Comment by shubhamjain
21 hours ago
India: 47M
China: 358M
Both countries have roughly the same population. The IPv4 problem has been swept under the rug with CGNAT and a normal person doesn't even notice it. But it sucks. Forget having a dedicated IP, even on a broadband connection, you don't get a public IP that's truly yours. According to IPInfo[1], there are around 1,000 users sharing my IP. I get flagged for malicious activity, and online gaming is impossible without a Tailscale relay.
Of course, much of this comes down to the bad luck (+ policies) of developing late, when most IPv4 blocks had already been allocated. But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks they'll probably never fully use, and may never sell. Meanwhile I am sharing a single public IP with a thousand strangers.
[1]: https://ipinfo.io/223.233.77.184
[2]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
PSA that if you have a ham radio licence, anywhere in the world, there are IPv4 addresses available for you for the taking at ARDC (AMPR)[1].
You can either get a block of /24 to announce yourself (you've got to cover all the technical setup and costs of this) or use their free 44net.connect service and just organise a wireguard tunnel.
You cannot use it for anything commercial.
[1] https://wiki.ampr.org/wiki/Main_Page
I have looked into acquiring an ipv4 block many times but never came across this. Thanks for the lead!
> But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks
Maybe Apple and Ford, but it's more than fair that DoD has large blocks since they created ipv4 to connect themselves to other networks. It was only 10 years ago that the US government decided to give up control of IANA.
Sure there's historic reason that the DoD has such a large block, but it is definitely unfair in the modern world. There is no way they need or will ever use their massive block of addresses. They have 13 different /8 blocks, ~218 million unique addresses, that's over 5% of the entire IPv4 address space.
The modern paradigm you're using as a comparison only exists because this network designed for the US military industrial complex was so freely open and fair that it is now used by everyone.
There were and still are are other global networks -- none of them come close to being anywhere near as open or interoperable. What's the next closest, PSTN maybe?
Seen differently, it’s fair for a founder who has relinquished most of their control over the system to retain 5% equity ¯\_(ツ)_/¯
You can always just use IPv6 where there is plenty of address space available. You can even get a /44 as a hobbyist easily
I have no deep ip knowlede, but if the companys do not use those addresses , cant we just use them an snatch away those unused addresses?
Nobody will peer with you if you start announcing addresses you don’t own, so there’s no way to make those addresses reachable on the public internet.
My take is that the solution here isn't "give India more IPv4 addresses", it's "force more Americans onto CGNAT", so that it becomes untenable for service providers to treat IPv4 addresses as if they're tied to a single user, and to encourage people to use IPv6.
s/IP/IPv4/g
Configuring my OS to prefer IPv6 addresses of DNS responses significantly reduced the number of web captchas I see (on NAT444 with native IPv6).
IPv4 is old and broken, use IPv6.
I'd love to do that, if my ISP would provide me an IPv6 address. Windstream doesn't provide IPv6s. They did a trial a few years ago rolling it out and then undid it.
It's crazy I can get fiber to my house in the US, but not IPv6.
iirc, hurricane electric was offering IPv6 via tunnelling somehow.
https://tunnelbroker.net
I was doing this back when I had BT in London, my internet speed back then was pretty abysmal and it would randomly drop routes- ironically this tunnel actually improved my internet (because of the routes not being dropped, not the speed).
5 replies →
Try getting a /24 these days without paying a fortune. We NAT everything and still wait for IPv6 because the ISP CPE barely supports it. Land analogy is apt, landlords everywhere.
My ISP is only a few years old, but they don't support IPv6 at all. And when I complain about it to support, their response is basically "we don't see the point".
Practically everything on IPv6 also has a IPv4 address you can use instead. Adding IPv6 just adds more that can go wrong.
3 replies →
This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6
> Most security conscious operators would only allow IPv4 instead of IPv6.
I strongly disagree. That's obsolete knowledge, thrown around by people who want to be considered security conscious but haven't actually updated their knowledge in many years. A statement with similar implications might be "security conscious operators require their users to rotate their passwords monthly", which is what a lot of people use to think a decade ago, and now what it really communicates is that you're talking to a dinosaur.
7 replies →
Most IPv4 "security" is a side-effect of NAT. NAT was not intended as a security feature, but it does provide a level of security in the common consumer implementation (PAT, single external IP, unroutable internal network.)
Otherwise, what are the practical differences?
There's more that's been written about configuring/protecting IPv4 networks and if you learn about network security from a mentor or from coworkers at a job, rather than reading books/the internet/LLMs, you're more likely to learn about IPv4 security.
But if you've ever had to deal with endpoint security, if you're just doing static rule based blocking/throttling, /32 or /24 blocking is often your best option. Thanks to CGNAT this often means having a pretty large impact since an ISP's residential customer might end up getting randomly assigned a "bad" address and the cooldown for these rules is often months long or more.
In IPv6 land, you can just block a /128 or even a /64 and rarely hit anyone else in the crossfire.
1 reply →
> IPv4 is old and broken
IPv4 is old, very old. But how is it broken? It's literally been working just fine since it came out.
That there are limited addresses is something else: it doesn't mean it's broken.
