[ErroneousBosh]

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated".

You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

[mr_mitm]

I had a gig for a contractor of some banks once. One of the banks was using 5.0.0.0/8 internally. I asked the guy if it doesn't lead to issues. All the time, he said. When they first came in, they just assigned each bank 1.0.0.0/8, 2.0.0.0/8, and so on. Number ten feels really lucky, he said.

[inigyou]

As long as it's strictly separated from the internet it works. The Internetwork Packet Exchange, used for cellular roaming, is a parallel global internet with its own addresses and allocation policies.

[prerok]

This story is so silly it must be true. Thank you, made me laugh out loud.

[tracker1]

LOL, they should have just used a 10.x space instead if they wanted slightly simpler numbers.

On the shotgun, or adjacent, I do tend to prefer ammo classes for my nets... 10.22.x.y, where x may be 1, 38, 45, etc. Allows for site to site vpn with friends/family a bit easier to remember.

[zrobotics]

I dunno, seems like it could be a bit vague. Does 45 refer to 45 Webley or 45 GAP? Could possibly also refer to 45 Colt I guess, if you're boring. But 45 Colt, 45 ACP, 45 Colt Government?

Also, just in case this comment isn't pedantic enough, 10.22 would be a firearm range, not an ammo range. And AFAIK they only ever chambered that for .22 rimfire cartridges. ;)

[tracker1]

I appreciate the pedantry, but in this case it's pretty immaterial to what specifically it refers to, and yeah, I'm pretty boring like that.

I made me smile.

[jabart]

Didn't AT&T do that and Cloudflare made them change it when they aquired that space?

[tracker1]

I got a "home" Verizon box, and the first thing I did was change the DNS setting... 1.1.1.1 wasn't working, and I wanted to change it back to default. Verizon's tech support are idiots... they literally wouldn't give me the default DNS IP because they were concerned about security.

Google's DNS worked fine, but Cloudflare's didn't. No idea if they ever fixed it... I'm using it as a backup for my main connection, eventually I'll setup autofailover on my router (OpnSense). For now, I just swap the cables.

[hackernudes]

Quantenna used 1.1.1.1 for RPC to their wifi chip in their SDK by default. Should not have been exposed to global routing but of course people screwed that up.

https://medium.com/@mrtcve/atts-misuse-of-cloudflare-dns-ip-...

[Melatonic]

Or they didn't want you to know the IP(s) so you could easily block it

Sounds like they blocked Cloudflare but couldn't block Google

[ethin]

My ISP won't give me the router credentials because they claim that that would somehow risk their network interconnectivity or something. I have no idea how this makes any sense since a router (shouldn't) give me that level of access, but maybe I'm missing something?

[bityard]

If the router is also the modem, it can have diagnostic stuff that could (I am careful to point out: theoretically) cause them a big support headache in one way or another.

Also, I had a DSL modem back in the day with its own terrible NAT built-in. I managed to log in (I may have been given the admin password from a friend who worked at the ISP, allegedly) and once I put it into bridge mode, I was able to acquire multiple public IPv4 addresses via DHCP.

[ethin]

Really? I didn't know ISP-provided modems could even do that, I assumed they were like routers and isolated to the local network and what the ISP gives them access to. I just wish they would give me more than "well it's for security and it's corporate policy" or something, it just seems like some excuse, and their remedy is "buy your own router" (which isn't an option for me, too expensive).

[ErroneousBosh]

Funny enough their problems really began in earnest about seven or eight years ago...

[cyanydeez]

Sounds like someones on the path to sovereign citizenship. I can't wait for our cyber-sovereign citizenships who deny various IP ranges coming from the government's domain naming system.

[inigyou]

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range.

If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

[Matuzy]

> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range

I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.

[inigyou]

All global IPv6 addresses start with 2. This is by design. Pedantically, 3 is also reserved for global. Some other prefixes are also reserved, like fd for the ULA (local) range.

The point of IPv6 was to make the addresses so long they are easy to manage.

[SV_BubbleTime]

>The point of IPv6 was to make the addresses so long they are easy to manage.

lol, there is no doubt that had a massive opposite effect. To the point of nearly killing it in terms of willingness to adopt.

[tracker1]

I know that on my hosted server, I never bothered to set it up, because I didn't know how to properly configure or sub-net it. I know it's skill issue, but really feels significantly more complicated and even harder to understand than NAT even.

