20 ms·

I don't use IPv6 because it solves a problem that I don't have and it provides functionality that I don't want. And also because I don't understand it very well

by ajnin 9mo ago

I don't use IPv6 because it solves a problem that I don't have and it provides functionality that I don't want. And also because I don't understand it very well. My points : - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. - Every host routable from anywhere on the Internet? No thanks. Maybe I've been irreparably corrupted by being behind NAT for too long but I like the idea of a gateway between my well kept garden and the jungle and my network topology being hidden. - Stateless auto configuration. What ? No, no, I want my ducks neatly in a row, not wandering about. Again maybe my brain is rotten from years of DHCP usage but yes, I want stateful configuration and I want all devices on my network to automatically use my internal DNS server thank you very much. - It's hard to remember IPv6 addresses. The prospect of reconfiguring all my router and firewall rules looks rather painful. - My ISP gives me a /64, what am I supposed to do with that anyways? - What happens if my ISP decides to change my prefix ? How do my routing rules need to change? I have no idea. In short, so far, ignorance is bliss.

MindSpunk 9mo ago
> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. What happens when multiple devices in your /8 want to listen on port 80 and 443 on the public address? Only one of them can. Now you're running a proxy. > - Every host routable from anywhere on the Internet? No thanks. Maybe I've been irreparably corrupted by being behind NAT for too long but I like the idea of a gateway between my well kept garden and the jungle and my network topology being hidden. It's called a firewall. You want a firewall. IPv6 also has a firewall. NAT is not a firewall. NAT is usually configured as part of your firewall, but is not a firewall. > - Stateless auto configuration. What ? No, no, I want my ducks neatly in a row, not wandering about. Again maybe my brain is rotten from years of DHCP usage but yes, I want stateful configuration and I want all devices on my network to automatically use my internal DNS server thank you very much. DHCPv6 > - My ISP gives me a /64, what am I supposed to do with that anyways? What are you supposed to do with a /8? Do you have several million computers? > - What happens if my ISP decides to change my prefix ? How do my routing rules need to change? I have no idea. What happens if your ISP changes your IPv4 address?
- everdrive 9mo ago
  >What happens if your ISP changes your IPv4 address? Absolutely nothing, because the private IPs behind the NAT are agnostic of the public IP.
  - lazide 9mo ago
    Actually, all your open connections break (including outbound ones, inbound ones via UPnP which is commonly on by default, etc.)
    - everdrive 9mo ago
      No, my connections time out for a brief period of seconds or minutes and then everything is fine for the next two years (until my ISP cycles my IP out again) and I don't actually need to do anything to resolve this. I wouldn't even know when my IPv4 address changed because the impact is so minor. uPnP may be on by default but that doesn't mean most people are actually using it for anything.
      - lazide 9mo ago
        And what do you think when ipv6 changes addresses? Notably, even less.
        everdrive 9mo ago
        When my IPv6 changes my prefix changes and then my internal devices have new IP addresses and I don't know what those IPs are.
        lazide 9mo ago
        That is what link local addresses are for - which you can access your devices on just fine, and don't change. And bonus points - aren't externally routable either. They are also much shorter. [https://en.wikipedia.org/wiki/Link-local_address https://en.wikipedia.org/wiki/Link-local_address] One really nice thing about IPv6 is you can (and do) have many addresses, all of which work. for example, you can add a manual fe80::5 address to one machine, and fe80::9 on another - and use those to access those machines on the local network. And not have to worry about that being externally addressable, or having conflicts, etc. And they won't change when your external addresses change either (unless there is some weird software bug in your OS or something). Though you probably want to use a unique local address range instead [https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address] as they're more equivalent to the 10.0.0.0/16 type behavior you're expecting.
1vuio0pswjnm7 9mo ago
Will be amazed if the parent comment stays at #1 I share some of the same thoughts IPv6 should be optional, not mandatory I disable IPv6 whenever and wherever I can Gateway is always IPv4 only No "smartphone" gets direct connection to the internet IPv6 can be useful. For example, cjdns I like having the option to use it, but it should not be mandatory
- NedF 9mo ago
  [dead]
heavyset_go 9mo ago
> - It's hard to remember IPv6 addresses. The prospect of reconfiguring all my router and firewall rules looks rather painful. fd00::1 is pretty easy to remember. It's your network, give yourself a sane and short prefix.
- Hobadee 9mo ago
