Hah. But to be fair, ATM did have a specific use that it worked great for. That is the move to digital voice circuits. The small fixed cell size and built in QoS meant that if you had a fixed line size you could fit X voice channels, and they would all be extremely low latency and share the bandwidth fairly. You didn't need to buffer beyond one cell of data and you didn't need to include overhead beyond the cell headers.
ATM was designed to handle the "future" or digital network needs. But, the immediate use was about voice frames and that likely dictated a lot of the design I'd expect.
You shouldn’t have to?? Maybe you might need to change the mask in your firewall settings if the ipv6 allocation block size changes but that should be it.
You should only assign static ipv6 to servers, in theory you could just define a host id and use a prefix too. But, most people at home really aren't running enough servers to make that worthwhile. Everything else should just pick up new addresses fine using ND.
Will the app for the smart thermostat be updated three years from now and still be useful? If it was instead a web server app on a routable IP, it wouldn’t matter provided they didn’t fuck up the authentication and access control.
Yeah, but they're not. That's the modern world. But also even if it was a web server there's usually ways to advertise the IP for the app to connect to. I've seen other stuff do that. So getting an IP is easy. Once the app knows the IP and if you really want to allow connections from outside to your IOT devices (I wouldn't) it could remember the IP and allow that.
You really don't need to give a fixed IP to everything. I think I've given 1 or 2 things fixed IPv6 IPs. Everything else is fine with what it assigns itself.
The other app off the top of my head is VoIP. You should be able to “dial” a number directly. Most solutions go through the company’s data center first in order to pierce through NAT. Which makes it more expensive, less reliable, slower, and more susceptible to snooping.
There’s a “if you build it, they will come” effect here. Once you can address hosts directly, a whole bunch of things become better, and new ideas that were infeasible are now feasible. They don’t exist now because they can’t.
You can use ULAs (unique local addresses) or that purpose. Your devices can have a ULA IPv6 address that’s constant, and a public IPv6 that changes. Both can be assigned using SLAAC (no manual config required).
I do this because the /56 IPv6 range provided by my ISP is dynamic, and periodically changes.
Yes but you’d still be performing NAT. It’s at least 1:1.
You’ll need to deal with firewall rules regardless, and drop IPs into policies. IPv6 doesn’t remove any of those chores but gets rid of having to maintain tables to deal with many-to-one NAT.
If you use a single shared public ip then you’re using some amount of address translation
This is practically never the case with IPv6. Usually, each device gets its own public IP. This is how the IPv4 internet used to work in the old days (one IP = one device), and it solves so many problems. No need for NAT traversal since there’s no NAT. No need for split horizon DNS since the same IP works both inside and outside your network.
There’s still a firewall on the router, of course.
At least that’s how I understand ipv4 and I don’t think ipv6 is much different.
With IPv6, each network device can have multiple IPs. If you have an internal IP for whatever reason, it’s in addition to your public IP, not instead of it.
IPs are often allocated using SLAAC (stateless address auto config). The router tells the client "I have a network you can use; its IP range is 2001:whatever/64, and the client auto-generates an IP in that range, either based on the MAC address (always the same) or random, depending on if privacy extensions are enabled - usually on for client systems and off for servers.
Just like ipv4 though, you wouldn’t use external addresses internally because your external IPs might change, such as when moving between ISPs. You would NAT a hosts external address to its internal address.
your external IPs might change, such as when moving between ISPs
This is true
You would NAT a hosts external address to its internal address.
This is usually not true.
If you’re worried about your external IP changing (like if you’re hosting a server on it), you’d solve it the same way you solve it with IPv4: Using dynamic DNS. The main difference is that you run the DDNS client on the computer rather than the router. If there’s multiple systems you want to be able to access externally, you’d habe multiple DDNS hostnames.
There’s no translation between them. With IPv6, one network interface can have multiple IPs. A ULA (internal IP) is only used on your local network. Any internet-connected devices will also have a public IPv6 address.
ULAs aren’t too common. A lot of IPv6-enabled systems only have one IP: The private one.
I think it’s worth taking the time to learn IPv6 property. If you have a good understanding of IPv4 it shouldn’t take you more than an afternoon.
Eliminating NAT and just using firewall rules (ie what NAT does behind your back) is incredibly freeing.
I don’t get people complaining about typing out IPs. I like to give all of my clients full FQDNs but you don’t have to. Just using mDNS would be enough to avoid typing a bunch of numbers.
Maybe I have Stockholm Syndrome, but I like NAT. It’s like, due to the flaws of IPv4 we basically accidentally get subnets segmented off, no listening ports, have to explicitly configure port forwarding to be able to listen for connections, which kinda implies you know what you’re doing (ssshh don’t talk about UPnP). Accidental security of a default deny policy even without any firewalls configured. Haha. I’m still getting into this stuff though, please feel free to enlighten me
Anything connected to an untrusted network should have a firewall, doesn’t matter if it’s IPv4 or IPv6.
