Weekly Edition
Return to the Announcements page
| |||||||||||||||||||
2013 IPv6 Summit
FOR IMMEDIATE RELEASE March 20, 2013 2013 IPv6 Summit Keynote: The Big Shift To IPv6 Is On By Default Industry Leading Speaker Lineup Explains Why IPv6 Adoption Imperative for Continued E-Commerce (DENVER) The Rocky Mountain Internet Protocol version 6 (IPv6) Task Force (RMv6TF), in conjunction with Regional North America IPv6 Task Forces, announced keynote speakers for the upcoming North American IPv6 Summit in Denver on April 17-19, will include Latif Ladid, President, IPv6 Forum and Google Vice President and Chief Internet Evangelist Vint Cerf. This years keynote covered by Ladid and Cerf explains why the big shift to IPv6 Internet is on by default. When a protocol is on by default, explains Ladid, vendor readiness, network readiness, and service enablement become critical. The issue now is can IPv6 be treated like IPv4. The service providers with advanced deployment experiences have discovered that IPv6 is a totally different networking paradigm. Cerf, who is recognized as one of the fathers of the Internet will address the audience via video from Silicon Valley. Cerf will discuss The Adoption of the Internet of Things, and how the Internet impacts our daily life with the plethora of new services and how security and privacy should be managed. Additionally, the speaker lineup covers compelling trends and discoveries made regarding IPv6 deployments, and looks closely at the highly discussed topic of Bring Your Own Device (BYOD), one of the foremost reasons for the essential transition to IPv6. Featured keynote speakers will address topics including the Dos and Donts of IPv6 Transitions, Enterprise Deployments and overall best practices. This years speaker lineup offer up compelling information and insights on the transition to IPv6, said Scott Hogg, Chair-Emeritus, RMv6T. The world is experiencing an explosion of IP connected devices through BYOD in business as well as homes. There are simply not enough IP addresses to sustain commerce as we know it on the IPv4 platform. This lineup of speakers will help ensure the world is ready. Hogg added, In time, every business, large and small who wants to continue to conduct business over the Internet will have to migrate to IPv6. Its imperative that those managing that transition know how to do it fast, and as seamlessly as possible. The speaker list and agenda are now available. Registration for the conference is open to anyone who would like to attend. A newly added Government panel will look at current IPv6 adoption levels in the US Government, learn how real deployments are being impacted and hear how some government agencies are making the most of the IPv6 transition process. This half-day session will also be available to those who cannot attend in-person via Webex. Additionally, the conference will also host a full day of pre-conference tutorials at a small additional fee for attendees looking for training and development on IPv6. An Introduction course, Security Course and Advanced training class are offered. Registration for tutorials is open and will take place on April 17, 2013. About The Rocky Mountain IPv6 Task Force Dedicated to the advancement and adoption of Internet Protocol version 6 (IPv6), the Rocky Mountain IPv6 Task Force (RMv6TF) works to educate the community on IPv6 and its benefits. As a sub-chapter of the North American IPv6 Task Force, the organization primarily hosts local IPv6-focused events to promote the use of IPv6 within the Rocky Mountain region. The RMv6TF is a non-profit/tax-exempt organization that industry and government can look to for guidance on IPv6 transition information and advice about best practices and solutions involving IPv6. For more information, visit www.RMv6TF.org. ### (Log in to post comments)
2013 IPv6 Summit Posted Mar 25, 2013 23:34 UTC (Mon) by gerdesj (subscriber, #5446) [Link]
Ho hum another IPv6 related topic on a tech website that lacks IPv6 support.
Granted that not all countries or ISPs have much of a commitment to moving on but I'd have thought the US has at least one or two ISPs that offer it.
If you can name your DNS servers tex and corbet then you must have a reasonable setup available. Is moving from 32 -> 128 bit IP addressing too much!
Mind you 8 -> 16 -> 32 -> 64 bit processors took (still taking) a while so perhaps a bit of patience is needed.
Cheers
2013 IPv6 Summit Posted Mar 27, 2013 1:03 UTC (Wed) by gerdesj (subscriber, #5446) [Link]
... No bites yet.