  That's a gripe I have with IPv6. There are too damn many special networks and addresses! With IPv4 I can easily remember 10.0.0.0/8 and 192.168.0.0/16, but I can't remember the other one off the top of my head. (172.16.0.0/12 I think?). Multicast is 224.x.x.x/x IIRC, but definitely need to look that one up when I need it. IPv6 has SO many special networks. Network. Public. Multicast. Link local. (Which isn't like an IPv4 link local, but apparently it can actually be on the LAN? IDK - I was just learning about it earlier today.) And every interface seems to have about 5 different addresses of each type.
  - ozim 9mo ago
    Why do you need to remember that when you can look it up? Important part is knowing there are special networks.
  - 9dev 9mo ago
    For almost all cases, there is absolutely zero need to ever remember addresses, or dealing with them directly. Give your devices proper names, and your router’s DNS will handle resolution automatically. There is no point in your network having sequential addresses, so you don’t need DHCP; routers advertise configuration, clients know where to look for it. IPv6 is amazing, if you let it handle connectivity without trying to micromanage it.
    - Ekaros 9mo ago
      I think this is the big hangup. Wanting to micromanage each and every address. Instead of letting it just manage itself. Reminds me on some level of the pet vs cattle of containers and servers. Mental switch is needed. And many are resistant towards this.
ssl-3 9mo ago
> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. Remember, mate, with a /64 you can host your own ISP. You can finally have real Internet access! (Oh, wait -- it's not actually your /64 and your local ISP[s] wouldn't route it to you if it were, so you really can't.) > - Every host routable from anywhere on the Internet? No thanks. Maybe I've been irreparably corrupted by being behind NAT for too long but I like the idea of a gateway between my well kept garden and the jungle and my network topology being hidden. Oh, come on. Just look around. Almost everyone here agrees: NAT isn't a security function. Furthermore: NAT is literally the devil and has been for all of the decades you've been using it. Just think of all the stuff it breaks! Like FTP! (Remember how broken FTP was with NAT back in 1995? Or, *shudder*, h.323?) Besides, with a /64, you can even have every computer on your network changing addresses for every IP connection! Doesn't that kind of obscurity sound nice? (Except... No, that doesn't sound nice at all. That just sounds bizarre and weird -- like dancing about architecture, or maybe some analogy about babies and bathwater.) > - Stateless auto configuration. What ? No, no, I want my ducks neatly in a row, not wandering about. Again maybe my brain is rotten from years of DHCP usage but yes, I want stateful configuration and I want all devices on my network to automatically use my internal DNS server thank you very much. Have you ever considered the concept of giving each machine two different IPv6 addresses? One for you to control, and one for your ISP to be in charge of. That'd be quite lovely, wouldn't it? (Except: Now you have two problems.) > - It's hard to remember IPv6 addresses. The prospect of reconfiguring all my router and firewall rules looks rather painful. Yeah, well. Uh. Have you tried looking into using ULA addresses like fe80::? (It's awesome! It's got all the hypothetical network convergence problems that an RFC 1918 10/8 has with which to bite you in the mysterious future, except it's also hexadecimal! And unlike the grossly prevalent DHCP system that your 10/8 LAN uses today, nobody can agree on how to centrally assign these addresses to devices!) > - What happens if my ISP decides to change my prefix ? How do my routing rules need to change? I have no idea. Look, man. Let me just move these goalposts for you. The real problem here is that people, like you, need to adopt IPv6. So adopt it already. Your router's implicitly always-on stateful firewall will just take care of it, just like it has almost certainly both incidentally and irrevocably done for your entire history of using NAT with IPv4. And the advantage to you is... you have that big, beautiful /64 to play with however you want (except: it isn't yours, so you don't), free of the chains of that ugly hack of NAT. (See? That wasn't so hard! The goalposts are heavy, but they can still be moved easily-enough. These new chains are better than the old chains, anyway. The chains of IPv4 NAT were getting a little bit old and dusty, and learning which /64 your ISP will decide to number your LAN with this week is like opening a surprise box! Unless your ISP provides a /56 or something instead! Don't you like surprises? Hey, did I mention ULA? It's always important to mention ULA at least thrice because maybe you want at least two sets of LAN addresses for everything! (All snark aside: ULA+DHCP+local NAT doesn't sound so bad at all. fd00::3 instead of 10.0.0.3? Gateway at fd00::1 instead of 10.0.0.1? Singular static LAN addresses if we feel like it -- without them being world-known, and regardless of which residential ISP we're using at the moment? People can get used to that. And it would at least present a familiar set of problems that would respond to a familiar set of solutions -- plus, with bonus nachos consisting of a whole dynamic /64 to play with if we ever feel like using that for some reason. But AFAICT nobody does it that way because NAT is in and of itself some kind of evil thing even when it is under our direct control, so we're just stuffed. Thus, instead of local NAT, we get some combination of prefix bingo, global per-device identifiers or bizarro randomness, and/or overlayed logical networks with local ULA+public Internet addresses for the same friggin' doorbell. And that shit is simply weird. As a response to the weirdness, we get the resultant and inevitable pushback that all weird shit deserves.))
