Hacker News Reader

Comment by flyinghamster | Hacker News Reader

IPv6 blacklists seem to be based on /64 prefixes rather than individual addresses. That hit me when I was enabling an IPv6 MX on a VPS; I had to get my own /64 prefix rather than use the standard default single address, since the default lied within a spammer-contaminated /64 block.

I know it seems rather excessive to use an entire /64 and only populate a few addresses, but I'd rather have too many addresses available than too few.

View on HN

Blocking a /64 is not even enough in many cases. I know a couple of server providers handing out a /48 per server. If routing is done the right way, you can pretty easily randomize your source address by making use of features like AnyIP and add a whole prefix to your network interface. I have written a small tool to demonstrate this: https://github.com/blechschmidt/freebind

Solutions to this problem that try to avoid penalizing other users sharing a prefix will certainly be interesting. Some approaches ban per /128 and extend this ban to a /64 if two or three addresses within the /64 got banned.

But how do you know you should use a /64 mask? One of my hosting providers assigns much smaller subnets. Some others assign /56. You are at risk of blocking many legitimate IPs and missing many others.

> But how do you know you should use a /64 mask? One of my hosting providers assigns much smaller subnets.

It's baked into the standard that IPv6 networks shouldn't be smaller than /64. If a provider is disregarding the standard so blatantly I would probably avoid them.

Really, why on earth would a cloud provider be so stingy with IPv6 that they'd give less than a /64 per customer? ARIN gives out /32s like candy and a single /32 can be split into ~4.3 billion /64s.

/32 is like you can build your own entire internet!

Sadly the ISP for internet to our office building only gave out a /65... that we are meant to share with ~20 companies.

Suffice to say I've got IPv6 to the internet gateway, but no further. => They fulfilled their contractual obligation to "provide ipv6 connectivity", while being entirely useless. They'll probably use us as a stat to prove that no one wants ipv6 anyway...

There is no choice in provider.

But why /65 is such a big deal? You can divide it in 32 different /70 subnets, one per company. That still leave you with 2^58 IPs by company. You can still even use MAC addresses in your IPs.

SLAAC on ethernet requires a /64. A provider assigning you anything but at least a /48 is pure incompetence, if it's explicitly for 20 companies, they really should be giving out a /43.

Yeah but stateful vs stateless DHCP is really a minor problem.

> is really a minor problem.

So, it's a problem. For no reason at all.

Also, no, it's not really just a minor problem. Reconfiguring your one client device might be trivial, but that's really not the question.

The question is what you do with a setup with a few dozen devices/machines/routers/whatever.

First of all, even if you do a new setup, it's idiotic that you'd have to consider the idiosyncrasies of your ISP when designing your network, instead of choosing whatever setup fits your internal requirements best. That you possibly cannot buy a certain printer because it doesn't support DHCPv6, or whatever.

But it's a lot worse when you think about switching ISPs with an existing setup: Having to completely rebuild your network because of your ISP's idiocy is ... well, idiotic. Suppose you have a bunch of routers that do SLAAC for end devices and obtain prefixes via DHCP-PD from the uplink router. Really, all that should be technically required in such a setup to switch from one provider to another would be to unplug the old line, plug in the new line, everything should renumber automatically, while keeping the exact same network structure. Good luck reconfiguring all of that to work with a /65 ... and when you have done that, tell me again that it's a minor problem.

You don't need to set up your clients with IPv6 more than you need with IPv4. Your router will do DHCP in just the same way. To me this is only a minor inconvenience.

You might as well be saying that electrical installation is trivial, as it's just a plug you need to plug into the wall.

All the stuff that I've been talking about is what is required so that in the end, you can just plug in your laptop and have IPv6 connectivity without any manual intervention on your part. Yeah, that's how it is supposed to be. But that depends, among other things, on the ISP providing a reasonably sized prefix.

Also, there is more to networks than "the router" and "clients". You can have more than one router, you can have servers, you can have routers with multiple interfaces that are isolated from one another ... not everything is "my home DSL router with built-in WiFi access point, used by one smartphone, one tablet, and one laptop".

And I think you might be confusing SLAAC with DHCP? Those are two completely distinct mechanisms, and you don't need DHCP in IPv6 networks at all, in particular not for client systems.

lay within

I was trying to figure out where the deception played into it

Reply on news.ycombinator.com