Both countries have roughly the same population. The IPv4 problem has been swept under the rug with CGNAT and a normal person doesn't even notice it. But it sucks. Forget having a dedicated IP, even on a broadband connection, you don't get a public IP that's truly yours. According to IPInfo[1], there are around 1,000 users sharing my IP. I get flagged for malicious activity, and online gaming is impossible without a Tailscale relay.
Of course, much of this comes down to the bad luck (+ policies) of developing late, when most IPv4 blocks had already been allocated. But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks they'll probably never fully use, and may never sell. Meanwhile I am sharing a single public IP with a thousand strangers.
PSA that if you have a ham radio licence, anywhere in the world, there are IPv4 addresses available for you for the taking at ARDC (AMPR)[1].
You can either get a block of /24 to announce yourself (you've got to cover all the technical setup and costs of this) or use their free 44net.connect service and just organise a wireguard tunnel.
> But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks
Maybe Apple and Ford, but it's more than fair that DoD has large blocks since they created ipv4 to connect themselves to other networks. It was only 10 years ago that the US government decided to give up control of IANA.
Sure there's historic reason that the DoD has such a large block, but it is definitely unfair in the modern world. There is no way they need or will ever use their massive block of addresses. They have 13 different /8 blocks, ~218 million unique addresses, that's over 5% of the entire IPv4 address space.
The modern paradigm you're using as a comparison only exists because this network designed for the US military industrial complex was so freely open and fair that it is now used by everyone.
There were and still are are other global networks -- none of them come close to being anywhere near as open or interoperable. What's the next closest, PSTN maybe?
My take is that the solution here isn't "give India more IPv4 addresses", it's "force more Americans onto CGNAT", so that it becomes untenable for service providers to treat IPv4 addresses as if they're tied to a single user, and to encourage people to use IPv6.
I'd love to do that, if my ISP would provide me an IPv6 address. Windstream doesn't provide IPv6s. They did a trial a few years ago rolling it out and then undid it.
It's crazy I can get fiber to my house in the US, but not IPv6.
I was doing this back when I had BT in London, my internet speed back then was pretty abysmal and it would randomly drop routes- ironically this tunnel actually improved my internet (because of the routes not being dropped, not the speed).
They do this for free because they're a tier 1, meaning everyone pays to connect to them and they benefit from having more things hosted on their network. It's free because your ISP pays for it.
And they can always tell your ISP if they don't like paying to connect to the tunnelling server they should just implement v6.
Our free tunnel broker service enables you to reach the IPv6 Internet by tunneling over existing IPv4 connections from your IPv6 enabled host or router to one of our IPv6 routers.
https://tunnelbroker.net/
This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6
There's more that's been written about configuring/protecting IPv4 networks and if you learn about network security from a mentor or from coworkers at a job, rather than reading books/the internet/LLMs, you're more likely to learn about IPv4 security.
But if you've ever had to deal with endpoint security, if you're just doing static rule based blocking/throttling, /32 or /24 blocking is often your best option. Thanks to CGNAT this often means having a pretty large impact since an ISP's residential customer might end up getting randomly assigned a "bad" address and the cooldown for these rules is often months long or more.
In IPv6 land, you can just block a /128 or even a /64 and rarely hit anyone else in the crossfire.
IPv4 is old, very old. But how is it broken? It's literally been working just fine since it came out.
That there are limited addresses is something else: it doesn't mean it's broken.
I don't care that spying/surveillance devices have more trouble spying on me with IPv4 than with IPv6 and I don't care that some apps have a harder time establishing connection.
IPv4 works. SSH over IPv4 works. Browsing the Web over IPv4 works.
IPv4 stopped working fine some 30 years ago. The invention of NAT was caused by IPv4 not working fine (RFC 1631 was written under assumption it's a temporary solution). Hole punching is a thing solely because IPv4 stopped working fine. Much like Y2K, the reason IPv4 appears to work fine is because absolutely massive engineering effort was put to work around the parts that don't work fine.
NAT and CGNAT break the basic idea of how the Internet was designed, forcing everyone into servers and consumers. We've just become used to it, and most people have never experienced it any other way.
The Internet was supposed to be a purely peer-to-peer network, where the addresses on each side of a connection pointed to an end node. That's why protocols like FTP or SIP break when NAT is used, and why you have to play games with port forwarding if you want to run services from your house (assuming you have a public IP address at all).
It's slightly unrealic idea though, as most of internet users are consumers, and that's the role they really prefer. That's why Dropbox gained popularity in spite of, you know, the fact that we all can do it with FTP.
I wish, just 37.73% of IPv6-capable users in Europe according to APNIC despite much higher availability in transit AS. Highest subgroup is Western Europe at around 72.09%, which is still far from near universal. Similar per-country numbers from Cisco.
On HN, 'In Europe' means in one person's particular locale based on their experience and generalised across a continent of about 30 countries. But it's always better than in the US of course.
Bell in Canada continues to offer only IPv4 on their fibre network. I fully expect for them to somehow crap up the transition to IPv6 by putting up CGNAT because fuck you, customer.
Fascinating. The resellers, particularly TechSavvy have ipv6. For TechSavvy I believe it was dynamic /64 by default but static /56 for free on request.
It's something I've only recently been made aware of as well. Shocked we're not seeing more push for ipv6 everywhere given that it sounds common enough. If I don't have an IP address, I'm not getting the Internet I'm paying for; I'm getting access to a network that happens to itself have a connection to the Internet. Not unlike some of the BBS's in the early 90s which had Internet access -- I might be dialed in, but that didn't mean my computer itself was on the Internet.
I don't think it's sarcasm, I didn't know this was a thing either! At first, I thought OP was writing about their mobile connection.
Some carriers in my country have recently started to share the same IP between 4 customers, each having a port range (1-16363, ...), but you can always request a full IP for free.
That explains a lot of the sentiments I've seen on HN then...
I, unfortunately, have been on CGNATed residential internet since 2016, though I used to still get a public IP on request (they stopped doing that though.) I live in South East Asia, for context.
Without IPv6 my only choice would have been relying on a centralized service like Zerotier and Tailscale.
My current setup is CGNAT on 5G WAN (T-Mobile US), which obviously doesn't open public ports besides needed NAT.
Worse is I have IPv6 connectivity for devices, yet still no open ports available, so no serving available. And I only receive a /64 so no delegation available through router.
So now it's Hurricane Electric tunnel to their nearest (in my city) hosted node for IPv6 and a prepaid 50 USD/year node (technically x2 since I wanted a backup to play around with) for IPv4 port forwarding.
Both options are acceptable because the needed infra is close by in the largest metroplex in Texas, it just sucks to have to do all this extra work to replicate what I could do with a dial-up ISP.
I'll say this - having LLM assistants handle the nasty routing and firewall rules needed to make this hodge podge work without needing to be a network engineer has been very helpful.
I converted from residential-class to business-class cable a few years ago. In both cases, I had routable IPv4 addresses.
I was just looking at flipping back, but now it seems the default for new resi accounts is CGNAT. They say they'll give me a real IP upon request at no additional charge, but it's anyone's guess how long that holds out.
In Sweden CGNAT was not a thing for a long time, the large incumbents still have their huge blocks of IPs so its "just" go to them if you want a pulic IP. Apparently smaller ISPs do use CGNAT, so its fairly common.
Me as somewhat of a nerd, even doubt if I need a public IP, seeing how cyber security is looking today.
CGNAT is awesome, you cant IP ban me anymore and I dont need a VPN turned on for silly things, and I can control fingerprinting (mostly), CGNAT is great for anonymity. If I want a static it cost me ~10.00 a month, im fine with that.
Most people don't care about a private IP, which is why they cost about $20-$25 each (which would be about $2 a year to finance). I've used Airtel in the past and they certainly offer a dedicated IP. Currently I'm with TATA and Vodafone in India
Indeed a shared IP is arguably a benefit in that it makes fingerprinting harder.
If your ISP had customers who were interested it could spend $150k on a /19 block giving 8000 IPv4 addresses and charge an extra ₹100 a month for them and after two years it would be in profit.
In fact I think Jio and Airtel offer static IPs for residential use for something like ₹300 a month, which given how cheap IPv4 addresses are is a massive money spinner, but I have't spoken to anyone living in India about ISPs for a couple of years.
From a Georgist perspective, IPv4 is actually a form of land (it's a finite "natural resource", although that's not quite proper), and you could make a case for "land rent" being taxed on the addresses. This is the same as radio broadcast frequencies, web addresses, actual land, un-mined gold/oil/coal/whatever, and other finite natural resources that create monopolistic tendencies.
The only thing that surprised me was that Canada was so small compared to other Western countries. But I suppose that might be an artifact. The map shows IPv4 proportional to land area, but a "fair" allocation would have IPv4 proportionate to population, not land area, and I'd assume Canada is (overall) less densely populated than most other developed countries.
IPv6 got some real traction in the last decade. From around 10% adoption up to 50%. It's not dead, like many are claiming. It works fine, just keep implementing it.
I keep IPv4 off on a media computer all the time out of curiosity. IPv6-only is still unusable because only about 5% to 10% of top sites that I find during a Google Search work. It's almost guaranteed that a website will not load on all the top results.
So even if it's true 50% of clients support IPv6, only about 5% to 10% of website hosts do.
Sure a person can do a dual-stack setup or do some IPv4-IPv6 translation, but seriously IPv6-only should be plug-and-play by now.
The obsession about "IPv6 only" has never made sense to me. Any decent firewall software will let you write rules that apply regardless of IP version. The "software complexity" argument is bunk... you already have v4 and v6 IP implementations in your OS, and every major OS has provided IP-version-agnostic socket interface code for much more than ten years. If you are using software that is IPv6-capable, it's very likely that it's using IP version agnostic library functions.
Unless stewardship of the Internet is wrested from the hands of the responsible, level-headed type of folks that run it now and transferred to the hands of folks who think nothing of making backwards-incompatible changes every six months, IPv4 won't stop running across the Internet within the lifetime of anyone who's currently reading HN. This delay is fine. The only thing about IPv4 that's a problem is that its address space is 32 bits wide. Had it been defined with a 128+ bit address space, we wouldn't have seen another version of IP on the Internet. Now that IPv6 is around to reduce address pressure, there's no big need to do anything about IPv4.
I believe the folks worrying about IPv6 only are just looking ahead to a possible future. Especially when they are looking at the question of do all the pieces work locally, vs do popular domains support it.
There are domains like T-mobile US that are IPv6 only already. T-mobile runs NAT in the network so that all of IPv4 is NAT'd to IPv6.
I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.
Once IPv6 becomes the choice to support to get new customers, it is reasonable to expect that IPv4 support will start deteriorating and will eventually fade away.
I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.
> I believe the folks worrying about IPv6 only are just looking ahead to a possible future.
I'm certain that that is not what the folks who scream very loudly about how IPv6 has been and continues to be a colossal failure because it's not the only version of IP on the Internet are doing.
> I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.
Sure. That's the future I find most plausible: For "residential" connections, provide IPv6 GUAs and IPv4 via CGN... [0] for "commercial" connections, provide IPV6 GUAs and give the customer the option of one or more IPv4 GUAs.
> I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.
I do hope we get to that point within the next five years, if not ten! But notice that my claim is that IPv4 will still be crossing the Internet after everyone reading HN today is dead. [1]
[0] I'm calling the various mechanisms that only provide an IPv6 address to an end user and do fancy gyrations to provide IPv4 access "CGN", even if might not strictly be CGN.
[1] ...as long as the the responsible, level-headed type of folks that run it now aren't replaced with the "making backwards-incompatible changes to everything every six months is A-OK!" type of folks.
I guess a lot of sites just turn it off. Even if Cloudflare proxies it over IPv4 the IPv6 source address still shows up in server logs. Features like geolocating users or fraud prevention might need additional work for IPv6.
Cloud providers and hosters seem to have the least interest in implementing IPv6. Sitting on a huge supply of IPv4 addresses gives them a competitive advantage. So they try to disable IPv6 as a default.
ah yeah, golden times of crawling google when they actually didn't monitor ipv6 traffic properly against scraping (seo monitoring tools were first to drive 'adoption', lol)
Okay, if you say so. Hotel Wifis are known for being on the bleeding edge of technology, and as the main innovator pushing new internet technology. Everything starts with hotel Wifis. /s
Exactly my point. IPv6 failed to reach the "boring, just works" level after 30 years of deployment. So much so that we are now deploying solutions with 10+ years of expected service lifetime that do not support IPv6.
Meanwhile, CGNAT really solved most issues with IPv4. Yes, even the voice/video chat issues.
Want another fun example? Try to find a SIP telephony provider in the US that supports IPv6. Go on. I do this exercise about once a year.
> IPv6 failed to reach the "boring, just works" level after 30 years of deployment.
/me glances over at my phone, which only has an IPv6 address when connected via cellular modem.
/me thinks back to the decade+ of incredibly boring IPv6 service from the residential ISPs I've used.
Sure.
If an ISP wants to provide only IPv6 addresses to CPE, they can set things up so that happens. But if you won't be satisfied until IPv4 no longer passes over the Internet, then you're going to die unhappy about that. The goal for our lifetime is one where every residential site has a global /56 and is behind IPv4 CGN, and servers hosted by commercial entities get to choose whether they assign IPv4 addresses, IPv6 addresses, or both to their servers.
/me searching through all the mobile network providers in Switzerland (a technologically advanced country) and not finding any.
Seriously, this drives me mad. There is NO WAY to get IPv6 on mobile networks in Switzerland. Neither Swisscom, nor Sunrise, nor Salt, and of course no reseller.
And Android handles this particularly poorly. I have some servers set up in my tailscale network on private IPv6 addresses, but android doesn't query AAAA addresses if it has no ::/0 route, so I HAVE to route all my traffic through my VPN which often creates other complications (with corporate wifi etc.)
I get your frustration. But not having access to IPv6 personally does not mean IPv6 is dead. It's very much alive and handles considerable amounts of traffic.
Well ok, not dead. Dead sounds final and I still think that we will get more IPv6 deployed in the future. And I set up all my servers as IPv6-first. So no, I don't think IPv6 is dead.
