Hacker News Reader

Comment by emmelaich | Hacker News Reader

Most IT operations people within corporate networks use ips instead of names. And unix admins only trust ips in their host firewalls. So many things rely on the ip address that people get to know that 10.1.0.0 is headquarters and 10.1.3.0 is marketing and 10.4.0.0 is Seattle .. etc etc.

I'm not saying that is a good thing or not, I'm just saying it IS.

It would be a pain to use ipv6 internally.

View on HN

> It would be a pain to use ipv6 internally.

So.. Have you ever actually used ipv6?

With ipv6 your organization gets a prefix assigned, usually a /32 or a /48

So you would get assigned a prefix like 2626:32:400::/48

With ipv4 where if you were lucky you had a /16 that had 65,536 addresses - with "simple" /24 subnetting for 256 subnets of 256 hosts each.

With ipv6 you minimally have a /48 that has 65,536 subnets.

So you can just start subnetting things like 2626:32:400:0/64 is headquarters, 2626:32:400:1/64 is marketing. And you never have to worry about running out of address space on each subnet, since each subnet has room for 18,446,744,073,709,551,616 addresses.

And since there is room for 65,536 subnets, you can easily do things like immediately carve that up into blocks of 512 subnets for every geographical location and project... once. And not end up with "10.1.3.0 is marketing, but also 10.1.58.0 because we ran out of room"

So really, if you can type 192.168.x.y, you can type 2626:32:400:x:y.

In fact it's even easier. In the IP address you can embed an identifier for which office/datacenter, which department, which VLAN, etc. This makes it much more powerful and expressive.

I know that some network configurations will still have to use actual IPv6 addresses but for the most part you could save yourself a lot of pain by just using DNS and hostnames.

When I speak to our network guys to get a firewall entry they don't want to hear about names. Their network diagrams don't have names. Using names to them is unnecessary cognitive load.

What would happen if your current ISP got problems and you had to switch to a different ISP with a new range of addresses (assuming you don't have operator independent addresses and not using BGP)?

They'd NAT. And they're probably already NATed, so it would just be a few changes on the outside of the firewall.

Good luck NATing v6

There's nothing about NAT that makes it IPv4 specific. In fact, it implemented in netfilter (Linux)/PF (OpenBSD). For IPv6, there's also NPT (Network Prefix Translation), though I'm not sure how widespread it is.

Now, the fact that you can NAT IPv6, doesn't mean that you should. Specifically, if you NAT your IPv6 prefix because that's what you do with your IPv4 block, then you're doing something wrong.

That's already done. If you're big enough that renumbering is a concern, but small enough that you don't have your own assigned prefix, you use unique local addresses (fc00::/7) and NAT them to your providers space. (Which works better than it sounds - because you have enough space to nat one-to-one, the translation mechanism doesn't need to keep state. Simply replace one prefix with another, whack a new checksum in and send it along)

I would hope that the firewall guys are using a layer of abstraction in their rules rather than just putting the IPs in each rule individually. Network and protocol objects are fantastic, because you can assign names to network resources and then write rules that refer to hosts and networks by human names.

As an added bonus, if a resource changes addresses you just update the object and all of your rules are updated.

Such IT operations people and “unix admins” have chosen not to adopt the new thing slowly when they had the chance, so instead, they will now have the pain of adopting it quickly. This is entirely on them. Having that attitude towards IP addresses is not a practical attitude with IPv6 - you can do it, but it’s impractical. It is the attitude itself, not IPv6, which is the problem. This was going to be a problem whatever notation was used - there are simply too many bits in an address for it to be practical to deal with and memorize lots of raw IP addresses anymore.

Reply on news.ycombinator.com