9 ms·
Using the Internet without IPv4 connectivity
- nurettin 1y agoPast 10 years I just do ssh -R to the vps and use that as a socks5 proxy. Takes 2 seconds to set up.
- shmerl 1y agoIt's weird some major sites like Github still don't support IPv6. There is no excuse.
- thexa4 1y agoIf anyone else runs into this, it's very easy to set up an ssh proxy: ssh -D 8080 user@hostname Once that connection is set up, point your browser to use localhost:8080 as a socks proxy.
- daneel_w 1y agoI was just about to offer the same advice. It's a far simpler solution to a temporary problem - and equally, a permanent tool for the times when you want to proxy. Don't forget that this function needs "AllowTcpForwarding" to be enabled in your sshd_config.
- czbd 1y agoAnd I just managed to offer the same advice, then upon posting discovered I'd been beaten lol. This simple solution versus the article reminds me of McIlroy and Knuth: https://news.ycombinator.com/item?id=35915169 https://news.ycombinator.com/item?id=35915169
- appreciatorBus 1y agoThat was an amazing read, thank you!
- Biganon 1y agoI always do this when I'm using a public wifi. Don't need to pay for a VPN / trust one, I just socks forward everything to my infomaniak server.
- simonjgreen 1y agoSlightly misleading title, this is more “getting to the IPv4 internet via an IPv6 tunnel through a VPS”. Also just called 4in6. Interesting nonetheless! We find at our ISP that if we break something with IPv4 we experience a very different type of support issue to if we break IPv6. Breaking v4 results in, broadly, a pretty hard “down” state. While folks are unhappy, it is at least simple. Breaking v6 results in weird, and a partial down, which manifests for the users as partial outages, slow starts due to fall back, etc. Especially if their gateways believe there is v6 when there isn’t.
- danappelxx 1y agoMirrors my experience. IPv6 issues are frustratingly hard to triage and reproduce, lots of “works on my machine” etc.
- jeroenhd 1y agoI think it's because of all of those transition mechanisms and fallback code added over the years. IPv6 fails the same way IPv4 does, but because of the terrible bullshit ISPs do to IPv6 connections, you end up with tons of software triggering obscure timeouts and fallback mechanisms that lead to a system of almost working networking code. If the absence of IPv6 would've been treated the same way absence of IPv4 is, troubleshooting would've become a lot clearer. In fact, it probably would've been easier because ISPs can't just ignore and disable ICMP on IPv6 so you can actually get a hunch where in the network the problem is rather than seeing traffic vanish into the void.
- kalleboo 1y agoThere's certainly a long tail of IPv4, but the last time IPv4 broke at home, my wife didn't even notice since Google, Facebook, Apple/iCloud, and most CloudFlare-hosted properties all still worked over IPv6.
- paulddraper 1y agoGitHub is definitely a part of that long tail.
- JimDabell 1y agoOne thing I appreciate about Apple’s App Store rules is that they require all apps to work on IPv6-only networks. They’ve had that rule in place for many years. It’s a little surprising as a developer the first time you run into it, but I’m glad it’s there as a user.
- the_mitsuhiko 1y agoYes, but it does not require your server to have an IPv6 address.
- Gigachad 1y agoIs github accessible by v6 as long as you use the app?
- Sesse__ 1y ago”v6-only” in this context generally means ”with NAT64”, so only kind of.
- neilalexander 1y agoNo, their policy is that you have to use IPv6-capable sockets and APIs, not that the remote endpoints are accessible over IPv6.
- lostmsu 1y agoThat's, effectively, a non-policy.
- WorldMaker 1y agoIt does more than you think it does. GitHub may not support IPv6 and Apple can't force them, too, but the GitHub App on iOS is in most cases using DNS64 to get an IPv6 address to a NAT64 gateway to the GitHub IPv4 addresses, and all that just works today, in part because Apple forced apps to support "I'm always going to give you an IPv6 address, even if you know your own service isn't going to naturally return one".