But I'd claim it failed completely. Many very public services (eg. github.com, sentry.io, office365.com, archive.org) outright don't support it. And the fact that infrastructure providers (like mobile network carriers) don't support it either, proves that it is far from "alive". In fact, I'd say it is deader than MMS, Fax and landline. For these I can still get service. For IPv6 (on the phone) I can't.
It only failed to fully replace IPv4. But it runs perfectly fine along IPv4 and is very much alive. It replaced IPv4 where it was needed and didn't where it doesn't matter yet.
Email didn't replace letters on paper. But I wouldn't say email failed completely.
To be clear, 'TobTobXX' isn't 'cyberax'. 'cyberax' is claiming that IPv6 is dead, whereas 'TobTobXX' is -quite justifiably- complaining that both his local cellular ISPs and Android suck.
You're welcome to try to solve the challenges from my sibling post. Both of them are solved in IPv4 by a $100 router from a nearby store and with zero configuration.
I don't get your point. IPv6 is at "boring, just works". The majority of the worlds devices run on it dual-stack and it handles a considerable amount of traffic. A lot of 5G networks run on IPv6 single stack with IPv4 compatibility on top.
IPv6 is very much alive. And it's so boring and working so well, that you don't even notice it.
> I don't get your point. IPv6 is at "boring, just works". The majority of the worlds devices run on it dual-stack and it handles a considerable amount of traffic.
Most of the world runs on IPv4. If we shut down IPv6 on the core routers tomorrow, pretty much nobody is going to blink an eye. And now I believe that we should do it and start again.
The 50% stat is really mostly mobile phones on cellular networks, which remain the _only_ major success story for IPv6. Mostly because there's not enough private or even squattable IPv4 space available for many large mobile phone operators.
> IPv6 is very much alive. And it's so boring and working so well, that you don't even notice it.
Sigh. No, it's not. In a thread a couple of weeks ago, I gave several examples:
1. You're a SOHO-type business. How can you do multiple WAN uplinks with IPv6 without NAT?
2. How do you prevent your printer on IPv6 from breaking when your Internet connection goes down?
For context: I deployed IPv6 in my networks in 2006. I have war stories.
> How can you do multiple WAN uplinks with IPv6 without NAT?
Advertise the addresses offered by the primary uplink, then retire those addresses [0] and advertise the secondary when the primary fails. Or are you talking about load balancing, which is its own thing? Either way, this situation is inherently not boring, so the way you solve it is going to be quite a bit more complex -regardless of IP protocol version- than the very boring single-upstream situation.
> How do you prevent your printer on IPv6 from breaking when your Internet connection goes down?
I'll flip this around on you:
How do you prevent your printer from "breaking" when its ISP-provided DHCP lease on its globally-routable IPv4 address expires? How about when the ISP refuses to renew the lease on the printer's current globally-routable IPv4 address and forces it to get a new one?
Obviously, you use the ISP-assigned globally-routable IPv4 address and also assign an RFC 1918 address to the printer.
How to solve this with IPv6? Use ULAs! They're the equivalent of 1918 space in the IPv6 world. Just like in IPv4, IPv6 globally-routable addresses are for global communication and can be used for LAN-local communication. And -just like 1918 addresses- ULAs are for LAN-local communication. Just like with IPv4, if you can't control the addresses that you get from your upstream provider, and/or if your router is set up to retire your upstream provider's delegated address space when your upstream link goes down, then you use ULAs. [1]
I know that OpenWRT has a setting in LuCi to enable advertisement of a ULA prefix, and fifteen seconds of searching revealed that at least some Linksys combination router/APs seem to just generate and advertise a ULA prefix by default. [2]
So, if you're not configuring your LAN this way and upstream provider renumbering is getting in your way, then you really should bother to.
[0] ...by advertising their valid lifetime as zero seconds...
[1] ...or if you happen to like to be able to assign fixed IP addresses to certain pieces of hardware...
Isn't that the default for modern routers? They just generate a random ULA during setup and assign it.
Random ULAs are also great for LAN-to-LAN VPNs, because there aren't any private IP overlaps. Everyone setting up their LAN on 192.168.0.x makes it quite a mess on IPv4.
I assumed so because it's the obviously correct thing to do, but I haven't used a SoHo router in so many years, so I don't know.
> Random ULAs are also great for LAN-to-LAN VPNs, because there aren't any private IP overlaps.
Yep! Extremely low chance of prefix collision is their most important purpose. I've been part of several corporate acquisitions, and it inevitably took 6->18+ months to do enough of the IPv4 renumbering and server-discommissioning [0] process to begin to merge the LANs of the merging companies. Had they used ULA addressing, the odds of having to do that massive amount of work would be effectively zero.
And if collisions aren't something you give any shits about, nothing stops you [1] from setting your ULA to fd00::/48 and advertising fd00::/64 on your LAN for static IP addresses that are notably shorter than you can get with IPv4!
[0] ...because there's so little space in the 1918 range...
[1] ...well, unless your router's configuration system doesn't let you specify your ULA prefix...
> Advertise the addresses offered by the primary uplink, then retire those addresses
Prefix withdrawal doesn't work reliably on Android. And neither is it required to work, btw. Neither does this solution allow for load balancing, as all traffic will just go through one connection.
Bonus points: triangular routing to your local NAS through the router.
> How do you prevent your printer from "breaking" when its ISP-provided DHCP lease on its globally-routable IPv4 address expires? How about when the ISP refuses to renew the lease on the printer's current globally-routable IPv4 address and forces it to get a new one?
Printers get an RFC1918 address and don't care about global connectivity.
> How to solve this with IPv6? Use ULAs! They're the equivalent of 1918 space in the IPv6 world.
They're not. IPv6 is nothing like IPv4 operationally. Back to my challenge, ULA will NOT work.
The scenario is very simple: the printer gets a ULA prefix and a GUA prefix. Your computer also gets a GUA and a ULA from the same router.
So far so good.
Now the uplink goes down, and the router withdraws the prefix. The printer sees the withdrawal and removes its GUA address. Your computer misses it, and still has the GUA and the ULA addresses.
> Prefix withdrawal doesn't work reliably on Android.
Works fine on the Android hardware I have. Are you attempting to retire prefixes that have an infinite lifetime? That doesn't work, and I don't think it's supposed to work.
> Neither does this solution allow for load balancing...
As I said
Or are you talking about load balancing, which is its own thing? Either way, this situation is inherently *not* boring, so the way you solve it is going to be quite a bit more complex -regardless of IP protocol version- than the very boring single-upstream situation.
> Printers get an RFC1918 address and don't care about global connectivity.
Okay, so why are you complaining about your printer being broken by GUAs that you're not permitting it to have? ;)
> IPv6 is nothing like IPv4 operationally.
For anyone who's not an IP stack developer, network hardware developer, or Enterprise sysadmin it absolutely is. And other than the fact that every endpoint is able to get a global address in v6, the differences between v4 and v6 are minor. RAs instead of... well, nothing, and DHCP for both.
> Whoops. The printing is now broken somehow. Why?
Exactly.
Why isn't your DHCPv6 server putting either both the GUA and ULA, or -better- only the ULA addresses in your LAN's DNS server? This Just Works™ on dnsmasq, which is one of the most widely-deployed DNS+DHCP servers on SoHo gear. [0] dnsmasq's default TTL for hosts added to the DHCP lease file appears to be 0, so -worst case- your sleepy computer tries to continue its conversation with the printer a couple of times, does ND and discovers that the IP it was using is gone, then looks up the hostname again and gets the new address of the printer. I think the trendy term for this back in the 2000s was "self-healing".
If you're going to retort "But we don't use dnsmasq in the companies I'm sometimes talking about!"... well, if you can't figure out how to not register upstream-controlled GUA addresses for your LAN hosts in your DNS, then do what dnsmasq does and serve them up with a TTL of 0.
[0] To head off the "Android doesn't really do DHCPv6" retort: Even though Android refuses to use anything other than DHCPv6-PD for managed address assignment, -AFAIK- Android still sends DHCPv6 ADDR_REG_INFORM messages for addresses it autogenerates on networks with either the "OtherConfig" or "Managed" flags set. I haven't bothered to set up my Linux systems to do this, but I'd be surprised if Windows and Darwin systems didn't do this.
one is close to hundreds of millions in cost and with likeminded stakeholders. the other is hundreds of trillions in costs with the entire human population as stakeholders.
IPv4 is better than IPv6, and imperial is better than metric. I would like something to replace IPv4, but that thing shouldn't be IPv6 and probably won't be at this rate.
IPv6 has a huge amount of bloat created by guys in cargo shorts and pony tails being flown out to exotic locales 3x a year for IETF conferences to argue about minutia and try to get their name on some IPv6 spec document. All they needed to do was add a couple more dots onto IPv4 and maybe switch to hex.
Wasn't it from academics in their ivory towers? That's kind of the opposite of flying out to exotic locales.
Of course, back here in the real world you can look at the RFCs yourself and see that they're credited to places like Ipsilon Networks, Xerox and Sun Microsystems. Boring corporate network companies.
Nah, the details in the spec all have good reasons, but it's based on the original mistake of making it an entirely separate network from v4 with new address blocks.
IPv4 is inherently more user-friendly. IPv6 was designed for a world, in the 1990s, where it was expected that every host wanted to be routable. SLAAC etc were all natural consequences of that. For today's use cases, the v4 NAT public/private thing actually turned out to be nicer than v6 global routing. There's still confusion today about whether devices are exposed on a v6 network because the spec itself says default-deny firewall is optional. They had to recently add privacy addresses. The other kinds of v6 addrs like link-local and ULA add more complexity. V4 addresses are easy to remember, which v6 advocates keep saying doesn't matter but it does. There are all these little network management details that are messier in v6, as you will find on online help forums for v6 advocates who you cannot write off as just being too used to v4.
The v6 spec also has all these alternative ways to use it more like v4, commonly brought up as a cop-out against the above criticisms, but that's actually part of the problem. The spec is too big, and things only implement a subset of it, see Android not supporting DHCP6. Realistically you'll have 99% of people using anything like this the default way, and the spec does define SLAAC, no-NAT, etc as default.
But you could say v6 is better just cause it has more addresses, and that's fair.
...Imperial is better than metric because it lines up with everyday usage better unless you're specifically concerned about the physical properties of water. Especially ˚F vs ˚C. Not a big deal though.
0-100˚F lines up well with weather ranges, and 1˚F is about the smallest diff someone can feel. Many digital thermostats use integer ˚F and introduce 0.5 steps if you switch to ˚C, even in countries where ˚C is default, so they kinda admit it.
Pounds vs kg, similar story as F vs C. Pound is pretty much the human-discernible granularity. Otherwise doesn't matter.
0-100 MPH lines up well with car speeds, which is usually the thing you're measuring with that. KPH is excessively granular for that. Probably not by design, but yeah.
The feet/inches vs meters/cm thing matters less. It's base-12 vs base-10. You can do decimal feet or fractional meters of course, but it's less common, so apparently both ways are fine.
This is quite similar situation indeed. It was once easier to adopt the metric system when the infrastructure was not yet as developed around the previous ones.
Austria-Hungary adopted the metric system in the 1870s. Back then: no cars, no highways, no speeding laws etc. Oxen-drawn wagons in the countryside were not built to a precise spec.
Only the railway, the architects and the artillery had to really switch. Ordinary people would still ask the grocer for half a pound of ham in the 1930s.
USA in the 1970s would have to remeasure all the land communications etc., or end up with a weird hybrid like the UK.
WHat we have in IPv4 and IPv6 is the weird UK-like hybrid...
It's going to take decades, mostly waiting for the non-metric folks to die off probably and the raised-on-metric folks to grow up, but if you don't start you'll never finish.
I'm Australian and the only things measured in imperial units is babies (stones? But I think younger parents now use metric, but my parents only know baby weights in stones), beer (pints, but not the same as overseas I think, also it can vary by state), certain types of land units ("acerage" is a common land plot size) and height (feet and inches, for some reason people don't understand it in metric)
These are all customary usage so I'd say we are completely switched over, we couldn't tell you generally what these units look like outside of "how big is a baby" or "how tall is that person" or "is my beer large or small" really.
Canada also changed over in the 1970s. I was told as a kid that the US had planned to switch with us but backed out at the last minute. I'm not sure if that's true or not. Today, the imperial system holds on in a few places, like heights and weights of people (although not at the hospital) and cooking temperatures.
If you have a dedicated IPv4 address, those behind NAT and CGNAT face significant throttling and false positive blocking. It's been made worse by scraper botnets.
Creating an IPng was always going to be complicated:
So it's a matter of mathematical and physical fact that to expand
the address size, you must change the protocol, and that means
[three] things immediately:
You have to change the version number.
You have to add new code to handle the new version.
[…]
You need a coexistence technique so that updated systems,
with the new protocol, can connect to old systems that know
nothing of the new protocol.
Two minutes of thought show that this third requirement has only
two solutions:
(3A) Dual stack, in which the new machines speak both
the old (IPv4) and new (IPng) protocol.
(3B) Translation, in which something translates addresses
between the old and new protocols.
This is very valuable, but not sure if you think it contradicts my comment.
I'm not saying that IPv6 is incompetent, or that IPv6 implementations break backward compatibility, or that the problem can be solved without breaking bc.
I'm saying that while IPv6 breaks bc itself, dual stack does not, and even full migrations can maintain bc or gracefully degraded.
In essence, not all implementations IPv6 are good, and not all migrations from IPv4 are responsible, if someone is blindly team IPv6 or blindly team IPv4 in general there's a lack of nuance.
It's impossible for a long address system to be compatible with a short address system. No one has ever found a way to make it work. Plenty of people think they have, but upon closer inspection, they haven't.
NAT is the only one that actually does work, and it's terrible.
It's the hobbyists who LARP as network engineers, and that end users and hiring managers can't tell the difference, who are holding everyone back.
Anyone who doesn't by default set up IPv6-only networks by default with NAT64 and DNS64, or who present any notion that IPv4 is somehow "okay", shouldn't have a job anywhere, not even an entry-level desktop support job.
> IPv4 is perfectly and objectively fine on internal networks. IPv6 is overkill and way too complicated for most.
Unless there's a merger/acquisition and the two companies both use 10.0.0.0.
Most home networks use 192.168, and so you can't use that in corporate environments, because the WFH people who VPN in could then have routing snags between local and remote locations.
