Get me onto the network that's on the WAN interface of your router, disable the firewall on it, and I will. How do you want to go about doing this? Although, 100% of the time people have asked me to do this they chicken…
It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones. You don't need to take that on faith either -- you can just test it.
No, the reason is that people incorrectly believe it provides security. It doesn't actually do that.
It was engineered like that. It was known from the start that having a flag day wasn't possible (https://datatracker.ietf.org/doc/html/rfc1726#section-5.5): We believe that it is not possible to have a "flag-day" form…
NAT is accepted for transition purposes; for example NAT64 makes it trivial to connect from v6-only clients to v4 servers, and is used by some large ISPs (e.g. T-Mobile in the US) to avoid running v4 inside their access…
But v6 _is_ backwards compatible though? It's got dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how is this not backwards compatible? You could make a…
All you've done there is reinvent v6 with a combination of dual stack, NAT64 and 6to4, plus add a flag day. You haven't fixed any of the problems involved in deploying v6, and you added a step that was known 35 years…
SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases. Also... service discovery. Needing static addresses is a kludge.
People running servers don't seem to be reliably capable of making sure that either pMTUd works or isn't needed on their network, so... it is indeed broken on random servers. We've mostly decided to go with TCP MSS…
That's basically no burden at all. If we cut the address length down to increase throughput, we would get a one-time increase of about 0.8% -- but consider how much faster Internet connections have gotten over the past…
There were always expected to be v4 hosts on the Internet effectively indefinitely. That's not a failure condition for v6. "There are a couple of v4-only hosts out there somewhere" would be kind of irrelevant if most…
Except you are, because all the same work needs to be done. > You can use the 8-byte addresses earlier if you want You can't have both this and "The 8-byte phase only starts when v4 has been abandoned" simultaneously.…
$ wget -4 https://github.com/HackerNews/API Resolving github.com (github.com)... 140.82.114.4 Connecting to github.com (github.com)|140.82.114.4|:443... failed: Network is unreachable. $ git clone…
I think the span would be about the same, or smaller even, if you limited yourself to a granularity of 4 bits for v6. Allocations are often rounded to 4 bits in v6 because it correlates to exactly one character of the…
Let's assume that's true... so what? That doesn't tell us anything about how long migrations like this normally take.
Windows, Linux, OSX, Android and iOS all ship with v6 enabled by default out of the box, so it's already turned on without you needing to think about it. You have to deliberately go out of your way for this not to be…
People are at work during the week, and work networks have a lower average deployment of v6 then home networks do. As evidence, you can also see the impact of holidays and COVID-19 lockdowns on the size of the dips.
If we're talking tangible, real-world threats in existing ISPs, then NAT is doing nothing to protect you. In fact it's doing the exact opposite, because without NAT you wouldn't be able to connect out from your network.…
Google's stats claim that it's 10-20ms for many countries, for example both the US and Canada show the latency impact of v6 as being -10ms. This is per round trip too -- between the connection handshake, congestion…
I don't have to imagine, because that's how things are right now for the billions of people using v6, and it's fine.
I'm in Europe and I use a tunnel from HE for v6. I feel like that's something I would have noticed if it was as widespread as you make it sound.
Try `ip link set mtu 1280 dev eth0` (or equivalent for your OS). pMTUd breakage exists on v6 just like it exists on v4, and requires workarounds just like it does on v4. I get the impression a lot of people are applying…
I've heard plenty of accounts from people (and these were techy people even, not just the ones who only go to Facebook and think that's the Internet) who lost v4 and didn't even realize for days, so I'm not sure how…
I have no v4 on this machine. I'd disable the v4 stack on it if that was a thing Linux could do, but as it stands it's just sitting there doing nothing. The thing you're claiming is not going to happen is something I'm…
You have to do that with range bans in v4 too, since you have no idea how big the pool of addresses a user can pull from is -- and with CGNAT in the picture you're kind of doomed to banning legitimate customers on v4 no…
Get me onto the network that's on the WAN interface of your router, disable the firewall on it, and I will. How do you want to go about doing this? Although, 100% of the time people have asked me to do this they chicken…
It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones. You don't need to take that on faith either -- you can just test it.
