|
|
If you have an IPv6 IP address, does that prevent you from accessing pure IPv4 websites? (Or even impure IPv4 websites  ).
Do you currently need an IPv4 one as well, and if so how will that issue be resolved?
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
If you have an IPv6 IP address, does that prevent you from accessing pure IPv4 websites? (Or even impure IPv4 websites ).
No, the "normal/default" situation for now is dual-stack. In that case your browser would first make a DNS query for an AAAA record. When no such record exists (as would be the case for an IPv4 only site) it will then try an A record query which will return a "normal" IPv4 result and the whole connection will proceed as if there was no IPv6.
Do you currently need an IPv4 one as well, and if so how will that issue be resolved?
Yes and no. For dual stack operation, which is where deployments are currently headed you need both an IPv4 and IPv6 address per interface. (Or multiple addresses more likely for IPv6).
Longer term NAT64 is likely to play a big part - one box plays the role of "translator" for lots of IPv6 only clients that want to talk to IPv4 only hosts.
|
|
|
The key is for move devices like games consoles to support ipv6
|
|
The author of the above post is a thinkbroadband staff member. It may not constitute an official statement on behalf of thinkbroadband.
|
|
Register (or login) on our website and you will not see this ad.
|
|
|
Interesting point, XBox360 currently has no IPv6 support: http://technet.microsoft.com/en-us/network/hh994905....
Oliver.
|
|
|
If you have an IPv6 IP address, does that prevent you from accessing pure IPv4 websites? It doesn't prevent you but it is of no use to access anything on IPv4 alone.
--
Phil
MaxDSL - goes as fast as it can and doesn't read the line checker first.
MaxDSL diagnostics
|
|
|
So really, you mean yes. If you only have an IPv6 address you can't access a website that doesn't. You have to have an IPv4 one as well, which is just silly.
That NAT64 and 464xlat looks as though it ought to be forced to be placed in front of IPv4-only web hosts. How? The mind boggles.
Thanks for the background and that link  .
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
If you have an IPv6 IP address, does that prevent you from accessing pure IPv4 websites? It doesn't prevent you but it is of no use to access anything on IPv4 alone.
?
To me that reads "It doesn't prevent you but yes it does prevent you". My question tried to specify a user with an IPv6 address and no IPv4 address, trying to access a website with an IPv4 one and no IPv6 one . (I'll edit it).
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
Edited by RobertoS (Mon 06-May-13 21:58:40)
|
|
|
|
One supposes that dual-stack could be later twinned with carrier grade NAT on ipv4 to achieve this... It's one solution at least and might explain BT/Plusnet paying that idea attention.
|
|
|
To me that reads "It doesn't prevent you but yes it does prevent you".
well nothing in IPv6 prevents IPv4 working but equally IPv6 provides no IPv4 connectivity.
Owning a stick of chewing gum doesn't prevent you changing the wheel on a car, but it isn't helpful either 
--
Phil
MaxDSL - goes as fast as it can and doesn't read the line checker first.
MaxDSL diagnostics
|
|
|
I gather you didn't connect the final sentence of my OP to what preceded it .
Anyway the question is answered - the whole setup is a complete dog's breakfast, and likely to get worse. Madness!
Imagine removing all fuel injection systems from petrol-using car engines and modifying the engine management systems to control a carburettor!
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
One supposes that dual-stack could be later twinned with carrier grade NAT on ipv4 to achieve this... It's one solution at least and might explain BT/Plusnet paying that idea attention. See my reply to yarwell. It's lunacy to have dual-stack at the user end.
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
|
Other than dual-stack somewhere in the mix (end user, SP, carrier, tunnel broker etc.) how do you envision the change over from IPv4 to IPv6 happening?
|
|
|
As I replied to awoodland, if I understand NAT64 and 464xlat they look like the answer. What I don't see as at all sensible is every home computing device having dual-stack not far in the future, which is when it will be necessary.
The resources of the big players seem to be being used to set up a mammoth codge up that it will be almost impossible to unwind, instead of conversion systems between end users and web servers.
As the older IPv4-based kit and systems at each end faded away, following a build-up of IPv6-based that has already started, those converters would peak then decline in usage, with the possibility of setting a switch-off date for IPv4 in a couple of decades or so.
