Slashdot Mirror
Comcast Begins Native IPv6 Deployment To End Users
First time accepted submitter Daaelarius writes "Comcast has begun deployment of Native IPv6 access to end users. The deployment is starting out small with a single market, but is expected to expand rapidly. They have provided ... more in depth technical details."
Finally; native dual-stack IPv6 for home customers. Perhaps we can avoid a post-exhaustion future of NAT-upon-NAT and use restrictions.
until every light switch and toaster has its own /64
Nullius in verba
I'll not still use NAT for my home network for all my devices that I authorize to use the wireless router...etc?
What does the regular user have to do to use this...and what exactly is going to push him to change his whole home network along with all the devices he currently has on there (tv's, ipads, laptops, desktops, toasters...etc)?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Kudos for Comcast for finally getting the ball rolling on IPv6. A /128 address gets their foot in the door, and as their post says, they can expand it later.
When is it going to be available nationally instead of a couple of markets?
It's rare to see companies take such a long term view of their business, but Comcast sure is doing it now. I know from seeing it being done at work, huge IPv6 deployments are not trivial things!
With IPv6 addresses being so plentiful, does that mean it should never have to change? I've been running a webserver and mailserver on my Comcast account since it was an @Home account (10+ years) and my IP rarely changes, but occasionally it still does.
IPv6 deployment - Yea! Wait, it is Comcast. Ok, what's the catch?
"The ferrets, they're every where I tell you!"
Well, Dual Stack Lite is going to be their long term IPv4 availability, which removes NAT from the CPE and shifts it up into the ISP layer. So all of your transactions will be manipulated inside the ISP's AFTR element, which would be a very convenient place to mine your data stream for goodies. But that would be paranoid to think they would do that. Especially when they could do it anywhere else just as easily!
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
Extra charge for allowing you access to IPv6?
Extra charge for staying with IPv4?
Extra charge for keeping your IPv4 if you also want IPv6?
It's lock-in. Once you've gone IPV6, who's going to want to go back. You'll be a Comcast customer until FIOS, DSL or whatever other competition might actually exist catches up.
The living have better things to do than to continue hating the dead.
My solution has always been to bring the toaster into the shower with me so I do not require a notification.
Or at least that's my plan now, I'll implement that right awaZORCH
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The problem is that there is no benefit in using IPv6 as long as there are no IPv6-only services.
Therefore, it is unlikely that IPv6 can be rolled out successfully.
And why would anyone but an idiot want a phone number or postal address that can be reached by the public at large??
Exactly. Who wants to have to deal with idiot marketing calls all the time?
Must be a relic of an operating system.
now also your ISP can see exactly how many devices you're attaching to the internet.
And since comcast is really just a cable TV company at its core, they will charge you per device.
I'm assuming that something like PFsense or a timecapsule will still work as a NAT device?
---- Booth was a patriot ----
That notion is very alarmist and 1990's era. An ISP can make a pretty good guess of how many lan devices you have using million dollar stat boxes, like sandvine makes. They dont care. ISPs are all media providing machines on another face and they know all your lan devices are just media consuming vehicles with credit card slots strapped on the side. They really don't care. They'll just do metered billing someday and we'll all crab together.
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
So set your firewall up so that your ISP cannot see your toaster.
Go green: turn off your refrigerator.
I've seen plenty of people plug their cable modems right into the back of their computer with no firewall of any kind. Thankfully, most operating systems ship with a software firewall - it's better than nothing. Most of these types of customers bought a nat box, not due to security concerns, but to get wireless connectivity.
IPv6 direct connectivity will be a problem ONLY if end users plug all of their devices into a switch and those devices lack a software firewall. I don't know of any "non-technical" home users that have such a switch. Everyone seems to have a "nat box" simply for wireless connectivity. I suspect people will not go buy a dumb switch and access point, simply because they do not know what they are.
I suspect most people will go buy an "IPv6 capable" firewall/switch with built in access-point. End users will have no idea that they no longer use nat - hell most probably don't even know they have it now.
-ted
Did you hear that Verizon? Your "next generation optical network" is now behind the clunky old cable modem guys on this issue. Where is your update? Hmmmm?
