Comment by cyberax
2 days ago
IPv6-only is not a reasonable assumption for the next 10 years or so. Networks must support IPv4 for the reasonable future in some form, just because of a huge amount of V4-only IoT devices with long expected lifetimes.
But anyway, ULA vs. GUA preference is mostly an academic question. In practice, you can just squat on an unused IPv6 range and avoid the precedence issue.
The deeper problem is that the solution to IPv6 problems appears to be NAT. And we're switching from IPv4 to avoid NAT. And you'll need a stateful firewall for IPv6 anyway (it's a recommendation for SOHO, there's an RFC for it, too lazy to dig it up now).
I'm stubborn, so my house now has its own ASN, a PI block, and a DIA connection to two ISPs. Which is the only NAT-less way to achieve my goal.
> One of the other comments around here about not providing a “migration plan” does have a lot of truth to it. If, 30 years ago, they envisioned 464XLAT and made it part of the default features a v6 capable router should have, I bet v4 would be long dead (or nearly there) by now.
464XLAT (and its evil twin IPv6 RD) were envisioned in the early 2000-s. Along with about 20 various "migration plans". They all missed the point, though. Some people are still missing it.
The key to migration has never been some form of tunneling. The key to migration is making IPv4 and IPv6 coexist side-by-side, in other words, the Happy Eyeballs algorithm. It should have been reified to the TCP level in the late 90-s. So that applications could just do: `connect("somehost.com", 80)` and transparently get either an IPv4 or IPv6 connection, depending on whichever one works better locally. Other operational headaches like the ULA priority would have surfaced much earlier then.
>IPv6-only is not a reasonable assumption for the next 10 years or so. Networks must support IPv4 for the reasonable future in some form, just because of a huge amount of V4-only IoT devices with long expected lifetimes.
I’d say it’s a perfectly reasonable assumption. Why? In practice most mobile carriers (notably T-Mobile USA likes to discuss it) are entirely v6 only, with 464XLAT at the edges.
If mobile carriers can do it, and support $billions of devices, it does work, and works well.
If you do have any v4-only IoT trash, put it on its own VLAN (where all the IoT garbage should be no matter what anyway), and let that sole VLAN have v4 addresses.
>But anyway, ULA vs. GUA preference is mostly an academic question. In practice, you can just squat on an unused IPv6 range and avoid the precedence issue.
Totally, but it’s not a good practice to do, even if the risks are generally low. I don’t like to recommend it.
>The deeper problem is that the solution to IPv6 problems appears to be NAT. And we're switching from IPv4 to avoid NAT.
No one should be using NAT with v6 except in extremely limited circumstances. NPT is not NAT, the host portion of the network and, more importantly, the port do not change with NPT. Many of the issues of working around NAT on v4 just don’t exist with NPT. The only “real” limitation with NPT is global address discovery. (Which you’d also have with squatting, and one of the many reasons you shouldn’t do that).
>I'm stubborn, so my house now has its own ASN, a PI block, and a DIA connection to two ISPs. Which is the only NAT-less way to achieve my goal.
I’m very close to doing something similar. There’s an ISP POP that has a few Colo racks about 5 miles away that has clear radio line of sight to my house. I’ve strongly considered using a PtP radio and putting my home internet connection at the POP, just so I can use BGP with my own space to resolve this issue to my satisfaction. The alternative is tunneled connections to where I can use BGP and all of the headaches that go along with that.
>464XLAT (and its evil twin IPv6 RD) were envisioned in the early 2000-s. Along with about 20 various "migration plans". They all missed the point, though. Some people are still missing it.
Doesn’t matter when it was envisioned if it’s not a “just works” tech. There’s a silly amount of minutiae you have to work through to make it work. It should be as simple as enabling it for a VLAN and assigning v4 addresses to the XLAT on a router. Except for rare cases, it’s not the easy. It should be though.
>The key to migration has never been some form of tunneling. The key to migration is making IPv4 and IPv6 coexist side-by-side, in other words, the Happy Eyeballs algorithm. It should have been reified to the TCP level in the late 90-s. So that applications could just do: `connect("somehost.com", 80)` and transparently get either an IPv4 or IPv6 connection, depending on whichever one works better locally. Other operational headaches like the ULA priority would have surfaced much earlier then.
That is effectively how it works, they can coexist together, but it is significantly simpler to only use one. I do agree with you on the ULA priority though. Was a moronic decision to place that below v4, likely again, a lack of imagination on their part.
> If you do have any v4-only IoT trash
If it works and gets the job done. Who are you to call it trash? Are you happy to pay a few million dollars for me to upgrade my infra?
Most things IoT are trash, the v4 only special kinds are even bigger pieces of trash.
If you happen to have millions of dollars worth of v4-only IoT devices, that sounds like a you problem. v4 exhaustion has been known for decades, IoT devices that don’t support v6 were ewaste before they even left the factory.
2 replies →
> I’d say it’s a perfectly reasonable assumption. Why? In practice most mobile carriers (notably T-Mobile USA likes to discuss it) are entirely v6 only, with 464XLAT at the edges.
Carriers have their own specific challenges. Like not having enough private or even squattable IPv4 space for the voice circuits.
> If mobile carriers can do it, and support $billions of devices, it does work, and works well.
Mobile devices are actually pretty much the best case for IPv6. The phone environment is standardized and highly controlled. And yet some telecoms still don't provide end-user IPv6, even when the voice circuits use IPv6.
> No one should be using NAT with v6 except in extremely limited circumstances. NPT is not NAT, the host portion of the network and, more importantly, the port do not change with NPT.
This is really a distinction without difference. In practice, SOHO border routers have to be stateful to provide meaningful security for UDP-based protocols like SIP or QUIC.
> That is effectively how it works, they can coexist together, but it is significantly simpler to only use one.
The socket API still doesn't allow this. You have to implement Happy Eyeballs on the app level.
> I do agree with you on the ULA priority though. Was a moronic decision to place that below v4, likely again, a lack of imagination on their part.
If you want to look at politics, this was a compromise. There was a strong faction of "network fundamentalists" in the IETF that had a vision of a transparent end-to-end network with global addressing. So that a lightbulb in China could connect to a toaster in the US at will. So they resisted anything that could promote locally isolated networks.
But most of the IETF had a clue and actual operational experience, so they pushed for things like the ULA and PI space for IPv6. So we got these compromises that don't work well as a result.