Dual-stack at the user end will perpetuate the manufacture of IPv4-based kit and full switch-over to IPv6 will take far longer.
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
I don't do interpretation and elaboration. Sorry. Don't assume everyone has your world view or way of reading or thinking.
Does IPv6 prevent access to IPv4 ? No.
Simple
Can I access an IPv4-only website with an IPv6-only computer ? No.
Good questions get good answers. Woolly questions get 50 post threads.
All the bodges aren't necessary if web sites etc run dual stacks. They're supposed to be run by people who know what they're doing, so the humble user could do what they wanted and anything would work.
--
Phil
MaxDSL - goes as fast as it can and doesn't read the line checker first.
MaxDSL diagnostics |
|
|
Is IPv4 CG NAT necessary for dual stack? That seems to be what BT tell us, but I'm wondering if it's just a way to delay IPv6 rollout for several more years.
Oliver.
|
|
|
CG NAT only neccessary if you think you won't have enough IPv4 addresses to last until the time when some people are happy to elect to use only IPv6
Perhaps we should have a turn off IPv4 for an evening event to show how unready many online sites/services are.
|
|
The author of the above post is a thinkbroadband staff member. It may not constitute an official statement on behalf of thinkbroadband.
|
|
|
Perhaps we should have a turn off IPv4 for an evening event to show how unready many online sites/services are.
An evening? An hour will be sufficient and in that tie every help desk would go into melt down!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
M H C
taurus excreta cerebrum vincit
|
|
|
I was specifically wondering if ISPs could roll out dual stack without IPv4 CG NAT.
Oliver.
|
|
|
IDNet is doing precisely that, so yes it is possible.
|
|
The author of the above post is a thinkbroadband staff member. It may not constitute an official statement on behalf of thinkbroadband.
|
|
|
See my reply to yarwell. It's lunacy to have dual-stack at the user end.
Why?
|
|
|
As I replied to awoodland, if I understand NAT64 and 464xlat they look like the answer.
So are you in favour of CGNAT on IPv4?
Bob, 464xlat is a solution for existing CGNAT networks. It's used when migrating IPv4 CGNAT to IPv6 in a smoother fashion.
http://www.blubrry.com/ipspace/1729181/464xlat-expla...
NAT64 without 464xlat breaks some protocols. Try a SIP call via it and see how you do.
For residential CPEs dual-stack is the way to go. It's what people are already doing worldwide, from Andrews and Arnold to Comcast.
|
|
|
I'd not looked into CG NAT until it came up recently in relation to BT, although I'd vaguely heard of a Plusnet trial months ago. NAT64 and 464xlat were new to me in awoodland's first reply. So I am in no way qualified to answer your question.
CG NAT seems to have drawbacks. Dual-stack I've covered in this post.
I don't profess to be deeply knowledgeable about the various protocols. What is clear is that dual-stack without CG NAT ignores the fundamental issue - the exhaustion of IPv4 addresses, and with CG NAT is a horrible mess.
What is needed is something akin to DNS servers, (perhaps in the ISPs' routing systems?), or better still a modification to all DNS servers, that can do linkages between IPv4 and IPv6 addresses when the sender and receiver are not the same.
Surely that isn't beyond the wit of systems programmers? is it inherently more complex for an ISP to implement than CG NAT? I would have thought the two were roughly similar.
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
I don't profess to be deeply knowledgeable about the various protocols. What is clear is that dual-stack without CG NAT ignores the fundamental issue - the exhaustion of IPv4 addresses, and with CG NAT is a horrible mess.
I think what's critical is that every user has their own IP address. CG NAT on it's own does not offer that.
However, I'd fully support users sharing IPv4 addresses, but only if they have a dedicated IPv6 address as well, so that they can have ports listening to the internet if they so choose.
Oliver.
|
|
|
That makes sense Oliver, but still leaves the way open for providers to avoid the issue for ever.
Pure IPv6 needs to be standard and IPv4 consigned to the dustbin as soon as possible. There doesn't seem to be anything even remotely resembling any such intention.
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
I completely agree. And I find BT's CG NAT roll out not only a backwards step in the absence of a clear (public) IPv6 strategy, but also pretty contemptuous given that their customers seem to have gotten no warning, even though it has the capability to break things.
