I spent a week without IPv4 (2023) (apalrd.net)
137 points by mahirsaid 14 hours ago
jrmg 12 hours ago
I’m surprised home many technically knowledgeable people on Internet forums still think IPv6 is some niche, unreliable thing.
In my direct experience, in the USA, at least Spectrum, AT&T, and Xfinity (Comcast) still run IPv4, of course, but they also have IPv6 working and on by default on their home internet offerings.
All mainstream computer and mobile OSes support it by default and will prefer to connect with it over IPv4.
‘Everyone’ in many areas is using it. For many of us, our parents are using Facebook and watching Netflix over it. Over 50% of Google’s American traffic is over it. It just works.
m463 4 minutes ago
I use ipv4 on my internal lan, and turn off ipv6
It is well supported, easy to configure, private, secure.
...and I don't have to configure and secure ipv6 in parallel
nine_k 7 hours ago
T-Mobile, a major phone provider, runs an ISP which is IPv6 only. That is, your phone never gets an IPv4, unless connected to WiFi. They offer home access points with a 5G modem and a router; the external address is also IPv6 only.
It works plenty well. I access everything accessible via IPv6, and the rest through their 464XLAT, transparently.
My LAN still has IPv4, because some ancient network printers don't know IPv6. OpenWRT on my router supports IPv6 just fine. Of course I do not expose any of my home devices to the public internet, except via Wireguard.
themafia 4 hours ago
Ironically there's T-Mobile Business which is static IPv4 only.
nine_k 2 hours ago
LeoPanthera 11 hours ago
My problem with IPv6 is that my ISP (Xfinity) won't give me a static prefix, so every now and again it changes.
Unlike IPv4, my LAN addresses include the prefix, so every time they change it, all my LAN addresses change.
Combined with the lack of DHCP6 support in many devices, this means reverse DNS lookups from IP to hostname can't be done, making identifying devices by their IP essentially impossible.
db48x 10 hours ago
I think you’re conflating multiple things there. There’s nothing magical about IPv4 that gives your LAN addresses stability when your ISP changes your IP prefix. That’s provided by your router doing network address translation. You send a packet from your address which is 192.168.0.42 (a local address), and your router changes the bytes in the packet so that it comes from X.Y.Z.W (your router’s public address). If you really wanted it to your router could do the same thing for IPv6.
IPv6 also has local addresses, but a lot more of them. Anything starting with fd00::/8 is a local address with 40 bits available as the network number. So you can set up your local network with the prefix fdXX:XXXX:XXXX::/48 (where the Xs are chosen randomly) as the prefix and still have 16 bits left over for different subnets if you want. These addresses do not change when your ISP changes your public prefix.
And if you want to add reverse dns for SLAAC addresses then just have your router listen for ICMPv6 Neighbor Announcement addresses and use them to update your DNS server as appropriate. Or configure your servers to use stable addresses based on their MAC address rather than random addresses (which are better for privacy), and then just configure the DNS as you add and remove servers.
littlecranky67 9 hours ago
baq 10 hours ago
you should advertise a local prefix (anything in fd00::/8) in your network and it should just work. no need to use the isp-provided prefix for lan.
silb an hour ago
justaboutanyone 10 hours ago
hdgvhicv 11 hours ago
My ISP will route as many /64s to me as I want (I think I get a /48 by default, I guess if I want more than 64k subnets I’d have to justify it)
So I don’t have the changing ip issue. I do however have an issue if I want to change ISP as it’s a whole mess of rules to update rather than a couple of dns entries and two dst nat rule (one per public IP)
I believe the idea in v6 if you have multiple prefixes on the same network - including a local fc00::/7 one for local services. Layers and layers of things to break.
ebiederm 8 hours ago
karlshea 7 hours ago
Use a ULA (unique local address) for everything internal that you want shorter. It's just like rfc1918 addresses except you don't need NAT.
bcoates 8 hours ago
Is reverse dns even a thing outside of irc and forgetting to give command line tools the "don’t be slow" flag?
esseph 7 hours ago
Sleaker 7 hours ago
Well.. that's because with ipv6 you're not technically on a lan everything is exposed by default unless you set it all up differently.
ekr____ 11 hours ago
Well, for some value of "just works".
For example, I recently attended the IETF meeting in Montreal, which offers a by default v6-only network. My Mac worked fine, but my son's school-issued Chromebook had glitchy behavior until I switched to the network that provided v4.
phito 12 hours ago
Myeah... I've had weird issues on my network that I could only resolve by disabling IPv6. Granted, it's probably my fault, but if everything still works fine with ipv4 that's fine to me. One day I will get into it and learn how it work and maybe I'll get it figured out... One day...
hdgvhicv 11 hours ago
Corporate laptop won’t work (their version of windows seems to require an ipv4 adddess on an interface, not sure if that’s a windows thing or a them thing)
Doesn’t remove the need for nat - my wired IsP might be able to bgp with me, but my backup 5g won’t, and when I want to choose which to send my traffic through with PBR that means natting.
My router doesn’t support 64, so I have to use my isp’s which is speed constrained compared with native 4. Ok that’s on my setup. Haven’t tested my 5g provider and where 64 occurs, I’d hope in their network, but how do I configure my dns64.
Still need to provide v4 at the edge and thus 46 nat so I can reach internal v6 only servers from v4 only locations
Perhaps lost of that is because my router doesn’t do 64, but again that just shows that v4 is still essential. I haven’t found a single service that’s v6 only, so if I have to run a v4 network (even if only as far as a 64 natting device) why bother running two networks, double the opportunity for misconfiguration and thus security holes. Enabling dual v6 on my IoShit network would allow more escape routes for bad traffic, meaning another set of firewall rules to manage. Things like SLACC make it harder to work out what devices are on the network, many end user devices are user hostile now and keeping control of them on v4 alone is less work than in v4 and v6.
labcomputer 11 hours ago
> Doesn’t remove the need for nat - my wired IsP might be able to bgp with me, but my backup 5g won’t, and when I want to choose which to send my traffic through with PBR that means natting.
