Hacker News Reader

Comment by jcgl | Hacker News Reader

> If ISP would have deployed IPv6 early enough in time, like deutsche Telekom had a properly IPv6 network ready in 2012 or even before.

I think you forgot half a sentence here. What was your point?

> And dual stack is no issue.

How can that possibly be so? Having enough address space to comfortably architect gives you room for far superior topologies, meaning that running dual stack at the bare minimum means that either your IPv6 topology is being compromised to map cleanly to your v4 topology, or that you're running two different topologies altogether. You need two times the sets of firewall rules, two times the number of address configurations...everything in your infra roughly 2x.

> All these transitions methods are far to expensive and an unnecessary overhead.

How so? Running 464XLAT on a device with a proper CLAT has minimal overhead, and the PLAT is no worse than running a NAT for IPv4.

View on HN

Running nat on ipv4 is no worse than running a stateful firewall on ipv6 only, I don't get the complaints about it. Modern firewalls do far more with deep packet inspection, SSL unwrapping etc. NAT is a hardware function on enterprise access switches let alone firewall layers, any home router would have to do firewalling at their router anyway.

Well performance really isn't something I would point to at all. While I believe it can become problematic with great scale (e.g. those expensive CGNAT boxes), it's more the architectural and connectivity aspects that are problems:

Architecturally, dealing with two different address spaces is a complication. A flat address space is easier to reason about and more flexible. This is amplified by the fact that IPv4's RFC1918 address space is very small. Have you ever had to merge IPv4 networks from different companies? It's rarely the case that they don't have overlapping ranges.

Connectivity-wise, stateful IPv6 firewalling is very different from NAPT in IPv4 because the applications cannot reason about the ports being used (without rendezvous servers).

> Architecturally, dealing with two different address spaces is a complication

I completely agree, which is why dual stack is terrible.

> Have you ever had to merge IPv4 networks from different companies? It's rarely the case that they don't have overlapping ranges.

Dual stack doesn't solve that

> stateful IPv6 firewalling is very different from NAPT in IPv4 because the applications cannot reason about the ports being used

The source port is ephemeral for almost all applications, and I can't think of a good reason it wouldn't be, just legacy crap

I'd love to have an ipv6 only network with NAT66 at the boundary, at home and at work, but while it still requires ipv4 I don't see the point.

I'm not advocating dual stack either. Like I said in my other reply to you, I am suggesting IPv4-as-a-service using standard translation technologies and architectures.

Reply on news.ycombinator.com