Also, in your VPN software be sure to perhaps not use 172 addresses (like my previous job did), as some of those ranges are used by Docker by default, and so you can cause issues for developers.
But other than that IPv4 RFC 1918 is not complicated at all…
In theory IPv6 solves the problem by putting all of this under a single prefix (fc00::/8) and asking nicely that implementation/admins add 40 random bits to form their prefix. Which is plenty to prevent (almost all) eventual conflicts.
The thing is, asking nicely doesn't always work. Sure, automated tools like docker/incus/wireguard/tailscale will respect it. But admins who don't want to be stuck typing long addresses? Not so much. I've lost count of how often I encounter a network admin that manually set their prefix to some fcXX::, when it's not outright fc00::.
Of course you can (and should) blame this on admins and not on IPv6, but then the same could be said of IPv4 where adding entropy to 10.X.X.0 is the usual recommended way of doing things.
I have seen people suggesting this before, but it's problematic for a few reasons:
- If you are managing the 4to6 mappings manually, it's obviously not going to be scalable. Just to give people an idea, websites nowadays can connect to 10+ IPs in a single page due to CDN load balancing and stuff.
- If you are handling the mappings automatically, such as by monitoring DNS queries and creating dynamic mappings based on that, the issues become more insidious: applications with hardcoded IP literals would fail without an obvious reason.
I have encountered multiple IPv6-only domains - certain random domains were accessible through Chrome, but unreachable from any command line tools. Turns out they were IPv6-only, and Chrome was doing its own DNS resolution, while anything that was using the platform DNS stack was hitting a black hole between OPNsense and my ONT.
Ran across a comment a while ago on some fun "IPv6 math":
On the surface of the Earth [land+water], there are 8.4 IPv4 addresses per km². Not counting the oceans, that would be 28 IPv4 addresses per km² land.
IPv6 gives 10¹⁷ addresses per mm² (yes, square millimetre).
In terms of volume, 10⁸ IPv6 addresses per mm³ throughout the Earth.
* So (4x10¹¹)x(2x10¹²) = 8x10²³ stars in the universe.
* Size of IPv6 address space: 3.4x10³⁸
* Find the ratio between addresses and stars: 3.4x10³⁸ / 8x10²³
IPv6 offers about 430 trillion times more addresses than estimated stars in the universe. From Tom Coffee's presentation "An Enterprise IPv6 Address Planning Case-Study":
But it is really about more than just the available pool of addresses.
Much of the IPv6 rollout challenges have been centered around routing and security. It's great that I can personally have (in theory) more IP addresses than I would ever practically need (and I am saying this as someone with 200 IP endpoints just in my house), but if I can't easily manage and control access much of the theoretical benefit goes away.
IMO, IPv6 solved the address pool size part of the issue, but it made managing the v4 to v6 transition very painful.
You can still control access. Most home routers have firewalls that work a lot like V4 port forwarding except they don't have to maintain NAT tables or use as much CPU
.
Comparing land area to IP address assignments is one of the sillier visualizations I've ever seen. I can't imagine what this is intending to convey. Should Siberia have more IP addresses than all of Europe?
Perhaps I am being uncharitable, but I don't see what's interesting about it at all. Visualizing IPv4 against population (or maybe GDP) would have been far more illuminating.
One thing that was always a curious anomaly for me is Brazil having the second largest number of autonomous systems (ASNs) in the world. [1]
I've been told that this is actually because Brazil has a very competitive local ecosystem of small ISPs competing with eachother on the regional scale.
There is nothing that makes sense. The world population is about twice the total number of IPv4 addresses total. Many people own more than one device, and there are good networking reasons that you want most of the possible addresses on any network segment unused. There is no way to solve all of those problems at the same time and so nothing make sense when we are talking about IPv4 and it never will.
Sure, but it's evidently not that bad. And actually safer than firewalls because the default is so strongly deny-inbound. Most people absolutely don't want random devices on LAN to be exposed to WAN, and those with servers can get a public IP.
I’m hoping with RE everything, for at least consumer IOT products we’ll get to a point where we can just get rid of a lot of the need for ipv4 for home.
What’s left are just apps and devices that people don’t wanna change out but are probably pwnd and I don’t think are gonna get updates because the teams that wrote the software moved on and the companies don’t wanna keep spending on sustaining.
The scrolling scaling-controller on the map is genius. I wish more maps would add this dynamic ability to scale the logical size when there is a considerable ratio delta to the land size.
I still think we should just extend the length of IPv4. In my proposed system, existing addresses would become a subnet of the new set.
Eg 192.168.0.1 becomes 0.0.0.0.192.168.0.1
And then we dish out all the new address space. You would get the network providers to handle address conversion until software and hardware has been updated. Because all the existing addresses are reserved in the new set, it doesn’t affect them.
Keeps all the nice parts of IPv4, doesn’t require everyone to switch to an entirely new system, backwards compatible with existing hardware/software. Problem solved.
> backwards compatible with existing hardware/software
Absolutely not. Existing IPv4 hardware and software expects addresses to be 4 bytes long. They expect packets to have a 4 byte source address at offset 12 in the header, then a 4 byte destination address at offset 16. Everything breaks if you try to give them a header with an 8 byte source address at offset 12 and an 8 byte destination address at offset 20.
> Absolutely not. Existing IPv4 hardware and software expects addresses to be 4 bytes long.
As does DNS.
"A" records are fixed at 32 bits, so you have to add a new record type and update all DNS software, plus user-space API/library code and data structures to ask for and store the new record type.
Just like IPv6.
There is no "just" adding more addresses: whatever scheme anyone comes up with is the same amount of work as IPv6.
The set of all ip hardware and software is much much larger than just what currently exists, as it includes all hardware and software that is yet to be produced. Said another way, it’s a foolish consistency.
That would still constitute an entirely new system, just one that looks very like the previous one. So much code and other infrastructure (routing tables in hardware etc.) relies on IPv4 addresses being 32-bits not 64 and that would all need to change, complete with extra new stuff being added for that translation layer while both are in operation (which would end up being near permanent, people will find ways to keep the old stuff running as long as they can). I expect that this new scheme would just become a new version of CGNAT, “Global NAT” perhaps, with the same problems that adds.
IIRC something like that was considered when IPv6 was first being designed, be deemed insufficient for the long-term future. 64-bits is thought to be enough to stave off address starvation though, which is why IPv6 address ranges are usually assigned as /64s (my homer link has a /48 range should I wish to use it all!), so I can see your reasoning on that level.
Hence my having a /64 (/48 in fact, should I ever enable more than the current /64) shows that 64-bits is enough for global addressing. If it wasn't then giving me a /64 would be part of a path to creating an address exhaustion problem just like the one with IPv4 (which was exacerbated somewhat by handing out /8 ranges unnecessarily in the early days).
However many bytes are used in the scheme, you could in theory use decimal or hexadecimal to represent an address in string form for either scheme. Once the string is unpacked and interpreted, the address is just a number.
Though I've never seen a v6 address represented that way, it would make then noticeably longer, so I don't know if anything will accept such a string as a valid address. Though IPv4-mapped addresses are sometimes show as a mix (::ffff:10.5.2.1 for 10.5.2.1) so maybe I'm wrong there.
Likewise I've never seen IPv4 addresses written in hex in the wild, but the relevant specs say it is valid. `ping 0xc0a82bc2` works just as well as `ping 192.168.43.194` but I doubt many forms accepting IPv4 addresses will validate that and allow it.
Computers use binary. Hex is a human convenience. For anyone in computers hex is much better than decimal for obvious reasons. For anybody not in computers hex makes no sense and I'd need weeks of math lectures (which they wouldn't do the homework for and thus fail) to explain it.
Honestly IPv4 addresses should always have been formatted in hex, like FF 00 00 69, with whatever delimiter. Would make it trivial to write directly as a 32-bit int, and parsing and formatting a string would also be cheaper. And you could have funny blocks like CAFE.0.0.
You can indeed make good use of those funny names in IPv6. If your /64 or /56 prefix is $prefix you can assign your coffee pot to $prefix::cafe or maybe keep it just fe80::cafe if you only want link local access to your coffee pot.
How does 192.168.0.1 talk to 192.0.0.0.0.168.0.1? Like, literally, how does it make a packet with that destination address?
The entire ipv4 space is already mapped to reserved subsets of ipv6, by the way. e.g. ::ffff:0:0/96 (i.e. 0.0.0.0.0.0.0.0.0.0.255.255.w.x.y.z) or 64:ff9b::/96. v6 devices can already "talk to" v4. The problem is the ipv6 space is obviously not a subset of ipv4, so v4 doesn't have a clean way to talk to or even about v6.
Lots have thoughts on this, few take the time to review the existing implementations/proposals and explain both how it is their approach doesn't run in to the same problems as well as the problems their proposal still doesn't resolve.
Most of the time, this results in people thinking the big problems are one set like "if only there was a way to translate" while the real remaining problems are another set like "and how do you get people to want to transition when it works well enough for those clients in the translated state".
Iot isn't what's holding ipv6 back. There are tons of websites and even cloud platforms with totally ipv6-capable hardware and OSes, but the services are v4-only or strongly v4-preferred.
I can read one at a glance and the other makes me fill in the blanks myself after having to count how many invisible blanks I need to fill in.
Of all the sins of IPv6, its tied between using ':' as the separator, and the god awful '::' "just skip writing the address because we made them too fucking big lol"
Wouldn't have been a problem if they hadn't given every square millimeter of the planet 100 billion addresses.
You don't need 192.168.0.0.0.0.0.1. 40 bits covers the world easily, like 1.2.3.4.5. This doesn't mean the field has to be only 40 bits, could be 128 and you don't write the trailing 0s. Of course this means no SLAAC.
But I don't get why the other commenter was proposing putting the 0s at the beginning instead of the end. Shouldn't the new address space be under the existing subnets?
> I can read one at a glance and the other makes me fill in the blanks myself after having to count how many invisible blanks I need to fill in.
The protocol chosen for IPng, SIPP, did actually have "only" 64 bits, but this was deemed not enough as folks did not want to have to worry about running out again (amongst other reasons), and so tweaked it to have a fixed 128 bits:
You're right, my 100B per square millimeter undershot by six orders of magnitude.
I woulda thought 18 quintillion would've been enough addresses for the next century or two but good thing we locked in all this extra data we throw away with a '::'.
I'm sure it was all well considered by intelligent people, but it was still a dumb decision.
What problem does 128 bits cause? Just that you don't like :: for a run of 0s? Do you need to care about ipv6 addresses in your work? Because I can tell you that when I'm trying to design simple, efficient routing and firewall rules (with e.g. 100s of thousands of endpoints across different datacenters on different continents), it's really nice to be able to subnet things the way I'd like instead of the way I must to squeeze things into the space I have, and not have to worry about backing myself into a corner later because I gave the wrong number of bits to various dimensions. And worst case, if you somehow got it wrong, just give yourself an entire /64 or more to try again, with it being compatible with what you did (no need to do a phased migration that requires reclamation as you go along).
Like I only tangentially interact with this stuff, but I can't imagine how a network operator wouldn't prefer we live in an all ipv6 world.
Don't forget you want extra bits for hierarchical routing. Companies like Amazon and cloudflare have many separate address blocks instead of one big one because that's what was available, but it means every router in the internet has to remember all their blocks instead of just one.
You just drop the top half. Or xor it? That'd make for some nice traffic-pattern art ;)
Now the reason this doesn't work is that the address length is not encoded, so if you make the address longer, no one knows about it and they [routers and destinations] just assume the wrong address and send it on or discard the frame
That being said, we should take the time to understand why IPv4 is still hanging around when IPv6 has been around since before most people got internet access. What is really holding IPv6 back?
Everything in v6 was for a good reason, but it was targeting now-outdated use cases. Separately, there's no good migration path from v4. They should've kept the v4 address blocks in v6, and following the natural consequences of that, it'd be way easier to migrate. But they didn't do this with v6 because they were trying to solve the address fragmentation issue upfront, which again had valid reasoning but in hindsight wasn't the right move.
You could just use something like fd00:dead:beef::192:168:0:1 for your internal IPv4 host(s). Basically do a human-readable mapping of your IPv4 LAN IPs into a IPv6 private space. Now you only need to remember the ULA prefix and then can continue to use your IPv4 just with colons instead dots. Problem solved. :-)
> I still think we should just extend the length of IPv4. In my proposed system, existing addresses would become a subnet of the new set.
There is no "just" extending the address length:
So it's a matter of mathematical and physical fact that to expand
the address size, you must change the protocol, and that means
[three] things immediately:
You have to change the version number.
You have to add new code to handle the new version.
[…]
You need a coexistence technique so that updated systems,
with the new protocol, can connect to old systems that know
nothing of the new protocol.
Two minutes of thought show that this third requirement has only
two solutions:
(3A) Dual stack, in which the new machines speak both
the old (IPv4) and new (IPng) protocol.
(3B) Translation, in which something translates addresses
between the old and new protocols.
> Keeps all the nice parts of IPv4, doesn’t require everyone to switch to an entirely new system, backwards compatible with existing hardware/software. Problem solved.
You have to ship new code to every 'network element' to support your "IPv4+" plan. Just like with IPv6.
You also have to update DNS to create new resource record types ("A" is hard-coded to 32-bits) to support the new longer addresses, and have all user-land code start asking for, using, and understanding the new record replies. Just like with IPv6. (A lot of legacy code did not have room in data structures for multiple reply types: sure you'd get the "A" but unless you updated the code to get the "A+" address (for "IPv4+" addresses) you could never get to the longer with address… just like IPv6 needed code updates to recognize AAAA, otherwise you were A-only.)
You need to update socket APIs to hold new data structures for longer addresses so your app can tell the kernel to send packets to the new addresses. Just like with IPv6. In any 'address extension' plan the legacy code cannot use the new address space; you have to:
* update the IP stack (like with IPv6)
* tell applications about new DNS records (like IPv6)
* set up translation layers for legacy-only code that cannot be update to reach IPv4+-only destination (like IPv6 with DNS64/NAT64, CLAT, etc)
You're updating the exact same code paths in both the "IPv4+" and IPv6 scenarios: dual-stack, DNS, socket address structures, dealing with legacy-only code that is never touched to deal with the larger address space.