I don't care that spying/surveillance devices have more trouble spying on me with IPv4 than with IPv6 and I don't care that some apps have a harder time establishing connection.
IPv4 works. SSH over IPv4 works. Browsing the Web over IPv4 works.
IPv4 stopped working fine some 30 years ago. The invention of NAT was caused by IPv4 not working fine (RFC 1631 was written under assumption it's a temporary solution). Hole punching is a thing solely because IPv4 stopped working fine. Much like Y2K, the reason IPv4 appears to work fine is because absolutely massive engineering effort was put to work around the parts that don't work fine.
> IPv4 is old, very old. But how is it broken?
It is broken for you by upstream NAT and CGNAT.
21 replies →
There is no need for that, every modern OS prefer IPv6 over IPv4
Depends on the application, a web-browser that implements Happy Eyeballs protocol may prefer IPv4 if the IPv6 latency is higher.
4 replies →
What I really don't understand is IPv6 has been around... decades now... why the heck havent we started forcing it more and more?
Second system effect. It's way more complicated
Replicating even a simple ipv4 lan with mostly stable local addresses and some isp uplink is pretty complex, even assuming all the devices involved support ipv6, which they wont
It's much easier to run a dual stack with v4 for ease of use on the lan and v6 as an additional address that can change whenever and is only used to reach the wan
But the main reason you'd care would be if you can't get a public ipv4 address to NAT to. And if you can't get that, some of the internet breaks anyway.
A large chunk of IT people don't understand it. So they don't demand it from their vendors. The vendors see the lack of demand so they spend fewer resources on it. When someone wants to implement IPv6, they see the limited vendor support and decide against it.
The last three companies I've worked at have all been IPv4 only. I set up IPv6 in our lab, but neither the SCADA software nor the PLCs we use support it at all, and none of my coworkers can troubleshoot it if problems pop up.
I've got a buddy that's a technical manager at an ISP and he'll straight up tell you they don't do IPv6 because he and his people don't know it.
Yep. I run into "enterprise" cloud environments where IPv6 is disabled, all the time. The sad thing is IPv6 is easier to understand than v4, just based on subnetting practices alone. The real problem is the average "IT" person doesn't understand hexadecimal.
1 reply →
It's definitely a slight learning curve (a few days at most for basic understanding and troubleshooting). I can't speak to complexities like routing protocol configurations.
But goodness, the infinite-subnets-of-same-size glitch is so amazing. I see companies all the time that struggle to subnet their sprawling enterprise. Different subnet sizes everywhere, fragmented networks, subnet migrations to try to defragment, so on.
Many orgs are so short-staffed and staffed with mediocre talent that they spend their days fighting fires and keeping their flawed current practices operating just well enough to keep the lights on and not cause outages or security breaches. Things like "optimizations" and "redesigns" of the IP stack, even in 2026, would be a 5-10 year journey without a dollar sign benefit attached to it. So they limp along until the transition is seamless and necessary or monetarily desireable.
1 reply →
Early bad experiences made a lot of people reluctant to try again.
There's a lot of edge cases to bite people still.
That said, something like 50% of users have working v6 now, which helps to file down the edges. Growth of v6 in the last 10 years has been much more significant than the previous 10 years. I suspect the next 10 years will be pretty significant, too.
I don't think many organizations are in a position to force adoption though.
You have mandates from say US government for government services and vendors and similar in some other countries. Some countries can force it through strong regulations on equipment sales. And then there's Jio (and maybe other ISPs) that have significant market power in some locales and a significant lack of v4 resources and can strongly encourage vendors and partners to support v6 for better service to users on their network.
We're 10 years out from the Epochalypse as well. Past a certain point you need a governing body to intervene to force the issue in advance of problems with systems, and we've got a dearth of functioning governments these days.
IPv6 brings more address space but also a whole bunch of other stuff, it is much more complex and changes basically everything to how you manage a network. The fact that it's not been widely adopted after 30 years indicates that people generally think the tradeoff is not worth it.
From my readings and limited experience, it's two things.
First, IPv6 in the 90s and 00s is different from IPv6 today. Various extensions and standards have been added that make IPv6 administration easier than it was in the early days. I want to say RDNSS is one of them. Background: one of v6's early selling points was SLAAC, where DHCP could be disposed of and endpoints would auto-configure their own IPs in accordance with the network announced by a router. Problem is, without DHCP, there was no way to get DNS, and DHCPv6 wasn't widely deployed/it was discouraged... so how does one get a DNS server automatically? RDNSS came around to announce DNS servers from the router directly.
TLDR: Early IPv6 sucked more than today.
Second, it's simply a chicken-and-egg problem, particularly at the consumer network level. User-friendly IPv6 router configurations are still rare for home routers, and ISPs have simply dragged their feet. At this point, if we're going to have government mandating all manner of things for consumer products, we should be mandating IPv6 support on home routers and that ISPs delegate at least a /60 to each customer.
You mustn't be on HN very often. People constantly complain about IPv6 being less secure because it doesn't have NAT. And that's part of the reason. Fear and misinformation keeps demand low. The same people don't drive IPv6 implementation where they work, so their fear impacts more than 1 person.