lmm 9mo ago
> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. That's great until you need to connect to a work/client VPN that decided to also use 10.0.0.0/8. > - Every host routable from anywhere on the Internet? No thanks. Maybe I've been irreparably corrupted by being behind NAT for too long but I like the idea of a gateway between my well kept garden and the jungle and my network topology being hidden. Even on IPv4, having normal addresses for all your computers makes life so much nicer. Perhaps-trivial example, but one that matters to me: if two people live in one house and a third person lives in a different house, can they all play a network game together? IPv4 sucks at this.
- silverwind 9mo ago
  > That's great until you need to connect to a work/client VPN that decided to also use 10.0.0.0/8. There's numerous other reserved IPv4 blocks that can be used: https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4 https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4. Would definitely not recommend to use 10/8 for private networks.
  - nijave 9mo ago
    Landed on 172.16/22 for this reason however it's not uncommon how an enterprise to use all 3 private classes. One place I worked used 192.168 for management, 10 for servers, and 172 for wifi Using 2 different classes has been a pretty common setup for wifi and wireless in my experience
globular-toast 9mo ago
> In short, so far, ignorance is bliss. This isn't ignorance. This is an example of a little knowledge is a dangerous thing. Ignorance is the internet just works the way it's meant to work for everyone. That's only practically possible with IPv6 these days. Your limited use case and privileged circumstances (ie. you even get a publicly routable v4 address) do not mean anything for someone who just wants things to work.
bandrami 9mo ago
> Maybe I've been irreparably corrupted by being behind NAT for too long Bangs head against desk NAT per se does not prevent an outside host from connecting to a host on your local network.
- allarm 9mo ago
  Every single time. But that actually gives a simple answer for why IPv6 is still not commonly used. People can’t wrap their heads around the (simple) fact that NAT is orthogonal to firewalls - and IPv6 has more difficult concepts to offer.
  - otabdeveloper4 9mo ago
    If you'd bothered to read the Original Post, you'd know that the author already answered that.
    - allarm 9mo ago
      If you'd bothered to understand the context of my comment you wouldn't have left your comment and we wouldn't have had this obnoxious discussion.
- captainmuon 9mo ago
  I guess technically you are right, in that NAT doesn't prevent connections, it enables connections. But in the situation where you would have a NAT, behind a residential router, an outside host cannot connect to an arbitrary host on my internal network. On a publicly routed PC, I can call `listen` and an outside host can connect to me. On a PC behind a NAT - if I don't set up port forwarding - I can call `listen` and nobody from outside can connect to me. So one could say, going from publicy routed to behind a NAT means that only allowed incoming connections are possible. Or am I missing something and you can really, from the outside, open a connection to a PC on a residential network which is behind a simple NAT (TCP server listening on that PC)?
  - Dagger2 9mo ago
pelorat 9mo ago
IPv6 also makes it unfeasible to scan the whole address space, unlike IPv4 which is regularly scanned.
- otabdeveloper4 9mo ago
  ASN addresses are public information.
  - Dagger2 9mo ago
    An ASN with a /32 allocation (the smallest for ISPs) is four billion /64s. It takes dozens of yottabytes of traffic to exhaustively scan one single /64. The entire v4 space takes 0.00000001 yottabytes, or about 110 GB/port in more understandable units. There's a ton of things you can do to cut down on the scan space for v6, but it's still far huger than v4 can be.
otabdeveloper4 9mo ago
> cue 500 replies of people telling you to eat your vegetables and wear the IPv6 hair shirt Gee thanks, network experts, for solving a problem I don't have and making me pay for it!
bdavbdav 9mo ago
Other points aside, I didn’t think ISPs were meant to issue space as small as a 64.
ksec 9mo ago
Thank You. You summarise it really well. Kind of surprised this is top comment given HN ( in terms comments )tends to be very pro IPV6. It's time for IPv5, I know its been taken so may be IPv7.
belorn 9mo ago
Practically every single device or program that is connected in that ipv4 network will have a built in tunnel into the garden, with nat traversal being standard practice for everything. Your fridge, car, door lock, light fixture, all the applications on the phone, everything can and likely is a whole into the garden where someone can get full access. There are quite a few companies who has lost millions because they assumed that the garden was safe from threats within.
benjiro 9mo ago