I read the internet for the articles.
Well if we're going to get silly...
I'll take addresses and phone numbers for all of my homes and phones, without having to use post-it notes and pseudo-addresses to make everything reachable. Particularly if having those addresses affords me the same level of security as doing without.
After all, nothing about being able to address all your devices precludes the use of proper firewalling, just as you do now.
nope, as you can also change the your ipv6 address, specially if you use the ipv6 privacy extension... your ISP will not know when its the same device or another device
to do that, they would need to deliver just ONE ipv6 address for you... and that goes against the goal of the IPV6 and would probably force the ISP to have a lot more work to deliver ipv6 that way than to allow a normal ipv6 range to the user...
Higuita
1. The only IPv6 "routing and discovery" packets that should be flying around are local-network only. The fact that you didn't know that, and the fact that you are confused by the whole thing, suggests that the problem is with you, not IPv6.
2. More than likely, you screwed up configuring your public web server when setting it up for IPv6 (it is hard to tell, because the only information we have is you blame IPv6 for it). That suggests the problem is with you, not IPv6.
3. You need to sit down and figure out how things work, security-wise, on IPv6. That's nice... join the club? There isn't some grand conspiracy to confuse and frustrate you.
4. There was a time when people complained about remembering phone numbers that were an incredible *7* digits long. My advice to you is adapt or go get a job at McDonalds. I hear there is some sort of distributed naming system that lets you assign names to IP addresses, maybe that will help.
The current situation provides some level of security for the end-user ... even if the end-user does not understand the concepts.
The get 1 IP address from their ISP and they buy a magic box that provides them lots of sockets to plug stuff into and wireless access. They don't know if they're running NAT or PAT or what the difference is between stateless and stateful.
But will that same behaviour have different results once they receive globally routable IP addresses for each device? I think it will.
And I also think that there will be IPv6 compatible magic boxes that do NOT have firewall capability up for sale very soon. It's just cheaper to NOT have certain functionality and that means saving $5 or so on the device. In essence, they will be just a cheap switch/wireless-bridge that plugs into the Comcast cable modem.
And those devices will, initially, appear to have MORE functionality as the end-users won't have to go through additional steps configuring the firewall to connect to other gamers / torrents / whatever.
And that's not considering the end-users who will turn off the firewall functionality of the firewall/wireless-bridge/router devices because it "makes everything work".
I'll take addresses and phone numbers for all of my homes and phones, without having to use post-it notes and pseudo-addresses to make everything reachable.
Is there a difference between having a post-it note reminding you of the IPv6 address for your toaster compared to a post-it that reminds you of the address and port?
Particularly if having those addresses affords me the same level of security as doing without.
It doesn't. Securing an address that exists requires proper configuration of a firewall and some reasonable assumption that the firewall itself doesn't have security issues. Securing an address that doesn't exist requires nothing. You cannot break into a toaster that doesn't have an internet connection.
After all, nothing about being able to address all your devices precludes the use of proper firewalling, just as you do now.
Botnets thrive because mom and pop computer users don't know better. Your "just as you do now" doesn't apply to the vast majority of home network users, because "just as you do now" for them means "do nothing". Assuming that giving every mom and pop a toaster with an IPv6 address will result in better security instead of worse is ignoring history.
YOU may know how to configure a modern firewall properly, but mom and pop won't, and they'll have their toaster on the wild and wooly IPv6 internet.
And what I expect will be a more serious problem will be all the people who know how to configure a firewall but who will wind up with equipment behind that firewall that doesn't work unless the firewall is open. Anecdotal evidence? My fancy new smartphone has an SMB app so I can get files from my Windows and Linux desktops. It uses a kind of authentication that neither of my desktops understands, so I need to leave both of them open if I want access from my phone. I know better than to open the ports on my NAT/router/firewall so the public can get to them, but mom and pop won't, and someone who really really wants to access his systems from his phone while outside the internal network may either open the firewall, or at best rely on the firewall to be configured properly and have no security holes that makes his home network swiss cheese.
