The IPv6 Transition

I have even implemented an IPv6-Only network. It fully works, including accessing IPv4 only websites like github.com via DNS64 and NAT64 at my router.

The only practically useful thing about my IPv6 enabled network is that I can run globally routable services on my lan, without NAT port mapping. Of course, only if the client is also IPv6.

Other than this one use case, IPv6 does nothing for me.

It doesn't work from most hotels, nor from my work lan, nor many other places because most "managed" networks are IPv4 only. It works better at Cafes because they are "unmanaged" and IPv6 is enabled by the most common ISPs, like ATT and Comcast and their provided routers.

Based on this experience, I think IPv6 is less valuable than us HN audience thinks it is. Private networks, NAT, Carrier Grade NAT are good enough, and internet really doesn't care about being completely peer-to-peer.

I think the adoption rate reflects this--it's a linear growth curve over the last 25 years. It should have been exponential.

I think cost of IPv4 reflects this--it is now below the peak, and has leveled off.

As surprising as it seems, IPv4 exhaustion has not been a serious problem. Internet marches on. IPv6 is still a solution looking for a problem, and IPv4 exhaustion wasn't one of them.

IPv4 exhaustion is a real problem, it's just not enough to motivate people much.

The truth is that people who care about port forwarding are such a small minority -- especially now that P2P file sharing has lost its hype -- that they don't make a visible dent in the rate of IPv4 exhaustion.

Ipv6 is hard. I had to learn quite a bit to make it work and not only I see no value, but it is significantly more difficult to use dire to the address length.

I think IPv6 is a missed opportunity, it was probably designed by experts that did not take into account the population that will use it (not the one users who do not care, but the layer above them)

Maybe you have a definition of "access" that is different from the usual one. That's fine, but let's be honest, it's not the usual definition.

Last I checked (a few years ago, I suppose), AWS APIs were incapable of using IPv6 internally, so a VPC still needed to dual-stack it in order to use AWS cloud features. That may have changed by now.

You could always place a small NAT-enabled router between your ISP's device and your home network.

The only problem I could see would be the lack of a (semi-)static public IPv4 address, which one could solve by renting a VPS.

Something to do with Router Advertisement intervals being too short, though I don't get why that only affects her ~5yo android phone. And IPv6 is so complex, I haven't figured out if the RA interval is something I can or should tweak, whether that comes from the PiHole or whether I'd have to flash OpenWRT on my router, or whether my ISP ultimately controls that upstream. Like, I can't figure out as easily where the boundary between me and "the internet" ends with things like the /64 prefixes and SLAAC and RDNSS and all the other acronyms.

Yeah, yeah, I should RTFM, and eventually I might figure out what makes a "good" home IPv6 network. But I can't be arsed to do that in my free time yet, and neither can most software companies cough cough Google/Android and that one guy causing IPv6 drama in the android team

Like.... Ehhh... I'll come back to it in a few more years. "Are we IPv6 yet?"

Now IPv4 prices are returning to pre-Covid long-term trends. But of course Amazon won't reflect that in their pricing table.

When I replace DHCP/DNS with Pihole I need to account for that. While this is not a complex setup once you understand IPv6 you still need to learn it.

I work in IT so I tried to get myself to IPv6 several times but never had any reason to do so (despite self-hosting a lot and generally being a nerd). I had to do that this time and my uninformed opinion is that it could have been done so that it is much simpler for advanced users (but not yet networking experts)

What did you use to implement that? I found it surprisingly difficult to find software to do NAT64 on Linux.

That said, I think the difficulty of IPv6 is in the UI of the home routers that implement it, and a lack of sane defaults.

The ISP should give every SOHO/residential customer a /60. The router of a simple IPv6 should do prefix delegation. The router should default to SLAAC for local IP addresses, and configuring DNS with Router Advertisements. And residential routers can be set up to have an internal DNS server which populates the ".internal" domain with hostnames from the network.