> It's hard to remember IPv6 addresses. Never understood why they decided to include letters instead of keeping it numeric. Hell, going from 199.120.121.122 to 199.120.121.122.123 will have expanded IPv4 by 254 times. It took us, what? 40 years to exhaust Ipv4... Just increasing it by 254 alone is insane large amount. Belgium used this solution for their number plates They used to have a 6 letters/digit mix. Like abc-001 type of number plate. It started to run out, so they simply created a expansion, so new number plates started with 1-abc-001 in 2010, ... and in 2021 did 2-abc-def ( they did not run out of 1, they seem to simply use the first number to indicate the decade more and more). At that rate, Belgium will run out of numbers in they year 11990 ... Ipv4 is easy to work with, easy to remember, write down, read ... Ipv6 is always a struggle. And yea, the idea that every device may need its own IP from your provider, is just insane. I have so much more issues configuring things with IPv6, vs just basic IPv4+NATS. Its simply, its easy... And maybe some people do not have this issue, but our provider gives DYNAMIC IPv6, so the pre-fix keeps altering! What makes configuring things on a NAS even more hell. O and that :: range modifier is so fun. And the whole pre-fix and post-fix structure... I hate it. Its complex for my little brain as i do not work daily with it, and whenever i need to deal with Ipv6, i need to relearn the quirks of it every time because of issues like the whole pre-fix/post-fix, dynamic pre-fix etc. Where as IPv4 ... so easy.
- throw0101a 9mo ago
  > Hell, going from 199.120.121.122 to 199.120.121.122.123 will have expanded IPv4 by 254 times. It took us, what? 40 years to exhaust Ipv4... Just increasing it by 254 alone is insane large amount. In it's original design, SIPP, the design that was chosen for IPng had 'only' 64-bits, but it was decided that it would be impossible do another transition, and going to 128 would be better future-proofing: * https://datatracker.ietf.org/doc/html/rfc1752#section-9 https://datatracker.ietf.org/doc/html/rfc1752#section-9 So 199.120.121.122 could have grown to 199.120.121.122.152.183.166.197, which I do not think would have made a practical difference to those who complain about "hard to remember" addresses. And it took 40 years to exhaust IPv4 because NAT was invented (RFC 1631), and now we're stuck with that kludge and have to have all sorts of workaround for it (ICE/TURN/STUN). IMHO it has also has contributed to the centralization of the Internet because doing P2P is just a pain in the ass.
blacklion 9mo ago
> - My ISP gives me a /64, what am I supposed to do with that anyways? For me, it is main problem. /64 is too small: SLAAC needs /64 per collision domain, and I have more than one (wired network, my WiFi, guest WiFi, control plane for UniFI APs), and it is painful to distribute /64 among them. I'm using HE tunnel which provides /48 to client and it is easy to configure, as intended. There is recommendation (SHOULD, not MUST in RFC lingo) for ISPs to provide at least /56 to clients, but most domestic ISPs ignore this recommendation. > - What happens if my ISP decides to change my prefix ? And it is another problem: tooling. There is no standard way to reconfigure router with dynamic prefix(es). Yes, it is possible to write scripts for it, but it will be fragile. No Linux distribution or FreeBSD is ready to have dynamically allocated prefixes. It is not a real problem with IPv4 because real life practice to dynamically allocate one address and then configuration changes are trivial, and if you are delegated /24, it is typically static delegation.
throw0101a 9mo ago
> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. 10/8 is great until two organizations with 10.0.0.0/24 in their OSPF or IS-IS topologies are brought together via a merger/acquisition. Then you can end up with NAT with-in an organization itself. (Internal split-horizon DNS here we come.)
jech 9mo ago
> I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. Your ISP has paid 40€ for your IPv4 address. That's a cost they're most probably passing on to you. > Every host routable from anywhere on the Internet? No thanks. Every time you start a videoconference, there is a couple of seconds' pause while the peers perform NAT traversal.
m463 9mo ago
exactly. ipv6 just gives you two configurations to maintain, two firewalls to write rules for and cross-leaks that are hard to understand. I make my internal network ipv4 only, I have a lovable static config, one firewall to maintain. I also use vlans to separate into "can get out", "can only get out through a whitelist proxy", and "can't get out ever". and I am very happy. I just don't understand how people can just plug every device they own into a promiscuous ipv4 and ipv6 router and contribute to profiling, television snooping, vacuum cleaner house mapping, data leaks, botnets and more...
- preisschild 9mo ago
  I do the opposite. IPv6-only in my LAN and Kubernetes Cluster and NAT46/NAT64 for external ipv4-only egress/ingress. Makes it much easier than both dualstack or IPv4 alone.
nijave 9mo ago
>I don't use IPv6 because it solves a problem that I don't have At least here in the U.S., my observation has been it's usually a bit faster and has more efficient routes than IPv4. I assume part of that is using newer equipment and architecture than practical for IPv4 and ability to have more granular routes. I regularly see 1-2ms improvement to first hop outside my ISP network (10ms vs 12ms) Remembering addresses is a solved problem with DNS.

