Hacker News Reader

Comment by xlmnxp | Hacker News Reader

Hetzner should provide free CGNAT IPv4 Addresses (IPv4 Gateway) for IPv6-Only VMs

A whole lot of ISPs are doing CGNAT for IPv4 now, mostly in Asia. Starlink does it. It's mostly OK but has a lot of drawbacks, particularly IP-based geolocation. (Starlink does not support IPv6 although they seem to be rolling it out this month.)

My ISP (Metronet, Ohio, US) uses CGNAT. I’ve had their service for about 15 months now, and it has been pretty much uneventful. Maybe a handful of times I’ve gotten a captcha on something, but for the most part, it’s just fine. I also don’t see thousands of blocked connection attempts a day either, so there is a plus side. I just use Tailscale should I need to access anything at home while I’m away.

Being behind CGNAT has downsides yes, for example being unable to ever host anything; you become relegated to a consumer who's dependent on the big hosting companies to ever have an Internet presence. But geolocation? I don't want everyone to be able to get my location! Breaking IP-based geolocation is a benefit of CGNAT, not a drawback.

It's a huge PITA though. I'm near Sacramento but my IP looks like it's in Los Angeles. It screws up a surprising number of things, particularly local TV streaming services.

IP geolocation is a bad idea for lots of reasons. Unfortunately it's also a reality of how services work.

47.57% of observed requests coming out of as14593 is ipv6, as of two days ago: https://twitter.com/noIPv6/status/1600527249282895879

& to be clear, that is CRAZY growth!

edit: that's traffic to monitoring resources, not in general, sorry /facepalm

IP-based geolocation is fundamentally broken. Making it visibly broken in more cases is good.

Communal ipv4 is very problematic for certain services due to bad neighbors causing it to be blacklisted.

Not for hosting services, but for things like accessing Github.

That's GP's point. Service providers will block the IPs of abusive clients. If those clients are your cg-nat neighbours, you're blocked with them.

Try accessing the web through TOR and you see why public, shared IP addresses are quite a hassle in practice. Exit nodes don't host anything either, after all.

Actually, that's not even that bad a way to get IPv4 on any IPv6-only host: route it all through TOR!

this sounds like a valid argument for deploying ipv6 wherever you can, tbqh

cgnat is only going to get MORE common, globally

Just to specify the kind of "should": But they don't, do they? Same with vultr, their ipv6 boxes have no outgoing IPv4 connection route.

Reply on news.ycombinator.com