"Just adding more bits" means updating a whole bunch of code (routers, firewalls, DNS, APIs, userland, etc) to handle the new data structures. There is no "just": it's the same work for IPv6 as with any other idea.
Not really, it assumes people will make IPv5 devices without a reason to. If you can get them to make IPv5 you can use the same mechanism to get them to make IPv4/6 dual-stack.
People already make ipv6 devices, that's not the problem though. It's also maybe possible to do ipv5 with ipv6 hardware at least on the hosts, since the v6 header is totally fine for this.
You have 2002:47b1:11ab::/48. If your ISP supports it, packets sent to that /48 will be delivered to you as native v6 packets, otherwise they'll be stuffed into a v4 packet which will be sent to 71.177.17.171. Or there's ::ffff:71.177.17.171 which will reach you using unmodified v4 packets.
That's two different ways your v4 address is present in v6.
I would like 71.177.17.171, encoded as 2002:47b1:11ab:: or whatever static prefix, to go directly to my router as v6 packets without ever being translated to v4. 2002:47b1:11ab:: doesn't do that, it goes to a 6to4 relay and is translated to v4. I'm pretty sure every ISP will at best give you a v4 /32 and an unrelated v6 /64. I don't want that separate v6 address, I want the same address for both.
I recall something like this, what did you call this? ipv8?
the thing is that it does require a switch similar to ipv6. but maybe there’s a subnet that maps 1 to 1 with the legacy block?
something like this could theoretically be pinned onto ipv6 AND anyone could do it, just select a 98 bit prefix you own, and the rest of the 32 bits you can map to ipv4.
phase -1 could be tunneling traffic through a single zone proxy which would be inefficient and is purely conceptual
phase 0 would be the same, but with an anycast ipv6,same ip that resolves differently based on location, like 8.8.8.8
phase 1 would be the mapping prefix to ipv4 (and viceversa?) being distributed to the routing tables like, which could be done via application logic (most efficient), or via some deep arcane isp routing conf files, or just a hell of a lot of routing table entries for each ipv4 but duplicated, possibly programatically controlled by an application that generates router table files as a target, thus avoiding desyncs and effectively becoming the first option of application level implementation
maybe something like this already exists though
of course it’s horrible hacking (as hacking in the non crime sense often is), but it allows for a purely technical solution to issues of political and administrative nature.. which is all the rage nowadays
There already is a subnet. Actually a few. ::ffff:192.168.0.1 is reserved for when you need to pass an ipv4 address through an ipv6 API (e.g. v6 client application on a dual-stack OS on a dual-stack network) and 64:ff9b::192.168.0.1 is reserved as an actual address for NAT64 gateways to use (v6-only client, network has a NAT64 gateway somewhere on it)
That was kinda the way IPv5 proposed to handle it.
But the big big problem isn't windows/Linux/mac. Writing drivers for those are "easy".
The problem lies in all the networking gear speaks only IPv4 and/or 6. LLM assisted hacks can get into maintenance areas, but these devices are also built to support the least amount of things. Like, there may not be enough ram or storage to even run it.
And 20 years in, you see how well IPv6 has taken off :eyeroll:
And even on my network, I disabled IPv6. My upstream ISP is doing something that makes '6 unstable, but '4 is fine. And I find most network engineers don't have to maintain '6, so they never really learn it.
Can I have an AI look at my ff::ee::::fa345::32sdfklasd ipv6 address and translate it to something like 192.168.1.4, and have another AI make sure my frikin Amazon Stick isn't exposed to WAN
I initially read the "As" in the "As land" label as "land of plural letter A". Which I understood as the land of DNS A records, which seemed like a whimsical yet fitting name.
Either I've lost it, or there are other countries there that are bigger losers than the DRC. North Korea says it is 1069.6 times smaller, Greenland says it is 1507.8 times smaller, etc.
A lot of European cloud machines geolocate to the Netherlands. A lot of AWS instances use IPs from the Netherlands, although they are running somewhere else. No idea why, but it's a pattern I've observed many times. Get some cloud instance in Europe and it's often going to be geolocated to Amsterdam.
Amsterdam, specifically Science Park, is basically the biggest internet hub in Europe. Frankfurt is second. A lot of stuff is there. It also helps they don't have overly strict policing like in Germany.
Sure, but even if a provider peers through Amsterdam it doesn't mean their IPs must be geolocated and registered there. It's probably because of favorable legislation.
Also some car entertainment systems with integrated 4G/5G use Dutch IPs. Which leads to the weird situation that I sometimes get dutch radio ads on TuneIn or some websites redirect to the Dutch version.
First impression: Poland stronk. Even Czechia strong. Charles IV.'s realm restored. Russia in shambles, not a very efficient conqueror of the address space. And the glory of Rome restored, with pitiful Constantinople looking at their backs from afar.
Second impression: Morocco, Kenya, Egypt and South Africa as the African heavy-weights. Corresponds to what I know.
Third impression: the real bosses are Taiwan and South Korea - just wow.
Hi, I’m helping a hospital in Buenos Aires that has lost their IPv4 due to their ISP moving to CGNAT, putting their on prem imaging servers offline for 7 days. (it’s ok for us though, we have a backup failover isp)
Might have to do something horrible like:
- setup an ipv4 tunnel, which will require hacking a VPN to allow TCP listening, and routing connections to some external proxy with a dedicated static ipv4 address
- or do some modem router level nat port forwarding, and use a ddns to avoid ip changes breaking stuff. but that won’t work probably since public ip is shared
will investigate the isp to see if they are truly short in ipv4 or if they are just moving clients off them in order to sell them to higher bidders and plans, which is likely since I’ve been upsold into optic fiber, static ip surcharge, sd-wan, dedicated connection so far
if you have any advice or RIR contacts (or an ipv4 block to donate, invest or sell), I’d be thankful, my email is in my profile
The first thing you need to ask is: Why do you need IPv4?
I don't know much about your imaging servers: Do they accept incoming https connections, or is it some other kind of TCP or UDP protocol? Assuming it's https, why do you need to stick with IPv4?
> Hi, I’m helping a hospital in Buenos Aires that has lost their IPv4 due to their ISP moving to CGNAT, putting their on prem imaging servers offline for 7 days. (it’s ok for us though, we have a backup failover isp)
Two more things:
1: If you require IPv4, that needs to be part of the contract with your ISP. If they just arbitrarily turned you off, it means that you didn't contract for the services you thought you had.
2: IPv6 is supposed to solve a lot of these problems... So again, why can't you move to IPv6?
> I don't know much about your imaging servers: Do they accept incoming https connections, or is it some other kind of TCP or UDP protocol?
Yes
>why do you need to stick with IPv4?
To support devices and routes that do not have ipv6 support?
>1: If you require IPv4, that needs to be part of the contract with your ISP. If they just arbitrarily turned you off, it means that you didn't contract for the services you thought you had.
That is correct in principle. Although, in the absence of a contract, if a service has been provided for a long time in one way, I'd say there's an argument for breach of contract when that way changes for the worst.
Another argument for breach of contract, which can work jointly with the previous, are industry standards, as far as they define the terms that are implied by common words like "internet connection".
Finally, there's the specifications themselves, since the service is billed as "internet", one can refer to the Internet Protocol Specification, although if they do offer IPv6, that might be reasonably considered a substitute, it is a material change that was not agreed to originally (this being a pre IPv6 contract). That said, an IPv4 with a local address might technically still be defined as internet, what is broken in this case is TCP, not the IP, although by lacking a public IP address, TCP is broken via an IP protocol failure, so there's an argument that something is being sold as Internet but it isn't really internet, there's no written contract necessary, the term used to describe the product creates the contract in the same way that selling a carton labeled Milk would create a contract based on milk coming from mammaries of a domestic mammal, and not pressed Soy Juice with artificial coloring.
>2: IPv6 is supposed to solve a lot of these problems... So again, why can't you move to IPv6?
I'm open to proposals to moving IPv6, I'm not content with having that be forced and removing it from people and institutions, if there's a shortage, then that means no new IP addresses can be issued, why are we normalizing the removal of IPv4 addresses? Are they being removed from lower priority users in order to serve high priority usecases? If so is a hospital a low priority user?
The main issue with IPv6 seems to be IPv6 proponents that try to kill IPv4, no one will migrate if you force them to, if you propose, we will consider.
The professional services that I work with give plenty of notice (years) before turning off services. Were you using an internet connection that's intended for hosting servers? (As in you were paying for a dedicated static IP.) If so, then you have a case.
Otherwise, your arguments about what "internet" is are flawed. IPv6 has been a thing for about 30 years, with a well-publicized problem with IPv4 address space and migration plan. I suspect that it's (IPv6) older than your hospital's contract. Even in the IPv4 world, your IP can change at any time and you can be put behind a NAT. That's why ISPs will sell you a static IP if you need one.
>> why do you need to stick with IPv4?
> To support devices and routes that do not have ipv6 support?
> Are they being removed from lower priority users in order to serve high priority usecases? If so is a hospital a low priority user?
After reading your response, I suspect the real problem is attitude and experience. The hospital should have IT staff that know to purchase a static IPv4 IP. This should be part of the contract with the ISP. If it wasn't, ultimately it's up to the IT staff to approach the ISP and arrange to purchase one.
> The hospital should have IT staff that know to purchase a static IPv4 IP
I purchased a static IPv4 IP, and they made the CGNAT IP static.
I thought about making a blog post about it, but I realize there's so much nuance and details. I can't tell if it's just venting about work, or a genuinely interesting clusterfuck in some forlorn corner of the new world.
Have you noted that in the mainline Linux build config file, the option to enable IPv4 functionality is CONFIG_LEGACY_IP= ?
I can tell you that in cicd for production Linux systems today, we have
CONFIG_LEGACY_IP=""
which in a Linux build config file means "do not include this in the build".
_
What might work well for your organization is ZeroTier which will make you immune to what any ISPs do. The downside is your organization would be dependent on ZeroTier, but ZeroTier is much less likely to screw you over than any ISP.
https://www.zerotier.com/
_
I appreciate your speculation on the principles of contract law. Like you, I believe those principles should be upheld and I believe in morality. If you lived under a monarchy and I were of the monarch, I would cross-examine your ISP in public and solve your problem in minutes. I would also on occasion take someone to the side of the road and chop off their head in front of the entire village, and everyone would know on a visceral level they are all much better off with someone taking out the trash now and then.
But, as many technical workers know, the contract stuff takes months or years to resolve, and technical issues involving IP addresses are best worked around with technical approaches.
_
What I would suggest your network team (you and whoever) do in your shoes is:
- set up NAT64 and DNS64 at the edges of subnets that contain devices that don't do IPv6 properly, because if these devices do not have updates to do IPv6 properly then they are broken in a fundamental way, and a workaround is necessary;
- dictate that starting on December 1st, all new devices and VMs have IPv6 addresses with all userspace services listening on IPv6 addresses or some nftables rule to kludge IPv6:$port -> 127.0.0.1:$port if necessary, with firewall configured to block that IPv6 traffic, then at a later date firewalls not blocking those IPv6 addresses, then at a later date prohibit any new IPv4 addresses being assigned anywhere with special exception to devices tagged "legacy" or "end of life" requiring documentation of such;
- use a combination of IPv6 GUA addresses assigned by whatever ISP and IPv6 ULA addresses chosen by your team -- in IPv6, multiple local gateways and multiple addresses on a network interface issued by those local gateways via RA is relatively a norm rather than an exception (requires userspace tooling in IPv4, DHCP doesn't have this functionality), so leverage this advantage;
- use IPv6 AH (authenticated headers) wherever possible;
- because in an ideal world, ISPs would behave consistently and IPv6 GUA addresses would always be stable, but we aren't living in an ideal world, so be ready to update your internal DNS to drop AAAA records containing IPv6 GUA that an upstream ISP fumbled;
- or, if you have the internal resources, register your own AS and command your own official block of IPv6 addresses;
- use a combination of OpenTOFU (Terraform) and Salt or Ansible, all versioned with Git, be very strict with your team about versioning with Git, to manage everything, and use
terraform plan -detailed-exitcode
and Salt or Ansible equivalents for continuous monitoring;
- move userspace services to Podman where possible.
Personally I like Salt. I know Ansible is more popular out there with more inertia.
_
>> why are we normalizing the removal of IPv4 addresses?
This was normalized a long time ago actually. "The future is already here, it's just not evenly distributed".
You and I are total strangers on different corners of the globe. You may not like what you're about to read, but it's better that you get a hint where the wind is blowing sooner than not.
If my team were consulting with your organization's execs and we caught a hint that the existing internal resources were not already proactively staying current with internet protocol (which is IPv6), we would point out there is urgency to start right away with emphasis that the existing internal team is over two decades behind staying current.
Or, if a detected hint the internal team were at all resistant to IPv6, we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.
Many network engineers at many ISPs would gladly drop all IPv4 traffic if they thought they could get away with it.
IPv6 only seems more complicated if you still need to unlearn IPv4. IPv6 does have a steeper learning curve, but once that learning curve is overcome, IPv6 is actually much simpler than IPv4. More people than not don't like reading RFCs, but professionals do slowly read RFCs on their own time.
Thanks, I'll take a look into the recommended protocols.
One clarification I'd like to make is that IPv6 is not offered, I can only get IPv4 addresses through the ISP DHCP, there is no ipv6 being offered with command 'dhclient -6' for example on linux, neither does window pick any ipv6 up so it doesn't seem to be an us problem.
It's often that Argentinians miss nuances when copying ethical gray areas from the Americans, and without those slight nuances the debate often gets mixed up with a much more subtle debate.
To make a parallel, Trump issued a memecoin days before entering office, it wasn't technically while being president, it was a memecoin so there was no underlying asset, a gray area, see? America.
Now Milei saw and culted the cargo, he made a coin during his office mandate, and he mentioned it would be used to fund Argentina tech projects, so it's an unregulated security. The nuances are lost, and it's just plain bad.
EDIT1:
>Or, if a detected hint the internal team were at all resistant to IPv6, we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.
>we would point out there is urgency to start right away with emphasis that the existing internal team is over two decades behind staying current.
I appreciate the candor
>You and I are total strangers on different corners of the globe.
