You must log in or register to comment.
Hi I have no idea what I’m doing when it comes to networking. I have ipv6 off on my home network because I was scared of accidentally exposing things outside of my home network. I’m using Ubiquiti. Can someone give me/link me a crash course on how to setup ipv6 without introducing any security holes into my network? Maybe also a crash course in firewalls.
Don’t worry Ubiquiti has ipv6 issues. You have an excuse.
Surely we can do better. Why not IPv10? That’s 4 higher than 6!
My IP goes up to 11.
not sure if you’re aware thats a real thing https://www.ipv10.net/
>Forbidden
>You don’t have permission to access this resource.
Awesome.
Obviously. You can only access it in IPv10.
Guess we have to crank it up to 11, then.
Is this IPv5?
Fun fact: IP version 5 is actually reserved for the Internet Streaming Protocol.
An ipv6 address turns my brains thinking center off. Short circuit at how fucking stupid it looks.
No different the 10.A4.b2.12
I see your satirical IPv6 meme and raise you the highest quality IPv6 evangelism you’ll ever see.
That was beautiful
I use IPv6 every day and everywhere I can. It solves so many issues in large corporate and ISP network setups. And yes 10. Wasn’t big enough, and NATing is a PitA.
Honestly we just keep pushing it off when it’s not that bad. Workaround after workaround just because people are lazy.
How much slack did you have in your 10.* network? Or was it literally 16.7 million devices?
16M devices on one network would almost certainly have major scalability problems all its own. SMB chattiness alone . . . shudder.
Having the breathing room is great.
You have two teams that independently set up private networks but now someone has to talk to them both?
In IPv4, they likely stepped on the same private subnets. In ipv6, they pretty much certainly did not step in the same ULA prefixes. My VPN setup is a mess of a maze to deal with the fact that most things I connect to are all independently allocated 10. subnets, with the IPv6 focused customer being easiest.
Also, if you want to embed information in your addressing, like vlan I’d or room information.
Besides, you can have addresses like fd37:5f1a:b4c1::feed:face, and that’s fun isn’t it?
IPv6 isn’t just a larger IPv4. There are features inherent to it, like link-local actually functioning and being predictable, unlike APIPA in v4 which was grafted on as an afterthought and breaks more than it works.
It also functions router-less. You can grab 30 10-port switches and just stick them together and start plugging computers in. It will work without configuration or an authority.
I am all v6 internally, but that’s not because I have a splatillion devices, but rather it’s just better and easier to manage.
Well sometimes the lla is not predictable, some stacks take privacy addresses to lla, which is silly but they do it. Of course you can multicast ping and check your neighbor table to get the lla chosen in such cases.
I agree with everything you said but it still doesn’t make me hate ipv6 less.
The reason IPv6 was originally added to the DOCSIS specs, over 20 years ago, is because Comcast literally exhausted all RFC1918 addresses on their modem management networks.
My favourite feature of IPv6 is networks, and hosts therein, can have multiple prefixes and addresses as a core function. I use it to expose local functions on only ULA addresses, but provide locked down public access when and where needed. Access separation is handled at the IP stack, with IPv4 it’s expected to be handled by a firewall or equivalent.
My favorite feature of IPv6 is that there are so many addresses available. Every single IPv4 address right now could have its own entire IPv4 range of addresses in IPv6. It’s mind-boggling huge.
you could assign every square meter of the planet an ip and use it for location, and still have addresses left over
Oh it’s way more than that!
After looking up some numbers, I note we could give every single square MILLIMETER on the planet its own entire IPv4 address space.
…And then every one of those IPv4 addresses could have its own entire copy of the IPv4 address space!
…And that would just be a drop in the bucket compared with IPv6! One good comparison I’ve seen is that you could assign an address to every atom on the surface of the earth (but not inside it) and have enough left over for 100+ more earths.
Rough math for the square millimeters:
The surface area of the earth is roughly 510 trillion square millimeters. Let’s round that up to a quadrillion or 1015.
The number of IPv6 addresses is 2128 or 3.4x1038. To be conservative again, let’s just round that down to 1038.
1038 / 1015 = 1023 IPv6 addresses per square mm of earth.
IPv4 address space is 232 or around 4 billion. let’s round up to 10 billion or 1010.
So then 1023 / 1010 = 1013 IPv6 addresses per IPv4 address per square mm of earth.
1013 / 1010 =
1,000 IPv6 addresses per IPv4 address per IPv4 address per square mm of earth.
And that was with the conservative estimates along the way. I think it would actually be tens of thousands.
square centimeter is the one I heard
I understand some of these words!