Does anyone here really give a shit about IPv6? I took a deliberately cheap shot at LWN int al. about their lack of v6 availability and in 24 hours or so no one seems to have noticed enough to bother posting a riposte.
Says a lot.
Cheers
2013 IPv6 Summit Posted Mar 27, 2013 1:47 UTC (Wed) by jake (editor, #205) [Link]
> Does anyone here really give a shit about IPv6?
Well, Jon, I think the answer is "yes", but that doesn't mean that it somehow magically shoots to the top of our priority list. I don't think readers are having any trouble connecting to our site due to a lack of IPv6 support (or at least we haven't had any reports). We do intend to find some time to work on that, someday.
Sorry to disappoint,
jake
2013 IPv6 Summit Posted Mar 27, 2013 4:20 UTC (Wed) by dlang (✭ supporter ✭, #313) [Link]
Other than as a checkbox for geek cred, why should any website care about IPv6 at this point in time?
There are currently zero users who have IPv6 only and are unable to access IPv4 sites.
In fact, the vast majority of users cannot use IPv6 at all (or if they can, it's only within their small bubble or by going through a tunnel that increases latency and overhead for the privilege being able to say that you are using IPv6)
From a security point of view, Disabling IPv6 is the smart thing to do because it reduces your attack surface.
From a business point of view, working on IPv6 means spending resources with no payback expected before the systems that are implemented are probably going to be retired.
Any company that setup a IPv6 only service is cutting off so much of their potential customer base that they will fail.
Any ISP who starts offering IPv6 only service to clients (without some sort of proxy/NAT to give users to the IPv4 Internet is cuttong off so much useful content that they will fail.
now, there are people who desperately want IPv6,
It seems to mostly be because they think it will return the Internet to the mythical days when it was 'pure', with no firewalls or NAT devices interfering with whatever individual users want to do. If those days really existed they were in the times of a handful of massively multiuser machines where what you could do was greatly limited by the sysadmin team (not to mention resource limitations), and most of the surviving protocols that were invented in those days of 'freedom' are considered horrible today (think FTP for example)
Now, conditions may change in the future faster than I am expecting, getting to the point where IPv6 really does matter, but I would be surprised if it was in the next decade, and frankly I would not be surprised to find that we will be dealing with the '2038 bug' before we really find that IPv6 becomes a mandatory thing and IPv4 gets consigned to the dust-bowl of history.
Ipv6 is getting some traction in niche cases, but before these isolated islands can talk to anything that matters, they are either hitting dual-stack servers that they could hit with IPv4 or going though some sort of NAT/Proxy to convert the traffic to IPv4.
I also think that the IPv6 advocates are taking the wrong tack on getting IPv6 deployed. Instead of being deathly opposed to carrier-grade NAT and NAT64, they should be embracing them. If these were widely rolled out so that someone could have a IPv6-only client talk to an IPv4-only server without the user needing to care about anything, then you would have ISP's starting to deploy IPv6 instead of the RFC private addresses to 'low value' DHCP clients, with the NAT boxes acting as the interface between these bubbles and the Internet. Over time these bubbles would grow and the NAT boxes would gradually move from the edge of the client networks to the edge of the server networks. At that point, companies hosting services would fact the choice between maintaining these NAT devices or converting their systems to IPv6. A lot of them will continue to run the NAT devices (just like a lot of companies continue to run mainframe systems today)
but too many IPv6 'advocates' poison the well by attacking anyone who isn't 'pure enough', and IPv6 continues to be just a geed cred checkbox instead of something that produces value to the people who have to pay for deploying it.
Yes, the above post is deliberately provocative and harsh, but so is the attitude that attacks anyone who dares to talk about IPv6 without having invested all the effort to implement it.
2013 IPv6 Summit Posted Mar 27, 2013 9:31 UTC (Wed) by gerdesj (subscriber, #5446) [Link]
Thank you both jake and dlang for your replies. You both mention great reasons for not supporting IPv6 yet.
