Slashdot Mirror
World IPv6 Launch Day Underway
A number of readers have written in with stories related to today's permanent rollout of IPv6 by several major organizations. From the looks of it, for the 1% or so of end users with IPv6 support, everything is going smoothly. For those not so lucky to have IPv6 already, an anonymous reader writes with (mostly) good news: 60% of ISPs intend to enable IPv6 by the end of 2012. For business users, darthcamaro provides some words of caution: "...the Chief Security Officer of VeriSign doesn't think IPv6 should be turned on by a whole lot of people. The problem is network security devices in many cases don't scan IPv6. So if you turn IPv6 on, you're screwed.
'If you don't have that visibility into IPv6, you should probably consider explicitly disabling IPv6 on your systems until you can take a very concerted approach to enabling IPv6 in a secure manner,' McPherson said."
This is Verisign the operator of the .com and .net registry, not the other Verisign the certificate racket. The CA business was sold to Symantec in August of 2010. So don't mix this up with the recent news about the $99 fee to get your signed with the UEFI key that will be preloaded on every Windows 8-certified PC motherboard; that's all VeriNorton.
Those long IPv6 addresses are a pain in the ass to remember. So, I'm not looking forward to this.
So when is slashdot going to leave the dark ages?
Secure messaging: http://quickmsg.vreeken.net/
With IPv6 support
AccountKiller
other than having every single device have a unique public IP that is a wet dream for google and other marketers?
Did folks ever get IPv6 multi-homed routing straightened out?
It always felt like conflicting goals at work -- on one hand, people wanted to simplify and shrink the size of the backbone routing tables, but on the other, a purely hierarchical routing space removes redundancy. That is, a tree graph has the property that there is only *one* path between any two nodes, which means a purely hierarchical routing arrangement would mean that the idea of 'routing around censorship' would go into the waste bin because there are no alternative routes possible. (Note that I am differentiating this from redundant *physical* links -- this is a matter of administrative links. If there is no multi-homing and the upstream provider is blocking/filtering/limiting traffic, there is no network route around it, physical redundancy not withstanding.)
So any current best practices for IPv6 multihoming for small ISPs/businesses?
"The problem is network security devices in many cases don't scan IPv6. So if you turn IPv6 on, you're screwed."
Funny, The ones here do. In fact the last firebox update said it covered ipV6.
What out of date garbage are people running out there that will not scan ipV6?
Do not look at laser with remaining good eye.
a great article about why wee need IPv6 : http://www.forbes.com/sites/firewall/2012/06/05/why-we-need-ipv6-now-and-what-it-means-for-network-security/
The issue isn't just addresses. IPv4 was never meant to be a global business network. It is an experiment that was never turned off.
I don't know why everyone is freaking out about remembering addresses... really really easy
12-16 hex digits, That is it... assign static address after that.
Mine: 2001:470:8xxx /48 /64 networks, I use my VLAN ID
that is my
then for my
2001:470:8xxx:vlan::1 == router
2001:470:8xxx:vlan100::1 == router
etc...
easy
I will not use it at my home. I have an IPv4 address, and always will. NATing firewall. IPv6 can be used on my LAN, and I'll participate in BitTorrent with an IPv6 address, but this all happens without any thought from me. I can always disable IPv6 in my Windows networking stack if I want, but I won't bother.
I'll be damned if all of my devices get a fucking public IPv6 address. Fuck that. I doubt that I'll ever enable IPv6 on my router.
Regarding my ability to use the internet... I'll let the ISPs and transitional technologies sort that out.
For example, when I look at Comcast's site, I see "When Comcast decided to participate in World IPv6 Launch, we committed to enabling at least 1% of our customers with IPv6 by June 6, 2012." So, how does that figure into the 60%? If there are 50 ISPs in the world, but Comcast has 5% of the subscriber base, is that 2% out of the 60%? Or is it 5% Or is it .002%? I'm curious how this 60% number was calculated.
For your security, this post has been encrypted with ROT-13, twice.
...that are going to enable IPv6 for all customers by the end of 2012? Does it include CenturyTel?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I've been using IPv6 via he.net tunnels on pfSense 2.1 for over a year now, and it's working great.
Really happy to see my Netflix streaming going over IPv6 this morning, too.
Run OpenWRT on your router, then.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
$> dig facebook.com aaaa
Ink splashes across ar8ogance was
..or other hostnames with AAAA records:
Add -4 to ping_check command, restart nagios and carry on.
Dan
To the dozens of new hosts worldwide.
I'm glad to see you mention that. While under the FreeBSDs, Monowall has supported BSDs for a while, the same hadn't been true about pFSense. I wanted to know whether pFSense 2.1 supports IPv6 or not. Checking out their site, it stated
Today is World IPv6 Launch day, when many major websites have permanently added AAAA records to make their sites accessible via IPv6. All our sites have been IPv6-enabled (on native connectivity thanks to bluegrass.net) since last year, running behind pfSense 2.1. Many others are using the current snapshots in production networks.
We’d hoped to have 2.1 released in time for today, but getting to the point we consider full IPv6 support has taken far more work than anticipated. As has become the norm for us over the last several years, we do much more than put a GUI on things, having to implement and/or fix things in the underlying software to meet the needs of our users. There was far more to implement and fix in the underlying software than we anticipated. We have the last major piece addressed this week with CARP IPv6 support now functional. We’re just validating things at this point and fixing some last issues, with the official release coming roughly in the next 1-2 months.
