[judge2020]

When you're using a private network v4 address exhaustion doesn't matter much and the simplicity of only 4 octets helps with IP memorability and simplicity. I would still prefer a v6 option though, as keeping private networks on v4 might be contributing to the slow adoption of v6.

[wmf]

Life sure would be easier if "cloud native" meant IPv6-only (except the load balancer) with non-overlapping unique addresses everywhere. 10/8 doesn't go far if you give each VM a /24 and each k8s cluster a /16.

[llama052]

What network are you running where you're giving each virtual machine a /24? That's insane.

10/8 should go very far if you do it correctly, hence why it's in use in almost all internal networks.

[KaiserPro]

kubernetes, because for what ever reasons people are suspicious of using DHCP provided by the VPC.

[ec109685]

Where have you experienced shortages? Even with a /16, you are talking about millions of unique IPs.

[ponyfleisch]

A /16 has ~65k unique IPs.

[api]

> When you're using a private network v4 address exhaustion doesn't matter much

Until you start trying to connect to enterprise networks...

This is seriously ridiculous. It's 2020, and Google and now DO have no IPv6 in their cloud networks.

[JonathonW]

DO has IPv6 on the public side of their network.

Couldn't tell you why they've chosen not to use IPv6 for VPC networks, though. Probably just for management simplicity.

[jrockway]

DO sort of has IPv6. Their load balancers don't do IPv6, and you can't use IPv6 in their managed k8s offering.

(My guess, honestly, is that nobody asks for it. IPv6 is a problem for Some Other Day.)

[caymanjim]

They also only give you 16 addresses. 16! Most providers give you an entire /64 or sometimes even a /48.

[RaitoBezarius]

Wow. In France, home ISP give you a /64 generally (Free for example, known for Online/Scaleway). I think 80 % of their fiber deployments comes with IPv6 enabled now. And in few years, it should be 100 %.

[lloeki]

When I was a customer, Free gave you eight (or was it 16?) /64 (as it appeared in the UI[0], I seem to recall they may not all be contiguous), 7 of them you could use for prefix delegation (can't recall why using the first one caused issues, IIRC it was special cased in some way as the "main" one that the Freebox wants to manage). Also it was 6rd, not purely native IPv6. Hopefully they changed that because latency was bad enough the devices would often pick IPv4 through Happy Eyeballs and throughput was a half to a tenth of the v4 path.

After that, I had a whole native /56 at Red by SFR.

Currently I'm at Sosh by Orange and I have a native /56.

[0]: https://lafibre.info/remplacer-freebox/freebox-erl-et-ipv6/?...

[beagle3]

As a (former) network security guy, I shudder at the thought that you WANT to expose your internal routing details. That's a recipe for security disaster.

It is also an administration problem - you've given out an internal IP network to someone else -- and now your ability to move it to a different IP address for whatever reason depends on the change processes at the other enterprise, which can take months -- or on the ability of your own network infrastructure to NAT it to the new location.

It tends to work much better all around if you have a well defined "external" interface, that gets properly monitored and filtered with a network/app firewall, and gets routed to the right server -- and then internal change for your organization are decoupled from change processes in the others.

And for that, v4 exhaustion really doesn't matter.

[api]

I don't get this. IPv4's address space is so small I can trivially scan any internal network, and there are a ton of ways to gather that data covertly from behind the firewall via maliciously crafted web pages or apps, abuse of any number of P2P apps or protocols (VoIP, video chat, WebRTC, etc.), and so on. IPv6 actually makes scanning harder since the address space is massive. E.g. if I have a /64 routed internally I have to scan 2^64 addresses to find internal hosts!

If knowing internal IP addresses is a security risk, then IMHO you have serious security problems. I used to do netsec too and the cornerstone was internal scans for unpatched or rogue systems and services and keeping systems patched and locked down. A network is only as secure as what is connected to it! We also had smart switches and APs where you could lock port to MAC and IP and thus could prevent rogues.