As a network admin, you have to learn new things like the uses of IPv6 multicast, and ND, the lack of ARP, and some other things. Home users shouldn't have to care about that.

Being able to relay through a third party is a different thing.

CG-NAT adds a cost that not everyone can easily afford:

> We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices.

> First off I despise both Apple and that other evil empire (house of mouse) I want nothing to do with either of them. Now with that said I am one of four individuals that suggested and lobbied 15 other tribal nations to offer a new AppleTV device in exchange for active ROKU devices. Other nations are facing the same dilemma. Spend an exorbitant amount of money to support a small amount of antiquated devices or replace the problem devices at fraction of the cost.

* https://community.roku.com/t5/Features-settings-updates/It-s...

* "Roku devices don't support IPv6 in 2023 and it's costing ISPs", https://news.ycombinator.com/item?id=35047624

IPv4 prices peaked in early 2022; AWS started charging for public IPv4 in 2024 (announced in 2023):

* https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address...

If they had increased prices in 2022 (or at least announced in 2022), then I could see some kind of correlation, but give it was 1.5-2 years after, I doubt there is a connection.

CGNAT would cripple every customer I've ever had, going back to the beginning of broadband. Everyone one has had something on-premises that needs to be accessible. Nearly always, it's multiple things that are critical to operations.

    However. if someone wants to forever keep 100% of their accessible data in someone else's silos...

    and be forced to pay 3rd parties to access anything located on their own premises (ex:cameras) 

    then imprisonment behind CGNAT might feel 'good enough' to them.

I don't need to forward any ports but seemingly because I share an IP with a billion people I get Captchas everywhere (Google, Cloudflare etc.). I was even blocked from accessing Reddit without an account at some point.

They now support IPv6 but only with dynamic address allocations so you don't get a lot of advantages from it.

Internet (I mean, the IETF) does care a lot about the end-to-end principle, however. It is true that "misbehaving" NATs break e2e badly. It is also true that IPv6 can also be put behind such NATs.

For better or worse, IP blocks are still very common. It's easy to complain about this, but there aren't really any good methods to deal with persistent abuse.

The ISP should give every residence 295 quintillion IPv6 addresses? I know there is an abundance of ipv6 addresses but that seems like a lot of waste.

Even assigning a /96 would provide 4.3 billion ipv6 addresses (which is the same number as all ipv4 addresses in existence)

And since available ipv6 space is basically 4.3 Billion^2, assigning an ipv6 /96 would be like assigning a /32 in ipv4 terms of total ipv6 space utilization.

Anything larger (usually /56, sometimes even /48) gives the customers a chance to segment their LAN.

The other Starlink hassle is the geocoding for user IPv4 addresses is wildly wrong. I'm in Grass Valley, CA near Sacramento but sites all think my IP is either in Seattle or Los Angeles, depending on the week. This makes streaming services a huge PITA, I have to jump through hoops to convince them I'm in the Sacramento TV market about once a month. IPv6 could help with this too, Starlink could give out more precisely geolocated addresses. Not sure they're doing it though, all I see are IPv4 addresses in the geocoding feed: https://geoip.starlinkisp.net/feed.csv

A couple of other practically useful things:

- You never get address collisions when connecting to someone else's VPN, or connecting to your home network via VPN from someone else's private network (if you've set that up)

- If there are two people living in your home, they can play online games against a mutual friend who doesn't live in the home without anything breaking

I think you're right that IPv6 isn't a game-changing improvement for most people. It gets rid of some annoyances, it's the obviously correct thing to do for new networks (and cheaper than setting up CGNAT), but fundamentally the pile of hacks on IPv4 is "good enough" for most use cases.

If we are to have a transition to IPv6, and I am very much in favour of this, then by all means make the addresses be globally routable, but force people to select the ports and addresses to be shared in their router. Otherwise we end up with another mess ala "open wifi".

EDIT: I also understood the GP comment to be getting around the problem of long IPv6 addresses and not actually making every machine globally accessible.