Yes, it does. You just have each of your routers (wired and 5G) advertise the /64 prefix delegated by each of your ISPs. Your hosts will self-assign a v6 address from each prefix.
To control which link the traffic uses, you just assign router priority in the router advertisement (these are all standard settings in radvd.conf).
> Things like SLACC make it harder to work out what devices are on the network
Again, not true. If you really don’t trust your devices, then DHCP isn’t going to save you. Malicious hosts absolutely can self assign an unused v4 address, and you’ll be none the wiser if you just look at your DHCP leases.
toast0 8 hours ago
bblb 2 hours ago
>their version of windows seems to require an ipv4 adddess on an interface
Could be DirectAccess. Microsoft's earlier built-in VPN solution before Always On VPN. DirectAccess works only with IPv4 inbound so you can't use IPv6 only stack. Under the hood it uses a combination of v4-v6 transition and translation protocols, but it still requires the Windows client machines to have IPv4 addresses.
If you can run PowerShell commands on the laptop and if "Get-DnsClientNrptPolicy" returns some DirectAccessDnsServers then it's DA laptop.
mightyham 11 hours ago
For consumer traffic, your probably right. In data centers, cloud computing, and various enterprise networking solutions, IPv4 is still king. I'm sure IPv6 would work fine in all these use cases, but as long as many large tech companies are not exhausting the CIDR ranges they own (or can opt for using private ranges) there is no impetus to rework existing network infrastructure.
betaby 9 hours ago
> cloud computing
Nope. Large scale DCs are IPv6 only underneath, exascalers like Google and Meta have stated that multiple times. I.e. https://www.youtube.com/watch?v=Q3ird3UDnOA also see various NANOG talks https://www.youtube.com/@TeamNANOG/videos
kortilla 7 minutes ago
umanwizard 2 hours ago
immibis 8 hours ago
opan 11 hours ago
I had working IPv6 in the past, but currently I seem to have no working IPv6. Using Xfinity. I have access to some servers at a friend's place in another city, pretty sure he also doesn't have IPv6. Maybe some phone calls would sort it out, but when "everything" still works (with IPv4), it's hard to care.
bigstrat2003 11 hours ago
That is really bizarre, because I have Comcast and I find their IPv6 support excellent. The only complaints I have are that I wish you could get bigger than a /60 prefix (a /56 would be nice), and that I wish it was feasible to get a static prefix as a residential customer. Granted you said you don't really care to fix it, but if that ever changes I do think you could get them to fix it pretty easily. IPv6 is one of the things they generally do right.
oarsinsync 11 hours ago
pyuser583 2 hours ago
It’s still a pain to manage ipv6 AWS infrastructure via Terraform.
ekr____ 11 hours ago
Well, for some value of "just works".
For example, I recently attended the IETF meeting in Montreal--practically the epicenter of v6 thinking--which offers a by default v6-only network. My Mac worked fine, but my son's school-issued Chromebook had glitchy behavior until I switched to the network that provided v4.
6r17 9 hours ago
I'm "niche" - but i had issues with Wireguard being able to connect me through ipv6 to a v4 - other than that i spent most of my time on v6 and as you said it just works
cornonthecobra 9 hours ago
CenturyLink, an ILEC, only offers IPv6 using 6rd gateways. The IPv6 throughput is a fraction of IPv4 and has much higher latency. During peak times, the 6rd gateway saturates, forcing me to stop advertising the prefix to restore internet access. It has been this way for years.
It is also impossible to report IPv6-specific outages. CenturyLink technical support is the worst of the worst, with agents utterly incapable of doing more than pushing a "check ONT" button on their end and scheduling a technician visit with a multiday window. If you ask them for the 6rd configuration information, they act like you're speaking an alien language.
Even among their technicians, IPv6 knowledge is rare. Imagine the guy installing hundreds of dollars of gigabit fibre equipment at your demarc staring you like an idiot because you spoke two extra syllables between "IP" and "address". I'd think the term "IPv6" is chatbot poison if it weren't for the fact it's a human physically in front of me.
The result is their service is effectively IPv4-only.
toast0 8 hours ago
I had CenturyLink CPE that would crash when a fragmented IPv6 transitted it. That was fun :P. They're also all in on PPPoE and at least on my VDSL2 line, didn't enable RFC 4638 (baby jumbos) to get back to MTU 1500. Pretty happy to be on muni fiber now (although the installation cost was huge).
cornonthecobra 7 hours ago
kstrauser 5 hours ago
Ah, good ol’ CenturyLink: “We put the TTY in TTY.” Be happy it’s not IPv4 over telegraph.
anonym29 4 hours ago
Not all of the skepticism is "does IPv6 work", some of it is "why should I want it as an end user who values privacy and minimal attack surface?"
From my perspective:
• CGNAT is a feature, not a bug. I'm already deliberately behind a commercial VPN exit node shared with thousands of others. Anonymity-by-crowd is the point. IPv6 giving me a globally unique, stable-ish address is a regression.
• NAT + default-deny inbound is simple, effective security. Yes, "NAT isn't a firewall", but a NAT gateway with no port forwards means unsolicited inbound packets don't reach my devices. That's a concrete property I get for free.
• IPv6 adds configuration surface I don't want. Privacy extensions, temporary addresses, RA flags, NDP, DHCPv6 vs SLAAC — these are problems I don't have with IPv4. More features means more things to audit, understand, and misconfigure.
• I already solved "reaching my own stuff" without global addressing. Tailscale/Headscale gives me authenticated, encrypted, NAT-traversing connectivity. It's better than being globally routable.
So yes, my parents are using IPv6 to watch Netflix. They're also not thinking about their threat model. I am, and IPv4-only behind CGNAT + overlay networking serves it well.
"It just works" isn't the bar for me to adopt IPv6. "It serves my goals better than IPv4" is the bar, and IPv6 doesn't meet it. Never has, never will.