by ajnin 9mo ago

MindSpunk 9mo ago

> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. What happens when multiple devices in your /8 want to listen on port 80 and 443 on the public address? Only one of them can. Now you're running a proxy. > - Every host routable from anywhere on the Internet? No thanks. Maybe I've been irreparably corrupted by being behind NAT for too long but I like the idea of a gateway between my well kept garden and the jungle and my network topology being hidden. It's called a firewall. You want a firewall. IPv6 also has a firewall. NAT is not a firewall. NAT is usually configured as part of your firewall, but is not a firewall. > - Stateless auto configuration. What ? No, no, I want my ducks neatly in a row, not wandering about. Again maybe my brain is rotten from years of DHCP usage but yes, I want stateful configuration and I want all devices on my network to automatically use my internal DNS server thank you very much. DHCPv6 > - My ISP gives me a /64, what am I supposed to do with that anyways? What are you supposed to do with a /8? Do you have several million computers? > - What happens if my ISP decides to change my prefix ? How do my routing rules need to change? I have no idea. What happens if your ISP changes your IPv4 address?

everdrive 9mo ago
>What happens if your ISP changes your IPv4 address? Absolutely nothing, because the private IPs behind the NAT are agnostic of the public IP.
- lazide 9mo ago
  Actually, all your open connections break (including outbound ones, inbound ones via UPnP which is commonly on by default, etc.)
  - everdrive 9mo ago
    No, my connections time out for a brief period of seconds or minutes and then everything is fine for the next two years (until my ISP cycles my IP out again) and I don't actually need to do anything to resolve this. I wouldn't even know when my IPv4 address changed because the impact is so minor. uPnP may be on by default but that doesn't mean most people are actually using it for anything.
    - lazide 9mo ago
      And what do you think when ipv6 changes addresses? Notably, even less.
      - everdrive 9mo ago
        When my IPv6 changes my prefix changes and then my internal devices have new IP addresses and I don't know what those IPs are.
        lazide 9mo ago
        That is what link local addresses are for - which you can access your devices on just fine, and don't change. And bonus points - aren't externally routable either. They are also much shorter. [https://en.wikipedia.org/wiki/Link-local_address https://en.wikipedia.org/wiki/Link-local_address] One really nice thing about IPv6 is you can (and do) have many addresses, all of which work. for example, you can add a manual fe80::5 address to one machine, and fe80::9 on another - and use those to access those machines on the local network. And not have to worry about that being externally addressable, or having conflicts, etc. And they won't change when your external addresses change either (unless there is some weird software bug in your OS or something). Though you probably want to use a unique local address range instead [https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address] as they're more equivalent to the 10.0.0.0/16 type behavior you're expecting.

1vuio0pswjnm7 9mo ago

Will be amazed if the parent comment stays at #1 I share some of the same thoughts IPv6 should be optional, not mandatory I disable IPv6 whenever and wherever I can Gateway is always IPv4 only No "smartphone" gets direct connection to the internet IPv6 can be useful. For example, cjdns I like having the option to use it, but it should not be mandatory

NedF 9mo ago
[dead]

heavyset_go 9mo ago

> - It's hard to remember IPv6 addresses. The prospect of reconfiguring all my router and firewall rules looks rather painful. fd00::1 is pretty easy to remember. It's your network, give yourself a sane and short prefix.

Hobadee 9mo ago
That's a gripe I have with IPv6. There are too damn many special networks and addresses! With IPv4 I can easily remember 10.0.0.0/8 and 192.168.0.0/16, but I can't remember the other one off the top of my head. (172.16.0.0/12 I think?). Multicast is 224.x.x.x/x IIRC, but definitely need to look that one up when I need it. IPv6 has SO many special networks. Network. Public. Multicast. Link local. (Which isn't like an IPv4 link local, but apparently it can actually be on the LAN? IDK - I was just learning about it earlier today.) And every interface seems to have about 5 different addresses of each type.
- ozim 9mo ago
  Why do you need to remember that when you can look it up? Important part is knowing there are special networks.
- 9dev 9mo ago
  For almost all cases, there is absolutely zero need to ever remember addresses, or dealing with them directly. Give your devices proper names, and your router’s DNS will handle resolution automatically. There is no point in your network having sequential addresses, so you don’t need DHCP; routers advertise configuration, clients know where to look for it. IPv6 is amazing, if you let it handle connectivity without trying to micromanage it.
  - Ekaros 9mo ago
    I think this is the big hangup. Wanting to micromanage each and every address. Instead of letting it just manage itself. Reminds me on some level of the pet vs cattle of containers and servers. Mental switch is needed. And many are resistant towards this.