This is true and it might impact the nuances and extra-technical semantics of the protocol. For example, in here dropping IPv4 support might mean dropping support for older devices, which might be less common in America, ISPs might not support it, so it's not just about the device but the network, to give you an idea I just got off the phone with the ISP which is THE biggest ISP in Argentina, they don't offer IPv6, period.
>If my team were consulting with your organization's execs
Here might be a big disconnect, my organization execs would probably be way out of budget for whatever your org may charge, that would never happen.
If you want to point the salesmen of your org to try and stir some shit up like that with the ISP, then that may make a bit more sense, the budgets may align for importing American consulting, and berating a big org chart that includes engineers might make more sense than trying to replace a 'team' of 1 or 2 fractionalist generalist IT guys on <500$ month contracts.
The ISP brand is Personal, local corp is Telecom Argentina S.A, Asynchronous System Number AS7303, trades as TEO in NYSE I think, owned by Grupo Clarin which comes is a traditional Media and news company. IPv6 is not offered to consumers right now.
>we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.
Everything I am suggesting here is what an internal team with full ownership of the network should do. An external team could chisel little by little, and progress the network in phases.
What is shared here is a general direction. I am sure some people I know where all they do is networking could tell me harshly some of these ways could be done better, and often these people are right ; but sometimes these same people are actually wrong and don't fully consider the positions of people in IT roles at companies that aren't ISPs.
All suggested below is not necessarily the ultimate way but a general direction.
_
>> can only get IPv4 addresses through the ISP DHCP
ISP-owned IP addresses, either of legacy IP or IPv6, are capricious and can suddenly change, as you experienced recently.
I suggest to adopt a mindset of "our network" and "their network", rather than functionally have your network be a passive extension of their network by using their IP addresses.
The router announcements (IPv6 RA) or DHCP (IPv4) for any IP addresses within your network should always be issued by devices controlled solely by our organization.
NAT64 and tunnels exist, any upstream ISP is not a blocker.
Modern Linux has eBPF and eXpress Data Path. Both Linux and FreeBSD (use HardenedBSD if you can) have DPDK. They can make for surprisingly high performance edge routers on x86_64 server boxes over a decade old, exceeding what most campuses or even datacenter footprints actually need and at low cost. Even without eBPF & XDP or DPDK, these on x86_64 are often "good enough" for router and firewall.
DNS running on these or adjacent boxes internal to the organization is essential.
The addresses at the gateways, either of IPv4 or IPv6, can be made highly available with VRRPv3.
IPv6 has an elegant way to handle multiple upstream ISPs without VRRP or CARP at the gateways, but even Linux is just recently implementing what may only be a piece of them (the BSDs will later), some mention of them here https://news.ycombinator.com/item?id=50143420
_
What I would do, which is opinionated so I'm not necessarily suggesting others do it, assuming tunneling will be involved: if the organizational wherewithal is there to register an AS and do BGP, is pay the AUD 500 fee to register an AS and have a chunk of IPv6 space for to use IPv6 GUA addresses that officially belong to the organization.
If not, which is often enough the case because we know how some organizations can be slow (not making any assumptions about your's), the remaining avenue is to use IPv6 ULA addresses which are the spiritual counterpart to IPv4 RFC1918 addresses.
You can embed MAC addresses in IPv6 ULA addresses, like the MAC 82c6.7943.acb2 put in an IPv6 like
fc00:5007:6525:2001:3003:82c6:7943:acb2
and use DHCPv6 to always assign a specific IPv6 ULA address to a specific MAC address, where you have thought through the potential information-disclosure implications and you are certain you want to do that.
Then I would use IPv4-only ISP paths for what they're good for: dumb paths to tunnel IPv6 packets to where there is proper internet.
For the option with an AS, BGP announcements on the other side of the tunnel. Personally I would do SCION on the gateways and out the other side of the tunnel, but you don't want to do SCION unless you are also crazy (like a fox).
For the IPv6 ULA option, PAT which is the spiritual counterpart to IPv4's NAT but is also technologically simpler.
With IPv6 ULA and no tunneling, NAT64 and DNS64 can work for outbound.
Site to site tunnels will be tricky no matter what. Tailscale, ZeroTier, Netbird, and similar may be able to do much of the work for you ; these should run in a DMZ on another side of a router/firewall that filters the appropriate IPv6 ULA prefixes.
I would try to see if I could make vanilla Wireguard work with NAT traversal techniques using some cloud-hosted VMs that help with the "hole punching", but not everyone would do that.
There aren't many options that will all work well but almost always more than one option that can work well, all subject to the specific site and inter-organizational resources.
_
>> dropping IPv4 support might mean dropping support for older devices
For as long as it makes organizational sense to continue using these devices, put them behind an OpenBSD box that performs NAT46 and DNS46, with IPv4 addresses statically mapped to IPv6 addresses, maybe ones that contain the MAC addresses of the devices.
With Salt or Ansible, such a scheme with NAT, DNS, DHCP configuration may all be templatized and in perfect alignment, and is scalable.
Authoritative inventory of canonical identifiers/names versioned with Git, what Ansible calls "inventory", is imperative.
Sometimes this looks like a couple of old x86_64 boxes doing CARP (similar to VRRP) on the IPv4 side for a few dozen or couple hundred devices downstream.
Sometimes this looks like, in a handful of distant corners of the larger network, a cheap single-board computer between a single device and the rest of the network ; without a wifi chip or the wifi chip removed by heating (board-repair style), unless downstream of a wifi AP.
_
>> the ISP which is THE biggest ISP in Argentina, they don't offer IPv6
>> The ISP brand is Personal, local corp is Telecom Argentina S.A, Asynchronous System Number AS7303, trades as TEO in NYSE I think, owned by Grupo Clarin which comes is a traditional Media and news company.
I can think of some service provider network engineers that would gladly drop all of Argentina's IPv4 off the entire internet and "IPv6 prefix announcements welcome", if the business sides would let them do it.
Something like this will probably start happening sooner than people think.
>I can think of some service provider network engineers that would gladly drop all of Argentina's IPv4 off the entire internet and "IPv6 prefix announcements welcome", if the business sides would let them do it.
Yes, there's no shortage of employees that would vote to reduce their workload by removing their service offering, if you ask a physician here if the hospital should stop taking patients of X type, they'd be onboard, less work for them.
It's a dream though, try to make an AAAA request for any website, it's not there, even government websites.
>Something like this will probably start happening sooner than people think.
I'm even trying american companies, like citi.com, walmart.com, there's no AAAA records there.
>For as long as it makes organizational sense to continue using these devices, put them behind an OpenBSD box that performs NAT46 and DNS46, with IPv4 addresses statically mapped to IPv6 addresses, maybe ones that contain the MAC addresses of the devices.
This is an external facing service, so we don't control the devices or routes that patients and external physicians will be accessing the website.
>Tunneling
Yeah, I'm going to go this route, IPv4 tunnel, it's a horrible hack, but this is hacker news after all.
I work for the hospital, occasionally, they are my client.
> You have an actual contract with the ISP, right?
They do not, it's an implied consumer contract, like when someone buys a hot dog from a stand.
I'd like a written contract too, but when trying to negotiate one, they want a lot more money for them, it depends of the nuances of the terms, but I've talked to sales reps, and it comes down to having a 1Gbps line that works right now vs a 100Mbps line that's more expensive, with the only difference being that the contract is now written and there's a symbolic SLA with some 10% penalty, and a single professional beration receiver instead of multiple anonymous on call rotation.
It's not a clear choice, especially considering that the dedicated route with SLA means introducing change risk to the operational and SLA benefit of the ISP, fiber, new holes, new lines, etc..
>You could also update to IPv6.
I would, they don't offer IPv6
>You don't need an address block from an RIR. You just need your ISP to give you an address.
Yeah, maybe. If I get an IPv4 block though what I'd do is a regional entity whether for profit or NFP to offer emergency regional tunneling, potentially while finding alternative revenue streams like collecting lists of wronged ISP customers and notifying them of class action lawsuits they may participate in. A 25K check, or a 5K check with an ipv4 block and I'm golden.
Reddit shadowbanned me multiple times for either absurd or political reasons, but my ISP used to assign dynamic IPv4 addresses, so I could easily create a new account. Then it switched to IPv6 with a static address, and now I can't create new Reddit accounts anymore.
Most consumer ISPs regularly rotate the prefix. IPv6 has proper support for that and can keep connections on the old and new prefix alive for a while in parallel.
With IPv4 most ISPs only rotate IPs on new connections (router restart). But my old home internet even stayed on the same ipv4 for years. Only if I shut down the router for a longer time it got a fresh ipv4 assigned.
So it's an implementation detail, not a technical limitation. Not rotating the prefix is a bad implementation.
China: 358M
Both countries have roughly the same population. The IPv4 problem has been swept under the rug with CGNAT and a normal person doesn't even notice it. But it sucks. Forget having a dedicated IP, even on a broadband connection, you don't get a public IP that's truly yours. According to IPInfo[1], there are around 1,000 users sharing my IP. I get flagged for malicious activity, and online gaming is impossible without a Tailscale relay.
Of course, much of this comes down to the bad luck (+ policies) of developing late, when most IPv4 blocks had already been allocated. But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks they'll probably never fully use, and may never sell. Meanwhile I am sharing a single public IP with a thousand strangers.
[1]: https://ipinfo.io/223.233.77.184
[2]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
You can either get a block of /24 to announce yourself (you've got to cover all the technical setup and costs of this) or use their free 44net.connect service and just organise a wireguard tunnel.
You cannot use it for anything commercial.
[1] https://wiki.ampr.org/wiki/Main_Page
Maybe Apple and Ford, but it's more than fair that DoD has large blocks since they created ipv4 to connect themselves to other networks. It was only 10 years ago that the US government decided to give up control of IANA.
There were and still are are other global networks -- none of them come close to being anywhere near as open or interoperable. What's the next closest, PSTN maybe?
Configuring my OS to prefer IPv6 addresses of DNS responses significantly reduced the number of web captchas I see (on NAT444 with native IPv6).
IPv4 is old and broken, use IPv6.
It's crazy I can get fiber to my house in the US, but not IPv6.
https://tunnelbroker.net
I was doing this back when I had BT in London, my internet speed back then was pretty abysmal and it would randomly drop routes- ironically this tunnel actually improved my internet (because of the routes not being dropped, not the speed).
And they can always tell your ISP if they don't like paying to connect to the tunnelling server they should just implement v6.
But if you've ever had to deal with endpoint security, if you're just doing static rule based blocking/throttling, /32 or /24 blocking is often your best option. Thanks to CGNAT this often means having a pretty large impact since an ISP's residential customer might end up getting randomly assigned a "bad" address and the cooldown for these rules is often months long or more.
In IPv6 land, you can just block a /128 or even a /64 and rarely hit anyone else in the crossfire.
IPv4 is old, very old. But how is it broken? It's literally been working just fine since it came out.
That there are limited addresses is something else: it doesn't mean it's broken.
I don't care that spying/surveillance devices have more trouble spying on me with IPv4 than with IPv6 and I don't care that some apps have a harder time establishing connection.
IPv4 works. SSH over IPv4 works. Browsing the Web over IPv4 works.
It is broken for you by upstream NAT and CGNAT.
The Internet was supposed to be a purely peer-to-peer network, where the addresses on each side of a connection pointed to an end node. That's why protocols like FTP or SIP break when NAT is used, and why you have to play games with port forwarding if you want to run services from your house (assuming you have a public IP address at all).
tracert -4 google.com
tracert -6 google.com
I do get very different hops and latency.
However for “happy eyeballs” algo to fallback to IPv4, latency needs to be very bad on IPv6.
False: https://stats.labs.apnic.net/ipv6
> "China: 358M
> "Both countries have roughly the same population"
To save anyone else curious from looking it up - their populations are about 1.4 billion (1400 million) each.
But if you are living in a Western country, then you are probably blessed with CGNAT-free residential internet.
Some carriers in my country have recently started to share the same IP between 4 customers, each having a port range (1-16363, ...), but you can always request a full IP for free.
I, unfortunately, have been on CGNATed residential internet since 2016, though I used to still get a public IP on request (they stopped doing that though.) I live in South East Asia, for context.
Without IPv6 my only choice would have been relying on a centralized service like Zerotier and Tailscale.
Worse is I have IPv6 connectivity for devices, yet still no open ports available, so no serving available. And I only receive a /64 so no delegation available through router.
So now it's Hurricane Electric tunnel to their nearest (in my city) hosted node for IPv6 and a prepaid 50 USD/year node (technically x2 since I wanted a backup to play around with) for IPv4 port forwarding.
Both options are acceptable because the needed infra is close by in the largest metroplex in Texas, it just sucks to have to do all this extra work to replicate what I could do with a dial-up ISP.
I'll say this - having LLM assistants handle the nasty routing and firewall rules needed to make this hodge podge work without needing to be a network engineer has been very helpful.
I was just looking at flipping back, but now it seems the default for new resi accounts is CGNAT. They say they'll give me a real IP upon request at no additional charge, but it's anyone's guess how long that holds out.
They don't do IPv6 at all.
Michigan USA.
Me as somewhat of a nerd, even doubt if I need a public IP, seeing how cyber security is looking today.
Indeed a shared IP is arguably a benefit in that it makes fingerprinting harder.
If your ISP had customers who were interested it could spend $150k on a /19 block giving 8000 IPv4 addresses and charge an extra ₹100 a month for them and after two years it would be in profit.
In fact I think Jio and Airtel offer static IPs for residential use for something like ₹300 a month, which given how cheap IPv4 addresses are is a massive money spinner, but I have't spoken to anyone living in India about ISPs for a couple of years.
So even if it's true 50% of clients support IPv6, only about 5% to 10% of website hosts do.
Sure a person can do a dual-stack setup or do some IPv4-IPv6 translation, but seriously IPv6-only should be plug-and-play by now.
The obsession about "IPv6 only" has never made sense to me. Any decent firewall software will let you write rules that apply regardless of IP version. The "software complexity" argument is bunk... you already have v4 and v6 IP implementations in your OS, and every major OS has provided IP-version-agnostic socket interface code for much more than ten years. If you are using software that is IPv6-capable, it's very likely that it's using IP version agnostic library functions.