IPv6 wasn't designed as "IPv4 with more bits." It was designed as a reimagining of how networks should work: global addressability as a first-class property, stateless autoconfiguration, the assumption that endpoints should be reachable. That philosophy is baked in. For someone like me, whose threat model treats obscurity, indirection, and minimal feature surface as assets, IPv6 isn't just unnecessary, it's ideologically opposed to what I want.
Want me to adopt a new addressing scheme? Give me a new addressing scheme, don't impose an opinionated routing philosophy on me.
paulddraper 11 hours ago
> It just works.
Until you want to like, use GitHub.
notKilgoreTrout 11 hours ago
There is a clean bifurcation between just works and Microsoft compatible.
mahirsaid 3 hours ago
paulddraper 9 hours ago
esseph 7 hours ago
Yes the largest companies have the most resources. Makes sense.
Most do not.
There are far more single person, small, and mid sized companies that do not.
This includes b2b, regional ISPs, etc.
mightyham 10 hours ago
> Peer-to-peer communications such as gaming usually have to deal with NAT traversal, but with IPv6 this is no longer an issue, especially for multiple gamers using the same connection
You know the list of "benefits" is thin when the second item is entirely theoretical. Even though IPv6 doesn't have to do NAT traversal, it still has to punch through your router's firewall which is effectively the same problem. Most ISP provided home routers simply block all incoming IPv6 traffic unless there is outbound traffic first, and provide little to no support for custom IPv6 rules.
Even if that were not an issue, my bet is that there are close to zero popular games that actually use true peer to peer networking.
justaboutanyone 9 hours ago
Punching through just a firewall is much easier than punching through a typical NAT+firewall setup
themafia 4 hours ago
> it still has to punch through your router's firewall
That's why most routers use a stateful firewall. Then nothing has to "punch through" it just has to be established from the local side.
> block all incoming IPv6 traffic unless there is outbound traffic first, and provide little to no support for custom IPv6 rules.
This is why STUN exists.
> my bet is that there are close to zero popular games that actually use true peer to peer networking.
For game state? You're probably right. For low latency voice chat? It's more common than you'd think.
ruszki an hour ago
The complication starts when such an ephemeral port gets connection from somewhere else, which is the crucial part not the creation of such ports. That is not supported necessarily by firewalls, or not that simple than just having a stateful firewall.
brigade 10 hours ago
Getting a streamer’s IP attracts DDoSes and doxxing, so yeah it’s generally considered a vulnerability to use P2P in games
trashtensor 4 hours ago
Not having a congested CGNAT in the mix at 4pm every day is a nice benefit.
mojuba 13 hours ago
> Groups of zeros can be omitted with two colons, but only once in an address (i.e. 2000:1::1, but not 2000::1::1 as that is ambiguous)
Can someone explain why it's ambiguous?
On the subject, IPv6 is one of the strangest inventions on the internet. Its utility and practically are obvious no matter how you look at it except... just one thing.
Network-related things are generally easy to remember and then type from memory: IPv4, domain names, standard port numbers. Back in the day it was the phone numbers, again, easy to remember and dial when you need it. IPv6 is just too long and requires copy/paste all the time. This is the only real reason in my opinion, why IPv6 is doomed to be second-grade citizen for (probably) a few more decades.
clashandcarry 13 hours ago
2000:1::1 would expand to 2000:0001:0000:0000:0000:0000:0000:0001
2000::1::1 could be 2000:0000:0000:0000:0001:0000:0000:001, or 2000:00000000:0001:0000:0000:0000:001
There's ambiguity on where to fill in the five groups of 0000 in the second case.
rockskon 12 hours ago
The second address is invalid. You can only use :: once per address.
Edit: Whoops. Didn't read what the above post was in response to. My bad.
tpetry 12 hours ago
throw0101c 12 hours ago
> This is the only real reason in my opinion, why IPv6 is doomed to be second-grade citizen for (probably) a few more decades.
Except if you're using a mobile phone, in which case many telcos hand out only IPv6 addresses to handsets. 2018 NANOG presentation "T-Mobile's journey to IPv6":
* https://www.youtube.com/watch?v=d6oBCYHzrTA
From 2014, "Case Study: T-Mobile US Goes IPv6-only Using 464XLAT":
* https://www.internetsociety.org/deploy360/2014/case-study-t-...
But who cares about mobile phones, right? They're only second-grade devices.
ck2 12 hours ago
my tmobile 5g modem has ipv4 but changes ip every single page load, it's wild
I'm used to cablemodems with static ipv4 for months basically until mac changes
throw0101c 12 hours ago
hylaride 11 hours ago
immibis 8 hours ago
nwellinghoff 13 hours ago
I said this in a previous post and was shot down hard. I think you are right. Every time I look at a ipv6 address my brain goes “fack this”.
WarOnPrivacy 13 hours ago
> Every time I look at a [long] ipv6 address my brain goes “fack this”.
I do get that but I also get 'There are so many I could have all I wanted ... or I could if any of our fiber ISPs would support it, that is'
hdgvhicv 11 hours ago
mike_d 12 hours ago
IPv4 isn't perfect, but it was designed to solve a specific set of problems.
IPv6 was designed by political process. Go around the room to each engineer and solve for their pet peeve to in turn rally enough support to move the proposal forward. As a bunch of computer people realized how hard politics were they swore never to do it again and made the address size so laughably large that it was "solved" once and for all.
I firmly believe that if they had adopted any other strategy where addresses could be meaningfully understood and worked with by the least skilled network operators, we would have had "IPv6" adoption 10 years ago.
My personal preference would have been to open up class E space (240-255.*) and claw back the 6 /8s Amazon is hoarding, be smarter about allocations going forward, and make fees logarithmic based on the number of addresses you hold.
throw0101c 12 hours ago
shawabawa3 10 hours ago
immibis 8 hours ago
boob 13 hours ago
> Can someone explain why it's ambiguous?
Because you don’t know how many zeroes are on each side around the 0001 in the middle.