Oliver.
|
|
|
One supposes that dual-stack could be later twinned with carrier grade NAT on ipv4 to achieve this... It's one solution at least and might explain BT/Plusnet paying that idea attention. See my reply to yarwell. It's lunacy to have dual-stack at the user end.
Not really, it's the cleanest technical solution possible. What is lunacy is the ISPs and hosting providers who've got their heads so deep in the sand that they've yet to even try a technical trial, let alone a full scale roll out and have so far shown little or no signs of any willingness to do anything but a braindead sleepwalk into a horrible technical mess.
It's also lunacy that hardware vendors see IPv6 as a chance for another shakedown of their customers rather than just an (automatic) firmware update and it's lunacy that people like VM, BT, TT Sky etc. don't use their homogenous install base and considerable commercial leverage to push out a firmware update that effectively "flicks a switch" overnight.
Back on track: If the goal is not to run dual stack at the home user's property there are ways to achieve that, with caveats depending on the application. NAT64 can be run at an ISP level which works well enough as to be usable for general browsing. You can also run an HTTP proxy (which can be automatically configured, e.g. with WPAD) and browse IPv4 only sites from IPv6 only hosts.
|
|
|
The key is for move devices like games consoles to support ipv6
If TF2 had hats for IPv6 connected players....
|
|
|
I don't profess to be deeply knowledgeable about the various protocols. What is clear is that dual-stack without CG NAT ignores the fundamental issue - the exhaustion of IPv4 addresses, and with CG NAT is a horrible mess.
It's a transitional state and the normal process for a transition is to run the old and new systems together for a time until the new one has been comprehensively adopted.
It's definitely less messy than either one or two layers of NAT.
EDIT: Incidentally, Bob, how do you propose NAT64 or 464XLAT don't ignore the issue of IPv4 exhaustion without putting customers behind asymmetrical NAT and causing the same issues as CGNAT?
Edited by deleted (Tue 07-May-13 20:05:20)
|
|
|
What about the paragraph that follows the one you quoted?
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
What about the paragraph that follows the one you quoted? This? What is needed is something akin to DNS servers, (perhaps in the ISPs' routing systems?), or better still a modification to all DNS servers, that can do linkages between IPv4 and IPv6 addresses when the sender and receiver are not the same. That would simply give site operators another excuse to delay implementing IPv6.
I agree with Ignitionnet- the current system is the least worst way. Run the systems in parallel, when IPv4 addresses run out, site operators have a choice- implement IPv6 or see their hit rate inexorably decline.
|
|
|
(I agree with Ignitionnet- the current system is the least worst way. Run the systems in parallel, when IPv4 addresses run out, site operators have a choice- implement IPv6 or see their hit rate inexorably decline. But your conclusion is false.
As the plan seems to be that all end users will have an IPv4 address, be it dynamic, static or CG NAT, site operators have no incentive at all to move to IPv6. Only new sites that cannot get an IPv4 addresses will take IPv6, which the end users will be able to access because they are dual-stacked. It's going to be a long time before there are anything like as many IPv6 sites with no IPv4 access as there are IPv4 ones with no IPv6 access.
I've already said I'm arguing from little knowledge of the technology, but logic, human nature, and life experience point towards a right mess with very little chance of resolution for decades.
All of you that argue against that belief seem to be starting from a position of "received wisdom" that the way BT et al seem to be going is the best, without any discussion of alternatives such as the one I suggest. I'm sure there must be others as well.
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
All of you that argue against that belief seem to be starting from a position of "received wisdom" that the way BT et al seem to be going is the best Flatly disagree, especially with the emboldened bit.
See Oliver341's query and Andrew's response.
If IDNet (and others, I assume) can do it then anyone can. If they don't then they're corner-cutting.
(For the benefit of others- IDNet are my ISP, and thoroughly recommended )
I agree with you about human nature but at some point IPv4 addresses are going to run out, and incorporating dual stacking at both ends is the easiest way to make the transition as seamless as possible.
If I understand the terminology correctly then I'm dual stacked here- without explicit checking I never know whether I'm using IPv4 or IPv6 to connect to a site. It's completely transparent.
|
|
|
Yes the migration from IPv4-only to IPv6-only was always meant to proceed through a series of phases, and allows that these phases can have fuzzy edges and may take the order of a decade.