As I recall, I've used them all myself at one time or another in many situations as I'm sure you have (I don't know you per se but I have hung around here for quite some time) - not just for IPv6 but 10GBE and GBE, 100MB, and ethernet itself amongst others.
> Other than as a checkbox for geek cred, why should any website care about IPv6 at this point in time?
Given that this is LWN I would have thought that question answers itself or are we all getting too old for this stuff? Compared to the content in some of the kernel articles recently, IPv6 should be a doddle to whip up. It's now the default in most systems more complicated than a fridge and with a radvd or similar lying around, trivial to implement.
Cheers
2013 IPv6 Summit Posted Mar 27, 2013 17:48 UTC (Wed) by dlang (✭ supporter ✭, #313) [Link]
running IPv6 on an individual box with the default apps the distro provices is trivial.
Getting good (reliable, fast) IPv6 connectivity to the Internet is not.
Making sure that IPv6 is as secured as IPv4 is not.
Reviewing old application code to make sure that all connections are done with IPv6 safe routines is not.
For a business, where is the ROI?
now, in the case of LWN, geek cred and testing new stuff is part of what they do, so yes, they have far more reason than most to implement IPv6.
But those same drivers that push them to do IPv6 are pushing them to release the source that drives the site, and that is a project they have not been able to get done for a lot longer than IPv6 has been a possible issue.
2013 IPv6 Summit Posted Mar 28, 2013 1:35 UTC (Thu) by gerdesj (subscriber, #5446) [Link]
>running IPv6 on an individual box with the default apps the distro provices is trivial.
Yes
>Getting good (reliable, fast) IPv6 connectivity to the Internet is not.
Why not? I live in a rural county called Somerset in the UK, My town has a population of ~40,000. We do not have the best of anything internet related. Yet despite that _for my home connection_ I have my own two DNS servers and IPv6. Yes, I have had to pick my ISP and I am a nerd. Do this:
$dig pf1.roseandjon.gerdes.co.uk AAAA
(I reserve the right to remind you that my locality is pretty rural)
>Making sure that IPv6 is as secured as IPv4 is not. It's IP! Doh! You have to add rules to your router that look at IPv6 - yes it's a pain having two rule sets.
>Reviewing old application code to make sure that all connections are done with IPv6 safe routines is not. For a business, where is the ROI?
OK - I'm a crap programmer but I am an MD of an IT consultancy and the ROI for me is rather different than what your question supposes ...
>now, in the case of LWN, geek cred and testing new stuff is part of what they do, so yes, they have far more reason than most to implement IPv6. But those same drivers that push them to do IPv6 are pushing them to release the source that drives the site, and that is a project they have not been able to get done for a lot longer than IPv6 has been a possible issue.
I can't directly influence the phenomenal resource that LWN is or how they govern themselves but I can be a loud pest!
I regularly read articles in LWN that are (to me) mind bendingly complicated. I love it. The last application I developed used VB6 and ActiveX to query a 300,000 object Novell eDirectory thingie to manage groups - not exactly kool kid stuff.
I am a 42 year old nerd and I personally perceive a fair few tech websites who trot out the same old IPv6 news items and yet they don't themselves provide access over IPv6. It really isn't rocket science, you just have to care.
I only whinge about a lack of IPv6 on tech sites - we are nerds for goodness sake - start acting like one.
Cheers
2013 IPv6 Summit Posted Mar 28, 2013 1:59 UTC (Thu) by gerdesj (subscriber, #5446) [Link]
Just in case I sounded a bit hysterical in the above post. The world isn't about to die due to IP address exhaustion (for me anyway)
I have a /29 IPv4 range at home. My office has a /27 and several /29s. My "cloud" data centre allocation is a /26 and I can have several more and I have access to a /23 PI - must get around to using it.
All of those pale in comparison with my IPv6 allocations and that is the point - with IPv6 I have literally billions of addresses to play with.