It can be 2000:0000:1:0000:0000:0000:0000:1 or 2000:0000:0000:0000:0000:1:0000:1 etc.
koakuma-chan 13 hours ago
This shortcut system of ipv6 only makes it worse. It's too hard to remember how it works.
icedchai 12 hours ago
karlshea 13 hours ago
WarOnPrivacy 13 hours ago
> Network-related things are generally easy to .. type from memory [but] IPv6 is just too long
I was reminded of this 2d ago; I was testing one IPv6 WAN from another. DDNS had failed so I didn't have my usual crutch to lean on.
ekropotin 12 hours ago
I mean yes, but there’s no escape from the fact that ip addresses need to be longer as amount of devices on the internet already exhausted the pool of IPv4 addresses by multiple orders of magnitude.
I guess it could be possible to implement sort of mnemonic phrases for addresses, à la bip-39, but it would be just trading one kind of pain for another.
api 12 hours ago
I've said this since time immemorial, and networking people often dismiss it. "Just use DNS," say people who have never actually worked netops or devops.
The length of the addresses and the clunky nature of their ASCII representation is absolutely the #1 reason the IPv6 has taken this long. User experience is the most powerful force affecting large scale adoption, and IPv6 has poor UX.
I think the UX is partly fixable by creating less horrible ASCII representation, but this would take a lot of coordination that was hard even back then and is virtually impossible now. If someone told me in 500 years we're still running dual-stack IPv4/IPv6 absolutely unchanged, I'd believe it.
zamadatix 11 hours ago
Half the reason (literally) the address looks so bad is not because of IPv6 but because everyone keeps choosing to implement randomized in-subnet addresses and cycle through them for privacy reasons.
E.g. 2600:15a3:7020:4c51::52/64 is not too horrible but 2600:15a3:7020:4c51:3268:b4c4:dd7b:789/64 is a monster by unrelated intent of the client.
flumpcakes 11 hours ago
api 10 hours ago
ggm 13 hours ago
whats the rule to say where the first 1 floats between the 2000: and the :1 at the end? the :: rule says "all zeros" but not how long.
db48x 10 hours ago
It’s a really complicated rule called “subtraction”. Addresses are always 128 bits long, or 8 groups of four hex digits. 2000::1 is two groups, so you need six groups in between to make 2000:0000:0000:0000:0000:0000:0000:1. But I don’t know why people always ask this, because it’s always the computer you are typing addresses in to that does the subtraction. You never ever have to type out the whole address. Just type the shortened version, because 2000::1 _is_ the whole address.
Dylan16807 9 hours ago
doubletwoyou 12 hours ago
the :1 is short for :0001 basically and then just put that bit of the address at the very end and put the first bit of the address at the front, and then just fill each missing group inbetween with 0000
webignition 12 hours ago
ggm 10 hours ago
My answer was too terse. IF there was two :: in the address, then the length of EACH :: denoted section is not known. It can be either longest left :: or longest right :: and that wasn't defined, because the rule is THERE IS ONLY ONE :: section.
Posed as a question, disingenuously.
mlangenberg 13 hours ago
> There are also still a lot of misconceptions from network administrators who are scared of or don’t properly understand IPv6
Enable IPv6 on a TP-Link Omada router (ER7212PC) and all internal services are exposed to the outside world as there is no default IPv6 deny-all rule and no IPv6 firewall. I get why some people are nervous.
jeroenhd 9 hours ago
That's more proof that TP-Link should not be trusted than that there is a problem with IPv6, really. Even cheap $20 Aliexpress routers have a firewall enabled by default.
gz09 13 hours ago
I believe that was more a bug in the firmware that's been fixed for a while now.
throw0101c 12 hours ago
> Enable IPv6 on a TP-Link Omada router (ER7212PC) and all internal services are exposed to the outside world as there is no default IPv6 deny-all rule and no IPv6 firewall. I get why some people are nervous.
A router routing traffic makes people nervous? Isn't that what it's supposed to do? I'd be annoyed if my router did not pass traffic.
Now, if the ER7212PC was a firewall that would be something else.
(And no, I'm not being pedantic: routers should pass traffic unless told otherwise, firewalls should block traffic unless told otherwise. The purposes of the two device classes are different, they just happen to both deal with Layer 3 protocol data units.)
baobun 11 hours ago
Routers and access points are also typically separate device classes. Yet the market has figured out that most consumers prefer all-in-one devices. Expecting households to run dedicated firewalls besides their AiO wifi-routers is ludicrous.
What firewall do you recommend a typical user couple their ER7212PC (which BTW is already tripling as VPN gateway and cloud-controller) with?
The problem is that TP-link does not give two cents to security in their products.
> And no, I'm not being pedantic
You very much are.
flumpcakes 11 hours ago
You are of course correct, but most people will disagree because the world we live in is a lot messier than what we should do and people expect a base line. You have to remember that people rely on IPv4 NATing for security, despite every network engineer knowing that is it is not - in effect it is.
tsimionescu 11 hours ago
Are you suggesting that people should buy both a router and a firewall for their home networks? I suppose they should buy a separate Wi-Fi AP as well, and a switch or two, in your opinion?
zajio1am 10 hours ago
'firewall' is just a colloquial term for packet filtering, which is a term for a class of functionality that could be provided by a router.
Customer edge routers are expected to contain firewall (see RFC 7084 and RFC 6092).
shrx 9 hours ago
People expect their router to act as a firewall too, via NAT. If you take this away and force people to buy an additional piece of hardware to restore the expected functionality, they won't switch. Simple as that.
tsimionescu 8 hours ago
yjftsjthsd-h 5 hours ago
> I spent a WEEK without IPv4 to understand IPv6 transition mechanisms
> NAT64 - the method I’ve setup for this test
> IPv6 is absolutely ready for prime-time and has been for awhile
So... No, you spent a week effectively using both v6 and v4 with extra steps. If someone said "Linux is ready for primetime" but their setup only worked because they ran a bunch of applications in a Windows VM, I'd call that strong evidence that it really wasn't. Same here.
That said... This is from early 2023. Any chance it's better now?
eqvinox an hour ago
> That said... This is from early 2023. Any chance it's better now?
