Hacker News new | ask | show | jobs
by ginko 5032 days ago
I'm afraid of the possibility that instead of adopting IPv6, internet providers will just switch to ISP-wide NAT, making the internet even more asymmetric than it already is.
3 comments

To be clear: transitioning to IPv6 is a two step process:

1) you need to enable IPv6 everywhere 2) when that is working, you can sunset IPv4

So, every transition strategy involves both the life support for IPv4 and the delivery of IPv6.

Sometimes the ISP has no choice but to use it. And iff the ISP also rolls out IPv6 in parallel, this is fine, the users can access the dualstack websites over IPv6, while still using IPv4 for the rest of the content. And this is the key.

A lot of folks here are building products that have their front door on the Web.

And this is where all of you, as a "content provider", can make a difference for those users who already have IPv6 by providing the service both on IPv4 and IPv6.

Agreed - ISP wide NAT will be necessary, but if they choose that instead of ISP wide NAT+IPv6, then we're in trouble!

EDIT: Also - Everything I have a hand in is accessible via both IPv4 and IPv6..

In my conversations, the vast majority of the folks who are going to have to deploy CGN, also have already running programs to deploy IPv6. It's just that they don't necessarily advertise them, and also that these things take years - the access is by far the hardest part of the internet to transition.

At my $employer, a couple of bright interns this summer made this: http://6lab.cisco.com/stats/ - which aggregates the stats from various places and allows to get a more rounded view. Besides for the access part (EDIT: which, as I said, just takes some time), the situation is not bad at all!

EDIT: And, kudos to dualstacking your gear! :-)

I sincerely hope not! ISP wide NAT is bound to cause countless issues for internet services and businesses.

The first and mose obvious examples I can think of:

* Internet services (eg websites, netfix etc) can no longer blacklist IP addresses without blocking entire ISPs.

* Businesses can no longer offer "direct to the office" VPNs for remote workers.. Actually - even site-2-site VPN's will break if both sides are behind an ISP wide NAT.

The first is a feature. The second is not true: a VPN can tunnel through TCP in the worst case, and most NATs allow VPN over UDP using some tricks.
Look on the bright side: users will have more privacy.
http://panopticlick.eff.org/

Works over NATs and proxies. And obviously the techniques from there are already used by those who want to sell your info for profit. So, please, let's put this meme to rest :-)

Blacklisting can and will happen based on other things, just that it is more costly and less performant. So the consumers will pay for that in hidden costs - less of the "useful" services delivered, etc.

The VPN part is sort-of correct - it will depend on the type of the NAT. With most of the NATs, establishing the direct connection over a pair of them is technically possible - take a look at STUN, TURN and ICE (IETF standards).

From what I understand (which admittedly is not all that much) implementing so called carrier-grade NAT would be almost as expensive as transitioning to IPv6 would be. And even private ranges are finite, which afaik was one cause for Comcasts applaudably early transition to IPv6