@RobertoS
Because the IPv6 space is so much bigger, it allows for IPv4 addresses to be embedded with room for a prefix that identifies the transition method in use, of which there are several, partly because it depends which way the traffic is going and which ends have IPv4, IPv6 or both.
The requesting device understands this is a translated address and more importantly so do the routers and know what to do with it.
But in simpler terms it boils down to an endgame where:
- all customers of an ISP are provided IPv6 and
- can contact IPv6 hosts directly and
- can contact legacy IPv4 hosts via address translation or proxying (which can be transparent; this is not new tech as for example ALGs already know how to rewrite IPs and ports on the fly for services such as FTP if necessary)
- crucially these mechanisms can be setup to be automated once configured by the ISP so the customer doesn't need to know how to do any of this
Similarly while If an ISP still has enough IPv4s for each customer, they can continue to map these to each customer, directly with dual stack or via NAT (e.g. on behalf of a host on the internet trying to contact that customer).
However the first step remains to get both the ISPs and hardware manufacturers (or rather their firmware development) using IPv6 (and hence dual stack) and issuing this to customers as standard so that the other phases can proceed.
prompt $P - Invalid drive specification - Abort, Retry, Fail? $G
prlzx on iDNET: ADSL2+ / 21CN at ~4Mbps / 700kbps with IP4/6
Edited by prlzx (Wed 08-May-13 01:12:02)
|
|
|
That looks as though it makes sense, but I need to be more awake to take it in properly .
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
I should have added, in IPv4, people often assume it unusual or even wrong for some network interface to have more than 1 IP address (which is allowed, but for many use cases not necessary).
But in IPv6, that is not only normal, it is to be expected. For example most host interfaces will have (and use) both a link-local address and a globally unique address.
So the ISP could assign several kinds of IPv6 addresses to the customer.
As well as their "main" prefix (e.g. a /48) that the customer organisation can subnet from, I think there could be additional addresses (for NAT purposes) assigned to the customer router without confusion.
This is another reason the addresses seem so long, so that the prefix can identify what kind of address it is.
Being able to determine just from the prefix, what to do with the packet; for routers - whether and where to route it, for other hosts, whether they need to process it (if at all).
And even the current IPv4 addresses could be considered to have prefixes, if you have seen the binary forms it is clear that a host can figure out what class it is (A to E) from the first 3 to 4 bits.
prompt $P - Invalid drive specification - Abort, Retry, Fail? $G
prlzx on iDNET: ADSL2+ / 21CN at ~4Mbps / 700kbps with IP4/6
|
|
|
If I understand the terminology correctly then I'm dual stacked here- without explicit checking I never know whether I'm using IPv4 or IPv6 to connect to a site. It's completely transparent. Hopefully I'll be the same when my new router arrives. I'm also hoping to have my FTP server accepting IPv6 connections and perhaps (license allowing) my mail server.
|
|
|
Since my earlier post I've discovered an oddity... given the choice, Snow Leopard would use IPv6, Mountain Lion (and Lion) uses whichever seems to be "fastest" for the site in question. Which is usually IPv4 of course.
Nought out of ten for standards observance, Apple... though I'll concede it's still transparent.
eta- Apparently Chrome and recent Firefox builds have similar behaviour, and Win8 will ditch IPv6 at a hint of a problem.
Edited by billford (Wed 08-May-13 09:51:36)
|
|
|
As an IPv6 ignoramous, I've been following this thread with increased befuddlement. Shamefully, I have to admit I am none the wiser, but have come across tunelling in my searches, has it anything to offer?
http://tunnelbroker.net/?a=26543899873&n=g&pos=1t1&p...
Edited by professor973 (Wed 08-May-13 12:54:12)
|
|
|
|
As it says "Once you configure your side you will be able to reach the IPv6 Internet"
|
|
|
As an IPv6 ignoramous, I've been following this thread with increased befuddlement. Shamefully, I have to admit I am none the wiser, but have come across tunelling in my searches, has it anything to offer?
http://tunnelbroker.net/?a=26543899873&n=g&pos=1t1&p... Further confusion really. I noticed a while back that Windows 7 establishes a 'Teredo' tunnel without asking. Doesn't seem a lot of use though. Most IPv6 test sites I've tried say I can ping to IPv6 and that my ISP (IDNet) DNS suports it but then rate my support as 0/10.
