IPv6 domain readiness tester | Hacker News Reader

IPv6 domain readiness tester

ip6.nl

40 pointsSami_Lehtinen41 comments

http://ipv6-test.com/validate.php is a better one. It also tests if the host can be reached. The one you submitted only tests DNS.

Not that I have any choice with regards to my ISP in my area (NYC - I'm stuck with TWC), but what ISPs in the US actually provide IPv6 support for even a majority of their residential customers?

Time Warner Cable certainly doesn't, but I was surprised to find that even Verizon doesn't provide it for many (most?) of their FiOS customers.

When pressed about IPv6 support, ISPs, typically respond that very few services require it, so it's not a priority for them. But this is a catch-22 - the only reason so few services require it is that so few people have access to it!

And the people who suffer the most aren't their customers - it's people in other countries who are forced to live behind NAT because of IP address exhaustion.

For example, the entire country of Qatar shares a single IP address: http://en.wikipedia.org/wiki/User:82.148.97.69/header

Comcast has it deployed very widely. Definitely in (most of?) SF.

Note that you need an IPv6 capable cable modem & router. Recent cable modems are mostly capable, and most (all?) Apple routers are.

Yes, Comcast provides v6 PD prefix(at least in bay area), which allows every v6-capable device in your home to have a v6 address. if your router is a bit outdated and doesn't support v6 with factory firmware (as my TP-Link router), I suggest to use openwrt 12.09(dhcp6c + radvd)

I have been playing with Comcast IPv6 at home. Being able to request a /60 is great. I can have 16 x /64 subnets on my home network. This is going to be an interesting transition for a lot of people who are used to IPv4 and NAT.

If anyone has Comcast and wants to play with IPv6, I recommend setting up a pfSense firewall/router. It has been a good learning experience. http://www.pfsense.org http://www.youtube.com/watch?v=N6vT3_2PO1w

Here in the UK there are ISPs that will give out IPv6 allocations, but most people use `miredo`, or similar, to proved an IPv6 connection to the outside world.

I host a fairly large number of domains, and I see IPv6 traffic hovers around the 5-15% level.

It's funny, I am in Germany, and I only have IPv6. IPv4 is provided over DS-Lite. So, things are slowly changing here and there.

"Comcast's IPv6 deployment continues to expand, over 25% of our customers are actively provisioned with native dual stack broadband! The following areas of the Comcast broadband footprint are now fully IPv6 enabled - Colorado, New Mexico, Minnesota, Kansas, Missouri, Maryland, Ohio, Pennsylvania, West Virginia, and Houston."

http://www.comcast6.net/

I live in a suburb of Houston and I do not have IPV6 via comcast...

I have TWC and a IPv6 tunnel from he.net. The HE tunnels are fast! Due to differences in HE/TWC peering agreements I often find that connecting to a site via IPv6 is much faster than using IPv4. I have to imagine that the NYC tunnel endpoint is fairly close to you (network wise, not geographically.) Try ping/tracerouting to tserv1.nyc4.he.net

Actually Time Warner is kinda rolling out IPv6 support in a way that makes me think that it might not be too far away. I think I've even caught them live-testing features in my area, sometimes.

I can (sometimes) get an IPv6 address from them, although it appears to always be in some kind of weird non-routable mode. I don't know enough about ipv6 to say exactly what is going wrong. Once upon a time I actually managed to ping -6 some external hosts, but when I came back a day later, it stopped working. Weird.

http://www.timewarnercable.com/en/residential-home/support/t...

Is the address you're getting a fe80::/64 address?

Because that is a "link local" address that gets automatically assigned to any IPv6-enabled interface.

It appears to be semi-legit, in this block: http://myip.ms/view/ip_ranges6/60/2605:e000::_2605:e000:ffff...

http://www.worldipv6launch.org/measurements/ has some numbers for % of traffic to major sites (google, facebook, yahoo, akamai, etc) from each ISP that goes over IPv6.

Some major US ISPs: Comcast: 20.61% AT&T: 13.53% Verizon Wireless (not FiOS): 40.03% Time Warner Cable: 3.88% T-Mobile USA: 9.58% Google Fiber: 71.87%

Very large ISPs have been deploying it because it actually simplifies their internal networks (which can be too large for RFC1918 space) and because carrier grade NAT is expensive.

Comcast has rolled out IPv6 en-masse. I have IPv6 using their service.

They have not rolled out IPv6 en-masse. I have Comcast and I do not have IPv6. They have only rolled it out to certain states, what amounts to about 25% of their customers[0] (as of December, might be much higher by now but still not 100%).

[0]: http://www.comcast6.net/index.php/8-ipv6-trial-news-and-info...

I assume "actively provisioned" doesn't just count Comcast's own network; the customer has to meet them halfway, and install an IPv6-compatible modem and router.

From that viewpoint, 25% seems quite impressive.

Ah, fair enough, I didn't think about that.

"For example, the entire country of Qatar shares a single IP address"

Which is ridiculous of course.

Unofficially IP addresses can be bought and defacto transferred. They could certainly given a budget do that despite what it says here:

http://www.apnic.net/services/services-apnic-provides/helpde...

Ok here it is (and I also have other personal knowledge of this happening):

http://www.networkworld.com/community/blog/microsoft-pays-no...

http://ip6.nl/#!mi5.gov.uk 0 stars http://ip6.nl/#!fbi.gov 3 stars - yay hope http://ip6.nl/#!cia.gov 3 stars again

My ISP, nope, BBC again no. Would appear the UK in no rush to move into IPv6, least publicly. Bet some people wondering what IRC is like over IPv6 and others wondering why Snowden never warned us about the lack of intelegence support of IPv6. If he did, then things would improve, but until people are forced into a corner then nothing will change.