YOU may know how to configure a modern firewall properly, but mom and pop won't, and they'll have their toaster on the wild and wooly IPv6 internet.
Then perhaps it's about time that manufacturers put some thought into security rather than blaming something else if their devices get pwned. There's no reason why a home appliance should need a separate firewall to be secure.
Even Microsoft have got the hang of it now - I had my Vista box on a public IPv4 address for months without problems.
Like 10x a standard consumer connection.
If the ISP is doing carrier-grade NAT across their whole address pool, does it matter anymore that you might technically share an IP address with others? Heck, you could be using different public v4 addresses for different connections and most people would never know.
Then perhaps it's about time ...
You can rant about how things would work in a perfect world, or you can be pragmatic and deal with the way things will be done. Mom and Pop won't pay for a toaster that contains all the network security they need but don' t know about. They'll buy a cheaper toaster with the network features but no security. If the toaster has too much inherent security by default, and it doesn't work out of the box, or they can't figure out how to set it up, they'll take it back. That manufacturer loses.
No, I don't. And you probably mean PAT, not NAT.
No it does not. The same as IPv4 does not require a firewall.
But, many end-users purchase an EXTERNAL firewall in order to get the PAT functionality so that they can run multiple devices (and wireless) on the single IP address that their ISP provides them.
So, in order for them to overcome the limitations of IPv4 (fewer IP addresses) they, inadvertently, purchase a firewall that improves their security.
I have no idea what you're thinking of.
Again, because with IPv6 there is no need for the ISP to limit the end-user to a single IP address. So the end-user can purchase different devices (such as a switch with a wireless bridge) that would allow the same PERCEIVED functionality with IPv6 as they get with IPv4 and a firewall/PAT device today.
And the point being that the end-user does NOT understand that TODAY. And cannot be expected to understand it when Comcast rolls out IPv6.
Having globally routable addresses means that if the end-user's home network is mis-configured from a security stand-point, their devices could still "work" from the perspective of the end-user. They would still be able to access the Internet.
Right now, with IPv4, that is less likely for the end-user.
Well, for web servers, you can run one webserver on port 80 that proxies to other web servers on different virtual hosts (at least in Apache).
What "security" would it need? It just needs to not do something stupid like accept and trust connections from anywhere on the planet. That's not too hard, surely? Just don't open any ports that you don't need. If you do need it, then you'd need to port forward with a NAT too, so no security gain there.
It sounds like you're operating under a premise I don't quite understand. Why does switching to IPv6 imply that we must network things that shouldn't be networked, and do it poorly? Can we, should we and will we network the toaster? That's unknown. But if we did, I don't see why it would have much to do with the particular form of network addressing we use. All discussion of device security beyond that seems tangential (though not unimportant on its own).
For "mom & pop", whom everyone seems both terrified of and for, the situation should be largely the same. They'll plug their devices into a box, likely provided by their ISP. That box will do all the routing and firewalling their current box does, seemingly by magic, just as it does now. I don't see why that would change.
And in the process we'll have rid ourselves of spaghetti solutions like NAT and negotiating port forwarding for like services. Need to expose some service on your xbox? Great, it's easy now. There's no need to expose the toaster in the process, any more than there is now.
Though if there's something I'm overlooking I'd genuinely appreciate a heads-up, because it's clear that time is a-comin'.
What "security" would it need? It just needs to not do something stupid like accept and trust connections from anywhere on the planet. That's not too hard, surely?
So, I want to control my toaster from my bedroom and from my smartphone. And my kitchen. How do I tell the toaster what addresses to accept connections from? How do I teach mom and pop how to determine what addresses they will be connecting from using that smart phone app they just downloaded? How do I teach it what addresses are in the house and should be trusted implicitely, and which are transient in the house and should not?
Just don't open any ports that you don't need. If you do need it, then you'd need to port forward with a NAT too, so no security gain there.
This statement makes no sense. Why would I need to port forward an IPv6-addressable toaster? Isn't that the point of IPv6 and an essentially infinite number of addresses? I connect it to the net and bingo, it's on the net! Unless the default security is so tight that nobody can connect to it (the only reasonable default that will protect everyone), and then I need to know how to configure it. Not an easy task for some people.