I’m asking, because I’m an advocate of having your gateway advertise a separate, stable ULA /64 in conjunction with the globally-routable dynamic /64.

This gives you a stable set of addressable LAN IPs, and you can usually ignore the dynamic globally routable IPs.

Granted this won’t work for everyone, but if dynamic global addresses are an issue, you should be requesting a plan that supports a static delegation from your ISP anyway.

Well, its only really a problem if you're poor. Rich people don't care - IPs are still cheap enough when you live in a wealthy country & have a decent job.

The people affected by IP address exhaustion are largely the exact set of people who can't do anything about it.

Doing NAT64 runs into MTU issues and the behavior I observed is chrome would resend the request but only after 30s, firefox and other programs entirely failed to resend requests that were rejected due to MTU issues. Once I got the rejection, retrying in firefox or whatever would work though, so it seems like the path MTU was cached somewhere at the OS level. Reducing MTU manually seemed to fix the problem, but isn't that supposed to be automatic? Why didn't the kernel do the resends?

Old iPads, Androids just don't work, I'm not sure why. My iPhone 11 would connect to the network but declare itself disconnected after 24h or so (some lease or dns expiry which it doesn't renew?).

Steam hardcodes an ipv4 address for login... !! I'm not sure what to make of that, and the fact that it was reported around 10 years ago and they still haven't fixed it. Is it even using TLS?

I needed to make docker dev containers use host networking, because otherwise they'd get ipv4 addresses and try to do ipv4 traffic which couldn't be tunneled by default over ipv6.

Other than that it basically worked.

There's fundamentally only two different ways ipv6 can be configured from an ISP: SLAAC with no delegation, so you essentially share a network with other customers, or DHCPv6 delegation. Unlike IPv4 which has a million different offerings: PPPoE, DSLite, MAP-E, DHCP, etc etc and many of those aren't supported by linux.

I signed up with an ISP that claimed to support NAT64 (Biglobe) but they only support it on their SLAAC ipv6 + PPPoE ipv4 setup, not on their DHCPv6 PD + MAP-E setup, so I had to switch back to SLAAC. At this point in time the NAT64 support seems to be have been a lie... But anyways, to control my network DNS settings despite that I made a program to rewrite RA (and various other packets) with my own DNS server information.

Just as today people have to adjust NAT as kind of an implicit inbound policy, a proper home IPv6 router defaults to drop for inbound traffic.

I don't play online games, don't use VPN, have a couple of services on my local RPi that has port forwarded on router and that's it...

ipv6 could be handy when testing some service on my laptop and trying with external services but this happens so rarely that it's not an issue... on the flipside, whenever I enable ipv6 I usually run into problems :|

As it might be wise to banish those devices into an isolated net anyways that might not matter too much — but a transition to IPv6-only has many places where hard- and software is the blocking factor.

Most? I have not seen a _single_ hotel that supported IPv6. Not one. And I always check, just for fun.

I've been to one hotel (in Menlo Park) that used to give out public IPv4 addresses automatically, and several hotels (The Venetian, Bellagio) where you could request a public IPv4 as needed.

BTW, I'm also looking for a SIP provider that supports IPv6. So far I haven't found any in the US.

And for everyone that does pay this "internet tax", it only strengthens the position of said corporations to be able to buy up even more of the available routable ips. It's not hard to see that the end result is very much not in the consumers favor, regardless of how unnecessary it feels for customers currently to have a real ip when all they want is kitten animations on social media.

Now, a home router should probably have a stateful firewall that's on by default, but that's a different matter.

Its very common for whole streets or neighbourhoods to collectively share a single IPv4 address. Its required, as a result of simple math.

You'll even see this in some parts of the US and UK.

As you wrote, internally, you can use ULA. But you cannot open access from outside, because your firewall rules will become invalid with prefix change. With classic IPv4 NAT, your internal addresses don't change, so your port forwarding works, even if the WAN address changes.

