Comment

Comment on IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos

glizzyguzzler@piefed.blahaj.zone ⁨1⁩ ⁨week⁩ ago

I see people say “not worth it” but never expound on what exactly makes it not worth it?

Most I get is a vibe (using a metaphor) “python-like judging where people prefer to do it in a ‘pythonic’ way” but of course that’s silly. There must be more to it, but I never seen interoperability issues called out

source

Sort:hotnew top

InnerScientist@lemmy.world ⁨1⁩ ⁨week⁩ ago
Most (all?) advantage of ipv6 when compared to ipv4 don’t work behind Nat. Thus there’s no reason to use it.

Either use Nat with ipv4 or don’t use Nat with ipv6.

Why did you want to use ipv6 when you don’t want what it represents? (End to end communication/IPs)

source
- glizzyguzzler@piefed.blahaj.zone ⁨1⁩ ⁨week⁩ ago
  Mobile devices are largely IPv6-only now, messing with VPN to home. The IPv6-to-4 conversion seems to be shoddy for my mobile carrier.
  
  Not here for what it represents, just want it to work.
  
  I haven’t run into NAT issues that I’ve noticed, would IPv6 avoid issues with cgnat that people complain about? (If/when it happens in the future)
  
  source
  - InnerScientist@lemmy.world ⁨1⁩ ⁨week⁩ ago
    Use ULA addresses for hosts inside your LAN, they are static, cannot be used to reach outside your LAN and use IPv6. Then give your server/VPN endpoint a real ipv6, that’s your VPN endpoint. This doesn’t require any nat and can be easily changed to GUA when you want to.
    
    CGnat is a “solution” for running out of ipv4 addresses, it has the same problems as any other nat but the problems are even more noticeable because the out-facing ipv4 address changes more often than the typical home nat configuration and tricks like FTP- and other helpers don’t work as well.
    
    Ipv6 would not only avoid the issues of cgnat, it would avoid cgnat entirely because you don’t need to Nat when you have enough ips.
    
    source
    glizzyguzzler@piefed.blahaj.zone ⁨1⁩ ⁨week⁩ ago
    Thanks for taking the time to go into detail on this, it helps because I just haven’t been able to put acronyms to actionable meaning from just reading blogs and posts.
    
    How do things outside the LAN talk to things inside the LAN that have ULA addresses (which I’m assuming are equivalent of 10.0.0.0/16 idea)? Will devices that are given ULA addresses be NAT’d just like IPv4 or will they not be able to talk to the outside world on IPv6?
    
    source
    -> View More Comments
Overspark@feddit.nl ⁨1⁩ ⁨week⁩ ago
NAT is not a firewall and it’s not that great for privacy either, it’s not hard to fingerprint individual devices behind NAT. There are no cases where NAT is better than the alternatives, except when you’re out of public IP’s, which isn’t an issue with IPv6.

So you’re much better off by not trying to reinvent the wheel and using IPv6 the way it was intended. Use privacy extensions for privacy. Use proper firewall rules for security. Revel in the fact that NAT isn’t fucking up your inbound connections. Do not under any circumstances force the horrible kludge that is NAT into your IPv6 network.

source
- glizzyguzzler@piefed.blahaj.zone ⁨1⁩ ⁨week⁩ ago
  I gather people talk like NAT is a rung of hell, but I guess it works because I never think of it. Maybe it becomes shittastic at multiple NATs? With one router it seems straight forward to have port forwarding.
  
  I do not understand why I want better inbound connections - but maybe if I get hit with a cgnat then I’ll understand?
  
  source
  - Overspark@feddit.nl ⁨1⁩ ⁨week⁩ ago
    Yeah multiple NAT is a lot worse, but normal NAT has a lot of corner cases too that most people just don’t run into that often. For example if two computers behind NAT want to listen on the same port, that just doesn’t work.
    
    NAT is a “good enough” solution that tricked a whole generation of people growing up with it into thinking it’s a good thing. While in reality the best case is that you don’t run into issues and the worst case is that performance is horrible and you can’t do the things you want to do. The only people that benefit from it are lazy ISPs, not their users.
    
    source
    glizzyguzzler@piefed.blahaj.zone ⁨1⁩ ⁨week⁩ ago
    I see now that a limitation I just understood for IPv4 (expose one port from one device only on the router) isn’t a thing for IPv6 working without NAT, every device on a LAN can be given a world wide routable address and expose the same port. Interesting, in my home I don’t think I’d ever run into that, but I can see issues like that pile up quick in big deployments.
    
    Thanks for taking the time to explain all of this in detail!
    
    source
    -> View More Comments