Not to mention, at home, most of the ads I do see (PiHole) are IPv6 addresses.

[unethical_ban]

No network is "smaller" than /64. All end-networks are /64.

Split subnets at four bit chunks.

Allocated networks, like to a home or small office, should be /56 or /60.

Then you have to think about link-local addresses and privacy addresses, and how to hand out IPv6 and configure DNS: SLAAC vs. DHCPv6 or some combination.

I have a rough draft of a beginner document but it's not ready. :)

[DrewADesign]

It seems to have absolutely terrible ergonomics as a technology, in nearly every conceivable way.

[inigyou]

How many /24s does your organisation have? With IPv6, one block is almost always sufficient.

[ErroneousBosh]

It's mental that my fairly techy-orientated but otherwise pretty standard UK ISP provides me with a /48 as default.

So I have 1.2 million million million million IPv6 addresses available.

That ought to be enough, eh?

[ConceptJunkie]

The point of IPv6 was to make the addresses so long that we don't run out of them in 20 years or so.

There fixed that for you.

[ralph84]

The problem is NAT solved the same problem more easily and cheaply. It was at the cost of making it difficult for every host to talk directly to every other host, but it turned out most of the people building networks didn't want that feature anyway.

[inigyou]

It's been a strong centralisation pressure on the internet. Centralisation is bad.

[inigyou]

We already ran out of ipv4 about 15 years AGO.

64 bits would be enough to avoid run out, but hierarchical allocation would still be a problem. 128 bits is long enough for many levels of hierarchy. (And yes, you can subnet all the bits, not just the first 64)

[vitally3643]

The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address.

It's not about low adoption, it's that there are unimaginably many IPv6 addresses.

...which is a major reason for why it has low adoption

[Matuzy]

Thanks for the reply. I'm reminded every now and then of the magnitude of the address space in v6. Then I do nothing with that information and slowly lose appreciation for the size again :)

[lukan]

https://xkcd.com/865/

[unethical_ban]

Respectfully I don't think they explained it well.

fc00::/7 is for "Unique Local Addresses". Basically, private, non-globally-routable addresses from which you can freely pick space. Kind of like RFC1918. It's deliberately huge and you should only use as much from it as you need. The idea being that if you merge with another organization or connect to them via VPN, it's unlikely your addresses will collide like with RFC 1918.

There's even a website (sites?) to register your ULA space on a volunteer basis to reduce collision chances.

[inigyou]

If you can't remember 192.168 you definitely can't remember a randomly picked ULA. So just use fd00. It's not any worse than 192.168.

[unethical_ban]

True, I was thinking more about the allocation discussion than the "easy to remember".

Anyone in IT who allocates 1.1.1.0/24 because 192.168.0.0/24 is hard, should be allocated to trash pickup.

[inigyou]

also easy to remember is 10.anything.anything.anything

[kowbell]

"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"

[iso1631]

192.168.0.0/24 -> fd00:0::/64

192.168.1.0/24 -> fd00:1::/64

192.168.2.0/24 -> fd00:2::/64

192.168.240.0/24 -> fd00:240::/64

It's not a great idea, but its no harder.

No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem.

Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.

[SV_BubbleTime]

I doubt any endpoints are entirely ipv6.

So it seems like it helps ISPs and large networks router… but they never had problems with address space running out at the high levels and almost all likely need to support v4 anyhow.

I think it’s been long enough to be honest that ipv6 was a spectacular failure by complicating an already complicated system into something no one actually asked for.

No human said “hey, networking sucks. Please make it much harder at my level!!”.

[toast0]

> I doubt any endpoints are entirely ipv6.

Lte and 5G can be v6 only, usually they also have NAT64 and DNS64 so you can get everywhere, but the less stuff that needs v4, the smaller their nat boxes are.

[tracker1]

I'm largely with you... I would think they'd take the IPv4 block and have a direct/virtual block that just extends it to more addresses... so it could be an IPv4 NAT or IPv6 direct.

like 1.1.1.1/192.168.45.4 ... for a router that understands IPv6, that's the direct route to the sub-network, otherwise it will have to use IPv4, and the subnet route is treated as NAT and otherwise isolated.

To me, that would make more sense... then internal IPv6 might be practically limited to 10. and 102.168. in the nearer term, but adoption would be MUCH simpler in practice, and distribution would mostly already be established, however unfairly, but can then be broken into single addresses and vNext adoption could be that much quicker as a result of piggybacking.