Together, with a single /64 -- which means no subnets for you -- you are getting worse deal than with IPv4. You shouldn't have to contact your ISP for a plan (for a premium, obviously), that allows you to segment your network or open access to specific devices. What's the use of direct connections -- the IPv6 promise -- when you cannot use them anyway?

In short, with limitations like these, you are getting a bad deal.

The reason that IPv6 is so lightly used is that it’s cheaper to use IPv4 + workarounds.

I’m not saying this is a good thing or a bad thing, or making any value judgment about IPv4 vs IPv6.

People and businesses don’t spend money on technology upgrades where the benefit is not measurably better than what they already have.

This is just common sense; no one wants to throw away money.

If you want people to use IPv6, then IPv4 has to fail first. As long as people keep making it work then the benefits of changing will never outweigh the costs.

BTW this is exactly the same situation as clean energy vs fossil fuel, etc. In that situation governments are actively putting their thumb on the economic scales in all sorts of ways. Again, I’m not offering a value judgment, just an observation.

Its not like IPv6 /56 subnets are expansive. Just give each customer a full /56 net and you are done.

I could have written this message in 1999. That's 25 years ago (as you alluded to). That's a long time to hold your breath.

If GooG/FB/Amazon force IPv6 how long will it take for ISPs to switch? I think in one week where some people cannot reach GooG/FB and any ISP that was dragging his feet has implemented IPv6 by the end of the week.

I expect IPv6 adoption will blow up any time now as past performance is not indication of future changes ;) because there is much more required on the server side than it was ever before. ISP and home use could live with NAT but servers not really even if you can handle bunch of services on a single IP address, there is just limited traffic you can squeeze onto a single server.

IPv6 was not created for you, but it benefits you. NAT is computationally expensive and it does have a real impact for large organizations with thousands and tens of thousands of devices. Such as large universities or you know ISPs.

I'm using Mikrotik, which doesn't allow prefix-less addresses in firewall, but allows you to put hostnames into your rules (so it will ask DNS what the address is and once the ttl expires, it will ask again).

On some CPEs (I don't remember which), it allowed to enter mac addresses, so the forwarding would always work for specific device, with any GUA address.

But we have to remember, that all these solution are optional and brand-specific; there's a wide range of devices that do not have anything to solve this problem.

The User Terminal issues a router advertisement (RA) and my gateway gives itself an address in that /64 via SLAAC in addition to assigning itself an address from the /56 prefix.

If not using prefix delegation each host's address is dependent on their SLAAC policy - if not preferring stable addresses (e.g: EUI64) then of course the public address will vary (be dynamic) when using temporary "privacy" addresses.

My gateway delegates /60 sub-prefixes of the /56 and bare-metal hosts then either delegates /62 or advertises /64s from the /60 to VMs, containers, network namespaces and so forth.

As someone else described, I have my gateway also delegate ULA prefixes by changing just the first two octets of the public delegated prefix to fddc (fd = ULA, dc = "data center :) but otherwise identical and likewise on the bare-metal hosts, etc.

ULA is used for internal services; ISP delegated prefix for anything that needs public access.

Multicast-DNS takes care of internal hostnames; everything is ${hostname}.local

There's a separate VLAN for legacy IPv4-only devices that does NAT64 using a ULA prefix.

DNS64/NAT64 for the laggards like github.com that can't grok 128 bit addresses :)

The only time I have problems with web services is when their DNS advertises an AAAA resource record but their firewall/load-balancers/servers are not configured to allow/listen on it.

The price had already dropped, and was continuing to fall, when they announced the change, so if rising acquisition cost was the primary reason for adding the IPv4 charge, it had already went away.

I think AWS has looked at a utilization graph and sees a time their current pool is get used up at current rates and doesn't want to go through the hassle of acquiring more IPv4 addresses, regardless of cost (even if it is "cheap").