No, the reason is that people incorrectly believe it provides security. It doesn't actually do that.
It was engineered like that. It was known from the start that having a flag day wasn't possible (https://datatracker.ietf.org/doc/html/rfc1726#section-5.5): We believe that it is not possible to have a "flag-day" form…
NAT is accepted for transition purposes; for example NAT64 makes it trivial to connect from v6-only clients to v4 servers, and is used by some large ISPs (e.g. T-Mobile in the US) to avoid running v4 inside their access…
But v6 _is_ backwards compatible though? It's got dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how is this not backwards compatible? You could make a…
All you've done there is reinvent v6 with a combination of dual stack, NAT64 and 6to4, plus add a flag day. You haven't fixed any of the problems involved in deploying v6, and you added a step that was known 35 years…
SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases. Also... service discovery. Needing static addresses is a kludge.
People running servers don't seem to be reliably capable of making sure that either pMTUd works or isn't needed on their network, so... it is indeed broken on random servers. We've mostly decided to go with TCP MSS…
That's basically no burden at all. If we cut the address length down to increase throughput, we would get a one-time increase of about 0.8% -- but consider how much faster Internet connections have gotten over the past…
There were always expected to be v4 hosts on the Internet effectively indefinitely. That's not a failure condition for v6. "There are a couple of v4-only hosts out there somewhere" would be kind of irrelevant if most…
Except you are, because all the same work needs to be done. > You can use the 8-byte addresses earlier if you want You can't have both this and "The 8-byte phase only starts when v4 has been abandoned" simultaneously.…
$ wget -4 https://github.com/HackerNews/API Resolving github.com (github.com)... 140.82.114.4 Connecting to github.com (github.com)|140.82.114.4|:443... failed: Network is unreachable. $ git clone…
I think the span would be about the same, or smaller even, if you limited yourself to a granularity of 4 bits for v6. Allocations are often rounded to 4 bits in v6 because it correlates to exactly one character of the…
Let's assume that's true... so what? That doesn't tell us anything about how long migrations like this normally take.
Windows, Linux, OSX, Android and iOS all ship with v6 enabled by default out of the box, so it's already turned on without you needing to think about it. You have to deliberately go out of your way for this not to be…
People are at work during the week, and work networks have a lower average deployment of v6 then home networks do. As evidence, you can also see the impact of holidays and COVID-19 lockdowns on the size of the dips.
If we're talking tangible, real-world threats in existing ISPs, then NAT is doing nothing to protect you. In fact it's doing the exact opposite, because without NAT you wouldn't be able to connect out from your network.…
Google's stats claim that it's 10-20ms for many countries, for example both the US and Canada show the latency impact of v6 as being -10ms. This is per round trip too -- between the connection handshake, congestion…
I don't have to imagine, because that's how things are right now for the billions of people using v6, and it's fine.
I'm in Europe and I use a tunnel from HE for v6. I feel like that's something I would have noticed if it was as widespread as you make it sound.
Try `ip link set mtu 1280 dev eth0` (or equivalent for your OS). pMTUd breakage exists on v6 just like it exists on v4, and requires workarounds just like it does on v4. I get the impression a lot of people are applying…
I've heard plenty of accounts from people (and these were techy people even, not just the ones who only go to Facebook and think that's the Internet) who lost v4 and didn't even realize for days, so I'm not sure how…
I have no v4 on this machine. I'd disable the v4 stack on it if that was a thing Linux could do, but as it stands it's just sitting there doing nothing. The thing you're claiming is not going to happen is something I'm…
You have to do that with range bans in v4 too, since you have no idea how big the pool of addresses a user can pull from is -- and with CGNAT in the picture you're kind of doomed to banning legitimate customers on v4 no…