But like I said, you can rant about what you think a perfect world would look like, or accept the fact that it won't be like that and learn from history.
IPv6 doesn't have NAT in the same sense that IPv4 does. What it has is prefix translation, which can move your devices into a different subnet, but it doesn't (at least that I've seen) have a means to hide multiple IPs behind a single address.
Not that it would be practical for ISPs to track/charge based on device anyhow...
Why wouldn't it be practical? They do it now with "TVs" via the mac address on the box(s) that is attached to it. i still think that was part of the forced ( purchased by the industry ) move to digital video transmission, and the DMCA, so that they could once again get you to rent($) cable boxes, in effect that cant be legally built by a 3rd party. ( be it a real box, or a card for your TV. )
Back to 'internet acces' charges: You get charged x$ per month "basic network access" fee with a low cap, + x$ additional charge per device, perhaps raising the cap for each device..
---- Booth was a patriot ----
Per more recent RFC changes the requirement has been lowered.
/48, so as long as they aren't forcing you to below a /64 for stupid reasons like "we're wasting IP space".
/56 and /60s as-needed.
ISPs do not have to provide a
Essentially, chances are you're going to get
Well, Dual Stack Lite is going to be their long term IPv4 availability, which removes NAT from the CPE and shifts it up into the ISP layer. So all of your transactions will be manipulated inside the ISP's AFTR element, which would be a very convenient place to mine your data stream for goodies. But that would be paranoid to think they would do that. Especially when they could do it anywhere else just as easily!
I'm just thinking ahead - perhaps the next box delivered to me for DSL could very well have some memory they could upload instructions to, to sniff on the spot and report back what it spots, rather than requiring the provider to sniff at their end.
With net neutrality going in and out of legislation (or directions to/from FCC) I'm not taking things for remaining status quo.
A feeling of having made the same mistake before: Deja Foobar
> Then perhaps it's about time that manufacturers put some thought
> into security rather than blaming something else if their devices get
> pwned. There's no reason why a home appliance should need a
> separate firewall to be secure.
For 99.9% of home devices, you shouldn't have them connected to the internet in the first place. Outside of a Netflix-streaming TV set, or an "internet radio", there isn't much in the way of home appliances that *NEEDS* an internet connection to function. And even those should not respond to incoming unsolicited connections.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Wake me when these idiots offer a plan that doesn't include a 250 GB monthly data cap.
The government has a defect: it's potentially democratic. Corporations have no defect: they're pure tyrannies. -Chomsky
NAT is not the Devil coming to Eat your Children.
Correct. But NAT does cause lots of problems, so getting rid of it where it isn't needed is a Good Thing.
NAT can be used to source many machines from the same address
Correct, but why would you want to if you weren't restricted on the number of addresses you could have?
and it can also be used to source one machine from many address.
Again, correct, but you don't need NAT to do this, you can just assign those many addresses directly to the machine in question. Doing that has the advantage that the software on that machine can know which address the connection was for.
You can do all kinds of cool stuff with NAT
Yes. Although, except for temporary measures (for network migration) and alleviating IP address shortages, the only use I've ever found for NAT in my 13 years of networking experience is load balancing internet connections. This is something I'm curious to figure out if there is a good solution for IPv6 (so far I've not had to configure load-balanced IPv6 connections).
because NAT is a firewall concept.
No... no it isn't. NAT has nothing to do with firewalls other than that it depends on some of the same low level technology (namely, stateful connection tracking). NAT provides very little security in itself (if you plug your NATting router into an untrusted broadcast network then people on that untrusted network can connect directly to machines within your NATted LAN. The only way to prevent this is with a firewall.)
http://blog.nexusuk.org
It looks like the initial deployments will only support recent Windows and recent OS X releases. Let me know when they take the blinders off their tech support people so that Linux folks can set their OpenWRT gateways and Linux servers up with IPv6.
