Comment by q3k | Hacker News Reader

Comment by q3k | Hacker News Reader

Parent Full thread

IPv6 is not complicated.

128 bits of address space. Everyone gets a /64's (128-64=>64 bits of address space). Larger entities get /48's (128-48=>80 bits of address space). So everyone (you, your device, your network) has plenty of addresses to spare.

Addresses are written in hex, in the form 0011:2233:4455:6677:8899:aabb:ccdd:eeff (that's 8 groups of 16 bits -> 128 bits). If there are zeroes in an address on, you can omit them (ie. 1122:3344:5566:0000:0000:0000:0000:1234 => 1122:3344:5566::1234).

Some protocols (ARP, kinda DHCP, ICMP) are merged into a single procotol called NDP (neighbor discovery protocol).

When you're a home user, your router/gateway/CPE would get a /64 from your ISP, for example 2001:1234:4567:89ab::0/64. to use for your local devices. For example, in your LAN, your router would probably be 2001:1234:4567:89ab::1, while your devices would probably be addressed between 2001:1234:4567:89ab::2 and 2001:1234:4567:89ab:ffff:ffff:ffff:ffff.

If your router is not using DHCPv6, but instead only NDP, it would simply respond with a “we're using 2001:1234:4567:89ab::0/64 here, I'm your gateway” to every device coming into the LAN, and the device would choose an address based on it's NIC MAC and some other facts. If your router would be using DHCPv6, the exchange would be just like in ordinary DHCP (dhcp request -> dhcp reply with IPv6 address to use).

There is some extra (standarized) link-local magic with IPv6 - if you seen an fe80::0/16 address on your link, then it means that there was no IPv6 router/DHCP server on there and the devices in the LAN are establishing connection independently - but of course, without any access to the rest of the IPv6 Internet. This is also done via NDP, IIRC.

And that's basically it. No NAT. The devices in your LAN are directly routable to devices in your friend's LAN, or to Facebook's server

Stupid question time.

Is there anything in all this that can make my machine behind the router get the same address all the time? Do I manually assign it locally as with IPv4 and hope no one else in the building assigns the same IP?

Is there anything to assign IP-to-Hostname at least on the local (behind the gateway) level. Or is this handled via some other service I need to run (maybe some server that runs dns and allows machines to push their desired hostname to it).

you'd handle that in the same way you'd handle it in IPv4: either a static assignment & a tracking process to avoid collisions, or static assignments in DHCP. DHCP6 does exist, and static assignments within a DHCP scope is a very common feature.

one caveat: DHCP6 is younger than IPv6, so not all router firmwares will have gotten around to implementing it yet.

It's done automatically by your router and your OS. By default you won't need to do anything--you plug it in and it just works.

On the machine I'm writing this reply on, when I boot it up (with either FreeBSD, Linux or Windows) it gets a router advertisement from the router (which is routing both IPv4 and IPv6). It gets a standard NATed DHCP lease for IPv4. For IPv6, it combines the /64 network prefix assigned by my ISP with the NIC MAC address to compute a unique (and stable) address.

There are of course alternatives. I can assign it statically, I can use privacy extensions to periodically change the address (seems to be the default on Windows for me) or I can use DHCPv6 to use DHCP-allocated addresses (my router doesn't support this though I have done it in the past with BIND).

There are multiple ways of assigning ipv6 addresses. The original way would actually give it the same address every time (48 of the lower 64 bits was based off of the MAC address and the remaining 16 bits were fixed). This has some privacy implications though (You now can be uniquely identified by the bottom 64-bits even when you change networks), so there are other ways of doing it, including a version of DHCP for ipv6.

OK, but how do I turn it on? Why is it not turned on everywhere yet? How do I turn it on on my router, and how do I turn it on on my server? Can I just write "useipv6=true" in some config file and I am good?

Do I want to turn it on - do I get some benefit, or would I just do it for the greater good? I've heard it's actually better for the spying agencies?

OS-wise it's probably already turned on. If you take your Mac OSX or Linux PC into an IPv6 network, it will just work. There are however few such networks, because ISPs don't really givae a fuck (also they need to change their configurarion/equipment/CPEs).

Some of the nicer profits of IPv6 for hacker is that you can host servers at home, and expose them to friends/clients.

As for "spying", yes someone (a website you connect to) can figure out whether it's you or your roommate who are connecting. But they can figure that out by browser headers, anyway. This is also partially mitigated by RFC4941.

When you mentioned servers, you reminded me of something neglected from your initial writeup that's a bit important to understand: for many years, people have ran with NAT as a de-facto firewall for incoming connections to their devices. With IPv6, since the hosts are now on a routable public network, they need to have proper firewalling enabled. (It's as simple as accept related/established, deny invalid, accept icmp.)

Yes, of course.

Reply on news.ycombinator.com