ssl-3 9mo ago

> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. Remember, mate, with a /64 you can host your own ISP. You can finally have real Internet access! (Oh, wait -- it's not actually your /64 and your local ISP[s] wouldn't route it to you if it were, so you really can't.) > - Every host routable from anywhere on the Internet? No thanks. Maybe I've been irreparably corrupted by being behind NAT for too long but I like the idea of a gateway between my well kept garden and the jungle and my network topology being hidden. Oh, come on. Just look around. Almost everyone here agrees: NAT isn't a security function. Furthermore: NAT is literally the devil and has been for all of the decades you've been using it. Just think of all the stuff it breaks! Like FTP! (Remember how broken FTP was with NAT back in 1995? Or, *shudder*, h.323?) Besides, with a /64, you can even have every computer on your network changing addresses for every IP connection! Doesn't that kind of obscurity sound nice? (Except... No, that doesn't sound nice at all. That just sounds bizarre and weird -- like dancing about architecture, or maybe some analogy about babies and bathwater.) > - Stateless auto configuration. What ? No, no, I want my ducks neatly in a row, not wandering about. Again maybe my brain is rotten from years of DHCP usage but yes, I want stateful configuration and I want all devices on my network to automatically use my internal DNS server thank you very much. Have you ever considered the concept of giving each machine two different IPv6 addresses? One for you to control, and one for your ISP to be in charge of. That'd be quite lovely, wouldn't it? (Except: Now you have two problems.) > - It's hard to remember IPv6 addresses. The prospect of reconfiguring all my router and firewall rules looks rather painful. Yeah, well. Uh. Have you tried looking into using ULA addresses like fe80::? (It's awesome! It's got all the hypothetical network convergence problems that an RFC 1918 10/8 has with which to bite you in the mysterious future, except it's also hexadecimal! And unlike the grossly prevalent DHCP system that your 10/8 LAN uses today, nobody can agree on how to centrally assign these addresses to devices!) > - What happens if my ISP decides to change my prefix ? How do my routing rules need to change? I have no idea. Look, man. Let me just move these goalposts for you. The real problem here is that people, like you, need to adopt IPv6. So adopt it already. Your router's implicitly always-on stateful firewall will just take care of it, just like it has almost certainly both incidentally and irrevocably done for your entire history of using NAT with IPv4. And the advantage to you is... you have that big, beautiful /64 to play with however you want (except: it isn't yours, so you don't), free of the chains of that ugly hack of NAT. (See? That wasn't so hard! The goalposts are heavy, but they can still be moved easily-enough. These new chains are better than the old chains, anyway. The chains of IPv4 NAT were getting a little bit old and dusty, and learning which /64 your ISP will decide to number your LAN with this week is like opening a surprise box! Unless your ISP provides a /56 or something instead! Don't you like surprises? Hey, did I mention ULA? It's always important to mention ULA at least thrice because maybe you want at least two sets of LAN addresses for everything! (All snark aside: ULA+DHCP+local NAT doesn't sound so bad at all. fd00::3 instead of 10.0.0.3? Gateway at fd00::1 instead of 10.0.0.1? Singular static LAN addresses if we feel like it -- without them being world-known, and regardless of which residential ISP we're using at the moment? People can get used to that. And it would at least present a familiar set of problems that would respond to a familiar set of solutions -- plus, with bonus nachos consisting of a whole dynamic /64 to play with if we ever feel like using that for some reason. But AFAICT nobody does it that way because NAT is in and of itself some kind of evil thing even when it is under our direct control, so we're just stuffed. Thus, instead of local NAT, we get some combination of prefix bingo, global per-device identifiers or bizarro randomness, and/or overlayed logical networks with local ULA+public Internet addresses for the same friggin' doorbell. And that shit is simply weird. As a response to the weirdness, we get the resultant and inevitable pushback that all weird shit deserves.))

