Most active commenters
  • eptcyka(3)

←back to thread

The IPv6 Transition

(www.potaroo.net)
215 points todsacerdoti | 16 comments | 20 Oct 24 05:54 UTC | HN request time: 2.309s | source | bottom
Show context
uobytx2 ◴[20 Oct 24 21:14 UTC] No.41898529[source]▶
People posting have mentioned that IPv4 is working for what they use the internet for. But of course it is. When NATs has been required for your whole life, how could the internet have built features that needed p2p routing? Just convince businesses to build something that requires special router configuration? And still wouldn’t work on phones or with ISPs that require CG NAT? You got what worked out of the box. You obviously couldn’t use what didn’t exist.
replies(2): >>41899158 #>>41899246 #
1. theamk ◴[20 Oct 24 22:55 UTC] No.41899158[source]▶
Why do people assume IPv6 means "easy p2p"?

Even if NAT will be gone one day, the stateful firewalls won't. Every every home router would still ship with "deny all incoming" by default, and every corporate network would have the same setting as well.

Same as IPv4, IPv6 serving would still need registration with border device, either manual by user, or via UPnP-equivalent.

replies(3): >>41899364 #>>41899487 #>>41901569 #
2. numpad0 ◴[20 Oct 24 23:25 UTC] No.41899364[source]▶
"everything gets a global IP, no more NAT headaches" was one of marketing talking points for IPv6. Not necessarily the case nor welcomed by everyone, but that was the intent.
replies(1): >>41899708 #
3. ndriscoll ◴[20 Oct 24 23:47 UTC] No.41899487[source]▶
UDP hole punching works when you don't have symmetric NAT. So e.g. voice and video calls don't need a proxy and can be higher quality. You only need a third party to locate/signal your peer.
4. mike_d ◴[21 Oct 24 00:39 UTC] No.41899708[source]▶
Wide scale deployment of NAT (the "home router" that allowed you to connect multiple devices) was the greatest leap in internet security we ever made. I remember the days when we had "everything gets a global IP," and we do NOT want to go back to that. Look up Conficker, Code Red, Blaster, etc.

People naively assume the large IPv6 address space somehow hides your computer on the internet. That isn't true. Both because v6 host discovery is a solved-ish problem for attackers, and worms have near unlimited resources to throw at the wall.

replies(3): >>41899815 #>>41900115 #>>41900299 #
5. bigstrat2003 ◴[21 Oct 24 01:02 UTC] No.41899815{3}[source]▶
I remember those days too. They had nothing to do with computers not being behind a NAT.
replies(1): >>41900391 #
6. BenjiWiebe ◴[21 Oct 24 02:05 UTC] No.41900115{3}[source]▶
You'll still need a router to route. It just won't have to do NAT. It can still do a statefull firewall, just like it does with IPv4.
7. numpad0 ◴[21 Oct 24 02:58 UTC] No.41900299{3}[source]▶
NAT is technically not a firewall in itself, I believe early/some NAT implementations used deterministic assignments between external range to internal ip:port. They can be more transparent if that is the goal.

But the effect of proliferation of cheap Wi-Fi routers with cheap dynamic NAPTs in conjunction with UPnP did to XP-era PC security - 100% agreed, it was like sunlight self-disinfecting brass door handles.

8. tptacek ◴[21 Oct 24 03:18 UTC] No.41900391{4}[source]▶
They had to do with computers being directly addressable, routable, and reachable by the entire Internet, which was the default prior to widespread deployment of NAT. NAT isn't the best way to do it, but it probably is the single biggest factor in reducing the external reachability of endpoint IPs.
replies(1): >>41904203 #
9. eptcyka ◴[21 Oct 24 07:27 UTC] No.41901569[source]▶
With how trivial generating new addresses in IPv6 is, it'd be cool to have a host block all incoming traffic on its own and have each service that deserves to be reached over the listen on an address unique to the service.
replies(1): >>41901733 #
10. nlitened ◴[21 Oct 24 07:56 UTC] No.41901733[source]▶
> have each service that deserves to be reached over the listen on an address unique to the service

It’s already a thing. These unique per-service addresses are called “ports” in IP protocol.

replies(2): >>41902517 #>>41902735 #
11. ◴[21 Oct 24 10:10 UTC] No.41902517{3}[source]▶
12. eptcyka ◴[21 Oct 24 10:47 UTC] No.41902735{3}[source]▶
Hosting service A shouldn't mean that every user of service A can also figure out you host C, B and D.

Also, the IP protocol does not care about ports at all. Ports are a thing for UDP and TCP.

replies(1): >>41904782 #
13. tucnak ◴[21 Oct 24 13:57 UTC] No.41904203{5}[source]▶
NAT deployment here is only tangential to the real differentiator: the firewall. I mean, you can make a case that NAT is a poor man's firewall but you should know that it's not a substitute for a security model. Zero trust is now the dominant philosophy, and it allows for firewall rules to be derived procedurally.

It's a shame the likes of Microsoft only care about "zero trust" insofar their compliance checkboxes with the the US government. They see it as a chore. Contrary to Google, Cloudflare, et al.

replies(1): >>41906767 #
14. nlitened ◴[21 Oct 24 14:48 UTC] No.41904782{4}[source]▶
> Also, the IP protocol does not care about ports at all. Ports are a thing for UDP and TCP.

You're right, they are one level above.

> Hosting service A shouldn't mean that every user of service A can also figure out you host C, B and D.

It how are ports on a single IP address essentially different from multiple IP addresses within a subnet?

replies(1): >>41908368 #
15. tptacek ◴[21 Oct 24 18:12 UTC] No.41906767{6}[source]▶
NAT was originally delivered as a security mechanism.
16. eptcyka ◴[21 Oct 24 20:46 UTC] No.41908368{5}[source]▶
In a /64, enumerating all hosts will not be as practical as enumerating all ports on a single IP. Further, you will not be able to link that two services are running on the same host by just the IP.