Grow a nerdy pair and do the IPv6 thing
2013 IPv6 Summit Posted Mar 28, 2013 3:18 UTC (Thu) by raven667 (subscriber, #5198) [Link]
I agree about just getting on with provisioning IPv6. Providers generally all have large IPv6 allocations and are running IPv6 throughout their core, they just aren't putting the work into enabling it on their consumer edge equipment even though it is generally capable.
2013 IPv6 Summit Posted Mar 28, 2013 3:32 UTC (Thu) by apmon (guest, #90098) [Link]
I think you are rather mistaken in calling IPv6 "just a checkbox for geek cred". IPv6 very much matters to end users and it matters now!
In Germany several large ISPs are moving over to DS-lite, Unitymedia in particular, as they are experiencing the exhaustion of IPv4 and no longer have enough IPv4s to supply all of their customers.
Therefore many customers no longer have native IPv4 and all IPv4 traffic is going through tunnels and CGN. This has caused many issues for every day users, be it added latency and severe speed issues due to going through tunnels and faulty MTU settings due to tunneling. But most importantly the loss of public IPv4 to the customer premises equipment and thus the unreachability from the outside has caused much havoc and led to bitterly complaints of many users as they can no longer use their internet connection as they used to.
Without public IP, you can no longer do remote desktop, you can no longer play many games as port forwarding doesn't work any more, you can not ssh into your home server, you can not access data on your home computers, you can not host servers, you can't do peer to peer communication and many other things stop working without public IPs as well.
Another large German ISP, Kabeldeutschland, seems to have postponed or slowed down its introduction of DS-lite, as there was too big a backlash for the loss of public IP. However, as there aren't going to magically suddenly appear many more public IPv4 addresses, they can only postpone for a little while.
The only option to retain public IP connectivity to the customer premises is to move to IPv6 and this move has to happen now! The only reason all of these customers even need to learn about IPv4 and IPv6, is because too many ISPs, tech companies and website operators were to short sighted and selfish to introduce IPv6 in time. Otherwise these issues and pains would have been entirely non existent.
Therefore to see that a commentator on a geek site like LWN takes such an attitude is really sad! If even open source geeks take such a fatalistic approach, then perhaps the future of a decentralised internet is truly doomed. But I do hope that the pressure from every day customers due their loss of public IP will finally force the ISPs and software developers to adopt IPv6.
I do not know what the situation is like in other countries, particularly in Asia, but given that in Europe severe issues are occuring so soon after RIPE has run out of IPv4s, I can only imagine what the situation must be like in Asia. But perhaps CGNs are so prevelant there already, that people have forgotten or never had the opportunity to experience the possibilities of a truly decentralised peer to peer internet.
But to say that IPv6 does not matter is simply false. It is also totally false to claim that there are zero users who have IPv6 only connections. Although it might be true in the outgoing direction, it isn't true on the incoming direction and too many people seem to forget that it needs two sides to communicate.
2013 IPv6 Summit Posted Mar 28, 2013 8:51 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]
> Without public IP, you can no longer do remote desktop, you can no longer play many games as port forwarding doesn't work any more, you can not ssh into your home server, you can not access data on your home computers, you can not host servers, you can't do peer to peer communication and many other things stop working without public IPs as well.
I'll point out that with most ISPs (at least in the US), these things are almost all prohibited by the terms of service of the ISP (and people do have their connections terminated if the ISP catches them doing them) and actively blocked by their firewalls.
So for a very larger percentage of users, the predicted dire consequences of not moving to IPv6 don't look noticeably different than their current connection.
Yes, for some people, these sorts of issues are important, but those people already have to carefully pick their ISP (and/or pay substantially more to get a 'business' connection)
But the argument that a company should spend resources adding IPv6 support to make it easier for people in some other country to be able to play games, or run their own server somehow doesn't seem to gain much traction with business people looking for the best return on their investment.
Here's an unpleasant truth. Every business has lots of things that they want to do, and of those there are a lot of thing that they know they really _should_ do. But they have a limited amount of manpower and as a result there are usually a long list of things that they want to do that they know will produce very direct benefits for the company. Things like IPv6 that they should do, but that won't result in anymore benefits to the business drop way down the list as a result.