They kept talking it was because address exaustion, and IANA sold all the remaining blocks they had…
I tested it at the time. Ran nmap ping scan across a block all night with zero results. IANA sold the internet
many “unused” IP addresses are unused because they’re kinda like having spare parts: if you’re planning on extending your network in the futures, your IP block kinda should reflect your end state (ie the parts you need over time to replace or “build” new hosts)
or for blue/green deployments where it’s likely that at least half the IP range will be used in terms of process, but unused most of the time in terms of reachability
and then there’s weird things with splitting up IP blocks into subnets with a division of 3 (the minimum needed for dealing with net splits etc) - eg across availability zones… there are always “waste” IPs because you can’t divide multiples of 8 cleanly into 3
Ipv6 is broken for those that want control over their home networks thanks to Google and terribly written RFCs.
All that was needed was an extra byte or two of address space, but no, some high and mighty evangelicals in their ivory towers built something that few people understand 30 years later. Their die hard fans are sure that this will be the year of ipv6. The Year of Linux on the Desktop will come 10 years before the year of ipv6.
And 10 years before fusion power?
is a /56 not enough address space for your home network
My home network is millions of ants with tiny little backpacks
you’ll never believe this
The backpacks themselves? I’m glad you asked. So, they each function on an actor model, where each potential state for each actor has its own address…
are there quintillions of states
No, actually tbh the address space is the least of my worries. At this point I’m gonna be honest, the ants just don’t wanna play ball
have you tried giving them tiny ant-sized balls
What did Google do? Just curious as I’m not into home networking
They refuse to support DHCP6 and will only use SLAAC on Android devices.
Broken how? What parts are not commonly understood?
Ipv6 is broken for those that want control over their home networks
I don’t see how? Works great for my home network.
I want per device firewall and DNS rules for myself, the wife and the kids. With opnsense or pfsense I don’t believe this is possible with SLAAC, which is what android only supports.
Shove all devices on a flat network with no special firewall rules and you are probably golden. But trying to control your own network, last few times I’ve tried, is impossible.
Just my perspective as a controls (SCADA engineer):
I work for a large power company. We have close to 100 sites, each with hundreds of IP devices, and have never had a problem with ipv4. Especially when im out in the field I love being able to check IPs, calculate gateways, etc at a glance. Ipv6 is just completely freaking unreadable.
I see the value of outward-facing ipv6 devices (i.e. devices on the internet), considering we are out of ipv4s. But I don’t see why we have to convert private networks to ipv6. Put more bluntly: at least industry, it just isn’t gonna happen for decades (if it ever does). Unless you need more IPs it’s just worse to work with. And there’s a huge amount of inertia- got one singular device that doesn’t talk ipv4 at a given generation site? What are you supposed to do?
90% of industrial devices are still 100 Mbit/s.
You’ll be lucky if you find ethernet on them. RJ45 serial is still pretty common nowadays
I mean that’s of the ethenet capable ones… a huge chunk are still serial
And the rest are pure analog
I was going to say, my friend has to maintain some fucking DOS systems because their ancient embroidery machines only want to talk to software as old as they are, over connections as old as they are.
If you set up your DNS correctly then you don’t even need the IPs. Just give devices unique, human-readable names and maybe do separate sub-domains for each site or something.
For that to work industrial devices have to support DNS in the first place…
Oh, now that you mention it I’ve never tried to map a static DNS entry to a device without DNS. Welp, time to get thousands of raspberry pi’s to act as IP KVMs!
That would imply en existence of display/usb outputs…
We’re essentially talking a bunch of embedded devices talking to each other. You can give them all the dns entries you want, but if they (or the programming environment) don’t support DNS lookup you might as well put your dns server in excel.
The microcomputers (raspberry pi, arduino, whatever) could have a modern network interface and relay the communication to the embedded devices over oldschool serial. But yeah, straight DNS wouldn’t work. I like the idea though, gonna start posting my 10 favorite IP addresses on a piece of paper on the fridge. Who needs excel!
https://en.m.wikipedia.org/wiki/Internet_Stream_Protocol
In case anyone wants to know what not to talk about.
I know its a joke but man its annoying to go from something that is organized in a human readable way to one where you have to rely on the system. I am someone who hates databases though so I have always been like this. Heck way back in the aughts I used to complain that my job involved more seeing and issues and fixing it and the systems were getting to were I feel more like im counseling it.
I do like how I can easily remember IPv4 addresses while I struggle to remember a single IPv6 address
Its really not possible to remember an IPv6. I mean it is but its really an abandonment on human level and a solution that leverage dhcp which was common anyway. Its about as easy as a hardware address.
Its really not possible to remember an IPv6.
skill issue. Your ISP isn’t giving you a /128, you don’t have to remember a whole ass SLAAC address. My desktop has like 4 IPv6 addresses most of the time, but I only have to remember the one I assigned it and my network prefix. This is one of the advantages of IPv6; you can have an easy to remember, and SLAAC, and privacy-extension addresses all at once.