I accidentally went IPv6 only on my home wifi for a few weeks a while ago. I only noticed when GitHub didn't load (I avoid work things at home, hence accessing GitHub being rare.)
Relatedly, fuck GitHub and their incompetence at rolling out IPv6. It's nothing other than that at this point. Blank, unadulterated incompetence.
rendaw 5 hours ago
None of the ISPs where I live provide NAT64 gateways. Exactly one advertised it, I signed up almost a year ago and they still haven't enabled it for me yet (I think they don't actually offer it and just forgot to remove the page).
dpkirchner 7 hours ago
I try enabling IPv6 every year or so. The last time I tried IPv6 at home I couldn't figure out what my netmask was, nor the size of my allocation. Some folks say my ISP issues /60s, others /64. I couldn't figure out how to get my IP to remain static long enough to have long-running TCP sessions, either. It was a mess and not much better than it was 20 years ago when I first tried it (and had to disable it because it being on broke all sorts of things).
Maybe 2026 will be the year of IPv6. I kinda doubt it given I'm some jackass and dedicated network professionals still don't use IPv6.
ianburrell 4 hours ago
Why are you setting up anything? You turn on IPv6, the router figures out its prefix from the upstream router, and then router broadcasts the network to devices.
The netmask for IPv6 is nearly always /64. ISPs give out /60 to allow multiple subnets, but router makes /64 subnets from that.
illusive4080 4 hours ago
If you have ATT fiber, it’s a pain in the butt. Their default router will only issue a single passthrough /64 on request. If you have multiple VLANs you have to setup some scripts to ask for more, and even then you only get 8 of them. The gateway reserves the other 8 from the /60 it gets for its own use.
The only way I got IPv6 working well with them was to bypass their gateway. Now all my VLANs have /64, which is the standard subnet size.
ekropotin 2 hours ago
I think bypassing their gateway, that is - bringing your own router is the only way to do VLANs, because their gateway is very basic and doesn’t support VLANs at all.
Animats 12 hours ago
Here's China's current IPv6 plan.[1] It was an explicit objective of the 14th Five Year Plan, now concluding, to get most of China's Internet on IPv6. About 70% of China's mobile users are on IPv6 now. But fixed IPv6 traffic in China is only 27%.
[1] https://www.cac.gov.cn/2025-05/20/c_1749446498560205.htm
orangeboats 5 hours ago
Their IPv6 deployment rate saw a huge jump from 40ish% to 53% after this report though.
karlshea 13 hours ago
My two IPv6 issues (even having had a HE tunnel in the past):
- My local ISP (US Internet, soon to be part of T-Mobile Fiber) hasn't enabled it, even though the CEO has said on Reddit for years that it's a priority. Now that they've been acquired who knows if it'll ever happen.
- Linode allows transferring v4 addresses between machines, so if I need to rebuild something I can do so without involving my client who usually has control over DNS. They do not support moving v6 addresses, which means that the only sites I have control over that support v6 are the ones that I control DNS.
Making IPv6 a thing seems like it would be super easy if a couple hours could be spent solving a bunch of dumb lazy problems.
toast0 12 hours ago
> My local ISP (US Internet, soon to be part of T-Mobile Fiber) hasn't enabled it, even though the CEO has said on Reddit for years that it's a priority. Now that they've been acquired who knows if it'll ever happen.
Being a priority doesn't mean it's high priority. It could be a priority, but the lowest ranked one, so other stuff always comes first. :P
T-Mobile wireless US is pretty invested on IPv6, so if they take over the network, they may well push it.
karlshea 7 hours ago
It "finally hit the top of the project list" two years ago so we'll see lol.
It's "T-Mobile Fiber Home Internet" which looks to be a bunch of local ISPs they've been snatching up, so we'll see what happens. USI's customer service and reliability have been amazing so hopefully that doesn't get screwed up.
wolrah 12 hours ago
> Don’t blame your provider when they deploy CG-NAT, embrace IPv6 and global routing instead.
In theory this makes sense, but in practice my personal experience is that not a single wireline ISP I've ever seen deploy CG-NAT offered IPv6 service at all, nor did any of them indicate any intent or even interest when asked about it.
The mobile providers on the other hand have almost entirely gone IPv6-first, using 6>4 transition methods as the default form of v4 access which I fully support.
4>4 CG-NAT should never have existed and providers who deploy it without offering fully functional v6 should be shamed.
PaulKeeble 12 hours ago
When I moved to an ISP that supported IPv6 earlier this year I ran into niggly problems. Ubuntu failed to update because one of its regional servers was misconfigured. OpenDNS one of its servers seemed not to be there on a regular basis over IPv6. I also had odd behaviour and latency issues where sometimes IPv6 would fail to route for short periods and it would fail and fall back to IPv4.
It was a painful experience of trying to work out if I had misconfigured it, if it was something to do with my opensource router software or if it was my ISP or the end services. I didn't get to the end of working this out and reporting issues and I just gave up. Due to the intermittent nature of the issues I was facing I never managed to get a report of issues my ISP would accept.
So I'll give it some time and give it a try after a year and see if things have improved, but it was definitely not ready for prime time.
idatum 12 hours ago
OpenBSD makes it easy to try IPv6 tunnelbroker.net with NAT64/DNS64 if your ISP only has IPv4 ("one more lab test away.." they say).
This has worked for me well for a couple years. I do use a VLAN to keep the IPv6-only network separate (homelab) from video streamers in the household.
In my pf.conf:
# IPv6 tunnel
block in log on $tun6_if all
block in quick on $tun6_if inet6 from fd00::/8 to any
antispoof quick for $tun6_if
# allowed icmp6
pass in quick log on $tun6_if inet6 proto icmp6 icmp6-type {
unreach, toobig, timex, paramprob, echoreq
}
# MSS clamping 60 bytes less than HE 1480
# 20 byte IPv4 tcp header + 40 byte IPv6 ip header
match on $tun6_if all scrub (random-id max-mss 1420)
# DNS64/NAT64
module-config: "dns64 validator iterator"
dns64-prefix: 64:ff9b::/96
idatum 8 hours ago
Forgot the most important part of pf.conf!