[pbhjpbhj]

>limited to 10. and 102.168

I assume you meant 10.x.x.x and 192.168.x.x -- (and 172.16.x.x?), ie the standard subnets for home router-modems (which are non-routing and so can't be used on the internet).

[inigyou]

AFAIK this was one of several things that was tried, but failed for various reasons. It's called "TUBA" - TCP/UDP with Bigger Addresses - adding extra address bits at a layer above IP so that IP remains compatible.

I think one of the main problems with it is that you have to update the whole internet anyway, just like you do with IPv6, so you make the protocol stack stupider for no real benefit.

[iso1631]

1:1:1:1::192.168.45.4

That's a perfectly valid IPv6 address and can be set up, if you own 1:1:1:1/32

[ianburrell]

An alternate to IPv6 would have been to store the NAT addresses in IPv4 somehwere. But the IPv4 options are fragile and normal NAT would likely destroy them. It would still require rewriting all of the networking and software. It would have engrained NAT everywhere and made lots of routing problems, like is that your or mine 10. network.

[inigyou]

Public websites almost always still have ipv4 to serve ipv4-only users who make up half of the American business internet. But note that v6 connectivity is better than v4 in basically every other country and basically every mobile network (which is where most of the users are).

[ianburrell]

The proper way to do ULA is to generate random 40-bit ID. Then your ULA are likely unique. Which means that if you want to connect or merge with another company, the networks are distinct.

IPv4 has a lot of trouble since everyone is using 10/8 space for corporate networks.

[inigyou]

If someone can't remember 192.168 they definitely can't remember their own chosen random 40 bits.

[tracker1]

One thing I don't appreciate... Is the nature of NAT protected my internal/home network before... now, I have to actually configure firewall settings etc. to protect IPv6 issued addresses internally.

I know you can just block inbound non-established connections, but it feels like an extra step and complexity. Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6. Is there like a 50-100 page book you can recommend "for dummies" on IPv6, that hopefully contains at least a tiny amount of how to configure a common router and/or linux host.

[tredre3]

> Not to mention, that I really don't understand how IPs are supposed to be provisioned to devices on IPv6.

SLAAC is the only way that works across all IPV6 devices. In that mode, the router advertises the prefix and the device assigns its own address (prefix + its mac address).

DHCPv6 exists but is poorly supported. It sucks for people who like assigning IPs individually from an authoritative place (through static dhcp entries on the router). But people like us are "doing it wrong", you see? We must accept that in this brave new worlds an IP means nothing.

[tracker1]

Which doubly sucks in terms of assigning a DNS name to an IP/PC... and/or opening the assignment to less restricted access... feels just problematic to me.

Again, I don't know any of IPv6 enough to use it really right or wrong.

[inigyou]

And there's always static configuration, useful for servers.

[inigyou]

Home routers with IPv6 should have this enabled by default, at least by law in Europe, and you can turn it off or add exceptions.

[inigyou]

you can use 1234 if you want, that's also unused space

[Multicomp]

Agreed 100%! I know there's tough challenges to making this reality, but if https://serverspace.io/about/blog/ipv8-explained-what-we-kno... could be an IRL thing, I would buy company network equipment and use computer OSes that supported this draft standard.

It's a much better compromise and ergonomics to migrate from IPv4 to an IPv4 respecting successor, where IPv6 is just the academic snobbery and utterly alien mental model for not-enough benefits.

For the same reason Unix stuck around and beat up its own successor Plan 9/inferno. That inertia even decades later is the same reason IPv4 still beats IPv6.

IPv8 is more of a linux to unix than a plan 9.

[inigyou]

ipv8 is a "vibe coded" specification from someone who doesn't understand the problem at all. Just like ipv6, you can't use ipv8 without upgrading the whole internet. The internet is mostly ipv6 capable and not at all ipv8 capable so why do you want to throw away that progress and reset the clock?

It's also just a worse design, centralising a bunch of things and trying to authoritatively define what counts as "a network" on both sides of the communication, unlike v4 and v6 where you just have raw bits and can interpret them how you want. I mean ipv8 defines the internet as a bunch of networks and a network as a bunch of computers. And a network is something that has an ASN. Your computers would be on your ISP's big network, not your small home network because you can't have a network inside a network. It also decreases the number of bits than we already have (in ipv6), limiting futureproofing. It also says every network device will log in with OAuth. Yes, really.