- czbd 1y agoSo, those mythical IPv6-only internet users actually exist :) That's some great network engineering. I once needed something like that for the perhaps more common inverse purpose, to work on something IPv6 from within my happy IPv4-only connection. A more limited, but quicker solution given full control of a server - I set up a SOCKS5 proxy, using: ssh -D 1080 -N myserver and set my browser to use it. I think that it could also be set system-wide, but wonder if that might break the original ssh connection, holding it all up :)
- deleted 1y ago[deleted]
- hashworks 1y agoI'm in the same situation myself. It's quite frustrating, since 2 weeks I have been told that "the ticket is open and the technicians will take a look soon". Not sure if stuff like this has a low priority since IPv6 works and it's not considered a total outtage? In Germany there are laws to grant consumers compensation in those cases, but I'll see if this counts soon enough. One problem with the solution in this blog post is that various endpoints block datacenter IP ranges entirely or make you go through various captcha hoops, but no good way around that. Same for common VPN providers. Since I wanted to fix this for my entire home network I also had to do this on my router - in those cases it's quite beneficial to have a non-standard device like an Ubiquiti EdgeRouter, not sure how I would have set up all the Wireguard routing and nat rules on something like a FritzBox. The only downside is that the Router isn't powerful enough to handle a lot of connections, so I'll have to switch to IPSec which is supported by hardware offloading.
- jeroenhd 1y agoFritzbox actually has some very nice GUI steps for configuring a VPN connection, intended for Fritzbox to Fritzbox connections but any compatible VPN will do. It also allows setting up static IPv4/IPv6 routes (Home Network>Network>Network Settings>Additional settings>IPv4 routes/IPv6 routes). The biggest problem you'd probably run into is figuring out what kind of IPsec encryption configuration the router expects from the other side (Wireguard should be a lot easier but then you may run into hardware acceleration issues). If you need to get down to it, you can also make a backup of the Fritzbox config file, edit the dump to manually configure the VPN endpoint, recalculate the checksum (there are tools for that), and re-import the config file. AVM has loads of config not accessible to the user that you can tweak that way, but they make it a bit hard to access so you don't accidentally brick your router.
- Tijdreiziger 1y agoNot sure about the situation in Germany, but in the Netherlands, if you have your fixed + mobile connection with the same ISP and there’s an outage on the fixed connection, you can ask for free mobile data until the outage is fixed. Perhaps this would be an option to ask your ISP about.
- avhception 1y agoI'm operating a few IPv6-only VPNs at work, for access to internal infrastructure. The biggest problem so far is that Windows and macOS clients need a v6 DNS server. Otherwise, they won't even try to resolve v6onlyhost.vpn.example.com. Because the client may or may not be in a v6-enabled network, I have to run a DNS server inside the VPN and push that to the client, which can lead to all kinds of problems when the VPN disconnects but the Wireguard app for some reason fails to reset the DNS to the original one.
- somidscr21 1y agoI've found that using my v4 only network from my ISP and macOS can do v6 only without requiring a DNS server like you have been doing. I don't remember the details now, but after some digging a few years ago I realized macOS will happily work like that as long as it has a v6 address. I can put a ULA address on my host, and it's good to go. Granted this relies on users knowing how to do that. or depending on the VPN application to get to the v6 only network, you may be able to script adding a ULA (any kind even made up). You don't want to leave it wIth a made up ULA because that could screw things up if the user moves to a v6 capable network.
- avhception 1y agoInteresting. Do you actually use that trick in production? I'd have to find a name of an interface that I could safely mess with...
- somidscr21 1y agoYeah I've been using it daily for almost a year as have many other people at work
- avhception 1y agoIn an automated fashion using some kind of "PostUp" Script (to use the Wireguard term) or do you add the IPs manually after the VPN has been established?