# NAT64
pass in inet6 from any to $nat64_prefix af-to inet from ($ext_if)seviu 9 hours ago
And despite that, the place where I work, has disabled ipv6, rendering our development machines useless for trivial tasks such as debugging our iOS app on a device (which uses ipv6 under the hood)
Reasons given: the security policies say ipv6 is not safe enough.
flumpcakes 11 hours ago
I'm very surprised by the questions in this thread. There are some extremely basic things people are just not understanding. I suspect people hating on IPv6 have not spent the time with it. There is a difficulty in that it does behave quite differently to IPv4, and the lack of private addresses are also probably a shock.
transcriptase 10 hours ago
The basic thing proponents don’t understand is that nobody in their right mind can intuitively understand IPV6 addresses because they look like MAC addresses with trisomy and are a pain in the ass to remember or type for absolutely no benefit to the non-network engineer. And there are infinitely more people with home routers and a few dozen devices than there are people running ISPs, fortune 500s, and data centres. Play with your convolution all you want, in 20 years the rest of us will still be happily assigning 192.168.x.x and ignoring it. V4 space running out is no more the average persons problem than undersea cables or certificate authority.
Dylan16807 9 hours ago
> nobody in their right mind can intuitively understand IPV6 addresses
If someone can't understand "it's longer" then what is wrong with them?
And using hex instead of decimal for magic computer numbers should be more intuitive, not less.
Also structure-wise the first half is the subnet and the second half is the host. That's much more intuitive than IPv4.
> absolutely no benefit to the non-network engineer
If you do anything peer to peer at all, calls or file transfers or games, there's a benefit. And the typical benefit grows over time as more and more ISPs install CGNAT.
transcriptase 8 hours ago
mzajc 5 hours ago
justsomehnguy 4 hours ago
> intuitively understand IPV6 addresses because they look like MAC addresses with trisomy and are a pain in the ass to remember or type
I have north of 500 IPs I have some relation to. No way I would be bothered to remember them. Typing? Do you type IPv4s all day long? And it's still copy-paste 99% of times.
> for absolutely no benefit to the non-network engineer
Non-network engineer should work with names. And non-engineers don't 'work' with IPs at all. Look at your granpa - he's typing 'bbc' into the search form in the browser to get to bbc.com.
> nobody in their right mind can intuitively understand IPV6 addresses
And 99% of so called engineers can't understand even IPv4. So this is a moot point.
themafia 4 hours ago
> There is a difficulty in that it does behave quite differently to IPv4
Which can be fine if you have a /solid/ transition plan to move networks wholesale from v4 to v6. They absolutely failed on this point and almost purposefully refused to carry over any familiar mechanisms to make dual stack easier to manage.
It's a University protocol that escaped into commercial usage based mostly on false fears of global routing table size becoming unmanageable or impossible to store in RAM. The results are absolutely predictable.
tgsovlerkhgsel 3 hours ago
I haven't spent a lot of time with my power grid either, but I do expect the light to go on when I press the switch.
(Needing to dedicate time for it is, to some extent, either a failure of the protocol or at least a contributor to the lack of adoption.)
Dylan16807 11 hours ago
Am I missing something? Where's the part where he actually talks about his experience in that week? This goes straight from an overview of IPv6 to the conclusions section.
glitchc 13 hours ago
While these articles are useful in understanding the utility of IPv6, what would really help is an article explaining step by step how to configure a home network using IPv6. The tutorial should answer these questions:
- How to ensure there are no collisions in address space? Translates to, how to pick safe addresses, is there a system?
- How do I route from an external network resource to an internal network resource? Translates to, can you provide syntax on how to connect to an smb share? Set up a web service that works without WireGuard or equivalent?
- How does one segment networks, configure a vlan, set up a firewall?
candiddevmike 13 hours ago
- if you're talking a private/local prefix, you can use tools like this to generate one: https://unique-local-ipv6.com/. Otherwise DHCPv6 and SLAAC will ensure no collisions for the most part.
- Use global/public addresses on all your devices (using something like prefix delegation) or use NAT.
- Same as IPv4. Prefix delegation will let your ISP assign you multiple networks, and then most routers will break these up into /64 networks for each of your VLANs.
Latty 13 hours ago
- SLAAC - the address spaces for IPv6 are so huge, collisions are extremely unlikely outside of intentional actions.
- Open holes through firewalls, point DNS at the address, and it should just work, the joys of actually having public addresses.
- Same way as with IPv4 mostly. The only real difference is because SLAAC assumes a /64 you probably want your networks to be at least that big.
oezi 12 hours ago
> extremely unlikely outside of intentional actions.
But come on! It is a legitimate question, do you just scramble keys when picking an address?
> the joys of actually having public addresses.
If your ISP gives you a static IPv6. Unfortunately in Germany none of the ISP for private users does (last I checked).
db48x 11 hours ago
daft_pink 6 hours ago
I feel this doesn’t really address whether we are losing something privacy or security related by not having NAT. I think my main devices are always updated Mac iPhone or iPad and can handle it, but do I really want my thermostat or doorbell or lock or garage door opener or light switch directly accessible on the Internet or is the nat serving a useful purpose? I don’t feel like this is addressed in this article.
yjftsjthsd-h 6 hours ago
> but do I really want my thermostat or doorbell or lock or garage door opener or light switch directly accessible on the Internet or is the nat serving a useful purpose?
You should have a firewall, regardless of v4/v6.
mzajc 5 hours ago
You should, but the exposure from having no firewall is much higher without NAT. Packets with private network IPs are martians on the internet and will not find their way to your device unless they come from the same network and the ISP's infrastructure doesn't drop them. IPv6 addresses are routable across the internet so the packets will most likely get to your router, meaning anyone on the internet can talk to your LAN in the absence of a firewall.