Unless stewardship of the Internet is wrested from the hands of the responsible, level-headed type of folks that run it now and transferred to the hands of folks who think nothing of making backwards-incompatible changes every six months, IPv4 won't stop running across the Internet within the lifetime of anyone who's currently reading HN. This delay is fine. The only thing about IPv4 that's a problem is that its address space is 32 bits wide. Had it been defined with a 128+ bit address space, we wouldn't have seen another version of IP on the Internet. Now that IPv6 is around to reduce address pressure, there's no big need to do anything about IPv4.
There are domains like T-mobile US that are IPv6 only already. T-mobile runs NAT in the network so that all of IPv4 is NAT'd to IPv6.
I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.
Once IPv6 becomes the choice to support to get new customers, it is reasonable to expect that IPv4 support will start deteriorating and will eventually fade away.
I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.
I'm certain that that is not what the folks who scream very loudly about how IPv6 has been and continues to be a colossal failure because it's not the only version of IP on the Internet are doing.
> I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.
Sure. That's the future I find most plausible: For "residential" connections, provide IPv6 GUAs and IPv4 via CGN... [0] for "commercial" connections, provide IPV6 GUAs and give the customer the option of one or more IPv4 GUAs.
> I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.
I do hope we get to that point within the next five years, if not ten! But notice that my claim is that IPv4 will still be crossing the Internet after everyone reading HN today is dead. [1]
[0] I'm calling the various mechanisms that only provide an IPv6 address to an end user and do fancy gyrations to provide IPv4 access "CGN", even if might not strictly be CGN.
[1] ...as long as the the responsible, level-headed type of folks that run it now aren't replaced with the "making backwards-incompatible changes to everything every six months is A-OK!" type of folks.
Google sees 70-80% from some countries:
* https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
I will believe otherwise once even one US hotel chain supports it. I have _never_ seen a hotel in the US with IPv6 WiFi. Not once.
And I once stayed in a hotel (in Mountain View, CA) that gave out public IPv4 addresses.
Meanwhile, CGNAT really solved most issues with IPv4. Yes, even the voice/video chat issues.
Want another fun example? Try to find a SIP telephony provider in the US that supports IPv6. Go on. I do this exercise about once a year.
/me glances over at my phone, which only has an IPv6 address when connected via cellular modem.
/me thinks back to the decade+ of incredibly boring IPv6 service from the residential ISPs I've used.
Sure.
If an ISP wants to provide only IPv6 addresses to CPE, they can set things up so that happens. But if you won't be satisfied until IPv4 no longer passes over the Internet, then you're going to die unhappy about that. The goal for our lifetime is one where every residential site has a global /56 and is behind IPv4 CGN, and servers hosted by commercial entities get to choose whether they assign IPv4 addresses, IPv6 addresses, or both to their servers.
Seriously, this drives me mad. There is NO WAY to get IPv6 on mobile networks in Switzerland. Neither Swisscom, nor Sunrise, nor Salt, and of course no reseller.
And Android handles this particularly poorly. I have some servers set up in my tailscale network on private IPv6 addresses, but android doesn't query AAAA addresses if it has no ::/0 route, so I HAVE to route all my traffic through my VPN which often creates other complications (with corporate wifi etc.)
But I'd claim it failed completely. Many very public services (eg. github.com, sentry.io, office365.com, archive.org) outright don't support it. And the fact that infrastructure providers (like mobile network carriers) don't support it either, proves that it is far from "alive". In fact, I'd say it is deader than MMS, Fax and landline. For these I can still get service. For IPv6 (on the phone) I can't.
Email didn't replace letters on paper. But I wouldn't say email failed completely.
Check my reply to your post. [0] I wrote it up before I noticed your message here. ;)
[0] <https://news.ycombinator.com/item?id=50295293>
IPv6 is very much alive. And it's so boring and working so well, that you don't even notice it.
Most of the world runs on IPv4. If we shut down IPv6 on the core routers tomorrow, pretty much nobody is going to blink an eye. And now I believe that we should do it and start again.
The 50% stat is really mostly mobile phones on cellular networks, which remain the _only_ major success story for IPv6. Mostly because there's not enough private or even squattable IPv4 space available for many large mobile phone operators.
> IPv6 is very much alive. And it's so boring and working so well, that you don't even notice it.
Sigh. No, it's not. In a thread a couple of weeks ago, I gave several examples:
1. You're a SOHO-type business. How can you do multiple WAN uplinks with IPv6 without NAT?
2. How do you prevent your printer on IPv6 from breaking when your Internet connection goes down?
For context: I deployed IPv6 in my networks in 2006. I have war stories.
Advertise the addresses offered by the primary uplink, then retire those addresses [0] and advertise the secondary when the primary fails. Or are you talking about load balancing, which is its own thing? Either way, this situation is inherently not boring, so the way you solve it is going to be quite a bit more complex -regardless of IP protocol version- than the very boring single-upstream situation.
> How do you prevent your printer on IPv6 from breaking when your Internet connection goes down?
I'll flip this around on you:
How do you prevent your printer from "breaking" when its ISP-provided DHCP lease on its globally-routable IPv4 address expires? How about when the ISP refuses to renew the lease on the printer's current globally-routable IPv4 address and forces it to get a new one?
Obviously, you use the ISP-assigned globally-routable IPv4 address and also assign an RFC 1918 address to the printer.
How to solve this with IPv6? Use ULAs! They're the equivalent of 1918 space in the IPv6 world. Just like in IPv4, IPv6 globally-routable addresses are for global communication and can be used for LAN-local communication. And -just like 1918 addresses- ULAs are for LAN-local communication. Just like with IPv4, if you can't control the addresses that you get from your upstream provider, and/or if your router is set up to retire your upstream provider's delegated address space when your upstream link goes down, then you use ULAs. [1]
I know that OpenWRT has a setting in LuCi to enable advertisement of a ULA prefix, and fifteen seconds of searching revealed that at least some Linksys combination router/APs seem to just generate and advertise a ULA prefix by default. [2]
So, if you're not configuring your LAN this way and upstream provider renumbering is getting in your way, then you really should bother to.
[0] ...by advertising their valid lifetime as zero seconds...
[1] ...or if you happen to like to be able to assign fixed IP addresses to certain pieces of hardware...
[2] <https://support.linksys.com/kb/article/3744-en/>
Isn't that the default for modern routers? They just generate a random ULA during setup and assign it.
Random ULAs are also great for LAN-to-LAN VPNs, because there aren't any private IP overlaps. Everyone setting up their LAN on 192.168.0.x makes it quite a mess on IPv4.
I assumed so because it's the obviously correct thing to do, but I haven't used a SoHo router in so many years, so I don't know.
> Random ULAs are also great for LAN-to-LAN VPNs, because there aren't any private IP overlaps.
Yep! Extremely low chance of prefix collision is their most important purpose. I've been part of several corporate acquisitions, and it inevitably took 6->18+ months to do enough of the IPv4 renumbering and server-discommissioning [0] process to begin to merge the LANs of the merging companies. Had they used ULA addressing, the odds of having to do that massive amount of work would be effectively zero.
And if collisions aren't something you give any shits about, nothing stops you [1] from setting your ULA to fd00::/48 and advertising fd00::/64 on your LAN for static IP addresses that are notably shorter than you can get with IPv4!
[0] ...because there's so little space in the 1918 range...
[1] ...well, unless your router's configuration system doesn't let you specify your ULA prefix...
/me glances over at my LAN which has been happily using ULAs for local communications and GUAs for global for the past I don't even know how long.
_Sure_.
> Advertise the addresses offered by the primary uplink, then retire those addresses
Prefix withdrawal doesn't work reliably on Android. And neither is it required to work, btw. Neither does this solution allow for load balancing, as all traffic will just go through one connection.
Bonus points: triangular routing to your local NAS through the router.
> How do you prevent your printer from "breaking" when its ISP-provided DHCP lease on its globally-routable IPv4 address expires? How about when the ISP refuses to renew the lease on the printer's current globally-routable IPv4 address and forces it to get a new one?
Printers get an RFC1918 address and don't care about global connectivity.
> How to solve this with IPv6? Use ULAs! They're the equivalent of 1918 space in the IPv6 world.
They're not. IPv6 is nothing like IPv4 operationally. Back to my challenge, ULA will NOT work.
The scenario is very simple: the printer gets a ULA prefix and a GUA prefix. Your computer also gets a GUA and a ULA from the same router.
So far so good.
Now the uplink goes down, and the router withdraws the prefix. The printer sees the withdrawal and removes its GUA address. Your computer misses it, and still has the GUA and the ULA addresses.
Whoops. The printing is now broken somehow. Why?
Works fine on the Android hardware I have. Are you attempting to retire prefixes that have an infinite lifetime? That doesn't work, and I don't think it's supposed to work.
> Neither does this solution allow for load balancing...
As I said
> Printers get an RFC1918 address and don't care about global connectivity.Okay, so why are you complaining about your printer being broken by GUAs that you're not permitting it to have? ;)
> IPv6 is nothing like IPv4 operationally.
For anyone who's not an IP stack developer, network hardware developer, or Enterprise sysadmin it absolutely is. And other than the fact that every endpoint is able to get a global address in v6, the differences between v4 and v6 are minor. RAs instead of... well, nothing, and DHCP for both.
> Whoops. The printing is now broken somehow. Why?
Exactly.
Why isn't your DHCPv6 server putting either both the GUA and ULA, or -better- only the ULA addresses in your LAN's DNS server? This Just Works™ on dnsmasq, which is one of the most widely-deployed DNS+DHCP servers on SoHo gear. [0] dnsmasq's default TTL for hosts added to the DHCP lease file appears to be 0, so -worst case- your sleepy computer tries to continue its conversation with the printer a couple of times, does ND and discovers that the IP it was using is gone, then looks up the hostname again and gets the new address of the printer. I think the trendy term for this back in the 2000s was "self-healing".
If you're going to retort "But we don't use dnsmasq in the companies I'm sometimes talking about!"... well, if you can't figure out how to not register upstream-controlled GUA addresses for your LAN hosts in your DNS, then do what dnsmasq does and serve them up with a TTL of 0.
[0] To head off the "Android doesn't really do DHCPv6" retort: Even though Android refuses to use anything other than DHCPv6-PD for managed address assignment, -AFAIK- Android still sends DHCPv6 ADDR_REG_INFORM messages for addresses it autogenerates on networks with either the "OtherConfig" or "Managed" flags set. I haven't bothered to set up my Linux systems to do this, but I'd be surprised if Windows and Darwin systems didn't do this.
Early IPv6 was a mess. It took a surprising amount of time for IPv6 to become mature and usable.
:grimace:
Also, that same tech industry has shown remarcable competence in working around IPv4's limitations.
Of course, back here in the real world you can look at the RFCs yourself and see that they're credited to places like Ipsilon Networks, Xerox and Sun Microsystems. Boring corporate network companies.
The v6 spec also has all these alternative ways to use it more like v4, commonly brought up as a cop-out against the above criticisms, but that's actually part of the problem. The spec is too big, and things only implement a subset of it, see Android not supporting DHCP6. Realistically you'll have 99% of people using anything like this the default way, and the spec does define SLAAC, no-NAT, etc as default.
But you could say v6 is better just cause it has more addresses, and that's fair.
...Imperial is better than metric because it lines up with everyday usage better unless you're specifically concerned about the physical properties of water. Especially ˚F vs ˚C. Not a big deal though.
Pounds vs kg, similar story as F vs C. Pound is pretty much the human-discernible granularity. Otherwise doesn't matter.
0-100 MPH lines up well with car speeds, which is usually the thing you're measuring with that. KPH is excessively granular for that. Probably not by design, but yeah.
The feet/inches vs meters/cm thing matters less. It's base-12 vs base-10. You can do decimal feet or fractional meters of course, but it's less common, so apparently both ways are fine.
Austria-Hungary adopted the metric system in the 1870s. Back then: no cars, no highways, no speeding laws etc. Oxen-drawn wagons in the countryside were not built to a precise spec.
Only the railway, the architects and the artillery had to really switch. Ordinary people would still ask the grocer for half a pound of ham in the 1930s.
USA in the 1970s would have to remeasure all the land communications etc., or end up with a weird hybrid like the UK.
WHat we have in IPv4 and IPv6 is the weird UK-like hybrid...
* https://en.wikipedia.org/wiki/Metrication_in_Australia
It's going to take decades, mostly waiting for the non-metric folks to die off probably and the raised-on-metric folks to grow up, but if you don't start you'll never finish.
† Can Aussie HNer confirm?
These are all customary usage so I'd say we are completely switched over, we couldn't tell you generally what these units look like outside of "how big is a baby" or "how tall is that person" or "is my beer large or small" really.
Creating an IPng was always going to be complicated:
* https://github.com/becarpenter/misc/blob/main/why6why.md* https://datatracker.ietf.org/doc/html/rfc1671
For anyone curious as to the decision-making process, here are the criteria for what the IETF was looking for in an IPng:
* https://datatracker.ietf.org/doc/html/rfc1726
Here are the candidates that were floating around at the time, and the reason why the winner was chosen:
* https://datatracker.ietf.org/doc/html/rfc1752
I'm not saying that IPv6 is incompetent, or that IPv6 implementations break backward compatibility, or that the problem can be solved without breaking bc.
I'm saying that while IPv6 breaks bc itself, dual stack does not, and even full migrations can maintain bc or gracefully degraded.
In essence, not all implementations IPv6 are good, and not all migrations from IPv4 are responsible, if someone is blindly team IPv6 or blindly team IPv4 in general there's a lack of nuance.
NAT is the only one that actually does work, and it's terrible.
Anyone who doesn't by default set up IPv6-only networks by default with NAT64 and DNS64, or who present any notion that IPv4 is somehow "okay", shouldn't have a job anywhere, not even an entry-level desktop support job.
IPv6 can be selectively applied to say, NAT addresses, but other than that, IPv4 is just fine and your statement is incorrect.
Unless there's a merger/acquisition and the two companies both use 10.0.0.0.
Most home networks use 192.168, and so you can't use that in corporate environments, because the WFH people who VPN in could then have routing snags between local and remote locations.
Also, in your VPN software be sure to perhaps not use 172 addresses (like my previous job did), as some of those ranges are used by Docker by default, and so you can cause issues for developers.
But other than that IPv4 RFC 1918 is not complicated at all…
The thing is, asking nicely doesn't always work. Sure, automated tools like docker/incus/wireguard/tailscale will respect it. But admins who don't want to be stuck typing long addresses? Not so much. I've lost count of how often I encounter a network admin that manually set their prefix to some fcXX::, when it's not outright fc00::.