I also think that they have statistic for their www.Amazon.com storefront, and maybe are seeing a good proportion from IPv6 and so figure that there's a 'critical mass' (especially mobile).

Also, you're speaking from the privileged perspective of a first-world country- many other countries missed the boat on IPv4 addresses and are limited to IPv6, which also probably explains why global uptake continues upwards despite the US stagnating.

I have never gotten github access from my IPv6-only Hetzner-hosted machine. I don't have control over their router(s) and I am not an experienced network admin who would know how to set up something that would let me simply fucking "git clone" from that machine. I would end up having to set up something janky. The fact that Github is IPv4-only in 2024 is atrociously bad and hopefully handing over business hand-over-fist to their closed-source and open-source competitors.

I love having access to all my internal machines over IPv6 from anywhere without having to use janky hacks. I'd be able to self-host boutique and portfolio websites for example (at least from IPv6-enabled clients), without having to use (and pay for) an external host just for the sake of access.

The fact that hotels and work LANs don't permit access is a "hotel and work LAN" problem, as well as a chicken-and-egg one. If enough people request it (perhaps work people want some cheap Hetzner hosts for dev environments and traveling devs want access to the same machines), the Sysops That Be will make it happen- They are certainly educated enough in the space to enable it.

You are neglecting the cost savings and the non-Western perspective, as well as the "simple developer, not devops expert" perspective.

Either this or a "killer app" use-case that requires IPv6 will push it forward significantly, IMHO.

Cheaper? Hetzner and other hosts give IPv6 addresses out for free and charge extra for IPv4 addresses.

My solution for my home network was to write a script that periodically checks my IPv6 prefix and updates the firewall rules and DNS if it ever changes. It doesn't feel like a great way to do it but it seems to work.

Our current patterns of internet behaviour are limited by IPv4, so almost by construction nobody does things that need IPv6.

Few people made international journeys before deep water navigation; watched live streams before Twitch; or had pizza delivered at 4am before dominos.

IPv4 is "good enough", but we could do some things to extend its usage further.

First, adopt service location in DNS, and being to retire it at the TCP port-number layer. Then we could run more than one website per ip address, and this would significantly increase resilience against censorship. Rotating ports for censored websites is a significantly easier task than rotating IPs for them since it does not involve routing changes. This could be done with "here and now" technology.

How does a device with a 32-bit-sized addressing scheme construct an IP packet to a device with an address in a 128-bit-sized addressing scheme?

You can DoS your whole subnet by pretending to be a billion devices. In IPv4 you can do it by occupying all the IP addresses. Therefore putting several customers on one network is a bad idea, just like in IPv4.

Companies will relay your video calls for free. For now. Basically undercutting. The only way to prevent undercutting is by the government regulation.

Writing to you from /72.

If more people wanted an IP, the price would just rise. The same percentage of people (less than 1/3) would have one. They would just pay more.

It’s like buying land in a city like SF. Demand can change the price, but the supply remains the same.

1) CG-NAT

2) IPv6

You literally can not have one unique IPv4 address per mobile phone.

They're moving onto the "squeeze" part of the cycle.

True, but each person does not need to have their own bank to send or receive money, they can have an account within a bank of their preference, and use that extra information to route money transfers precisely.

"But they can't route money directly" — most people will never need to.

His scenario is really a PITA, where he's basically forced to migrate to IPv6 only because of IPTV. There might have been a solution by creating an IPv6-only VLAN just for the TV, while keeping the rest at legacy, but it's not really trivial.

IPTV with Deutsche Telekom is also a pain, because they feed it in a separate VLAN and the routers and switches need to handle IGMP messages properly (IGMP proxy, IGMP snooping).

They are not useful, as you can't depend on them.

One, the most obvious, is actually having distributed net and serving content from your own machine and in the ancient times like 15 years ago Opera tried that by bundling sort of local http-server (?!, can't even remember the name of the project…) but it floped... I'm not sure that ipv4 was the issue or rather the fact that people don't usually have or want their machine work 24/7...

for calls we have to rely on STUN/TURN but than again some consider this a feature as it hides external IP... which with ipv6 would be even more privacy invading?

