[cyrnel]

> We all know how well IPv6 adoption has gone

What frustrates me is that people keep building solutions like this that heavily rely on IPv4, even when forward-compatible options exist. With clever use of IPv6 transition technologies, you could have retained support for legacy devices while generally using IPv6 everywhere else.

[sgjohnson]

Tailscale supports IPv6. But their IPv6 support is useless to you if your ISP doesn’t support IPv6.

This is a needed feature if you have no IPv6 AND are stuck in CGNAT hell.

And I’m an IPv6 evangelist.

[H8crilA]

No, Tailscale creates both IPv4 and IPv6 connectivity over .. well pretty much anything. If there's IPv4 - it will use it, if there's IPv6 - it will use it. If there's some traversable NAT - it will use it. I think we should dig out the old meme about ADSL running over a pair of wet strings.

[sgjohnson]

> If there's some traversable NAT - it will use it.

But there is no traversable NAT if you’re stuck in CGNAT hell with no IPv6 and the CGNAT subnet they gave conflicts with the one you have. Unless you NAT it again or do some other route fuckery.

NAT4444 sounds really great!

[WarOnPrivacy]

> IPv6 support is useless to you if your ISP doesn’t support IPv6.

I can't upvote this enough. It is my experience that IPv6 advocates deflect hard when this gets brought up.

The vibe I get is people stuck with IPv4-only IPSs are insignificant and unimportant. They simply do not matter.

[waynesonfire]

> And I’m an IPv6 evangelist.

Nice! Learning ipv6 is on my bucket list, any resources that you like to recommend?

[sgjohnson]

I kind of just winged it. But IPv6 is really super similar to IPv4. The key differences are:

- 128-bit addresses, expressed in hexadecimal. A single character is 4 bits (making every 4 bits a nibble boundary, making allocations really easy)

- All subnets are /64 (if you really want to have a different size subnet, you can, but it’s against the standard, and anything other than /64 will break SLAAC. There is one exception to the standard—point to point links are allowed to have a /127)

- The concept of a network address or a broadcast address within the subnet doesn’t exist. ff02::1 is the all-nodes link-local multicast address (serves the same purpose as a broadcast address in v4).

- ARP is gone. A very similar protocol, ND takes its place

- The preferred way to assign addresses to endpoint devices is SLAAC. Which is basically the router telling the endpoints to self-assign. Ridiculously small chance of a collision, and in case a collision happens, just run the rng again. It’s 64 bits after all. You can use DHCPv6 instead or in tandem with SLAAC if you need more granularity.

- You don’t need to use NAT. Which means you have to set up a firewall on the router correctly. Default-deny, while still allowing ALL ICMP traffic through, as ICMP is kinda vital for IPv6 because it’s used to communicate error conditions.

I’m sure I’ve missed something, but these are all the differences I can recall from the top of my head.

[jpdb]

> You don’t need to use NAT. Which means you have to set up a firewall on the router correctly. Default-deny, while still allowing ALL ICMP traffic through, as ICMP is kinda vital for IPv6 because it’s used to communicate error conditions.

I do think using NAT in the form of NPTv6 is awesome for home use because it allows you to have a consistent address regardless of your ISP prefix assignment.

Think of NPTv6 as a kind of "stateless NAT" where the prefix is mapped 1:1 to your internal prefix. This means if your ISP changes your address, you only need to your external DNS versus all of your devices.

[sgjohnson]

> This means if your ISP changes your address

Yes. If your prefix is dynamic, stateless NAT66 can reduce some headaches. But that’s just about the only use case.

[teddyh]

You don’t need a system for assigning IPv4LL addresses (169.254.0.0/16), since IPv6 has automatic link-local addresses on all interfaces.

[cchance]

Gotta say i had to check wtf a nibble was lol

[blooalien]

A nibble is half a byte. (4 bits) Arcane binary maths wizardry from way back when every single bit had value to the programmers, and 64 Kilobytes was a lot of RAM. ;)

[bombcar]

Do the hurricane electric IPv6 stuff. You need a Linux box and a domain maybe.

https://ipv6.he.net/certification/

When you run into issues, google.