There’s functionally no difference between NAT on IPv4 or directly allowing ports on IPv6, they both are deny by default and require explicit forwarding. Subnetting is also still a thing on IPv6.
If anything, IPv6 is more secure because it’s impossible to do a full network scan. My ISP assigned 4,722,366,482,869,645,213,696 addresses just to me. Good luck finding the used ones.
With IPv4 if you spin up a new service on a common port it usually gets detected within 24h nowadays.
Ahh, woah, I never thought about the huge address space would affect network scans and such.
With NAT on IPv4 I set up port forwarding at my router. Where would I set up the IPv6 equivalent?
I guess assumptions I have at the moment are that my router is a designated appliance for networking concerns and doing all the config there makes sense, and secondly any client device to be possibly misconfigured. Or worse, it was properly configured by me but then the OS vendor pushed an update and now it’s misconfigured again.
With NAT on IPv4 I set up port forwarding at my router. Where would I set up the IPv6 equivalent?
The same thing, except for the router translating 123.123.123.123 to 192.168.0.250 it will directly route abcd:abcd::beef to abcd:abcd::beef.
Assuming you have multiple hosts in your IPv6 network you can simply add “port forwardings” for each of them. Which is another advantage for IPv6, you can port forward the same port multiple times for each of your hosts.
I guess assumptions I have at the moment are that my router is a designated appliance for networking concerns and doing all the config there makes sense, and secondly any client device to be possibly misconfigured. Or worse, it was properly configured by me but then the OS vendor pushed an update and now it’s misconfigured again.
That still holds true, the router/firewall has absolute control over what goes in and out of the network on which ports and for which hosts. I would never expose a client directly to the internet, doesn’t matter if IPv4 or IPv6. Even servers are not directly exposed, they still go through firewalls.
I wouldn’t rely on the size of the address space to provide security. It’s possible to find hosts through methods other than brute force scanning. I remember seeing a talk from a conference (CCC? DEF CON? I can’t remember) where they were able to find hosts in government IPv6 address space (might have been DOD?) through stuff like certificate transparency logs and other DNS side channels.
Will take a look at the talk once I get time, thanks. If you can find the original one you were talking about, please link.
For servers, there is some truth that the address space does not provide much benefit since the addressing of them is predictable most of the time.
However, it is a huge win in security for private internet. Thanks to the privacy extension, those IPs are not just generated completely random, they also rotate regularily.
It should not be the sole source of security but it definitely adds to it if done right.
Could a hypothetical attacker not just get you to visit a webpage, or an image embedded in another, or even a speculatively loaded URL by your browser. Then from the v6 address of the connection, directly attack that address hoping for a misconfiguration of your router (which is probable, as most of them are in the dumbest ways)
Vs v4, where the attacker just sees either your routers IP address (and then has to hope the router has a vulnerability or a port forward) or increasingly gets the IP address of the CGNAT block which might have another 1000 routers behind it.
Unless you’re aggressively rotating through your v6 address space, you’ve now given advertisers and data brokers a pretty accurate unique identifier of you. A much more prevalent “attack” vector.
There is this notion that IPv6 exposes any host directly to the internet, which is not correct. When the client IP is attacked “directly” the attacker still talks to the router responsible for your network first and foremost.
While a misconfiguration on the router is possible, the same is possible on IPv4. In fact, it’s even a “feature” in many consumer routers called “DMZ host”, which exposes all ports to a single host. Which is obviously a security nightmare in both IPv4 and IPv6.
Just as CGNAT is a thing on IPv4, you can have as many firewalls behind one another as you want. Just because the target IP always is the same does not mean it suddenly is less secure than if the IP gets “NATted” 4 times between routers. It actually makes errors more likely because diagnosing and configuring is much harder in that environment.
Unless you’re aggressively rotating through your v6 address space, you’ve now given advertisers and data brokers a pretty accurate unique identifier of you. A much more prevalent “attack” vector.
That is what the privacy extension was created for, with it enabled it rotates IP addresses pretty regularily, there are much better ways to keep track of users than their IP addresses. Many implementations of the privacy extension still have lots of issues with times that are too long or with it not even enabled by default.
Hopefully that will get better when IPv6 becomes the default after the heat death of the universe.
Since you can have multiple IPv6 addresses on one machine, you can use a rotating address for all outbound connections and a permanent address for inbound connections. If you visit a malicious website that tries to attack the IP that visits it, there will be no ports open. They would have to scan billions of addresses to find the permanent address. All of that scanning would be easily detected and blocked by an IDS.
There is this notion that IPv6 exposes any host directly to the internet, which is not correct.
TP-Link routers used to actually do this. They didn’t have an IPv6 firewall at all. In fact they didn’t add an IPv6 firewall to their “enterprise-focused” 10Gbps router (ER8411) until October 2023.
That and the IPv6 address on client systems will periodically rotate (privacy extensions), so the IPs used today won’t necessarily be the ones used tomorrow.