Of course you can (and should) blame this on admins and not on IPv6, but then the same could be said of IPv4 where adding entropy to 10.X.X.0 is the usual recommended way of doing things.
How would an IPv4 client send a packet to an IPv6 server? The IPv4 packet has only 4 bytes to spare for the destination address.
You can't.
Anything longer, even if it's just 1 bit, would require a new IP version.
- If you are managing the 4to6 mappings manually, it's obviously not going to be scalable. Just to give people an idea, websites nowadays can connect to 10+ IPs in a single page due to CDN load balancing and stuff.
- If you are handling the mappings automatically, such as by monitoring DNS queries and creating dynamic mappings based on that, the issues become more insidious: applications with hardcoded IP literals would fail without an obvious reason.
A second way of thinking about it:
* Stars in the Milky Way: 400 Billion
* Galaxies in the universe: 2 Trillion
* So (4x10¹¹)x(2x10¹²) = 8x10²³ stars in the universe.
* Size of IPv6 address space: 3.4x10³⁸
* Find the ratio between addresses and stars: 3.4x10³⁸ / 8x10²³
IPv6 offers about 430 trillion times more addresses than estimated stars in the universe. From Tom Coffee's presentation "An Enterprise IPv6 Address Planning Case-Study":
* https://www.youtube.com/watch?v=7Tnh4upTOC4
The math is a lot less impressive when you do it with 2^48 or 2^64.
Much of the IPv6 rollout challenges have been centered around routing and security. It's great that I can personally have (in theory) more IP addresses than I would ever practically need (and I am saying this as someone with 200 IP endpoints just in my house), but if I can't easily manage and control access much of the theoretical benefit goes away.
IMO, IPv6 solved the address pool size part of the issue, but it made managing the v4 to v6 transition very painful.
There is no easy way to transition from IPv4 to any kind of IPng; see my other comment:
* https://news.ycombinator.com/item?id=50288091
I've been told that this is actually because Brazil has a very competitive local ecosystem of small ISPs competing with eachother on the regional scale.
[1]: https://bgp.he.net/report/world
Anyway, the Netherlands also seems to be an attractive place to build datacenters.
We are close to not having enough just for the servers people really want much less random things that should be contactable peer to peer.
NAT should not replace a firewall
What’s left are just apps and devices that people don’t wanna change out but are probably pwnd and I don’t think are gonna get updates because the teams that wrote the software moved on and the companies don’t wanna keep spending on sustaining.
Eg 192.168.0.1 becomes 0.0.0.0.192.168.0.1
And then we dish out all the new address space. You would get the network providers to handle address conversion until software and hardware has been updated. Because all the existing addresses are reserved in the new set, it doesn’t affect them.
Keeps all the nice parts of IPv4, doesn’t require everyone to switch to an entirely new system, backwards compatible with existing hardware/software. Problem solved.
Absolutely not. Existing IPv4 hardware and software expects addresses to be 4 bytes long. They expect packets to have a 4 byte source address at offset 12 in the header, then a 4 byte destination address at offset 16. Everything breaks if you try to give them a header with an 8 byte source address at offset 12 and an 8 byte destination address at offset 20.
As does DNS.
"A" records are fixed at 32 bits, so you have to add a new record type and update all DNS software, plus user-space API/library code and data structures to ask for and store the new record type.
Just like IPv6.
There is no "just" adding more addresses: whatever scheme anyone comes up with is the same amount of work as IPv6.
* https://github.com/becarpenter/misc/blob/main/why6why.md
IIRC something like that was considered when IPv6 was first being designed, be deemed insufficient for the long-term future. 64-bits is thought to be enough to stave off address starvation though, which is why IPv6 address ranges are usually assigned as /64s (my homer link has a /48 range should I wish to use it all!), so I can see your reasoning on that level.
Hence my having a /64 (/48 in fact, should I ever enable more than the current /64) shows that 64-bits is enough for global addressing. If it wasn't then giving me a /64 would be part of a path to creating an address exhaustion problem just like the one with IPv4 (which was exacerbated somewhat by handing out /8 ranges unnecessarily in the early days).
You still need to have routers, clients, and absolutely everything to understand the new scheme to use those new addresses.
Though I've never seen a v6 address represented that way, it would make then noticeably longer, so I don't know if anything will accept such a string as a valid address. Though IPv4-mapped addresses are sometimes show as a mix (::ffff:10.5.2.1 for 10.5.2.1) so maybe I'm wrong there.
Likewise I've never seen IPv4 addresses written in hex in the wild, but the relevant specs say it is valid. `ping 0xc0a82bc2` works just as well as `ping 192.168.43.194` but I doubt many forms accepting IPv4 addresses will validate that and allow it.
Or octal:
* https://networkingtoolbox.net/ip-address-convertor/represent...
The entire ipv4 space is already mapped to reserved subsets of ipv6, by the way. e.g. ::ffff:0:0/96 (i.e. 0.0.0.0.0.0.0.0.0.0.255.255.w.x.y.z) or 64:ff9b::/96. v6 devices can already "talk to" v4. The problem is the ipv6 space is obviously not a subset of ipv4, so v4 doesn't have a clean way to talk to or even about v6.
Most of the time, this results in people thinking the big problems are one set like "if only there was a way to translate" while the real remaining problems are another set like "and how do you get people to want to transition when it works well enough for those clients in the translated state".
Yeah, about that part. This is a "now draw the rest of the fucking owl" type of idea.
It turns out when you ignore the hardest part of the problem, you can always make a good-looking proposal!
Being an IETF draft means nothing at all, as covered in this IETF draft: https://datatracker.ietf.org/doc/draft-wkumari-not-a-draft/
Dual-stack is also the default, and CG-NAT exists as a fallback. For IPv6 only websites there is still the option to use a HTTP proxy.
How is this different from ::192.168.0.1? :)
Of all the sins of IPv6, its tied between using ':' as the separator, and the god awful '::' "just skip writing the address because we made them too fucking big lol"
Wouldn't have been a problem if they hadn't given every square millimeter of the planet 100 billion addresses.
Fine, let's change the question.
Without counting, how many zeroes are there in 192.168.0.0.0.0.0.1?
But I don't get why the other commenter was proposing putting the 0s at the beginning instead of the end. Shouldn't the new address space be under the existing subnets?
The protocol chosen for IPng, SIPP, did actually have "only" 64 bits, but this was deemed not enough as folks did not want to have to worry about running out again (amongst other reasons), and so tweaked it to have a fixed 128 bits:
* https://datatracker.ietf.org/doc/html/rfc1752
SIPP originally was variable-length capable, but it was decided fixed-length was better (e.g., for hardware like ASICs).
> Wouldn't have been a problem if they hadn't given every square millimeter of the planet 100 billion addresses.
For the record: IPv6 gives 10¹⁷ addresses per mm²; in terms of volume, 10⁸ IPv6 addresses per mm³ throughout the Earth.
I woulda thought 18 quintillion would've been enough addresses for the next century or two but good thing we locked in all this extra data we throw away with a '::'.
I'm sure it was all well considered by intelligent people, but it was still a dumb decision.
Like I only tangentially interact with this stuff, but I can't imagine how a network operator wouldn't prefer we live in an all ipv6 world.
See, no colons in sight!
Now the reason this doesn't work is that the address length is not encoded, so if you make the address longer, no one knows about it and they [routers and destinations] just assume the wrong address and send it on or discard the frame
That being said, we should take the time to understand why IPv4 is still hanging around when IPv6 has been around since before most people got internet access. What is really holding IPv6 back?
There is no "just" extending the address length:
* https://github.com/becarpenter/misc/blob/main/why6why.md* https://datatracker.ietf.org/doc/html/rfc1671
> Keeps all the nice parts of IPv4, doesn’t require everyone to switch to an entirely new system, backwards compatible with existing hardware/software. Problem solved.
You have to ship new code to every 'network element' to support your "IPv4+" plan. Just like with IPv6.
You also have to update DNS to create new resource record types ("A" is hard-coded to 32-bits) to support the new longer addresses, and have all user-land code start asking for, using, and understanding the new record replies. Just like with IPv6. (A lot of legacy code did not have room in data structures for multiple reply types: sure you'd get the "A" but unless you updated the code to get the "A+" address (for "IPv4+" addresses) you could never get to the longer with address… just like IPv6 needed code updates to recognize AAAA, otherwise you were A-only.)
You need to update socket APIs to hold new data structures for longer addresses so your app can tell the kernel to send packets to the new addresses. Just like with IPv6. In any 'address extension' plan the legacy code cannot use the new address space; you have to:
* update the IP stack (like with IPv6)
* tell applications about new DNS records (like IPv6)
* set up translation layers for legacy-only code that cannot be update to reach IPv4+-only destination (like IPv6 with DNS64/NAT64, CLAT, etc)
You're updating the exact same code paths in both the "IPv4+" and IPv6 scenarios: dual-stack, DNS, socket address structures, dealing with legacy-only code that is never touched to deal with the larger address space.
"Just adding more bits" means updating a whole bunch of code (routers, firewalls, DNS, APIs, userland, etc) to handle the new data structures. There is no "just": it's the same work for IPv6 as with any other idea.
You have 2002:47b1:11ab::/48. If your ISP supports it, packets sent to that /48 will be delivered to you as native v6 packets, otherwise they'll be stuffed into a v4 packet which will be sent to 71.177.17.171. Or there's ::ffff:71.177.17.171 which will reach you using unmodified v4 packets.
That's two different ways your v4 address is present in v6.
the thing is that it does require a switch similar to ipv6. but maybe there’s a subnet that maps 1 to 1 with the legacy block?
something like this could theoretically be pinned onto ipv6 AND anyone could do it, just select a 98 bit prefix you own, and the rest of the 32 bits you can map to ipv4.
phase -1 could be tunneling traffic through a single zone proxy which would be inefficient and is purely conceptual
phase 0 would be the same, but with an anycast ipv6,same ip that resolves differently based on location, like 8.8.8.8
phase 1 would be the mapping prefix to ipv4 (and viceversa?) being distributed to the routing tables like, which could be done via application logic (most efficient), or via some deep arcane isp routing conf files, or just a hell of a lot of routing table entries for each ipv4 but duplicated, possibly programatically controlled by an application that generates router table files as a target, thus avoiding desyncs and effectively becoming the first option of application level implementation
maybe something like this already exists though
of course it’s horrible hacking (as hacking in the non crime sense often is), but it allows for a purely technical solution to issues of political and administrative nature.. which is all the rage nowadays
https://xkcd.com/927/
But the big big problem isn't windows/Linux/mac. Writing drivers for those are "easy".
The problem lies in all the networking gear speaks only IPv4 and/or 6. LLM assisted hacks can get into maintenance areas, but these devices are also built to support the least amount of things. Like, there may not be enough ram or storage to even run it.
And 20 years in, you see how well IPv6 has taken off :eyeroll:
And even on my network, I disabled IPv6. My upstream ISP is doing something that makes '6 unstable, but '4 is fine. And I find most network engineers don't have to maintain '6, so they never really learn it.
not really sure what it does, resurrect itself when dead?
(Fun fact: Aslan is canonically Jesus)
You haven't lost your marbles, this looks like straight Claude slop, just look at the fonts.
Of course: it's long been a developed country and it's densely populated.
Also some car entertainment systems with integrated 4G/5G use Dutch IPs. Which leads to the weird situation that I sometimes get dutch radio ads on TuneIn or some websites redirect to the Dutch version.
First impression: Poland stronk. Even Czechia strong. Charles IV.'s realm restored. Russia in shambles, not a very efficient conqueror of the address space. And the glory of Rome restored, with pitiful Constantinople looking at their backs from afar.
Second impression: Morocco, Kenya, Egypt and South Africa as the African heavy-weights. Corresponds to what I know.
Third impression: the real bosses are Taiwan and South Korea - just wow.
Might have to do something horrible like:
- setup an ipv4 tunnel, which will require hacking a VPN to allow TCP listening, and routing connections to some external proxy with a dedicated static ipv4 address
- or do some modem router level nat port forwarding, and use a ddns to avoid ip changes breaking stuff. but that won’t work probably since public ip is shared
will investigate the isp to see if they are truly short in ipv4 or if they are just moving clients off them in order to sell them to higher bidders and plans, which is likely since I’ve been upsold into optic fiber, static ip surcharge, sd-wan, dedicated connection so far
if you have any advice or RIR contacts (or an ipv4 block to donate, invest or sell), I’d be thankful, my email is in my profile
I don't know much about your imaging servers: Do they accept incoming https connections, or is it some other kind of TCP or UDP protocol? Assuming it's https, why do you need to stick with IPv4?
> Hi, I’m helping a hospital in Buenos Aires that has lost their IPv4 due to their ISP moving to CGNAT, putting their on prem imaging servers offline for 7 days. (it’s ok for us though, we have a backup failover isp)
Two more things:
1: If you require IPv4, that needs to be part of the contract with your ISP. If they just arbitrarily turned you off, it means that you didn't contract for the services you thought you had.
2: IPv6 is supposed to solve a lot of these problems... So again, why can't you move to IPv6?
Yes
>why do you need to stick with IPv4?
To support devices and routes that do not have ipv6 support?
>1: If you require IPv4, that needs to be part of the contract with your ISP. If they just arbitrarily turned you off, it means that you didn't contract for the services you thought you had.
That is correct in principle. Although, in the absence of a contract, if a service has been provided for a long time in one way, I'd say there's an argument for breach of contract when that way changes for the worst.
Another argument for breach of contract, which can work jointly with the previous, are industry standards, as far as they define the terms that are implied by common words like "internet connection".
Finally, there's the specifications themselves, since the service is billed as "internet", one can refer to the Internet Protocol Specification, although if they do offer IPv6, that might be reasonably considered a substitute, it is a material change that was not agreed to originally (this being a pre IPv6 contract). That said, an IPv4 with a local address might technically still be defined as internet, what is broken in this case is TCP, not the IP, although by lacking a public IP address, TCP is broken via an IP protocol failure, so there's an argument that something is being sold as Internet but it isn't really internet, there's no written contract necessary, the term used to describe the product creates the contract in the same way that selling a carton labeled Milk would create a contract based on milk coming from mammaries of a domestic mammal, and not pressed Soy Juice with artificial coloring.