Same here at work although that might be the corporate firewall butting in. But I have IPv6, it works within the office and Timico DNS servers are apparently IPv6 capable. But 'ping ipv6.google.com' fails with unknown host and if I use the IP address:
Pinging 2001:4860:b002::68 with 32 bytes of data:
PING: transmit failed. General failure.
PING: transmit failed. General failure.
Damn' General Failure. Always getting in the way. Nearly as bad as Corporal Punishment and Major Disaster
|
|
|
Thanks for the replies chaps. Just one more query. Is IPv6 something that has to be requested from an ISP that supplies it and is there a charge, or is it just shoved down the pipes as stadard, as my capable routers here don't cut the mustard on test sites.
Edited by professor973 (Wed 08-May-13 13:22:41)
|
|
|
Thanks for the replies chaps. Just one more query. Is IPv6 something that has to be requested from an ISP that supplies it and is there a charge, or is it just shoved down the pipes as stadard Depends on the ISP. It might require an email to Support to activate it on your connection but I wouldn't expect it to be chargeable. I'd run a mile from an ISP that tried to charge for it. Frankly it should be ready and waiting on all ISPs by now, I can forgive some to/fro with support tweaking things but that's about all.
Sadly I think a number of ISPs still haven't started rolling it out.
Edited by Andrue (Wed 08-May-13 13:42:51)
|
|
|
While on the subject of IPv6 I've seen a few comments like this one which puzzle me:
"One final technical issue I found is that it is practically impossible to host a server on IPv6 without opening up that port in your firewall for all IPv6 hosts. For example, if I want to host a web server on 2001:db8::1, I must add an entry in my screening ACL for ::/0 port 80. This is necessary because I cannot guarantee that my provider-assigned prefix will always by 2001:db8::/64."
Several articles seem to imply that it's common for ISPs to change the prefix. That seems odd to me. It's the equivalent of dynamic IP addressing but seems fairly pointless for IPv6.
---
Andrue Cope
Brackley, UK
Edited by Andrue (Wed 08-May-13 15:17:43)
|
|
|
"... that it is practically impossible to host a server on IPv6 without opening up that port in your firewall for all IPv6 hosts. For example, if I want to host a web server on 2001:db8::1, I must add an entry in my screening ACL for ::/0 port 80. This is necessary because I cannot guarantee that my provider-assigned prefix will always by 2001:db8::/64."
Several articles seem to imply that it's common for ISPs to change the prefix. That seems odd to me. It's the equivalent of dynamic IP addressing but seems fairly pointless for IPv6.
Yes, I think it would be odd for the prefix to change frequently.
What would matter is updating the internet DNS(6) entry (or AAAA record) with the whole new address, which would be equivalent to existing dynamic DNS methods..
But back to the the firewall rule, remember this is not quite the same as port forwarding. What you are allowing is for traffic arriving at the internet side of the firewall that is requesting destination port 80 at one or more hosts on the internal side of the firewall. Not port 80 on the WAN address of the firewall.
The host portion of the address (the right half if you like) is something you control as it is your network, so you can ensure this is always the same host address, whether assigned by DHCP(6) reservation or stateless auto-configuration based its MAC address, so for the purpose of an allow rule it should not matter if the prefix (network number or left half) changes.
This will be assisted by firewalls that define their rules symbolically, conceptually something like:
| Text | 1
| allow in on interface {WAN} to host {h}, port {http, https} on {LAN subnet} |
so that they can reflect current prefixes.
To be really slick, host h above could be just a hostname (locally unique within your network) such that the router notes the host address for this anyway when the server renews its DHCP lease (or possibly during Neighbour Discovery).
I will be looking at how pfSense does this in the 2.1 beta ahead of release, as in IPv4 entries they already allow symbolic names (Firewall Aliases) in rules such that one rule can apply to a group of hosts (or ports, or networks).
Names for networks (like LAN, WAN, DMZ) are abstracted from the physical interface (and/or VLAN) such that you can do things like reassign your "LAN" network from eth0 to eth1, VLAN 100 without rewriting any rules.