Starlink recently updated their FAQ with more info on addressing: https://www.starlink.com/support/article/1192f3ef-2a17-31d9-...

As for static addresses, it says "a reservation system retains the ... IPv6 prefix even when the system is off or rebooted. However, relocating the Starlink or software updates may change these addresses."

I suspect in practice the IPv6 address will only change if you get moved to a different POP ground station. Some customers never get moved. I've been moved several times because I'm in NorCal and they keep switching me between Seattle and Los Angeles.

Here's some recent discussion of users reporting what they've observed about changing IPv6 addresses: https://www.reddit.com/r/Starlink/comments/1b6mr4c/how_stati...

YTTV at least will prefer your phone's geolocation to the IP address, that's how I "check in" to my metro every couple of months.

Even for a changing prefix, if operating a DNS authoritative server for a domain, any changes to the prefix can be quickly and automatically updated in both forward (AAAA) and reverse (PTR) resource records provided the TTL for those records is appropriately short, and thus allow almost seamless inbound via FQDNs. I do this with a bind9 (hidden) master locally that notifies external slave servers operated by a highly available, anycast, DNS service.

Same for network address translation, both NAT46 and NAT64 standards have existed for a while now and that also hasn't solved the "backwards compatibility" complaints for IPv6.

Says you need to have an AWS NAT for that to work. And AFAIK, setting up a NAT requires an ipv4 elastic ip.

And it makes since that AWS would want customers to have their own IP for NAT64, so that if one customer does something to get the ip address blocklisted it doesn't impact other customers.

For the relatively small number of people who do need public addresses, renting them from a cloud provider or buying blocks at auction are still economically viable, in comparison to the capital costs of upgrading everything that needs upgrading to support IPv6-only.

Who knows, maybe I dreamed it.

Nonetheless, I disabled IPv6 again and that, somehow, was the smoking gun that solved the "my phone always runs out of charge overnight when I stay connected to your wi-fi" problem.

However, I’d love to be able to interact with my car, CCTV cameras and other IoT devices at long distance with fewer middlemen involved.

Would people want to own such a server? I don't know, but as it stands currently, only the centralised players in the internet sphere can afford to serve content. Perhaps our relationship to these companies would be different if there was no barrier to entry for competition. Perhaps our entire conception of the internet would be different without that fundamental limitation. Or perhaps nothing would change. The central model has its advantages, but I'd also like to be able to own my own website.

You need to add the source IP/port into the mix. But they alone are in practice enough for decent load balancing.

Though I don't think AWS cares too much about IP blocklist, you can always just get another elastic IP at any moment.

I think the more elegant solution is to use static IP space for hosting services, but most of us home users aren’t used to that.

I proposed that you might be able to route the external router’s WAN to a ULA via NAT to save in complexity when the PD changes, but I agree that a static delegation would by far be the easiest. Us home hosters aren’t used to that even though it is technically against the license agreement more often than not.

Unless the service explicitly states that your subnet is your or yours alone you should assume it's dynamic.

If you start relying on the prefix not ever changing you might have a bad surprise.

And from experience, that kind of surprises always come when you least need them.

But IPv6 makes a difference for some other situations. If you operate a network with routers and such, it makes sense to have all connections to internal services use IPv6. Backup, file storage, databases, management interfaces, blah: Give everything its own IPv6 address, don't accept connections on IPv4, and allow IPv4 packets from 192.168/16 only to the outside world.

I think this is mostly the way it is because of all the NAT headaches that come with IPv4.

We regularly see the limitations of Dropbox/Google drive when we just want to share that large birthday video with our friends/family. Imagine them having a secure link to your device that you can revoke any time.

Same with all the home automation / iot devices / cctv cameras that have no excuse not to be local first/need you to install an ad infested app.