> traffic is going through tunnels and CGN. This has caused many issues for every day users, be it added latency and severe speed issues due to going through tunnels.
for many ISPs, the only way to get IPv6 is to go through tunnels. This works, but as you say it has drawbacks.
The statement from another commenter
> Grow a nerdy pair and do the IPv6 thing
is really confirming what I was saying: implementing IPv6 server side is more about geek cred then any benefit to the organization. For some organizations this is enough. My guess is that for LWN it's on their to-do list somewhere around the source release, but since it's probably easier to do, it may get done sooner.
Also, in case anyone is confused, I in no way represent LWN.net. My comments here are just my opinion.
back around 2000 or so, I remember commenting to someone at work that I thought we had just a couple years of cleanups to do and then migrate to IPv6 and the network would be effectively 'done', which just proves how much I didn't know at the time :-)
I will also predict that as IPv6 adoption grows, we are going to have at least one widespread security incident (as in, one that affects lots of different sites/home users) that uses IPv6 to bypass protections that are in place on IPv4, and this will cause IPv6 to be blanket blocked for a while to 'protect' people.
'business class' ?!? Posted Mar 30, 2013 22:44 UTC (Sat) by filteredperception (guest, #5692) [Link]
>> Without public IP, you can no longer do remote desktop, you can no longer play many games as port forwarding doesn't work any more, you can not ssh into your home server, you can not access data on your home computers, you can not host servers, you can't do peer to peer communication and many other things stop working without public IPs as well.
> I'll point out that with most ISPs (at least in the US), these things are almost all prohibited by the terms of service of the ISP (and people do have their connections terminated if the ISP catches them doing them) and actively blocked by their firewalls.
> So for a very larger percentage of users, the predicted dire consequences of not moving to IPv6 don't look noticeably different than their current connection.
> Yes, for some people, these sorts of issues are important, but those people already have to carefully pick their ISP (and/or pay substantially more to get a 'business' connection)
Obligatory zealot comment- here is a link to my 53 page manifesto on the issue that I've had bounce between the FCC (initial <1000 character 2000F complaint) and the Kansas Attorney General. It is currently under some 'Enforcement review' procedural step at the FCC. I've yet to get the FCC or Google to offer a single sentence or two of explanation as to why my interpretation of Network Neutrality here is wrong. Namely I believe that such aforementioned terms of service blocking home servers are an instance of violation of the 'blocking' network neutrality rule. Likewise, I loathe this concept of 'business class' users as much as I loathe differentiated pricing based on geographic region for DVDs, or, no doubt throughout human history, things like sex, skin color, and religious affiliation. Digressing- how is a residential home user using a VPN to work for their employer, and the Google Ads network to exchange their visual attention for the utility of access to advanced computing services delivered over the internet, not engaging in 'business'. I think the real bottom line is that the terms of service barring home servers are really just a convenient way for the establishment to thwart competing services based on home servers. I.e. that 'pure' vision of the internet with everyone with their own effectively free dns domain, non-scarce IP addresses, and email servers secured and simplified through natural FOSS evolution. Instead of the masses glomming onto things like gmail, that use the content of their messages to psychologically manipulate them into buying more of the products sold by google's advertising clients. Bah... get off my lawn- (FCC complaint ref#12-C000422224 http://cloudsession.com/dawg/downloads/misc/kag-draft-2k1...)
2013 IPv6 Summit Posted Apr 1, 2013 18:08 UTC (Mon) by intgr (subscriber, #39733) [Link]
First off, you have a very good point -- people designing standards for global future deployment should think harder about providing incentives for businesses to adopt and deploy given protocol. If ISPs could cut costs by turning on IPv6 and disabling IPv4, the situation would be better by now.
But IPv6 was designed 15 years ago and that revision is not going to happen now. We need to accept IPv6 for what it is.
> From a business point of view, working on IPv6 means spending resources with no payback expected before the systems that are implemented are probably going to be retired.
That's exactly the problem "gerdesj" is solving. There is no direct benefit for most websites, so the main forces are from enthusiastic employees and users. Users should let webmasters know that they care about IPv6 support. Yes it's a geek thing, but this is a geek website.
