Hacker News Reader

Comment by dsjoerg | Hacker News Reader

Maybe I'm not the only one wondering why I should bother to enable IPv6?

If you have that mentality, we'll never get off IPv4. If that happens, ISPs won't have a choice but to implement Carrier Grade NAT. That's bad for a lot of reasons, but mostly because many homes share the same address. Implementing IPv6 means every device in the world has a unique, globally routable address with all ports open (no NAT).

That's pretty cool. However, we can only do this if we get over the chicken-and-egg problem, which is why it's important you enable IPv6 and encourage others to do so.

If I want to pirate content, your Carrier Grade NAT looks quite attractive as a legal shield!

I'm not entirely sure if CGN will provide some legal protection for pirates but it might make it harder to pirate content as you cannot open ports on CGN meaning BitTorrent will have less seeds which slows downloads. Afaik, IPv6 will make piracy extremely easy as UPnP won't be a requirement. Want to share a file with some friends? You can quickly spin up a web server, send them the URL and it'll just work.

You still need UPnP or something, otherwise your IPv6 default firewall policy (allow out deny in) is going to block inbound connections.

Yes, it's easier to hole punch, but a webserver won't do that.

And if you're manually configuring a firewall, I'm not sure "allow port 80 <someIPv6>" is any easier than "forward port 80 to <someipv4>.

What am I missing?

I think you are missing a lot. For instance, I have IPv6 set up at home, at work and at some homes of friends and family. I have firewall rules setup such that traffic from subnets I know is generally allowed instead of allowing access to a single port for the general internet. I also have DNS set up with names like computername.sitename.mydomain.tld

That allows me and the people I know to connect to each other's machines in a way that wouldn't be possible with IPv4 and NAT. I can be at my brothers and type \\[fqdn] in explorer and it will just work. To me, that is the way the internet was meant to function from the beginning.

If you're able to configure firewall rules, you're well outside of any normal users able to make up a significant amount of P2P traffic. And to most users, port forwarding and configuring a firewall rule are nearly identical.

Truth is that for most users, NAT today is almost always synonymous with a firewall that has deny in, allow out policy.

10+ years ago, a lot of folks often connected their machines to the Internet in the way you specified. You could go around scanning people's systems, viewing their fileshares and so on. NAT "fixed" a lot of that.

First off, good luck trying to implement any kind of decentralized network service when almost nobody has a globally routable address.

Second, if ISPs are willing to keep records of IP-address-to-customer mappings, it's not much of a stretch to add TCP/UDP ports to those records as well.

The IETF has (sadly) specced logging of cgn associations for surveillance purposes.

> Implementing IPv6 means every device in the world has a unique, globally routable address with all ports open (no NAT).

Not necessarily. I've configured my IPv6 firewall to block all the things except for specific ip:port pairs. I didn't feel like leaving my network totally open.

You setting up firewall rules at your gateway has no influence on whether an address is routable or not.

IPv6 gives you the ability to make that choice for yourself rather than having it foisted upon you.

Indeed, in this case (and I'd imagine in most cases). IPv6 also gives your ISP the ability to make that choice for you; some ISP's, for example, block ports 25 and 80.

Because you will be excluding connectivity. Maybe you think that only affects far off places and not your stuff and your networks, but be aware that many mobile networks are using IPv6. The number of mobile devices keeps increasing. One day you (or the boss) will get a new device and it will have connectivity problems. Google and Facebook will work just fine.

Sure there is NAT and various other things carriers and ISPs can do, but that will increasingly be the slow path, and possibly even charged for.

You can put your head in the sand, only to have this issue bite you badly and urgently one day, or you can start now slowly but surely making sure everything appropriate is done. For example you can make sure purchases of equipment and software claim to work correctly (how will your VPN work?), do whatever training is necessary etc and gradually add IPv6 to your infrastructure and clients.

Mobile networks use IPv6, but they also NAT to IPv4. So unless there's financial pressure, it's unlike his IPv4 will stop working. Maybe one day in what, 15? 20? years your statement will be true.

It may take until then until IPv4 stops working, but it will be before then that it becomes less optimal, and possibly more expensive. Heck I already experience slowness due to some freshly installed systems trying IPv6 first (DNS lookups, connection attempts) and only on failure falling back on IPv4.

Enabling IPv6 for content motivates ISPs to enable IPv6 for users, and vice versa; it's a positive feedback loop.

Consider an ISP with Native IPv6 and NAT'd IPv4. (T-Mobile and Verizon Wireless are specific examples in the USA.) When you dual-stack your server, that traffic no longer needs to traverse the NAT, so users may see better performance.

There's no way to avoid NAT in general, because there simply aren't enough IPv4 addresses to go around, but ISPs should be able to deploy NAT equipment with the assumption that the operational costs will decline over time as IPv6 becomes more popular.

Putting stateful NAT boxes everywhere is antithetical to the concept of a free, neutral network, so we should all be striving to make the alternative viable.

Reply on news.ycombinator.com