The reality is that consumer router firmware is horrible in every aspect, especially security, and this isn't going to change with IPv6 rollout. I fear the most likely scenario is that ISPs will set up inbound firewalls on their end, and then we'll be even worse off than we are right now.
imathew 10 hours ago
My ISP has good IPv6 support. I was using it for a while and recently disabled it across my home network for simplicity of maintenance, cutting my vyos config in half. When I need to access something not available on IPv4 I'll set it up again but I'm not convinced that will happen in my lifetime.
candiddevmike 13 hours ago
I wish I could switch my network to all IPv6 and use NAT64/DNS64, but Android, the world's most popular OS, purposefully disables DHCPv6. I am forced to support IPv4/DHCPv4 for the foreseeable future to support these broken devices.
throw0101c 11 hours ago
> I wish I could switch my network to all IPv6 and use NAT64/DNS64, but Android, the world's most popular OS, purposefully disables DHCPv6.
It does not "disable" DHCPv6. It does not support DHCPv6. Android (really Lorenzo Colitti) in/famously WONTFIX adding DHCPv6 client support:
* https://issuetracker.google.com/issues/36949085
Of course after over a decade of denying that Android needs some kind of DHCP in IPv6, it seems that Android may finally be getting some kind of solution:
* https://android-developers.googleblog.com/2025/09/simplifyin...
* Via: https://blog.ipspace.net/2025/09/android-dhcpv6-prefix-deleg...
Hopefully, having admitted (?) the error of their ways with being SLAAC-only they'll also add 'regular' DHCPv6 in addition to DHCPv6-PD.
franklyworks 13 hours ago
Android supports SLAAC and has good support transitional tech like xlat464 and DHCP option 108.
I have used these on my network and office to move to IPv6-only for Android.
What about lack of DHCPv6 prevents you from using IPv6 on Android?
candiddevmike 13 hours ago
I can't run SLAAC and DHCPv6 at the same time without giving devices multiple addresses, and Android doesn't support DHCPv6, so I'd have to carve out a separate, SLAAC-based, android-only network. And then figure out firewall rules, multicast reflection, etc.
justincormack 12 hours ago
gspr 12 hours ago
dmm 12 hours ago
Android supports DHCPv6, just not stateful DHCPv6. You can give each device its own /64 or if you really want to track a devices usage you should use an authenticated layer on top of your base network.
avidiax 13 hours ago
Why can't you use stateless autoconfig?
candiddevmike 13 hours ago
Because I want to control the suffix assigned to devices for firewall rules and monitoring purposes.
avidiax 10 hours ago
suprjami 11 hours ago
World IPv6 day 6-6-26, just turn IPv4 off. Let the world catch up.
I said the same thing for 6-6-16 too.
transitorykris 5 hours ago
In my 25 year career in network engineering, I’ve encounter needing it as a user exactly once, and that was earlier this year. Supabase’s free tier allows direct connections the Postgres only over IPv6. It’s too bad the deploment has been a long drawn and expensive process for everyone.
rao-v 12 hours ago
What’s the pragmatic solution to ipv6 allowing everybody in my household to be trivially and stably mapped to a unique subnet? I like the accidental semi-randomization that ipv4 and ISP NAT offered and I don’t see anything like it short of putting my entire home net on a VPN (it’s expensive and can’t keep up with my ISP’s bandwidth)
lloeki 12 hours ago
Each device gets directly addressable from WAN with v6 but it also gets a randomised privacy IP that rotates very frequently so each individual device is just as "hidden" as it was with v4+NAT.
Your v6 subnet prefix is no different than whatever WAN-side v4 your NAT had. "Accidental semi-randomization" of the WAN side IP is not something one could reliably count on. Many ISPs just hand over a static-like IP, that is, even when it's supposed to be random the pool of IPs is so constrained that it's usually the same simply through the IP lease surviving power cycling. And that was before CGNAT.
If your concern is being identifiable through your IP then counting on whatever v4 artifact is the wrong move. Use a VPN with randomised exit nodes.
icedchai 6 hours ago
Everybody in your household is already mapped to a single IPv4 address that rarely changes with most ISPs. Mine hasn't changed in over 3 years. My IPv6 /56 prefix delegation hasn't changed, either.
yjftsjthsd-h 12 hours ago
It's true that you won't get CGNAT without having CGNAT. Depending on your concern, it is possible to NAT66 to make your entire network appear as one IP.
lonjil 2 hours ago
what exactly do you mean by "trivially and stably mapped to a unique subnet"?
1970-01-01 11 hours ago
I have firsthand experience doing that experiment about 3 months ago. Completely removed my IP4 DHCP lease from my ISP at the router. About 50% of the public sites I tried to visit didn't resolve. So many public sites, that I gave up and went back to dual stack after just a day. Google, ChatGPT, and a few other popular sites were fine with pure IPv6 traffic, however sites like eBay and even HN did not resolve. IPv6 simply is still not ready for everyone to just transition into overnight.
martinald 6 hours ago
Interesting. I did finally find a use for IPv6 which I wrote up here: https://martinalderson.com/posts/i-finally-found-a-use-for-i...
Tbh though the docker problems are very serious and extremely painful to work around. Everything works great apart from Docker which has so many issues - it does not handle IPv6 inbound but IPv4 out well at all (at least as far as I can tell!).
tlogan 12 hours ago
As a normal user: why do I need IPv6?
As far as I know, the majority of websites (about 70%) do not support IPv6.
jeroenhd 9 hours ago
Depends on your ISP. If you live in a place where there aren't many IPv4 addresses available, CGNAT is the reason you're seeing a lot of Cloudflare/Akamai/Google CAPTCHAs everywhere, and IPv6 fixes that.
calvinmorrison 7 hours ago
same reasons northern europeans had to invent all sorts of fancy food preservation and complex power struggle societies revolving around crop limitations and war.
Meanwhile closer to the equator, much less progress was needed to live and let live.
In short, Americans are native tribes. we have plentiful IPV4 and couldnt care less about SLAAC or whatever other complex moon sun and seasonal tide gods, salted codfish and salt mining operations. we just dont need to care about long addresses, they're plentiful here.
paulddraper 11 hours ago
You need it because there aren’t enough IPv4.