[progbits]

IPv6 for IPv4 Experts: https://sites.google.com/site/yartikhiy/home/ipv6book

[waynesonfire]

this looks cool but the "DRAFT" watermark makes it un-readable.

[cyrnel]

If you have an agent installed on every node that can already traverse NAT, you don't have to care about what your ISP supports.

There are many more IPv6-centric solutions to their problem. Sounds like they didn't even try to think of alternatives and instead reached straight for NAT. That wasn't necessary, at least from the amount of information we can glean from this one post.

[apenwarr]

(Tailscale cofounder here) Tailscale already gives every node on every tailnet a globally unique internal IPv6 address, that is reachable even if you don't have IPv6 on the "outside" network. If your apps and OSes are all willing to use IPv6, you haven't had a problem since the early days of Tailscale; they've been solved for years.

Alas, the "apps and OSes are all willing to use IPv6" problem is a persistent one, so we have to make IPv4 work too.

[bradfitz]

We considered so many alternatives actually.

[ksjskskskkk]

are those discarded documented somewhere so we don't walk in circles?

[INGSOCIALITE]

i'm at ipv6 luddite i don't agree with any addressing that can append or encode a mac address into the tcp/ip stack

[Frivolous9421]

https://datatracker.ietf.org/doc/html/rfc4941

[roody15]

One problem is not acknowledging just how bad ipv6 is being rolled out in the US.

Once promoted as a way to give every internet device you would like a reachable external IP … has instead been a new protocol locked behind giant corporations and telecoms. Now mobile providers and some ISP play gatekeeper … don’t allow you to keep any IPv6 devices (rotate assignments) so we end up with little benefit to the end consumer.

The idea that a home user ca setup a desktop and share anything I want via IPV6 another person without the need for a middle man “cloud” provider just didn’t happen. In fact requesting blocks of IPv6 is not easy … and at the end of the day for the average user who cares.

Great so Verizon can now assign my phone and IPv6 address… that I can literally do nothing with.

Corporate greed / government control have severely limited any usefulness of IPv6 at least here in the US

[samcat116]

> Now mobile providers and some ISP play gatekeeper … don’t allow you to keep any IPv6 devices (rotate assignments) so we end up with little benefit to the end consumer.

I see this as a feature not a bug. Use dynamic DNS if you need a stable endpoint here.

> The idea that a home user ca setup a desktop and share anything I want via IPV6 another person without the need for a middle man “cloud” provider just didn’t happen.

You can, you likely just need to change the default firewall settings on a typical ISP provided router.

> Corporate greed / government control have severely limited any usefulness of IPv6 at least here in the US

I don't see how either of those have to do with this.

[roody15]

Dynamic DNS for example through cloudflare … is a middleman. Great effort has been taken to make obtaining a small block of IPv6 addresses difficult for the end user.

It’s true a few isps will provide you a static up but most will not.

https://www.arin.net/resources/guide/ipv6/first_request/

In most implementations the end user sees no benefit from IPv6 or simply an isp using carrier grade NAT. When IPv6 first rolled out it was promoted as a way for everyone to easily obtain addresses .. reality is not so much. End user functionality crippled Or gatekeeped

Hypothetically should be to host a simple file share of let’s say photos on a desktop and share using SMB or another protocol via IPv6. No need for cloud provider / iCloud Photos, Google or whatever. Just a direct connection with a desktop that stays on 24/7. This is not the case and effort has been made to make IPv6 really more of a useful protocol to mobile isps managing large numbers of new devices.

IMO #lame

[FireBeyond]

> Use dynamic DNS if you need a stable endpoint here.

How do you tell an embedded device to push a DDNS update?

[alacode]

I don't use Tailscale, I use my own VPS and Wireguard but no way in my lifetime will I allow IPv6 to have any prevalence on any of my systems.