- sylware 1y agoBlockers for switching off IPv4: - I am using alternative search engines, and it seems most do not provide IPv6 connectivity (when they are not wrecked by big tech gigantic network resources, you know "AI"... how to conveniently DDOS alternatives...) - github.com: zero ipv6 last time I did check. This is microsoft, do not expect anything good, actually expect the worst, for instance they broke recently noscript/basic (x)html for the issues. Can we still create a account with a noscript/basic (x)html browser and self-hosted emails with IP(v6) literals (mailbox@[ipv6:...])? - steam? games? Did not check lately. I think many CDNs/game servers or good chunks of them are still IPv4 only. - many email servers: additionnally many blocks self-hosted email servers (often due to the usage of clumsy and inappropriate block lists from spamhaus, a shaddy company from Switzerland and Andore), with a DNS (SPF) or ip literals (even if it is much stronger than SPF). - A lot of network applications do not leverage the power of IPv6: for instance for the client-server applications (web for instance), a client-server session should be using a randomly generated IPv6 address, if the ISP provides a not to big prefix. Mobile internet IPv6 ISPs seem to provide random IPv6/128 addresses (in their prefixes), but should provide a stable prefix (probably 96bits) in order to let the terminal applications choose "fixed" ipv6 addresses for direct audio/video calls (no central and online name resolution required). A new user-level OS service is required for user application IPv6 address coordination (beware of brain damaged complexity which some vendors and developer will force upon users and app devs for lock-in).
- hashworks 1y agoI can confirm that Steam requires IPv4. Also some games that require authentication to play do too.
- sylware 1y agoI think microsoft(github.com)/steam are the main dominant corpos dragging the world backward, well from an IPv6 point of view. I though steam had now IPv6 addresses. Don't forget IPv4 is favoring hardcore centralized online services.
- miyuru 1y ago> I think many CDNs/game servers or good chunks of them are still IPv4 only. I have created a DNS proxy for this problem, it will add the correct AAAA records on such domains. https://gitlab.com/miyurusankalpa/IPv6-dns-server https://gitlab.com/miyurusankalpa/IPv6-dns-server
- pumplekin 1y agoIf you ever need a quick hack to get v4 connectivity over a true v6 only setup, you can use a public DNS64+NAT64 Gateway. You can find a list at https://nat64.net/public-providers https://nat64.net/public-providers. So for most regular use, all you are doing is changing DNS servers. This is the combo. ** 1. DNS64 Synthesis of AAAA DNS records for things that don't have them to a NAT64 box. $ dig +short @2a00:1098:2c::1 AAAA github.com 2a01:4f8:c2c:123f:64:5:141a:9cd7 ** 2. NAT64. Will take this traffic thats been sent to it because of DNS64 and protocol translate + NAT it for you. $ curl --resolve github.com:443:[2a01:4f8:c2c:123f:64:5:141a:9cd7] https://github.com/ https://github.com/ <loads github>
- rfv6723 1y agoUsing Cloudflare WARP would be much faster. And you can connect directly to ipv4 addr via WARP.
- WorldMaker 1y agoWARP is a full VPN tunnel. The above poster was suggesting if someone wanted to avoid a VPN tunnel, DNS64+NAT64 is a nice "hack" that just uses DNS as the tool to reestablish IPv4 connectivity. (It's also how most mobile/cell traffic today reaches IPv4, via DNS64+NAT64 gateways.)
- rfv6723 1y agoI don't use WARP's VPN mode. I run WARP in socks proxy mode, and using ipt2socks for redirecting traffic to socks proxy port. https://github.com/zfl9/ipt2socks https://github.com/zfl9/ipt2socks
- ncruces 1y agoCame here to say this. Over Europe, https://nat64.net/ https://nat64.net/ directly, at least, is pretty cool. Only had good experiences with them.
- theandrewbailey 1y agoA few months ago, one of the Linux distros I used released a kernel update with a bug that killed IPv4 connectivity. I tried to set up some kind of VPN to my basement server to work around that, but it didn't work. I even installed WireGuard, so I wasn't too far off. I gave up and decided to use the older not-buggy kernel.