As I have commented before, people may first have to wean themselves off the idea of assigning IP addresses manually on each host when adopting IPv6.
I am looking forward to a certain poster (hint beginning with E...) updating their current guidance to use static addressing as a fix for almost every network question.
prompt $P - Invalid drive specification - Abort, Retry, Fail? $G
prlzx on iDNET: ADSL2+ / 21CN at ~4Mbps / 700kbps with IP4/6
Edited by prlzx (Wed 08-May-13 21:59:44)
|
|
|
But back to the the firewall rule, remember this is not quite the same as port forwarding.
...
snip Wow. I actually understood that (on the second reading).
With IPv4 my router is pretending to be a single (very active) machine so when someone connects with my FTP server they are connecting through my router. But with IPv6 they actually connect to the host and the router just chooses not to get in the way.
---
Andrue Cope
Brackley, UK
Edited by Andrue (Wed 08-May-13 22:15:46)
|
|
|
Further confusion really. I noticed a while back that Windows 7 establishes a 'Teredo' tunnel without asking. Doesn't seem a lot of use though. Most IPv6 test sites I've tried say I can ping to IPv6 and that my ISP (IDNet) DNS suports it but then rate my support as 0/10.
A registry value needs to be added to fully enable the in-built Teredo tunnel in Windows: http://en.wikipedia.org/wiki/Teredo_tunneling#Implem...
After that, loading IPv6 websites works fairly well.
Oliver.
Edited by Oliver341 (Thu 09-May-13 00:30:36)
|
|
|
But back to the the firewall rule, remember this is not quite the same as port forwarding.
...
snip Wow. I actually understood that (on the second reading).
With IPv4 my router is pretending to be a single (very active) machine so when someone connects with my FTP server they are connecting through my router. But with IPv6 they actually connect to the host and the router just chooses not to get in the way.
Yes your description is much more succinct. Or - your IPv6 router becomes part of the internet rather than being the only local device actually on the internet.
Compare with IPv4 (if your ISP gives you only one address)
because your IPv4 router has private IPs on the internal side, as well as firewall rules it also has to do NAT
( masquerade as the source of outgoing WAN traffic,
and maintain a translation table of connections with the LAN hosts - because the internet is going to reply to the router itself,
then the router looks in that table and translates the destination back to that private IP and port,
and forwards it to that host)
So yes as far as the internet is concerned all your outgoing traffic appears to come from the WAN of the router itself,
and all your services (for incoming / port forward) also appear to be running on the WAN of your router.
(edit - snip)
For the purposes of running servers (or multi-player gaming or VoIP or conferencing or VPN or remote desktop or collaboration services or ...) IPv6 will eventually be simpler.
People don't always realise that firewall rules are separate from whether NAT is being used or not,
and the usual allow outgoing / deny incoming (unless established state) rules can still be defaults for consumer firewall routers.
prompt $P - Invalid drive specification - Abort, Retry, Fail? $G
prlzx on iDNET: ADSL2+ / 21CN at ~4Mbps / 700kbps with IP4/6
Edited by prlzx (Thu 09-May-13 02:37:04)
|
|
|
and it wont until mass isp's have ipv6.
This is an area where isp's need to lead I'm afraid.
Bear in mind its only a software issue so it be trivial for ipv6 to be added in an xbox update.
BT Infinity 2 Since Dec 2012
|
|
|
actually dual stack is the logical way forward and is what aaisp have been doign for many years.
Whilst I find cgnat lunacy, when there has been a decade or so to plan for ipv6 migration.
BT Infinity 2 Since Dec 2012
|
|
|
Is IPv4 CG NAT necessary for dual stack? That seems to be what BT tell us, but I'm wondering if it's just a way to delay IPv6 rollout for several more years.
its not necessary.
BT Infinity 2 Since Dec 2012
|
|
|
(I agree with Ignitionnet- the current system is the least worst way. Run the systems in parallel, when IPv4 addresses run out, site operators have a choice- implement IPv6 or see their hit rate inexorably decline. But your conclusion is false.
As the plan seems to be that all end users will have an IPv4 address, be it dynamic, static or CG NAT, site operators have no incentive at all to move to IPv6. Only new sites that cannot get an IPv4 addresses will take IPv6, which the end users will be able to access because they are dual-stacked. It's going to be a long time before there are anything like as many IPv6 sites with no IPv4 access as there are IPv4 ones with no IPv6 access.