Attempts to force it get routed around.
China mandates IPv6. So does the US, but the US drags their feet. Meanwhile in Europe it's near universal even though not mandated and no v4 shortage.
>Meanwhile in Europe it's near universal
False: https://stats.labs.apnic.net/ipv6
On HN, 'In Europe' means in one person's particular locale based on their experience and generalised across a continent of about 30 countries. But it's always better than in the US of course.
2 replies →
Unless I've missed something, the US only mandates it for government networks. I don't think there is any mandate for private entities to implement it.
A residential network that can't connect you to government websites is called a fraudulent business model. No different from selling a car that only transports up to 20kg.
1 reply →
I wish, just 37.73% of IPv6-capable users in Europe according to APNIC despite much higher availability in transit AS. Highest subgroup is Western Europe at around 72.09%, which is still far from near universal. Similar per-country numbers from Cisco.
A lot of the original /8 holders have sold off chunks to AWS and other cloud providers.
Bell in Canada continues to offer only IPv4 on their fibre network. I fully expect for them to somehow crap up the transition to IPv6 by putting up CGNAT because fuck you, customer.
Fascinating. The resellers, particularly TechSavvy have ipv6. For TechSavvy I believe it was dynamic /64 by default but static /56 for free on request.
> For TechSavvy I believe it was dynamic /64 by default but static /56 for free on request.
"On request" meaning you told your CPE equipment to send a DHCP-PD packet, i.e., you didn't have to call them and ask for something special with your account.
Wow I didn’t know CGNAT was a thing for home users.
It's something I've only recently been made aware of as well. Shocked we're not seeing more push for ipv6 everywhere given that it sounds common enough. If I don't have an IP address, I'm not getting the Internet I'm paying for; I'm getting access to a network that happens to itself have a connection to the Internet. Not unlike some of the BBS's in the early 90s which had Internet access -- I might be dialed in, but that didn't mean my computer itself was on the Internet.
I can't tell if this is sarcasm, Poe's law and all.
But if you are living in a Western country, then you are probably blessed with CGNAT-free residential internet.
I don't think it's sarcasm, I didn't know this was a thing either! At first, I thought OP was writing about their mobile connection.
Some carriers in my country have recently started to share the same IP between 4 customers, each having a port range (1-16363, ...), but you can always request a full IP for free.
4 replies →
In Sweden CGNAT was not a thing for a long time, the large incumbents still have their huge blocks of IPs so its "just" go to them if you want a pulic IP. Apparently smaller ISPs do use CGNAT, so its fairly common.
Me as somewhat of a nerd, even doubt if I need a public IP, seeing how cyber security is looking today.
I think CGNAT is the default for new connections in .au, since about 5+ years, at least among "younger" ISPs that popped up around the national broadband network crawlout.
You can generally request to get off it though, at ~1-5$/m extra cost.
1 reply →
> "India: 47M
> "China: 358M
> "Both countries have roughly the same population"
To save anyone else curious from looking it up - their populations are about 1.4 billion (1400 million) each.
and one of the countries has an over-reported while the other is underreporting
i purchased a dedicated ipv4 from my isp.
Most people don't care about a private IP, which is why they cost about $20-$25 each (which would be about $2 a year to finance). I've used Airtel in the past and they certainly offer a dedicated IP. Currently I'm with TATA and Vodafone in India
Indeed a shared IP is arguably a benefit in that it makes fingerprinting harder.
If your ISP had customers who were interested it could spend $150k on a /19 block giving 8000 IPv4 addresses and charge an extra ₹100 a month for them and after two years it would be in profit.
In fact I think Jio and Airtel offer static IPs for residential use for something like ₹300 a month, which given how cheap IPv4 addresses are is a massive money spinner, but I have't spoken to anyone living in India about ISPs for a couple of years.
End users do notice CGNAT when their internet voice/video calls keep dropping for no apparent reason.
CGNAT is awesome, you cant IP ban me anymore and I dont need a VPN turned on for silly things, and I can control fingerprinting (mostly), CGNAT is great for anonymity. If I want a static it cost me ~10.00 a month, im fine with that.
On the other hand, sometimes you get randomly banned due to someone else’s action on the CGNAT IP. Wikipedia is an obvious example.
Thats the only site Ive encountered issues. Im okay with that. I dont think they just let anyone edit anymore anyways.
an ipv4 for every man woman and child!
what is the meaning (or units) of your first numbers?
"swept under the rug with CGNAT" is a really funny way to say "solved by IPv6"
Yep. And, insult to injury, the /4's and /8's of little-unused IPv4 special-use addresses - https://en.wikipedia.org/wiki/Ipv4#Special-use_addresses
Diamonds and IPv4 share a common trait.
Lab-grown diamonds found a strong role as industrial components, which expanded overall demand for diamond materials and widened their use cases. IPv6 may follow a similar path, with adoption concentrated in newer and novel applications where IPv4 addresses were scarce.
IPv4 seems likely to remain in place for many existing applications, much like natural diamonds in jewelry, regardless of policy/advocacy views.