Your reaction comes off as to suggest that it's somehow bad for *paying customers* to submit feature requests.
> Instead of being deathly opposed to carrier-grade NAT and NAT64, they should be embracing them.
No. One of the largest advantages of IPv6 is restoring end-to-end connectivity on the Internet. The very principle that was destroyed by NAT and the scarcity of IPv4 addresses.
> Ipv6 is getting some traction in niche cases
Niche cases like Google, Facebook, Wikipedia, Yahoo, Akamai and others. Despite how pointless you claim that supporting IPv6 is, nearly all software packages and many of the largest websites already support IPv6. I'm glad there are companies that understand the that developing and deploying new standards has benefits for the whole industry -- not just their own bottom line. And I too find it ironic that LWN is not one of them.
Sadly consumer ISPs are the biggest outliers and they have the worst perverse incentives in this area -- they lose business from IPv4 netblock sales (eventually), they have to purchase customer equipment and ofter bear the support costs.
2013 IPv6 Summit Posted Apr 1, 2013 18:48 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]
> Your reaction comes off as to suggest that it's somehow bad for *paying customers* to submit feature requests.
No, I am not at all opposed to anyone submitting requests.
I am opposed to people who attack others for not having IPv6 support.
>> Instead of being deathly opposed to carrier-grade NAT and NAT64, they should be embracing them.
> No. One of the largest advantages of IPv6 is restoring end-to-end connectivity on the Internet. The very principle that was destroyed by NAT and the scarcity of IPv4 addresses.
If everyone has IPv6, then I expect carrier grade NAT to die off, it's expensive, creates network bottlenecks, and increases troubleshooting compared to a native IPv6 everywhere network.
But the rest of my argument (that you trimmed) is about how CGN with NAT64 makes a wonderful transition tool that would allow some people to create IPv6 only bubbles that can still interact with the existing IPv4 Internet, those bubbles can then grow and merge until the only places running IPv4 are datacenters (at which point, running their systems on IPv4 and having a CGN running NAT64 is a clear cost to the people running the servers, and they have a real incentive to convert)
>> Ipv6 is getting some traction in niche cases
> Niche cases like Google, Facebook, Wikipedia, Yahoo, Akamai and others...
Packages support IPv6 most of the time (it's seldom something that's well tested), and mostly they support it because the libraries have changed to support it under the applications.
I still feel that IPv6 on the server side is more about Geek Cred than any real benefit (and if you look at the big names that are supporting it, they are almost all technology companies, for who Geek Cred matters. They have a business need to be seen to be doing innovative, new things).
2013 IPv6 Summit Posted Apr 1, 2013 22:10 UTC (Mon) by raven667 (subscriber, #5198) [Link]
> If everyone has IPv6, then I expect carrier grade NAT to die off, it's expensive, creates network bottlenecks, and increases troubleshooting compared to a native IPv6 everywhere network.
I don't see this happening in the foreseeable future (10-20 years), what I see is dual-stack lite where everyone has an RFC1918 private IPv4 address and a real routable IPv6 address with providers maintaining CGNs indefinitely to deal with a long-tail of services which never convert over. There will be a short time where most of the traffic will go through the CGNs which will taper off as more devicess get native IPv6 to offload the traffic, but never quite reach zero. At this point though it's too late to have a network without permanent CGNs, IPv4 was allowed to get too big to allow it to fade quietly into the night, maybe in our lifetime IPv4 will be disabled, we can hope at least.
I don't see the point of NAT64 though, it dosen't seem to have any advantages over dual-stack and CGN and seems to require more infrastructure and introduce more flakiness (proxying DNS). Having IPv6-only edge infrastructure seems to be more of a geek-cred thing than a practical benefit.
2013 IPv6 Summit Posted Apr 1, 2013 23:30 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]
> I don't see the point of NAT64 though, it dosen't seem to have any advantages over dual-stack and CGN and seems to require more infrastructure and introduce more flakiness (proxying DNS). Having IPv6-only edge infrastructure seems to be more of a geek-cred thing than a practical benefit.