lmm 9mo ago

> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. That's great until you need to connect to a work/client VPN that decided to also use 10.0.0.0/8. > - Every host routable from anywhere on the Internet? No thanks. Maybe I've been irreparably corrupted by being behind NAT for too long but I like the idea of a gateway between my well kept garden and the jungle and my network topology being hidden. Even on IPv4, having normal addresses for all your computers makes life so much nicer. Perhaps-trivial example, but one that matters to me: if two people live in one house and a third person lives in a different house, can they all play a network game together? IPv4 sucks at this.

silverwind 9mo ago
> That's great until you need to connect to a work/client VPN that decided to also use 10.0.0.0/8. There's numerous other reserved IPv4 blocks that can be used: https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4 https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4. Would definitely not recommend to use 10/8 for private networks.
- nijave 9mo ago
  Landed on 172.16/22 for this reason however it's not uncommon how an enterprise to use all 3 private classes. One place I worked used 192.168 for management, 10 for servers, and 172 for wifi Using 2 different classes has been a pretty common setup for wifi and wireless in my experience

globular-toast 9mo ago

> In short, so far, ignorance is bliss. This isn't ignorance. This is an example of a little knowledge is a dangerous thing. Ignorance is the internet just works the way it's meant to work for everyone. That's only practically possible with IPv6 these days. Your limited use case and privileged circumstances (ie. you even get a publicly routable v4 address) do not mean anything for someone who just wants things to work.

bandrami 9mo ago

> Maybe I've been irreparably corrupted by being behind NAT for too long Bangs head against desk NAT per se does not prevent an outside host from connecting to a host on your local network.

allarm 9mo ago
Every single time. But that actually gives a simple answer for why IPv6 is still not commonly used. People can’t wrap their heads around the (simple) fact that NAT is orthogonal to firewalls - and IPv6 has more difficult concepts to offer.
- otabdeveloper4 9mo ago
  If you'd bothered to read the Original Post, you'd know that the author already answered that.
  - allarm 9mo ago
    If you'd bothered to understand the context of my comment you wouldn't have left your comment and we wouldn't have had this obnoxious discussion.
captainmuon 9mo ago
I guess technically you are right, in that NAT doesn't prevent connections, it enables connections. But in the situation where you would have a NAT, behind a residential router, an outside host cannot connect to an arbitrary host on my internal network. On a publicly routed PC, I can call `listen` and an outside host can connect to me. On a PC behind a NAT - if I don't set up port forwarding - I can call `listen` and nobody from outside can connect to me. So one could say, going from publicy routed to behind a NAT means that only allowed incoming connections are possible. Or am I missing something and you can really, from the outside, open a connection to a PC on a residential network which is behind a simple NAT (TCP server listening on that PC)?
- Dagger2 9mo ago

pelorat 9mo ago

IPv6 also makes it unfeasible to scan the whole address space, unlike IPv4 which is regularly scanned.

otabdeveloper4 9mo ago
ASN addresses are public information.
- Dagger2 9mo ago
  An ASN with a /32 allocation (the smallest for ISPs) is four billion /64s. It takes dozens of yottabytes of traffic to exhaustively scan one single /64. The entire v4 space takes 0.00000001 yottabytes, or about 110 GB/port in more understandable units. There's a ton of things you can do to cut down on the scan space for v6, but it's still far huger than v4 can be.

otabdeveloper4 9mo ago

> cue 500 replies of people telling you to eat your vegetables and wear the IPv6 hair shirt Gee thanks, network experts, for solving a problem I don't have and making me pay for it!

bdavbdav 9mo ago

Other points aside, I didn’t think ISPs were meant to issue space as small as a 64.

ksec 9mo ago

Thank You. You summarise it really well. Kind of surprised this is top comment given HN ( in terms comments )tends to be very pro IPV6. It's time for IPv5, I know its been taken so may be IPv7.

belorn 9mo ago

Practically every single device or program that is connected in that ipv4 network will have a built in tunnel into the garden, with nat traversal being standard practice for everything. Your fridge, car, door lock, light fixture, all the applications on the phone, everything can and likely is a whole into the garden where someone can get full access. There are quite a few companies who has lost millions because they assumed that the garden was safe from threats within.