I've already said I'm arguing from little knowledge of the technology, but logic, human nature, and life experience point towards a right mess with very little chance of resolution for decades.
All of you that argue against that belief seem to be starting from a position of "received wisdom" that the way BT et al seem to be going is the best, without any discussion of alternatives such as the one I suggest. I'm sure there must be others as well.
I already have 100s of sites running dual stack, my own personal sites will be dual stack this year.
Some datacentres are now deliberatly pushing ipv6, sites moving to ipv6 is happening, its just not an overnight change. The UK is slow to adopt tho, doing a bit of research shows that we are behind on ipv6.
Also as ignition said, dual stack is far less complex and messy than cgnat. Modern operating systems support dual stacking natively, modern net applications do. Many routers do as well although you think they dont as the feature gets hidden. Fritzbox doesnt have it hidden, and that has dual stacking capabilities.
All I am seeing is uk isp's making excuse after excuse as to why they havent done any ipv6 yet. There was even a uk body setup which then dismantled itself as they got frustrated with lack of support from the gov.
I will be joining aaisp soon after BT release my MAC so will be dual stack at home also soon. Which will then allow me to be more effective at deploying ipv6, as currently its hard for me to test ipv6 deployments due to lack of native ipv6 at home (currently have to use a tunnel).
BT Infinity 2 Since Dec 2012
|
|
|
The subject says "Daft question" . I still don't get some of this.
Accepting that dual stack does not require CG NAT, which I don't dispute, and given that CG NAT is being tested by BT and has been by Plusnet, it looks to me as if CG NAT is being brought into play because better options have been ignored for years.
Dual stack does not require CG NAT, but the need for an IPv4 address is why CG NAT is coming, to support dual stack. There aren't enough IPv4 addresses available to dual stack without CG NAT.
Is CG NAT with dual-stacking the international norm? You say we are well behind. Or did other countries adopt a different approach?
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
... but the need for an IPv4 address is why CG NAT is coming ... Afaics, the main reason there's a need for an IPv4 address is because the major players have been so slow in implementing IPv6.
It's more or less a panic measure to cover up for lack of previous effort.
|
|
|
Exactly Bill .
That doesn't make it the best conversion strategy - but no-one has replied yet to how the conversion was handled in the other countries I'm told are ahead of us.
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
I wonder if the American region may have a bigger problem, as their RIR is not running out quite as fast.
I read discussions from some of the USA WISPs saying they don't need IPv6 yet (or even at all) and neither do their customers. You see some worrying levels of ignorance, such as
- that it is some government conspiracy,
- that a little redistribution and renumbering could extend availability of IPv4 indefinitely,
- "I'm not giving up my IPv4s" as if they have switch off IPv4 and return their allocations in order to switch on IPv6,
- that it's only happening in Europe at the moment, so doesn't affect the internet for USA users
- comments along the lines of "2^128 - it's only 4 times bigger" or "how much longer will the expanded range like 123.456.789.123.456.789 last anyway" I really hope were deliberately trolling but I can't be sure!
Maybe they will be lucky and all networking equipment including home routers will already be dual stack (both in CLI and GUI) by the time they realise they have to move, due to the manufacturers having to release models with updated firmware for the other regions.
As regards the UK, maybe central government should issue a policy that all government departments and agencies must only buy router hardware and ISP / network services that are dual stack capable.
I believe it is currently recommended within procurement guidance but not mandated, which unfortunately in the current climate strict published policies can be spun either way as bad - "red tape to be abolished" or good - "transparency and accountability".
More likely, ISPs who offer no IPv6 will eventually lose customers or be forced to roll it out quickly or without time for thorough testing. But this will take time as it also depends if enough customers ever perceive they are no longer being provided full internet access.
prompt $P - Invalid drive specification - Abort, Retry, Fail? $G
prlzx on iDNET: ADSL2+ / 21CN at ~4Mbps / 700kbps with IP4/6
Edited by prlzx (Thu 09-May-13 23:28:38)
|
|
|
Thanks for that.
