares about IPv6 on a home server that you might not even want to expose to the public internet anyway?

ale42 3y ago
I do (and I guess I'm not alone...) -- have IPv6 exposed machines over a HE.net tunnel. Some of the things are ONLY accessible over IPv6 (because nobody needs them over IPv4, so that's enough).
miyuru 3y ago
I care. My ISP is deploying IPv6 only and with NAT64 translation and some of my servers hosted elsewhere does not even have public IPv4 to SSH.

JustSomeNobody 3y ago

I wish ISPs would care. CGNAT sucks.

heywire 3y ago
I’m behind CGNAT for the last 1.5 years without issue. What am I missing? I actually prefer my router not being bombarded by connection attempts all day.
- r1ch 3y ago
  Try connecting to an SSH server for more than a few hours without passing traffic and then have the server be the one to send a message. Oops! Your ISP tore down the NAT association and you have no idea the server isn't sending anything until you try to communicate with the server and get a timeout / RST. NAT breaks TCP, but at least with consumer NAT you're in control of the timeouts on your router. With CGNAT you're at the mercy of an ISP that likely optimizes for HTTP and has low timeouts that you can't control.
  - heywire 3y ago
    I actually used to have that issue years ago at work. To work around that I just enabled a keepalive (ServerAliveInterval maybe?) setting in my ssh config. I don’t connect to any ssh servers outside my house for long periods of time, so I haven’t encountered that. Thanks for the heads up, good info!
    - r1ch 3y ago
      OpenSSH does enable TCP keepalives by default so that it can detect and close dead connections, but the keepalive interval is far too high to work around bad NATs. Kind of related to the OP, I spent a decent amount of time trying to have my SSH sessions survive a sleep on Windows. With keepalive disabled, proper Wi-Fi adapter sleep behavior and long enough DHCP leases, I was able to put my PC to sleep and come back the next day and still have my sessions active on resume. Unfortunately it wasn't too practical to disable keepalive as sessions that really do crash never get cleaned up.

ale42 3y ago

I came on the comment page just to write the same.

MrFoof 3y ago

Especially when the reality is… you can almost go IPv6 only nowadays if you wanted to. I went down the rabbit hole recently, switching my network to IPv6 primary with IPv4 as the fallback. The ultimate test was disabling IPv4 for a weekend to see what, if anything, broke. I had set up DNS64, NAT64 and 464XLAT. The only weirdness is how Windows clients handle IPv6 literals in UNC paths, which is super ugly, and how some applications (like Discord calls) will actually embed IPv4 literals. Discord apparently does that for the relay servers for calls. Those things — and the rare website not supporting it - aside, I could actually be IPv6 only. I have IPv4 enabled as a fallback now, but it’s no longer primary on my network.

ninkendo 3y ago
464XLAT should work fine with ipv4 literals, no? At least on macOS, this will get routed to a local 192.0.0.2 interface, which does the CLAT, translates it to an ipv6 64:ff9b::<ipv4> address, and relays it to your nat64 server. The ipv4-only software doesn't know any different, and the only traffic going on your LAN is ipv6. I'm not sure if windows works the same way though... (Edit: Looks like windows can do this, but it only configures it for WWAN interfaces, go figure: https://techcommunity.microsoft.com/t5/windows-os-platform/clat-for-464xlat-for-lan-and-wireless/m-p/1303881 https://techcommunity.microsoft.com/t5/windows-os-platform/c...)
- MrFoof 3y ago
  Discord calls on Windows was the only exception I ran into, because as you found yourself, it functionally had to fallback on DNS64. In general, some peer-to-peer situations are the likely one of the few cases where it will end up falling back onto DNS64 for resolution. This isn’t something I entirely realized myself — I’m apparently far from the only person to discover this behavior (Discord embedding IPv4 literals for its relay servers). Discord has had tickets open about it for years so far. I appreciate my son being patient on that one, but he appreciated how seriously I dug into everything. Again, we have IPv4 enabled again as fallback, but the family agreed for an IPv6-only weekend as a test, and that was the only thing (outside of one website) that failed. Everything else worked perfectly, including tons of legacy devices and software, some of which had no concept of IPv6. For 464XLAT on clients, phones are actually the leaders here. It’s worked perfectly on at least iOS (and I assume Android) for a LONG time because of its built-in automatic tunneling. Mac OS had some recent improvements in Ventura to make things easier. Windows absolutely has some quirks, the biggest being IPv6 literals in UNC paths ending up using a domain Microsoft doesn’t actually own - a potential huge future attack vector.

xyst 3y ago

Especially when NDP covers all of the features of ARP

j16sdiz 3y ago
> Especially when NDP covers all of the features of ARP ... and more. and lots of options with varies level of support. Too many switch and flags to fiddle with. Someone in IEEE need to publish a Current Best Pratice list and deprecate all other options.

jonathantf2 3y ago

I wish I could care about IPv6 but I've never used it, my ISP doesn't provide it and I've never once seen it deployed in a business environment