benjiro 9mo ago

> It's hard to remember IPv6 addresses. Never understood why they decided to include letters instead of keeping it numeric. Hell, going from 199.120.121.122 to 199.120.121.122.123 will have expanded IPv4 by 254 times. It took us, what? 40 years to exhaust Ipv4... Just increasing it by 254 alone is insane large amount. Belgium used this solution for their number plates They used to have a 6 letters/digit mix. Like abc-001 type of number plate. It started to run out, so they simply created a expansion, so new number plates started with 1-abc-001 in 2010, ... and in 2021 did 2-abc-def ( they did not run out of 1, they seem to simply use the first number to indicate the decade more and more). At that rate, Belgium will run out of numbers in they year 11990 ... Ipv4 is easy to work with, easy to remember, write down, read ... Ipv6 is always a struggle. And yea, the idea that every device may need its own IP from your provider, is just insane. I have so much more issues configuring things with IPv6, vs just basic IPv4+NATS. Its simply, its easy... And maybe some people do not have this issue, but our provider gives DYNAMIC IPv6, so the pre-fix keeps altering! What makes configuring things on a NAS even more hell. O and that :: range modifier is so fun. And the whole pre-fix and post-fix structure... I hate it. Its complex for my little brain as i do not work daily with it, and whenever i need to deal with Ipv6, i need to relearn the quirks of it every time because of issues like the whole pre-fix/post-fix, dynamic pre-fix etc. Where as IPv4 ... so easy.

throw0101a 9mo ago
> Hell, going from 199.120.121.122 to 199.120.121.122.123 will have expanded IPv4 by 254 times. It took us, what? 40 years to exhaust Ipv4... Just increasing it by 254 alone is insane large amount. In it's original design, SIPP, the design that was chosen for IPng had 'only' 64-bits, but it was decided that it would be impossible do another transition, and going to 128 would be better future-proofing: * https://datatracker.ietf.org/doc/html/rfc1752#section-9 https://datatracker.ietf.org/doc/html/rfc1752#section-9 So 199.120.121.122 could have grown to 199.120.121.122.152.183.166.197, which I do not think would have made a practical difference to those who complain about "hard to remember" addresses. And it took 40 years to exhaust IPv4 because NAT was invented (RFC 1631), and now we're stuck with that kludge and have to have all sorts of workaround for it (ICE/TURN/STUN). IMHO it has also has contributed to the centralization of the Internet because doing P2P is just a pain in the ass.

blacklion 9mo ago

> - My ISP gives me a /64, what am I supposed to do with that anyways? For me, it is main problem. /64 is too small: SLAAC needs /64 per collision domain, and I have more than one (wired network, my WiFi, guest WiFi, control plane for UniFI APs), and it is painful to distribute /64 among them. I'm using HE tunnel which provides /48 to client and it is easy to configure, as intended. There is recommendation (SHOULD, not MUST in RFC lingo) for ISPs to provide at least /56 to clients, but most domestic ISPs ignore this recommendation. > - What happens if my ISP decides to change my prefix ? And it is another problem: tooling. There is no standard way to reconfigure router with dynamic prefix(es). Yes, it is possible to write scripts for it, but it will be fragile. No Linux distribution or FreeBSD is ready to have dynamically allocated prefixes. It is not a real problem with IPv4 because real life practice to dynamically allocate one address and then configuration changes are trivial, and if you are delegated /24, it is typically static delegation.

throw0101a 9mo ago

> - I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. I have a roomy 10.0.0.0/8 to work with. 10/8 is great until two organizations with 10.0.0.0/24 in their OSPF or IS-IS topologies are brought together via a merger/acquisition. Then you can end up with NAT with-in an organization itself. (Internal split-horizon DNS here we come.)

jech 9mo ago

> I don't have a shortage of IPv4. Maybe my ISP or my VPN host do, I don't know. Your ISP has paid 40€ for your IPv4 address. That's a cost they're most probably passing on to you. > Every host routable from anywhere on the Internet? No thanks. Every time you start a videoconference, there is a couple of seconds' pause while the peers perform NAT traversal.

m463 9mo ago

exactly. ipv6 just gives you two configurations to maintain, two firewalls to write rules for and cross-leaks that are hard to understand. I make my internal network ipv4 only, I have a lovable static config, one firewall to maintain. I also use vlans to separate into "can get out", "can only get out through a whitelist proxy", and "can't get out ever". and I am very happy. I just don't understand how people can just plug every device they own into a promiscuous ipv4 and ipv6 router and contribute to profiling, television snooping, vacuum cleaner house mapping, data leaks, botnets and more...

preisschild 9mo ago
I do the opposite. IPv6-only in my LAN and Kubernetes Cluster and NAT46/NAT64 for external ipv4-only egress/ingress. Makes it much easier than both dualstack or IPv4 alone.

nijave 9mo ago

>I don't use IPv6 because it solves a problem that I don't have At least here in the U.S., my observation has been it's usually a bit faster and has more efficient routes than IPv4. I assume part of that is using newer equipment and architecture than practical for IPv4 and ability to have more granular routes. I regularly see 1-2ms improvement to first hop outside my ISP network (10ms vs 12ms) Remembering addresses is a solved problem with DNS.