My personal rule was: any system that would not be safe to directly connect to the Internet without a firewall is insecure and needs to be fixed. The only exception is backplanes for things like internal databases/services or testing/dev, and those were separate networks for that purpose only. Separation was either physical or virtual/cryptographic. Back then we didn't have stuff like ZeroTier so we did that with IPSec and it was ugly, but we did it. Those nets could sometimes access the Internet (with restrictions) but could not even see the controlled internal LAN. They accessed the net via a port to outside the DMZ.

Next up was auditing software installed on internal systems. Next up was monitoring network traffic to detect anomalous activity. Firewalls are always the last line of defense. NAT is not a security feature at all.

I never once worried about keeping internal IPs secret (why?) and we ran IPv6 internally without NAT because IPv6 NAT is dumb.

We had two incidents when I was there. Both were the result of phishing to get malware onto personal PCs or phones.

My very strong personal opinion is that security people worry about the wrong things. They worry about network security and firewalls when what should really terrify them is phishing, auto-updating software made by who-knows-who, popular apps and SaaS services that are invisible security dumpster fires (Zoom anyone?), and of course barbarous demonic evocations like "npm install ...". Your firewall will do very little to save you from any of that, and NAT won't do crap because once again NAT is not a security feature.

[beagle3]

Mostly agree, but do want to clarify:

Obscurity is NOT security. But obscurity as one layer in a larger defense-in-depth setup IS helpful.

Do note that scanning IPv4 through a fishing page is still about a million times harder (literally) than targeting a known address.

And NAT is not security, but in some context is still helpful as one layer in a defense-in-depth setup - you can’t directly attack something that’s not routable.

Security is not binary; there are costs and there are benefits to various setups. My point was that the benefits provided by being able to provide an internal IPv6 address to an external entity are dwarfed by both Netsec and netadmin costs.

Also, if you can so easily scan my internal network with malicious web pages, you can probably passively listen for the v6 addresses. On the networks I managed, browsing happened through VNC to a browser on tightly controlled host that could only connect outside and only through a proxy. How do your fishing pages counter this?

[api]

My approach is and was always edge-first. Security begins at connected devices; everything else is an afterthought. The only time you try to secure something primarily at the network level rather than the device level is when it's legacy junk you can't secure otherwise and that you must use.

I am not opposed to network firewalls and such, but they're just defense in depth. If the whole network wouldn't remain secure if it were connected to the Internet with no firewall, it's not secure.

Given that these things are afterthoughts, I am not willing to prioritize them much over efficiency, complexity reduction, and user experience. Afterthoughts should be sacrificed to complexity reduction because complexity negatively impacts security a lot more. Inefficiency and poor UI/UX also have security implications. They increase the amount of "shadow IT" type activity and also seem to make phishing easier. If you secure something in ways that prevent people from getting their work done, they will get their work done insecurely.

Treating NAT as a must-have or should-have rather than the ugly hack you don't want to have increases complexity and negatively harms UI/UX by making P2P stuff not work and making people have to work harder to do simple things. If removing NAT makes you insecure, you were insecure to begin with.

Needless to say I am a fan of the BeyondCorp/deperimeterization approach. Ideally physical networks should be dumb pipes and everything should be virtual. The LAN itself is legacy baggage.

[beagle3]

I do not disagree.

If you look at my original message, I was not suggesting NAT was useful - on the contrary, I was cautioning against relying on your internal NAT as a mitigation of the other enterprise's change processes. My whole post was about complexity reduction (as it relates to inter-enterprise conections)...

> Needless to say I am a fan of the BeyondCorp/deperimeterization approach. Ideally physical networks should be dumb pipes and everything should be virtual. The LAN itself is legacy baggage.

I also like it. But the post I was originally replying to implied a server->server connection between two enterprises, which is afaik not at all addressed by BeyondCorp or any of the projects it inspired - specifically, you need to treat the other corp like a Google user at home, rather than a Google employee in a hotel because you cannot enforce trusted hardware, inventory tracking, or any of the other things that make BeyondCorp as useful as it is.