I can’t prove it, but I’m typing this from my head- 2a05:f6c7:8321::10
That’s about as human readable as IPv4.and you can put words in them too, like 2404:e80:905c:beef::1337
my favorite is ::beef:babe
💪👱♀️
Come on, it’s e easy to remember one IPv6 address: ::1
My favorite thing to use IPv6 for is to use the privacy extension to get around IP blocks on YouTube when using alternative front ends. Blocked by Google on my laptop? No problem, let me just get another one of my 4,722,366,482,869,645,213,696 IP addresses.
I have a separate subnet which is IPv6 only and rotates through IP addresses every hour or so just for Indivious, Freetube and PipePipe.
Hah, do they not just block the whole /64? That’s actually really funny.
Could you link the privacy extension in question I haven’t heard of it
Sure, it’s part of the IPv6 spec:
https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/
it’s not a browser extension, its a SLAAC thing https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ TL;DR is that SLAAC used to use part of your device MAC to form it’s IP, which would be trackable/fingerprintable. Now devices just pick the last 48-bits at complete random on the assumption that no other device is going to have one of the 4 quintilion available addresses.
Thanks, might have to try that sometime.
This is exactly why ipv6 was never widely adopted. There’s too much power in a limited IP pool.
Define “widely”.
According to Google 46.09% of their traffic is IPv6 and most servers support it. It’s mostly large ISPs dragging their feet.
I think it’s just a few domestic US ISPs. The rest of the world has been happily using it for quite some time.
I’ve never seen functional ipv6 except at university, and I would only consider gci large in terms of coverage area and price.
What is stoping Google from just blocking your entire IP-Block?
Mostly, I’m not big enough to trigger anything there.
Also, since ISPs usually only get a single humongous IPv6 block, it’s actually pretty hard to know what is okay to block. Somebody might be on a /48, /56 or /64 network but they might also just have a single IPv6 address. Since you’re blocking quintillions of IP addresses with each /64 net, the risk of hitting innocent IPs is high.
Also also, I’m not sure if Google is actually prepared for such a case. Since all the requests coming from Invidious just seem like legit unauthenticated requests, it’s hard to flag them on IPv6 when the IPs are fully randomized.
Still, Google is moving towards requiring a login for everything. So I assume that method won’t work for much longer.
C’mon, IPv4 has so many problems. Sure, let’s reserve a whole /8 for a single loopback address, that’s efficient. 🙄
Well of course, how else would you trick script kiddies that figured out when they DDOSed 127.0.0.1 and learned what a loop back was, and get them again in a few weeks with “ok ok my real address is 127.34.21.2”
Wait… I know 127.0.0.1 but what’s the second one?
not sure if you are joking, but any valid IP4 address starting with 127. does the same thing, loopback. 127.0.0.1 is just the standard most people use, you could use 127.127.127.127, or 127.1.1.1 or any random numbers 0 and 254 for the second 2, and 1 and 254 for the last and the effects will be identical.
In fact, it’s so standard that there’s a bunch of shitty code out there that thinks 127.0.0.1 is the only loopback address.
I’m thinking of a networked Chinese laser cutter that we put on our 10.0.0.0/16 network in the makerspace. It seems to think that 10.0.1.1 and 10.0.2.1 are on different networks. Wouldn’t be surprised if it does a similar mistake with loopback addresses.
A /8 subnet is basically everything after the first of the four segments, e.g. 127...*. marine_mustang was saying that loopback (what you think of as only 127.0.0.1) is actually an entire subnet, so any address that starts with 127 will hit the loopback interface. TIL, never thought about it much before.
bro just add another octet to the end of ipv4. That goes from 4 billion to a trillion and will most definitely outlast modern electronics and capitalism
I think they must have thought: ‘Well we thought four and a quarter billion was going to be enough. We don’t want to repeat the mistake, so let’s create an unimaginably large address space.’
Which, with the benefit of hindsight, now looks daft itself.
It looks daft now with a little hindsight, but we’re kind of still in the foresight stage for the overall life of IPv6.
I’m surprised by the comments here. I use 90% IPv6. For me v4 is only present for retro compatibility. The transition was hard however.
Was?
It’s still in progress…
I’m fully transitioned. The first step was getting an Internet provider that featured it. I had to change providers for that. Then I had to find equipment that worked. Some of the things that have an early implementation of IPv6 don’t actually work. It’s like they never actually tested it. Then I had to integrate IPv6 in the way everything worked. I’m a big user of unique local adresses, which I feel isn’t a really well known feature.
In progress?
I can’t even get an IPv6 address, even if I wanted to pay an obscene amount for a business tier.
You can get on IPv6 for free with a HE tunnel https://tunnelbroker.net/