I just think it is sad how IPv6 could of been and still can be pushed via mobile phone usage and in that case it is an area which makes 4G voice calls and easier from what I have heard (least networking level). Certainly the need is there in the mobile market, just support elsewere and it is not even a chicken and egg situation more a case of slowly dripping into excistance.

That all said it is such an investment in skills and effort for a demand that can just use an alternative. That and the NAT been abused so well that the biggest area (mobile networking) has been fine without it. Just makes it hard to justify, even if current hardware and software support it. One does not just go IPv6 overnight without some business tears.

Cloudflare offers transparent IPv6 support for the sites using it. It's just not enabled by default.

And news.ycombinator.com runs on Cloudflare, with IPv6 disabled. I weep for the future.

letting the admins know that the option is available is probably a good way of changing this. (http://ycombinator.com/contact.html)

Okay so the domain my site is run off gets 0 of 5 stars. I know my VPS provider has ipv6 support, so how do I close the gap?

If your VPS provider has it, usually you need to set up the given static address (from a /64), there won't usually be any autoconfig. Sometimes you have to turn it on per VPS in some management settings.

Looks like: IPv6 addresses for NS (nameserver) and MX (mail exchange) records, and root and www subdomain. Looks to check DNS responds to queries over IPv6, too. Easy mode to get at least four stars: enable IPv6 with a free Cloudflare account.

1) make sure your services listen on ipv6 and configure them accordingly if they don't. Watch out for things like virtual hosts and TLS configuration.

2) Add firewall rules to allow inbound traffic over ipv6 if they don't already exist. If using ufw (default in ubuntu), check that `ufw status` lists entries for ipv6.

  # ufw status
  Status: active
  
  To                         Action      From
  --                         ------      ----
  OpenSSH                    ALLOW       Anywhere
  80/tcp                     ALLOW       Anywhere
  443/tcp                    ALLOW       Anywhere
  OpenSSH (v6)               ALLOW       Anywhere (v6)
  80/tcp                     ALLOW       Anywhere (v6)
  443/tcp                    ALLOW       Anywhere (v6)

Allowing inbound https connections over both ipv6 and ipv4 is as easy as typing

  ufw allow 443/tcp

If you're managing your firewall rules by hand, do NOT block icmpv6 as it will break connectivity.

3) add a AAAA record pointing to your vps' ipv6 address to any domain name pointing at your vps. To find that address, use a command like

  ip -6 address | grep global

on your vps.

Make sure the TTL of your AAAA records matches that of your A records.

If you're hosting your own mail server, make sure your MX records point to host names returning ipv6 addresses. If using SPF, you'll need to add ipv6 addresses to your records as well.

4) Check that your DNS records return both ipv6 and ipv4 addresses, i.e. host should return something like:

  $ host www.rackspace.com
  www.rackspace.com is an alias for www.wip.rackspace.com.
  www.wip.rackspace.com has address 173.203.44.116
  www.wip.rackspace.com has IPv6 address 2001:4801:1221:101:1c10:0:f5:116

Changes in DNS can take time to propagate (depending on the TTL of your records), so give it a couple of hours if records don't show up right away,

5) test that your services are reachable and working as expected over ipv6. You can use ipvfox (firefox) or ipvfoo (chrome) to make sure that ipv6 was indeed used to reach your web server. curl -6, ping6, telnet -6 are also good to test/debug.

To see what services are listening on ipv6, use nmap to run a portscan (from a different machine than the vps itself).

  nmap -6 -P0 -T4 -p0-65535 <domain name or ipv6 address>

6) if you have any kind of monitoring set up to check on your ipv4 services, add monitoring checks for ipv6 as well. Way too often people forget about this and are not notified when their ipv6 setup breaks.

7) run http/https checks with http://ipv6-test.com/validate.php to ensure that connectivity is OK.

Hope this helps :)

Hmm, 2 out of 5 stars only because the nameservers (which are commonly only queried by recursive nameservers such as your ISP's) don't have AAAA records? I tried disabling IPv6 some time ago, and my site was one of the few still working next to Google services and a select other few. The recursive DNS servers did all the v4 work for me.

Sure, 4/5 stars because I don't have one of the items (v6 nameservers), but 2/5? The second point is inherent from the first, and www.lucb1e.com having no AAAA record is no problem because I don't use it (and it's resolved now, they cache results).

Not even Amazon has ipv6 dns entries. So it cant be very important.

I can now say Amazon supports IPv6 internally throughout most of the infrastructure.

Please, github, enable ipv6. Please.

What's so special about github?

Its the only service that stops me being able to run test machines ipv6 only. Everything else I need supports ipv6 already. And hey they have loads of people, surely one of them is interested...

Just install NAT64 on the network so that they can reach ipv4 if needed

As far as I can see I would still need to run ipv4 NAT in order to get ipv4 addresses for NAT64, so it doesnt really seem worth it.

One per network is fine though, you can run thousands of hosts behind one ipv4 in nat64

OK will try it at some point...

It was a disappointed to find my host, Digital Ocean, does not support IPv6: https://www.digitalocean.com/community/questions/is-ipv6-ava...

After I made an effort to get configure it within Nginx I was hoping things would work.

Hurricane Electric tunnel broker: https://tunnelbroker.net/

They only check the DNS server and DNS entries, not actual connectivity. No attempt is made to verify whether your mail and web servers are actually reachable over IPv6.

So, facebook's IPv7 is 2a03:2880:2110:df07:face:b00c:0:1

Reply on news.ycombinator.com