>2: IPv6 is supposed to solve a lot of these problems... So again, why can't you move to IPv6?
I'm open to proposals to moving IPv6, I'm not content with having that be forced and removing it from people and institutions, if there's a shortage, then that means no new IP addresses can be issued, why are we normalizing the removal of IPv4 addresses? Are they being removed from lower priority users in order to serve high priority usecases? If so is a hospital a low priority user?
The main issue with IPv6 seems to be IPv6 proponents that try to kill IPv4, no one will migrate if you force them to, if you propose, we will consider.
Otherwise, your arguments about what "internet" is are flawed. IPv6 has been a thing for about 30 years, with a well-publicized problem with IPv4 address space and migration plan. I suspect that it's (IPv6) older than your hospital's contract. Even in the IPv4 world, your IP can change at any time and you can be put behind a NAT. That's why ISPs will sell you a static IP if you need one.
>> why do you need to stick with IPv4?
> To support devices and routes that do not have ipv6 support?
> Are they being removed from lower priority users in order to serve high priority usecases? If so is a hospital a low priority user?
After reading your response, I suspect the real problem is attitude and experience. The hospital should have IT staff that know to purchase a static IPv4 IP. This should be part of the contract with the ISP. If it wasn't, ultimately it's up to the IT staff to approach the ISP and arrange to purchase one.
I purchased a static IPv4 IP, and they made the CGNAT IP static.
I thought about making a blog post about it, but I realize there's so much nuance and details. I can't tell if it's just venting about work, or a genuinely interesting clusterfuck in some forlorn corner of the new world.
I can tell you that in cicd for production Linux systems today, we have
which in a Linux build config file means "do not include this in the build"._
What might work well for your organization is ZeroTier which will make you immune to what any ISPs do. The downside is your organization would be dependent on ZeroTier, but ZeroTier is much less likely to screw you over than any ISP.
_I appreciate your speculation on the principles of contract law. Like you, I believe those principles should be upheld and I believe in morality. If you lived under a monarchy and I were of the monarch, I would cross-examine your ISP in public and solve your problem in minutes. I would also on occasion take someone to the side of the road and chop off their head in front of the entire village, and everyone would know on a visceral level they are all much better off with someone taking out the trash now and then.
But, as many technical workers know, the contract stuff takes months or years to resolve, and technical issues involving IP addresses are best worked around with technical approaches.
_
What I would suggest your network team (you and whoever) do in your shoes is:
- set up NAT64 and DNS64 at the edges of subnets that contain devices that don't do IPv6 properly, because if these devices do not have updates to do IPv6 properly then they are broken in a fundamental way, and a workaround is necessary;
- dictate that starting on December 1st, all new devices and VMs have IPv6 addresses with all userspace services listening on IPv6 addresses or some nftables rule to kludge IPv6:$port -> 127.0.0.1:$port if necessary, with firewall configured to block that IPv6 traffic, then at a later date firewalls not blocking those IPv6 addresses, then at a later date prohibit any new IPv4 addresses being assigned anywhere with special exception to devices tagged "legacy" or "end of life" requiring documentation of such;
- use a combination of IPv6 GUA addresses assigned by whatever ISP and IPv6 ULA addresses chosen by your team -- in IPv6, multiple local gateways and multiple addresses on a network interface issued by those local gateways via RA is relatively a norm rather than an exception (requires userspace tooling in IPv4, DHCP doesn't have this functionality), so leverage this advantage;
- use IPv6 AH (authenticated headers) wherever possible;
- because in an ideal world, ISPs would behave consistently and IPv6 GUA addresses would always be stable, but we aren't living in an ideal world, so be ready to update your internal DNS to drop AAAA records containing IPv6 GUA that an upstream ISP fumbled;
- or, if you have the internal resources, register your own AS and command your own official block of IPv6 addresses;
- use a combination of OpenTOFU (Terraform) and Salt or Ansible, all versioned with Git, be very strict with your team about versioning with Git, to manage everything, and use
and Salt or Ansible equivalents for continuous monitoring;- move userspace services to Podman where possible.
Personally I like Salt. I know Ansible is more popular out there with more inertia.
_
>> why are we normalizing the removal of IPv4 addresses?
This was normalized a long time ago actually. "The future is already here, it's just not evenly distributed".
You and I are total strangers on different corners of the globe. You may not like what you're about to read, but it's better that you get a hint where the wind is blowing sooner than not.
If my team were consulting with your organization's execs and we caught a hint that the existing internal resources were not already proactively staying current with internet protocol (which is IPv6), we would point out there is urgency to start right away with emphasis that the existing internal team is over two decades behind staying current.
Or, if a detected hint the internal team were at all resistant to IPv6, we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.
Many network engineers at many ISPs would gladly drop all IPv4 traffic if they thought they could get away with it.
IPv6 only seems more complicated if you still need to unlearn IPv4. IPv6 does have a steeper learning curve, but once that learning curve is overcome, IPv6 is actually much simpler than IPv4. More people than not don't like reading RFCs, but professionals do slowly read RFCs on their own time.
One clarification I'd like to make is that IPv6 is not offered, I can only get IPv4 addresses through the ISP DHCP, there is no ipv6 being offered with command 'dhclient -6' for example on linux, neither does window pick any ipv6 up so it doesn't seem to be an us problem.
It's often that Argentinians miss nuances when copying ethical gray areas from the Americans, and without those slight nuances the debate often gets mixed up with a much more subtle debate.
To make a parallel, Trump issued a memecoin days before entering office, it wasn't technically while being president, it was a memecoin so there was no underlying asset, a gray area, see? America.
Now Milei saw and culted the cargo, he made a coin during his office mandate, and he mentioned it would be used to fund Argentina tech projects, so it's an unregulated security. The nuances are lost, and it's just plain bad.
EDIT1:
>Or, if a detected hint the internal team were at all resistant to IPv6, we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.
>we would point out there is urgency to start right away with emphasis that the existing internal team is over two decades behind staying current.
I appreciate the candor
>You and I are total strangers on different corners of the globe.
This is true and it might impact the nuances and extra-technical semantics of the protocol. For example, in here dropping IPv4 support might mean dropping support for older devices, which might be less common in America, ISPs might not support it, so it's not just about the device but the network, to give you an idea I just got off the phone with the ISP which is THE biggest ISP in Argentina, they don't offer IPv6, period.
>If my team were consulting with your organization's execs
Here might be a big disconnect, my organization execs would probably be way out of budget for whatever your org may charge, that would never happen.
If you want to point the salesmen of your org to try and stir some shit up like that with the ISP, then that may make a bit more sense, the budgets may align for importing American consulting, and berating a big org chart that includes engineers might make more sense than trying to replace a 'team' of 1 or 2 fractionalist generalist IT guys on <500$ month contracts.
The ISP brand is Personal, local corp is Telecom Argentina S.A, Asynchronous System Number AS7303, trades as TEO in NYSE I think, owned by Grupo Clarin which comes is a traditional Media and news company. IPv6 is not offered to consumers right now.
>we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.
go nuts
What is shared here is a general direction. I am sure some people I know where all they do is networking could tell me harshly some of these ways could be done better, and often these people are right ; but sometimes these same people are actually wrong and don't fully consider the positions of people in IT roles at companies that aren't ISPs.
All suggested below is not necessarily the ultimate way but a general direction.
_
>> can only get IPv4 addresses through the ISP DHCP
ISP-owned IP addresses, either of legacy IP or IPv6, are capricious and can suddenly change, as you experienced recently.
I suggest to adopt a mindset of "our network" and "their network", rather than functionally have your network be a passive extension of their network by using their IP addresses.
The router announcements (IPv6 RA) or DHCP (IPv4) for any IP addresses within your network should always be issued by devices controlled solely by our organization.
NAT64 and tunnels exist, any upstream ISP is not a blocker.
Modern Linux has eBPF and eXpress Data Path. Both Linux and FreeBSD (use HardenedBSD if you can) have DPDK. They can make for surprisingly high performance edge routers on x86_64 server boxes over a decade old, exceeding what most campuses or even datacenter footprints actually need and at low cost. Even without eBPF & XDP or DPDK, these on x86_64 are often "good enough" for router and firewall.
DNS running on these or adjacent boxes internal to the organization is essential.
The addresses at the gateways, either of IPv4 or IPv6, can be made highly available with VRRPv3.
IPv6 has an elegant way to handle multiple upstream ISPs without VRRP or CARP at the gateways, but even Linux is just recently implementing what may only be a piece of them (the BSDs will later), some mention of them here https://news.ycombinator.com/item?id=50143420
_
What I would do, which is opinionated so I'm not necessarily suggesting others do it, assuming tunneling will be involved: if the organizational wherewithal is there to register an AS and do BGP, is pay the AUD 500 fee to register an AS and have a chunk of IPv6 space for to use IPv6 GUA addresses that officially belong to the organization.
If not, which is often enough the case because we know how some organizations can be slow (not making any assumptions about your's), the remaining avenue is to use IPv6 ULA addresses which are the spiritual counterpart to IPv4 RFC1918 addresses.
You can embed MAC addresses in IPv6 ULA addresses, like the MAC 82c6.7943.acb2 put in an IPv6 like
and use DHCPv6 to always assign a specific IPv6 ULA address to a specific MAC address, where you have thought through the potential information-disclosure implications and you are certain you want to do that.Then I would use IPv4-only ISP paths for what they're good for: dumb paths to tunnel IPv6 packets to where there is proper internet.
For the option with an AS, BGP announcements on the other side of the tunnel. Personally I would do SCION on the gateways and out the other side of the tunnel, but you don't want to do SCION unless you are also crazy (like a fox).
For the IPv6 ULA option, PAT which is the spiritual counterpart to IPv4's NAT but is also technologically simpler.
With IPv6 ULA and no tunneling, NAT64 and DNS64 can work for outbound.
Site to site tunnels will be tricky no matter what. Tailscale, ZeroTier, Netbird, and similar may be able to do much of the work for you ; these should run in a DMZ on another side of a router/firewall that filters the appropriate IPv6 ULA prefixes.
I would try to see if I could make vanilla Wireguard work with NAT traversal techniques using some cloud-hosted VMs that help with the "hole punching", but not everyone would do that.
There aren't many options that will all work well but almost always more than one option that can work well, all subject to the specific site and inter-organizational resources.
_
>> dropping IPv4 support might mean dropping support for older devices
For as long as it makes organizational sense to continue using these devices, put them behind an OpenBSD box that performs NAT46 and DNS46, with IPv4 addresses statically mapped to IPv6 addresses, maybe ones that contain the MAC addresses of the devices.
With Salt or Ansible, such a scheme with NAT, DNS, DHCP configuration may all be templatized and in perfect alignment, and is scalable.
Authoritative inventory of canonical identifiers/names versioned with Git, what Ansible calls "inventory", is imperative.
Sometimes this looks like a couple of old x86_64 boxes doing CARP (similar to VRRP) on the IPv4 side for a few dozen or couple hundred devices downstream.
Sometimes this looks like, in a handful of distant corners of the larger network, a cheap single-board computer between a single device and the rest of the network ; without a wifi chip or the wifi chip removed by heating (board-repair style), unless downstream of a wifi AP.
_
>> the ISP which is THE biggest ISP in Argentina, they don't offer IPv6 >> The ISP brand is Personal, local corp is Telecom Argentina S.A, Asynchronous System Number AS7303, trades as TEO in NYSE I think, owned by Grupo Clarin which comes is a traditional Media and news company.
I can think of some service provider network engineers that would gladly drop all of Argentina's IPv4 off the entire internet and "IPv6 prefix announcements welcome", if the business sides would let them do it.
Something like this will probably start happening sooner than people think.
Yes, there's no shortage of employees that would vote to reduce their workload by removing their service offering, if you ask a physician here if the hospital should stop taking patients of X type, they'd be onboard, less work for them.
It's a dream though, try to make an AAAA request for any website, it's not there, even government websites.
>Something like this will probably start happening sooner than people think.
I'm even trying american companies, like citi.com, walmart.com, there's no AAAA records there.
>For as long as it makes organizational sense to continue using these devices, put them behind an OpenBSD box that performs NAT46 and DNS46, with IPv4 addresses statically mapped to IPv6 addresses, maybe ones that contain the MAC addresses of the devices.
This is an external facing service, so we don't control the devices or routes that patients and external physicians will be accessing the website.
>Tunneling
Yeah, I'm going to go this route, IPv4 tunnel, it's a horrible hack, but this is hacker news after all.
You don't need an address block from an RIR. You just need your ISP to give you an address.
You could also update to IPv6.
I work for the hospital, occasionally, they are my client.
> You have an actual contract with the ISP, right?
They do not, it's an implied consumer contract, like when someone buys a hot dog from a stand.
I'd like a written contract too, but when trying to negotiate one, they want a lot more money for them, it depends of the nuances of the terms, but I've talked to sales reps, and it comes down to having a 1Gbps line that works right now vs a 100Mbps line that's more expensive, with the only difference being that the contract is now written and there's a symbolic SLA with some 10% penalty, and a single professional beration receiver instead of multiple anonymous on call rotation.
It's not a clear choice, especially considering that the dedicated route with SLA means introducing change risk to the operational and SLA benefit of the ISP, fiber, new holes, new lines, etc..
>You could also update to IPv6.
I would, they don't offer IPv6
>You don't need an address block from an RIR. You just need your ISP to give you an address.
Yeah, maybe. If I get an IPv4 block though what I'd do is a regional entity whether for profit or NFP to offer emergency regional tunneling, potentially while finding alternative revenue streams like collecting lists of wronged ISP customers and notifying them of class action lawsuits they may participate in. A 25K check, or a 5K check with an ipv4 block and I'm golden.
With IPv4 most ISPs only rotate IPs on new connections (router restart). But my old home internet even stayed on the same ipv4 for years. Only if I shut down the router for a longer time it got a fresh ipv4 assigned.
So it's an implementation detail, not a technical limitation. Not rotating the prefix is a bad implementation.
Here I am complaining that I lose my static address, but your problem is that the address is static!
Bottom line is that once a system is a certain way for a while, other systems and people grow dependency on that
>https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...