Until you can run a IPv6 only system and get real use out of it, everyone is going to need to continue to run, and be subject to the limitations of IPv4
As a result, I see NAT64 as being the tool that has the potential to break the IPv4 lock-in by allowing IPv6 only devices to communicate with the real-world
Waiting for all servers to switch to IPv6 before you get clients to fix is even worse than trying to kill off Internet Explorer 6
2013 IPv6 Summit Posted Apr 2, 2013 14:08 UTC (Tue) by raven667 (subscriber, #5198) [Link]
But why bother being IPv6-only? You are going to require a middle box to translate traffic no matter what is done and that middle box is probably going to be doing NAT, in the case of NAT64 you have to do DNS proxying and IPv6-IPv4 translation as well which is even more infrastructure, why not just route to the CGN you have to maintain in both scenarios?
Are you seeing something that I'm missing here?
2013 IPv6 Summit Posted Apr 2, 2013 16:37 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link]
Being IPv6 only allows for easier internal network structure for companies, in particular.
2013 IPv6 Summit Posted Apr 2, 2013 21:18 UTC (Tue) by dlang (✭ supporter ✭, #313) [Link]
The network is simpler if it's IPv6 only internally to one CGN box that does NAT64 than if you have to maintain dual-stack on all systems and devices, partitioning your IPv4 networks to be able to re-use addresses (and dealing the with NAT between these partitons.
This isn't true for everyone obviously, but for something like a cell phone company that does need to deal with millions of devices, being able to go to a flat IPv6 network instead of multiple 10. networks being re-used around the country/globe is a fairly significant win.
2013 IPv6 Summit Posted Apr 1, 2013 19:16 UTC (Mon) by foom (subscriber, #14868) [Link]
Unfortunately, end-to-end connectivity isn't going to come back with IPv6. Each endpoint can have a unique address, but there's still going to be a firewall in front of the endpoints allowing only "outgoing" connections, in almost all the same cases NAT is in the way today.
2013 IPv6 Summit Posted Apr 1, 2013 21:50 UTC (Mon) by raven667 (subscriber, #5198) [Link]
It's much easier to allow incoming connections for services you want to run when each internal host has its own globally unique address and/or to stop enforcing policy on the router/switch at all. The world which spawned network packet filters was one where the hosts had no effective network security controls, now full feature packet filters are ubiquitous on edge hosts, edge host packet filters also have more knowledge about the application using the network than network packet filters. The main advantage of the central firewall service is centralized policy control but any kind of automated configuration management system like puppet or Active Directory Group Policies can accomplish this. There are certainly some outliers, systems which for whatever reason choose not to implement effective policy controls even though they are available on any host which can do IPv6, but those can be handled as the exceptions that they are.
2013 IPv6 Summit Posted Apr 1, 2013 23:14 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]
every organization that has attempted to throw away their firewalls and live only by configuration on each individual host has been hacked.
In theory you are correct, you could administer rules on everything and be secure.
In practice, it just doesn't work well enough
"In Theory, Theory and Practice are the same. In Practice they are different."
2013 IPv6 Summit Posted Apr 1, 2013 23:34 UTC (Mon) by intgr (subscriber, #39733) [Link]
I think you are mistaken. Consumer IPv6 routers should and probably will come with a restrictive firewall by default, I agree. But all current routers provide a way to configure port forwards, many also support a "wildcard" forward where all unused public ports are forwarded to a local IP address (with an appropriate security warning). They stop there because they're limited to 1 IP address, not because they're mean.
I'm pretty sure that once IPv6 becomes prevalent, consumer routers will have means to unblock certain ports on hosts or all connectivity for certain hosts -- equivalent to port and wildcard forwards, but potentially with improved user experience and less tampering.
And even if restrictive firewalls are enforced upon customers, we still will have killed NAT, which is the stumbling stone for many current TCP extension proposals such as ECN. It also has benefits because IP routing is stateless -- BitTorrent won't fill the router's NAT table and your TCP sessions can survive router reboots.