SCREW THE ADS! http://adblock.mozdev.org/ Proud user of teh Fox of Fire - Registered Linux User #289618
This is untrue. NAT simply implies some form of firewall which disallows random incoming connections, which is where the security comes from. The security of this would be exactly the same as if I had a non-NAT router which I set to disallow connections from WAN to LAN.
Personally, my router has WAN and LAN interfaces and 2 DMZs. I apply the same rules to the DMZ interfaces as I do to the WAN (no connections to the LAN). The NAT is not necessary at all. No rewriting involved.
Perhaps we can avoid a post-exhaustion future of NAT-upon-NAT and use restrictions.
Sorry, the post exhaustion NAT future already happened, and entirely because of the IPv6 design cock-up. If IPv6 had been designed for maximum compatibility with IPv4 we would have completed the transition decades ago.
I'm afraid it's going to get worse from here, too. The big question is, what use is IPv6 when there are next to no web sites serving it?
Have you got your LWN subscription yet?
So, I want to control my toaster from my bedroom and from my smartphone. And my kitchen.
If you wanted to do this with IPv4 and a NAT, how would you do it? Rely on everything that you want to connect to it being on the LAN? You can achieve the same thing by having the device only accept connections from addresses corresponding to the LAN. This is an easy enough check for the device to do, it could work that way by default. No need for a separate firewall.
If you wanted to have it accessible from outside (on IPv4 behind a NAT) then you'd presumably have to tell the device to accept connections and the NAT to forward a port, whereas on IPv6 you wouldn't need the port forwarding. Either way, the security would be the same - an unwanted external attacker could attack both scenarios with equal ease.
IPv6 is a hackers paradise, thats why there are whole toolkits made for hacking it by reputable parties such as the Hackers Choice.. Backdoor deployment Enable IPv6 6to4 tunneling Run Backdoor on IPv6 address Not detected by port scanning Harder to analyze traffic IPv6 protocol exploits tools can be coded in just 5-10 lines Sounds like hacker heaven! Nat-upon-NAT!?!? I guess the phrase Double NAT escaped your notice.
1. The only IPv6 "routing and discovery" packets that should be flying around are local-network only. So that means anyone who bypasses your wireless WEP or WPA keys and has access to your local network. 2. More than likely, you screwed up configuring your public web server when setting it up for IPv6. Maybe, perhaps, I wouldn't know as I use IPSec & TCPCRYPT for my tunneling not IPv6. 3. You need to sit down and figure out how things work, security-wise, on IPv6. Oh I have and whats more I have all the tools to hack into it. 4. I hear there is some sort of distributed naming system that lets you assign names to IP addresses, maybe that will help. Bind9 and no not really that just set's you up for DNS Cache spoofing!
Rubbish IPv6 makes it harder to track traffic, besides if your downloading stuff across various networks that distribute copyrighted content then why the hell are you downloading stuff without a Blocklist & Blacklist all those IP addresses that belong to the idiots who call themselves the copyright police. Secondly you should be encrypting all your traffic from you to the peer, that way they know you are downloading, they can see the huge spike in the network traffic, but as to what you are downloading they remain totally clueless. I await the day I get a letter from the Copyrot & Copyleft police in anticipation, perhaps it'll say "we hereby notify you that your traffic was encrypted to a military standard and we where unable to see what you where transferring and with whom, we are just writing to make you aware that we are aware and are asking you to desist from using such an impregnable form of cryptography across a distributed sharing medium over which we acknowledge that we have no control. May we have a cookie?"
How does one enable it? Under Windows 7, if you click on Properties under Network, you have Client for Microsoft Networks, File & Printer sharing for Microsoft Networks, QoS Packet Scheduler, and Internet Protocol (TCP/IP). In Vista and 7, that line item is Internet Protocol version 4 (TCP/IP), and then there is one more item Internet Protocol version 6 (TCP/IP). That's how you get IPv6 in Vista and 7. But how does one get it in XP?
Initially, they'll be doing this on a limited basis, and only in homes that have just one computer, where no subnetting will be required, and there, they will just issue a single /128. That /128 cannot be NATed. Later, when they introduce home networking, they would issue /64 addresses, which is what most home routers support anyway.