- b0a04gl 1y agoipv6 only machine still reaches ipv4 sites because dns64 upstream is just faking AAAA records ,makes it look like everything is native ipv6. this part of the trick is happening somewhere else which's not controllable. if dns64 breaks or stops doing the mapping properly then this might break
- tatersolid 1y agoIn IPv4 if your NAT or your ISPs CGNAT stops mapping everything breaks. Having a stateful mapping device inline in the network sucks for reliability in general. Native IPv6 removes the requirement.
- WorldMaker 1y agoDNS64 exists upstream in your ISP in the same way that CGNAT, does, in a central gateway someone along your rout path. If your CGNAT breaks, it's possible that was also your DNS64 fallback provider. For many ISPs, if you are using CGNAT still for IPv4, it probably means that they haven't even invested in DNS64+NAT64, because you can force devices to be IPv6-only and especially with most consumer devices entirely replace a CGNAT with DNS654+NAT64 today, and it is probably cheaper to do so.
- Toorkit 1y agoHa, I actually had to do this last year while setting up Arch Linux on my desktop. I have to use this wifi dongle, but using IWD to connect somehow only gave me an ipv6 IP. Most of the big sites worked, but trying to click links from a search engine was a 50/50 chance. Thankfully, the Arch wiki was accessible, so I got it sorted out pretty quickly.
- throw0101c 1y agoIf anyone wants to try / use IPv6, but their ISP does not provide it, Hurricane Electric (HE) has offered a tunnel service for many years now: * https://tunnelbroker.net https://tunnelbroker.net * https://ipv6.he.net https://ipv6.he.net There are scrips available to bring up a tun device on your system (or router) and route traffic over it: * https://fedoraproject.org/wiki/IPv6_tunnel_via_Hurricane_Electric https://fedoraproject.org/wiki/IPv6_tunnel_via_Hurricane_Ele... * https://brandonrozek.com/blog/obtaining-ipv6-address-hurricane-electric/ https://brandonrozek.com/blog/obtaining-ipv6-address-hurrica... * https://wiki.dd-wrt.com/wiki/index.php/IPv6_setup_Hurricane_Electric_Tunnel_Broker https://wiki.dd-wrt.com/wiki/index.php/IPv6_setup_Hurricane_... * https://forum.mikrotik.com/t/auto-update-script-for-hurricane-electric-ipv6-tunnel-broker-ipv4-endpoint-behind-nat/176217 https://forum.mikrotik.com/t/auto-update-script-for-hurrican... * https://docs.rockylinux.org/guides/network/hurricane_electric_ipv6_tunnel/ https://docs.rockylinux.org/guides/network/hurricane_electri...
- daneel_w 1y agoHappy "customer" here. I've been using their free 6in4 tunnel through OpenBSD for about five years and have had no mentionable problems. I configure mine solely with OpenBSD's network interface files, e.g. /etc/hostname.gif0: tunnel <my current IPv4> <HE's IPv4 endpoint> inet6 <my desired IPv6 address> 128 alias <HE's IPv6 gateway> !route -n add -inet6 default <HE's IPv6 gateway> I use the connectivity to reach a cluster of VPSes in AWS deliberately set-up without public IPv4 addressing, which would otherwise represent a large part of the monthly costs because of buttholes like Jeff Bezos actively monetizing IPv4 address space.
- cebert 1y ago> because of buttholes like Jeff Bezos actively monetizing IPv4 address space. IPV4 addresses are finite and rapidly being depleted. What other solution do you have to manage demand of a finite resource other than charging for it?
- daneel_w 1y agoMy stance is that common connectivity shouldn't cost an additional $3.70 a month on top of already egregious traffic costs. The price per IP today is about $30. The lifetime of the investment is infinite and upkeep is in the grand scheme of things nothing. The markup profit is insane. It's a new behavior, pure usury, seizing an opportunity to profit on a crisis. To offer some contrast (without getting into the sizes of their respective turfs) Oracle doesn't charge a dime.