IPv6 isn’t yet a critical need for most every network, but it will be getting to that point quickly. I know many IT professionals have been ignoring it, but it’s time to get up to speed for those who haven’t yet. I encourage everyone to at least start experimenting with it at home if you haven’t yet. For the bulk of us who don’t have an option for native IPv6 at home, our Using IPv6 on 2.1 with a Tunnel Broker document will get you going.
Incidentally, which version of FreeBSD does pFSense 2.1 correspond to?
Why isn't /. participating ?
Ok, which home router support IPv6 ? does it support IPv6 WIFI ?
I go to Frys, and mention which router support IPv6 for both internet and Wifi - all I get is a
blank stare.
Tracking ability is going to be driven more by browser request headers than by IP address, anyway.
I expect ISPs will get beyond /64s within a year or two. Being stuck with only a single /64 is BS; I have my home wired and wireless networks on different subnets for pretty simple (but entirely valid) reasons:
This I agree w/, and I think that ISPs could probably have a 3 tiered choice to offer customers:
On this issue, I've argued that the IPv6 address space has been less than optimally allocated. They allocated the first 48 bits for global prefix, next 16 for subnet, and remaining 64 for the interface ID. In the meantime, for features like multihoming, /32 or lesser addresses are needed. That puts a squeeze on the upper half of the address space, host density ratio arguments notwithstanding. Instead, had the first 64 bits been totally dedicated to the global prefix, the next 16 or 32 bits to the subnet and the last 48 or 32 bits to the interface ID, it would have been far more optimal. The first word would have still been fixed, the next 2 words could have been used for things like PI addresses and so on, while the last word would have been given to the ISPs.
That way, ISPs could give their customers anything from 16 to 65536 addresses w/o feeling the pinch. If 32 bits were assigned to the interface ID, it would be plenty, since no network is likely to ever have that many nodes. It would allow for hierarchical subnetting. OTOH, if the entire 48 bits were desired for ethernet autoconfiguration, the subnet could have been just 16 buts, and still been plenty.
Well, others have already mentioned some, but let's try to get a list of possible solutions to this problem listed:
* DNS, access machines by name
* For frequently accessed machines, assign "short numbers", e.g.
1234:5678::25 (where 1234:5678 is your IPv6 prefix). For a little bit of added convenience, assign your network prefix to an environment variable, and you can, e.g.
$ ping ${IP6_Prefix}::25
* Run IPv4 *internally* as well as IPv6, then you can access machines on the local network using the EXACT SAME IPv4 private network addresses you've been using for the last 20 years. IPv6 is most useful for accessing hosts on OTHER networks on the global internet, no reason you can't use IPv4 for internal networking.
* If you use IPv6 auto-config based on Mac addresses, and you have a database of mac addresses on your network, I bet vendors will be releasing tools which allow you to automatically parse out the mac address from an IPv6 and show you which machine the address belongs to. That's good enough for machines you don't need to frequently lookup (like individual workstations of employees). For servers, printers, etc, assign "short numbers" as described above, in blocks (e.g. routers and switches might be ::1 through ::100, printers ::200-::300 , servers ::500-::600, etc, then you just have to remember what the short numbers of frequently used devices are.
A criticism from VerySlime is reason to adopt it, because it must mean it hampers at least some of their privacy violation schemes.
Yeah, maybe things have improved, but I played with IP6 tunneling for a short time. It was kind of cool, but on IPv4, my typical ping times are 20-80ms to reach most hosts. On IPv6 with tunneling, the latencies were typically >100-300ms. Which, is mostly fine for web browsing, but sucks for other applications.
I did this analysis back in March, here is a quick summary of sites found with AAAA records:
* 1% of total sites
* ~5% of sites in Germany and Russia
* 0.38% of sites in the USA
* 90% of sites are running Apache or Nginx
* 4% of sites are running IIS
In July, I am planning on a follow-up to see if there is any major change in the numbers.
http://hackertarget.com/ipv6-in-top-sites-infographic/
you don't even need large scale networks - I need to remote desktop to VMs on a LabManager server - currently every single one of those is an IPv4 IP and I don't think we'll switch to IPv6 anytime soon, but I dread the day we do, since currently all I really need to do is remember the last number and have the first three memorized (the IPv6 auto generation by MAC address will likely make me have to memorize more or all of the IP). All of these are accessed by IP and all of these require hand editing files and injecting the IP into them (so they correctly serve client machines outside of the VM, and these have to be outside the VM because they need hardware graphics acceleration on the head).
For this particular case, IPv6 is even better than IPv4. With IPv4, if you are already getting a NATed service, then there is no way you can assign new addresses to those VMs w/o another level of NATing. In IPv6, that's not even an issue - you can either configure DHCP6 to assign a certain set of addresses to the VMs that you create, or you could manually assign them yourself, but from the same network. So each VM would have its own direct link to the internet, whereas in IPv4, they are likely to be behind multiple NAT levels.
Isn't IPv4 mapped address all but deprecated as well? It's support varies according to the platform. Incidentally, why were IPv4 compatible addresses deprecated? Seems like they could have been allowed as a shortcut way to assign addresses, particularly to those who wanted NAT. I also never understood the need to have both IPv4 compatible and IPv4 mapped addresses.
I think because of the routing problem.
to their customers, for example Comcast is already doing that. Otherwise, there is not much point in IPv6.