It may partly explain the UK ISPs' tardiness as well, given that most sites I expect are US based and will therefore be on IPv4. Maybe they also generally use dynamic IP addresses for SOHO?
Back to the UK, I remember a few weeks ago it was reported as having been suggested in government/security circles that there should be legislation to make fixed IP addresses mandatory for all internet-connected devices.
No mention of IPv6 LOL. Shock horror when they discover that's the only way it's feasible, and all the ISPs say it can't be done within the next 20 years .
My broadband basic info/help site - www.robertos.me.uk | Domains,website and mail hosting - Tsohost.
Connection - Plusnet UnLim Fibre (FTTC). Sync ~ 54.2/15.2Mbps @ 600m. - BQM
"Where talent is a dwarf, self-esteem is a giant." - Jean-Antoine Petit-Senn.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Allergy information: This post was manufactured in an environment where nuts are present. It may include traces of understatement, litotes and humour.
|
|
|
Back to the UK, I remember a few weeks ago it was reported as having been suggested in government/security circles that there should be legislation to make fixed IP addresses mandatory for all internet-connected devices.
No mention of IPv6 LOL...
Oh yes the announcements are full of oversimplifications and misunderstandings in the interests of the soundbites.
I don't think official spokespersons grasp what they mean when talking about logging headers or envelopes. They seem to think that all UK users must send email using addresses issued by their internet provider, and/or only from a computer at a fixed location (home network), and/or that the envelope is always in plain view (like with postal envelopes).
It's like no-one sat down with them with a smartphone and walked them through:
"What do you think this does when it sends and receives emails?
What internet connection(s) does this take place on?
Who (which service providers) sees the envelopes?
Probably not the UK internet ISP if you use GMail, Yahoo, MS (Outlook.com) or Apple (me.com)
Or one based overseas. Or an independently run mail server.
Did you know many email providers allow / encourage you to use SSL/TLS by default?
How do you know which internet connection providers to approach if you want a complete set of logs for a person for a time period (unless they are under house arrest)"
prompt $P - Invalid drive specification - Abort, Retry, Fail? $G
prlzx on iDNET: ADSL2+ / 21CN at ~4Mbps / 700kbps with IP4/6
Edited by prlzx (Fri 10-May-13 00:10:59)
|
|
|
yeah cgnat is been used a ipv4 preserving measure, it actually bears no relation to ipv6.
the reason I mention it in ipv6 conversations is because if ipv6 was adopted years ago then the ipv4 situation wouldnt have got so bad. So dual stack will not in the short term relieve ipv4 suply issues as ipv4's will still be assigned to customers, but it does make a ipv6 internet closer.
My view is any isp with ipv4 supply issues should first reduce ip's to customers with more than 1 ipv4 before considering cgnat customers with a single ipv4. I believe this is the policy aaisp said they will do. It is also the policy I am seeing some datacentres do eg. hetzner in germany supply now just 1 ipv4 per server by default.
dual stacking ipv6 with ipv4 is basically having both turned on at once, in such a scenario if you do things like web browsing everything should "just work". if it doesnt then its possible to adjust things like temporary turn of ipv6 or fiddle with priority order. But things are already fairly advanced to the point it shouldnt cause huge issues having a dual stack setup.
double natting however can cause issues, there is the obvious issues with port forwarding, dont forget its not just people running servers, but all those millions who play on games consoles on the internet and need open ports, it can also cause issues doing basic tasks as web browsing can get stuck when traversing 2 nat's. A natted ip may have all its ports tied up because of the shared user's with too many active connections. A shared ip can also have extra issues if a user on it gets banned somewhere and another user on the same ip then cannot access that service, and of course some services check ip for eligibility of use and may flip out if they see multiple users on that one ip at the same time. There is more as well this is just some examples, double natting will need more processing resources as well on the isp side, I cant see how its less complex than supplying ipv4 alongside ipv6.
BT Infinity 2 Since Dec 2012
|
|
|
an example is germany.
one reason the fritzbox has ipv6 support is isp's there are utilising dual stack 'without' cgnat.
a reason why the uk body for ipv6 dismantled itself is the uk gov wouldnt even put its own sites on ipv6. That is one area we are behind other countries.
BT Infinity 2 Since Dec 2012
|
Pages in this thread: 
Print Thread
RobertoS