- allyourdatas 1y agoWhy would I ever need IPv6 at home or in my office? Explain to me logically why I need it in my house or in my office? I do not care about using up the last internet address because that is akin to the 'think of the children' crap used to justify things on an emotional level in order to manipulate people. There's no way I'll exhaust the private address spaces and I not not see NAT as a negative. I do not want my fridge or toaster on the internet. I do not want my phone always on the internet. Nor do I carry a smrt phone or use WiFi as everything in my house is hard-wired. So it seems like all I would ever need is a 4-to-6 gateway solution of some sort . Devices in my house or office will not ever really need IPv6 or a 'dual-stack' and all that extra complexity is a waste of time... what problem is it supposed to be solving exactly?
- neilalexander 1y agoLogically? Because the world’s needs are changing and one day there will be something you want or need that will be accessible via IPv6, at which point you can either move with the times or be left behind. IPv6 global adoption is on the rise whether you see the point in it or not. The religious arguments and nitpicking no longer matter.
- kstrauser 1y agoIf you don’t understand the engineering benefits, fine, not everyone needs to be an expert. I wouldn’t proudly brag about my ignorance of the subject, though.
- ok123456 1y agoWhat exactly are the "engineering benefits" beyond a larger address space? Most companies rely on private address spaces to logically separate them, and will ultimately end up using NAT66, ending up exactly where they started, but with significantly more complexity. Every time this comes up, people come out of the woodwork to say, "Well, akually we talked about this exact thing in 1995 and decided this was the right way!" Yet, it's never convincing. If it were a simple address expansion, we would have completed this upgrade around 1998. Yet here we are, 30 years later!
- xacky 1y agoI have strong opinions about ipv4, especially since I'm forced to use an ipv4 isp. The lack of ipv6 adoption should be considered one of the great failures of tech. Who actually is responsible? Is it router manufacturers writing poor quality firmware, ipv4 advocates in leadership positions at isps, ipv4 address speculators, poor training of network engineers and tech support staff? I think we all need to have a much greater discussion with the internet at large and not just on isolated web posts and subreddits. For comparison, the internet mostly transitioned off of TLS 1.0 just fine, why can't we do the same for transitioning off ipv4? Maybe AI powered proxies for legacy code perhaps?
- crims0n 1y agoWe have a saying in the industry… IPv6 is an academic solution to an engineering problem. The reality is it’s just too damn complicated to implement and maintain at scale while also retaining compatibility with v4… which is never going to go away because other than the address shortage, there are no problems with it.
- kstrauser 1y agoWe have no such saying in the industry. IPv6 is generally easier to implement and maintain. If IPv6 were the incumbent and someone came in proposing IPv4, they’d be laughed out of the room for its ridiculousness. “You have to run a stateful server just to assign addresses? Dynamic header length? A tiny address space? And tell me again about this NAT thing, LOL.” V6 was designed by the engineers who realized what they got wrong in V4.
- tsimionescu 1y agoYou still need a stateful server to assign IPv6 addresses for most use cases, through DHCPv6. SLAAC doesn't even give you a DNS server yet. And even if it did, many ISPs assign too small address spaces for SLAAC, or your networks isn't so simple that you can just auto-negotiate some address.
- 1y ago
- benchess 1y agoThe irony of posting this on GitHub which remains shamefully without IPv6
- johnklos 1y agoWhen you want to use a public address over a tunnel, IPv6 makes things easier. Instead of setting up a tunnel to a specific IPv4, deleting your default route, adding that deleted route as the other endpoint's IPv4 route, then adding the tunnel's other end's IPv4 as a default route, you can just connect to the tunnel endpoint via IPv6, and all the IPv4 is configured just in the tunnel. I use this often because IPv6 on phone networks is invariably the same as the author's - native IPv6 plus carrier grade NAT IPv4, and most NAT implementations suck (they time out, for instance). I haven't tried with WireGuard(r) yet, but I will soon (using NetBSD's clean reimplentation). With tinc [1] though, it's a piece of cake. [1] https://www.tinc-vpn.org https://www.tinc-vpn.org
- the_real_cher 1y agoThis is interesting at all but couldn't you just pay five bucks and use Mullvad.
