Comment by matja
20 hours ago
s/IP/IPv4/g
Configuring my OS to prefer IPv6 addresses of DNS responses significantly reduced the number of web captchas I see (on NAT444 with native IPv6).
IPv4 is old and broken, use IPv6.
20 hours ago
s/IP/IPv4/g
Configuring my OS to prefer IPv6 addresses of DNS responses significantly reduced the number of web captchas I see (on NAT444 with native IPv6).
IPv4 is old and broken, use IPv6.
I'd love to do that, if my ISP would provide me an IPv6 address. Windstream doesn't provide IPv6s. They did a trial a few years ago rolling it out and then undid it.
It's crazy I can get fiber to my house in the US, but not IPv6.
iirc, hurricane electric was offering IPv6 via tunnelling somehow.
https://tunnelbroker.net
I was doing this back when I had BT in London, my internet speed back then was pretty abysmal and it would randomly drop routes- ironically this tunnel actually improved my internet (because of the routes not being dropped, not the speed).
I think I had HE and Surfnet tunnels in the very late '90s already. IPv6 sure is taking some time...
They do this for free because they're a tier 1, meaning everyone pays to connect to them and they benefit from having more things hosted on their network. It's free because your ISP pays for it.
And they can always tell your ISP if they don't like paying to connect to the tunnelling server they should just implement v6.
Unfortunately, he.net tunnels have terrible reputation, so if you use this for your regular browsing, you're likely to get hit with more captchas than if you're on a cgnat with well behaved neighbors. Some sites will just not work, with no errors, because why waste errors on networks with bad reputation.
It wasn't always like this, but it was for me the last time I tried.
Annoyingly, this will not work over CGNAT as far as I know - the tunnel needs 'both ends' to be accessible directly from each other I think.
1 reply →
Try getting a /24 these days without paying a fortune. We NAT everything and still wait for IPv6 because the ISP CPE barely supports it. Land analogy is apt, landlords everywhere.
My ISP is only a few years old, but they don't support IPv6 at all. And when I complain about it to support, their response is basically "we don't see the point".
Practically everything on IPv6 also has a IPv4 address you can use instead. Adding IPv6 just adds more that can go wrong.
Sure, but if they're a new ISP, chances are they have a hard time getting IPv4 and they likely run CGNAT. If they run CGNAT, the benefit of IPv6 is there's a lot of high volume traffic that will move to v6 and the CGNAT use will be smaller. Routing v6 packets is much easier than tracking connection states and munging packets...
If they have enough v4 for all their customers, sure fine.
1 reply →
On IPv4 with CGNAT you get blocked and sent millions of captchas because you are sharing an IP with 5 IoT devices actively running a botnet.
On v6 you don’t have that problem.
This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6
> Most security conscious operators would only allow IPv4 instead of IPv6.
I strongly disagree. That's obsolete knowledge, thrown around by people who want to be considered security conscious but haven't actually updated their knowledge in many years. A statement with similar implications might be "security conscious operators require their users to rotate their passwords monthly", which is what a lot of people use to think a decade ago, and now what it really communicates is that you're talking to a dinosaur.
But IPv6 is complex and inherently globally accessible. Yes, NAT IS not supposed to be a firewall but it works like one nonetheless in many cases.
IPv6 will never replace IPv4 because it is a different protocol rather than merely a new version. The name is a lie.
6 replies →
Most IPv4 "security" is a side-effect of NAT. NAT was not intended as a security feature, but it does provide a level of security in the common consumer implementation (PAT, single external IP, unroutable internal network.)
Otherwise, what are the practical differences?
There's more that's been written about configuring/protecting IPv4 networks and if you learn about network security from a mentor or from coworkers at a job, rather than reading books/the internet/LLMs, you're more likely to learn about IPv4 security.
But if you've ever had to deal with endpoint security, if you're just doing static rule based blocking/throttling, /32 or /24 blocking is often your best option. Thanks to CGNAT this often means having a pretty large impact since an ISP's residential customer might end up getting randomly assigned a "bad" address and the cooldown for these rules is often months long or more.
In IPv6 land, you can just block a /128 or even a /64 and rarely hit anyone else in the crossfire.
Blocking /128 is unlikely to block anyone for very long around here. Both the major ISPs give out /56 blocks with prefix delegation. In almost 4 years, mine hasn't changed.
> IPv4 is old and broken
IPv4 is old, very old. But how is it broken? It's literally been working just fine since it came out.
That there are limited addresses is something else: it doesn't mean it's broken.
I don't care that spying/surveillance devices have more trouble spying on me with IPv4 than with IPv6 and I don't care that some apps have a harder time establishing connection.
IPv4 works. SSH over IPv4 works. Browsing the Web over IPv4 works.
IPv4 stopped working fine some 30 years ago. The invention of NAT was caused by IPv4 not working fine (RFC 1631 was written under assumption it's a temporary solution). Hole punching is a thing solely because IPv4 stopped working fine. Much like Y2K, the reason IPv4 appears to work fine is because absolutely massive engineering effort was put to work around the parts that don't work fine.
> IPv4 is old, very old. But how is it broken?
It is broken for you by upstream NAT and CGNAT.
You mean it's fixed by NAT and CGNAT. Because it's works just fine for me.
20 replies →
There is no need for that, every modern OS prefer IPv6 over IPv4
Depends on the application, a web-browser that implements Happy Eyeballs protocol may prefer IPv4 if the IPv6 latency is higher.
I know little of this. How/why could one be higher latency over the other?
3 replies →