(you can disable that of course, and it’s usually disabled by default on server-focused OSes)
I don’t think you have Stockholm syndrome. You just like what you already understand well. It’s a normal part of the human condition.
All those features of nat also work with IPV6 with no nat in the exact same way. When I want to open up a port I just make a new firewall rule. Plus you get the advantages of being able to address the ach host behind the firewall. It’s a huge win with no losses.
Instead of nat and port forwards that rewrite, your firewall is set to only forward specific traffic, exactly how’d you’d configure outbound forwarding on a nat network (but opposite directions)
Every time I see a defense of IPv4 and NAT, I think back to the days of trying to get myself and my roommate to play C&C: Generals together online, with a 2v2 game, with one of us hosting. Getting just the right combination of port forwarding working was more effort than us playing C&C: Red Alert on dial up when we both lived at home.
With IPv6, the answer is to open incoming traffic on the port(s) to the host machine (or just both since the other guy is might host next time). With IPv4, we have to have a conversation about port forwarding and possibly hairpin routes on top of that. This isn’t a gate for people “who know what they’re doing”, it’s just a bunch of extra bullshit to deal with.
I can see that, but surely there wouldn’t be much difference matching the first 4bits (0x2XXX, 0xfXXX) vs the first 16 (0x0001)?
0:: is presumably all for loopback-type stuff, but I don’t see a reason not to use 1:: through 1fff:: and they would be much easier to type/remember/validate for public DNS servers which are needed before name resolution is available.
IPv6 is big enough to give 10 billion unique addresses for every grain of sand on earth and still have some left over. Just in case we need to, I guess.
It’s great that the address space is so large. When designing a new system, you want to make sure it’ll hopefully never encounter the same issue as the old system, to ensure you don’t have to migrate yet again.
Sure. But the IPv6 implementation is a bit like if we went “you know the y2038 problem of 32 bit numbers, and how goin under 1970 is sometimes hard? Lets solve it by making it start from the big bang and store time as a 256 bit integer so we don’t run out until year 3.1 x 10^69”.
IPv6 is big enough for 340,282,366,920,938,463,463,374,607,431,768,211,456 unique addresses. Are we expecting to create an universe consuming army of exponentially replicating paper clip converting robots that each need an IPv6 address or something?
Having a large range has a number of benefits though. Companies that have dozens of IPv4 ranges may be fine with a single IPv6 range, which simplifies routing rules.
A lot of features in IPv6 take advantage of the fact that networks have at least a /64 range (at least if they’re built correctly according to RFC4291 and newer specs). SLAAC is a major one: Devices can auto-configure IP addresses without having to use something like a stateful DHCP server.
Because 48 bits over 32 bits does not really solve the problems with ip4. 128 bits basically gives one ip4 address space to each square meter of earth. Ip6 also drops all the unused and silly parts of ip4 too.
128 bits basically gives one ip4 address space to each square meter of earth.
That sounds like terminal stage capitalism to me. Why would we want every tree in the Amazons to be cybergorized with its own IP? I don’t know Rick, 64 kbits bits ought to be enough for everybody, and I’m already risking it.
Our network architecture has the tendency to waste IP addresses. A subnet may have 10 devices but have 256 IPs (e.g. a /24 network like 192.168.0.0 to 192.168.0.255) - that’s 246 wasted addresses. This wastage is kinda unavoidable since we’d need to keep our routing tables from being too fragmented.
With that in mind it is entirely possible for 64-bit addressing space to not be enough, unless we revert to methods like NAT which come with their own disadvantages.
We have already used up about one /11 block of the IPv6 internet. That’s 128-11=117 bits. If we replace the standardized /64 subnets of IPv6 with old /24 subnets typical in IPv4 networks, you get 61 bits. That’s dangerously close to the upper limit of a hypothetical 64-bit IPv5 internet.
Because bits are not expensive anymore, and if we used 64 bits, we might run out faster than the time needed to convert to a new standard. (After all, IPv4 is still around 26 years after IPv6 was drafted.) Also see the other notes about how networks get segmented in non-optimal ways. It’s a good thing to not have to worry about address space when designing your network.
If you want to be able to write practically anything on mobile, including ≠, ≈, ‰, ℝ etc., have a look at Unexpected keyboard. No spellcheck or autocomplete, though.
It definitely wouldn’t be the left image. With legs like those, you could never pull the pants up past the first (or I guess technically last) level of branching. It would either be the big pants or a large number of seperate, smaller pants on each of the lowest branches.
If the pants are stretchy they could fit one of the lowest (already pantsd) branches in each leg of the jeans, and easily pull it up. You need bigger and stretchier pants as you go up the tree, though.
The max size of required pants stretch will be the standard size for the right picture, since each leg already wraps half of the tree. That confirms viability at least, so now I think it’s down to comfort, and does the stretch retract in a restful position, or does stay all loose and cumbersome?
programmer_humor
Oldest
This magazine is from a federated server and may be incomplete. Browse more on the original instance.