- chaz6 1y agoIf you only need outbound connectivity then you can use a public NAT64 gateway. You can find a list at https://nat64.xyz/ https://nat64.xyz/
- xyst 1y agoI run my own tailnet (headscale as the coordinator server). Tailscale stack is essentially built on top of wireguard. I have an exit node setup with dual stack IPv4/IPv6 addresses. So in theory if my ISPs CG-NAT failed or IPv4 was inaccessible, then configuring my device to use my exit node to reroute traffic _should_ work without having to mess with WG internals like the author in this article. I suppose there are some caveats here since I have discovered many services do tend to flag IPs originating from VPS ASNs as "spammy" (ie, pretty much any service front loaded by CloudFlare). Maybe Hetzner is better in this aspect?
- heffer 1y agoCloudFlare and friends use a multitude of factors, AS being only one of them. I am a TekSavvy customer (Canada's largest independent, i.e. not owned by one of the incumbents, ISP). Pretty clearly an eyeball network, and I get the CloudFlare captcha multiple times per day on different sites. I'm guessing it may have to do with the fact that I use custom reverse DNS entries (instead of their default schema of 127.0.0.1.dsl.teksavvy.com) for my internet facing IPv4 and IPv6 subnet.
- ornornor 1y agoAfter all these years I still don’t see a compelling reason to spend days pulling my hair out switching all my machines and home lab to ipv6. I just find port forwarding and firewall rules more intuitive vs the prospect of spending weeks troubleshooting everything, reconfiguring firewalls, renunbering my network. What am I missing?
- bigstrat2003 1y agoYou're missing that it's not that difficult. Unless you have a very complicated home network, setting up IPv6 should take you an evening tops. For my network and my ISP (Comcast), it's literally just turn on IPv6 in the router, it will pick up a prefix from the ISP and advertise it locally, then I add a firewall rule for whatever I want to be accessible from outside (which isn't much).
- nyrikki 1y agoThe problem goes way back to the IPng days. With the project being designed by a committee who would choose random hills to die on, wasn't adaptive to new needs and used sticks more than carrots. Some of those have been changed but typically after trying to implement it broke so many things that people just quit trying. Some were well intended like the 'no NAT' in the days of FTP and before reverse proxies etc. Others were intentional pain points to for adoption like when resolvers were not permitted to return A and forced to return AAAA records even when you ISP didn't support IPv6 etc... Mix in problems like the max prefix size being too large for scanning a local network space to be practical etc... and people have been trained for decades that the pain is worse than any benefits. Yes, today it isn't hard on small home networks where IPX will an IP gateway would also work fine, but things break as things get more complex. Somewhere someone probably has a copy of the mail lists where I pointed out in around ~1996 that forcing globally unique IPs was a leaky abstraction and that there was more nuances and tradeoffs that needed to be considered. It was obvious to me because I was stuck on a Altavisa firewall, but I was roasted. On the IPv4 side, user needs were addressed through CIDR, carrier grade NAT, FTP passive connections etc... I still tried to move companies to IPv6 a few more times and was bitten ever time. Almost every time it was due to arbitrary global decisions, when they should have been focused on maintaining good will and making adoption as easy as possible. The effort depended on a collition of the willing, and just changing 'must' to 'should' in key RFCs would have dramatically improved the chances of adoption. I am actually glad you have an ISP that allows you to even do this, mine still does not.
- andix 1y agoI would just hook up a router to any VPN service that is reachable via ipv6. Done.
- FredPret 1y agoIt would be so cool, and so much cheaper, if I could route all my non-critical websites to my homelab instead of cloud services. I can’t guarantee five nines but my power almost never goes out, and that’s plenty for a blog and even many online stores
- zzsshh 1y agoWhy not just add the VPS to the Tailscale network and use it as an exit node?
- psim1 1y agoThere's an IPv6 article that's been on the front page for the better part of a day and to my incredulity, the "IPv6 sucks; why don't we just add more segments to the IPv4 address" guys haven't shown up yet. Where the hell are you, dudes? Do you take the weekend off?