2013 IPv6 Summit Posted Apr 1, 2013 23:42 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]
I expect it to be possible, but I don't expect any significant number of users to actually make such changes.
And the idea that the systems on the inside can automate the opening of firewall holes without involving a user or admin is an attacker's dream.
2013 IPv6 Summit Posted Apr 1, 2013 23:47 UTC (Mon) by intgr (subscriber, #39733) [Link]
> the idea that the systems on the inside can automate the opening of firewall holes without involving a user or admin is an attacker's dream
Funny you should mention that. You just described UPnP port mapping, which is enabled by default on many (most?) consumer routers.
2013 IPv6 Summit Posted Apr 1, 2013 23:51 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]
Yep, and as it gets more widespread, I expect to see it used for a lot more attacks, and then the recommendation will be to turn it off and it won't be on by default on new devices.
2013 IPv6 Summit Posted Apr 2, 2013 0:02 UTC (Tue) by mjg59 (subscriber, #23239) [Link]
"As it gets more widespread"? It's pretty much ubiquitous.
2013 IPv6 Summit Posted Apr 2, 2013 13:54 UTC (Tue) by raven667 (subscriber, #5198) [Link]
It is ubiquitous and has been for many many years but it is also doesn't have a real security impact. If an attacker controls a machine behind your UPnP device they can already make any arbitrary outbound connection and use that for bidirectional communication, the only thing that UPnP gets you is the ability to use a richer set of protocols such as active FTP or BitTorrent or VoIP or gaming without involving a middle server to tunnel the traffic.
A UPnP extension to open direct IPv6 connectivity might be a pretty good thing for making consumer firewalls totally transparent to the end user. The protocol already exists and is supported by applications, this might be a path of least resistance.
2013 IPv6 Summit Posted Apr 2, 2013 17:03 UTC (Tue) by nybble41 (subscriber, #55106) [Link]
Yes, but what does UPnP get you over simply not listening for incoming connections on the local machine? If the same program which opens the port also arranges to allow incoming connections through the firewall, I don't see any advantage over simply allowing all incoming connections through (after some basic protocol checks, e.g. filtering out traffic from internal and reserved IP addresses). It the local machine is permitted to determine the firewall policy; you might as well let it enforce the policy as well.
2013 IPv6 Summit Posted Apr 2, 2013 17:27 UTC (Tue) by andresfreund (subscriber, #69562) [Link]
Most NAT boxes have more than one machine on the private side. And the individual machines might not always get the same local IP.
2013 IPv6 Summit Posted Apr 2, 2013 18:09 UTC (Tue) by bjencks (subscriber, #80303) [Link]
Mostly as a defense against dumb machines that didn't bother to include any firewall or even source address checking in the application layer.
For example, I might not want to trust that my brand new Internet Toaster has appropriate security policies and non-buggy code, but it seems much more likely that it won't actively open inappropriate ports on an external firewall.
(I personally leave my home IPv6 connection wide open and just check for open ports on everything, but that's not necessarily the best solution for everyone)
2013 IPv6 Summit Posted Apr 2, 2013 20:16 UTC (Tue) by raven667 (subscriber, #5198) [Link]
You are right of course, devices which are smart enough to implement UPnP generally also come with perfectly adequate local packet filters. For an IPv4 NAT device you still need to signal to create the individual port-forwards but in an IPv6 device you can probably get away with enabling a blanket allow rule without further interference from the router. Just set the "I know what I'm doing" bit in the UPnP request 8-) That still protects devices which are too featureless to implement the required protocols, or at least requires positive action on the part of the device.
2013 IPv6 Summit Posted Apr 2, 2013 13:47 UTC (Tue) by raven667 (subscriber, #5198) [Link]
One way to ensure that the desired outcome happens is to make sure that OpenWRT and related projects work that way to demonstrate to vendors what a model consumer router looks like. Either they can distribute OpenWRT directly (like Buffalo), users can install it on their devices or the vendors can just incorporate the network config and not have to think about those details for themselves.
|
|||||||||||||||||||