If you have a mobile device with data, you’re likely already using it.
sethops1 11 hours ago
Do we really need all the mobile phones and IoT devices of the world to be publicly addressable? Is that even a good thing?
paulddraper 10 hours ago
badgersnake 12 hours ago
I don’t think that’s true. But of course it depends how you’re measure the majority of websites.
Most of the figures I see show 60-70% of the top 100 sites do support it. But maybe that does not reflect your usage.
Why do you need it? Maybe you don’t right now since ipv6 only sites are niche. The most tangible advantage I’ve seen is avoiding CGNAT. Gamers in particular don’t like that because it introduces latency. Services like Xbox live definitely do support ipv6 for this reason.
layer8 12 hours ago
If Google would announce that Chrome is dropping IPv4 support in n months, that would probably get things moving. ;)
stevekemp 11 hours ago
I guess it would, but remember there are more services out there than just HTTP(S).
For example the last time I had an IPv6-only host I had issues cloning things from github, as "git clone [email protected]..." failed due to github.com not having IPv6 records.
A quick search revealed this open 3+ year old discussion - https://github.com/orgs/community/discussions/10539
ChrisMarshallNY 10 hours ago
I'm pretty underwhelmed by IPv6. It looks like the typical "horse designed by committee."
I suspect that what will actually end up being implemented, will be a core subset of the spec.
We'll have to see what's still standing, when the dust settles.
jeroenhd 9 hours ago
The IPv6 spec looks long because it also includes protocols that are separate on IPv4 (DHCP/SLAAC, NDP, depending on the document ICMPv6, mirroring DHCP, ARP, ICMP, NetBIOS, etc.), as well as the addressing schemes that were different RFCs in IPv4 such as multicast/unicast/network classes/subnets.
As for the implementation: just about anything more powerful than an ESP32 has the entire protocol implemented and running already.
ChrisMarshallNY 9 hours ago
As long as the SDKs to apps make it simple, we'll be good. I haven't seen much, so far.
db48x 10 hours ago
Your computer, and every other computer on the planet, already supports the entire IPv6 spec. There is no subset.
yjftsjthsd-h 6 hours ago
I'm typing this on a computer running Android, which means it doesn't support DHCPv6. I would describe it as supporting a subset of IPv6 functionality.
ChrisMarshallNY 10 hours ago
Well, we'll have to see what all the "in-between" bits do. There's a lot in it, that will require implementation by countless layers of routers, switches, caches, firewalls, etc.
Look at Bluetooth, for an example, or TIFF.
I printed out the Bluetooth spec once, just for Ss and Gs. It was over 2,000 pages (double-sided).
I once tried writing a fully-compliant TIFF reader. Didn't go so well.
db48x 9 hours ago
illusive4080 4 hours ago
AWS doesn’t offer PTR records for IPv6 addresses, which makes Gmail blacklist my email server’s IPv6 address. I had to disable IPv6 due to lack of PTR records.
jyscao 13 hours ago
I need to switch my home network to at least use IPv6 externally, because my ISP recently deployed CG-NAT, which made my SSH server that used to work no longer reachable from outside of my LAN.
bakugo 13 hours ago
You can use a NAT-traversing VPN like tailscale to work around this.
razighter777 9 hours ago
The workarounds we need to enable P2P communication on the internet are a shame... we need turn, stun, webrtc, all this stuff so two computers can talk without a dedicated port forward or public ipv4.
ipv6 is a beautiful protocol, (not perfect, but elegant) with a lot going for it. But the momentum of ipv4 is just too strong.
It's a mess... with no good solution. I tried to turn off ipv4 and github (shame on you) stopped working. But what are we supposed to do? Have the government mandate everyone switch? (oh wait half of US government websites are ipv4 only)
We did this to ourselves...
ctippett 6 hours ago
Every few years I check to see how far away Virgin Media are from offering IPv6. Just checked again... nope!
sneak 5 hours ago
I tried that, but my HN addiction ended it.
ianburrell 4 hours ago
HN has IPv6 now.
If Reddit would finish adding IPv6, almost all of my browsing would be IPv6.
self_awareness 5 hours ago
My ISP has IPv6 since years and I'm on 6 as well.
NAT-less network is really cool, I can serve content directly from anything from my LAN.
We should really leave IPv4 and move on.
avidiax 13 hours ago
People keep saying that IPv6 allows you to more easily host services, but you still have to support IPv4.
Try connecting to your IPv6-only service on Hotel WiFi -- you usually can't.
It's unfortunate, but IPv6 doesn't really solve any problems for a home user. And I say this as someone that has deployed IPv6 at home before.
mattypg 13 hours ago
> It's unfortunate, but IPv6 doesn't really solve any problems for a home user.
CG-NAT and strict NAT in general. Newer ISPs often force users onto CG-NAT, and my consoles have had numerous issues with NAT in general over the years. ISP routers also often make fixing this an opaque or impossible problem for the user.
I don’t think IPv6 is the best thing ever, but I do think it solves the problems IPv4 did along with some annoying issues IPv4 struggled with.
brandonkal 13 hours ago
It does make it easier. IPv6 pinholes are simpler than port forwarding. My IPv4 is not static but my IPv6 prefix is. So I don’t need dynamic DNS. I have no IPv4 port forwards, instead I run snid on a VPS to support legacy internet clients and call it a day.
avidiax 10 hours ago
So you basically have a cloud server and a domain with a wildcard record, and you then forward IPv4 through IPv6?
I think this somewhat proves my point that IPv6 doesn't solve much for self-hosting. You still need some kind of working IPv4 setup. You are using IPv6 in place of either a reverse proxy or something like tailscale, which I suppose is more convenient.
kachapopopow 11 hours ago
the reason why I explicitely disable ipv6 cause "this shit don't work" (at the moment, will probably change in the future)
- random slowdowns
- horrible routing
- larger packet overhead
- hated by a lot of the people who run the internet
- hated by companies who provide ddos protection
- my poor TCAM cache in my budget routers
- supporting ipv6 is really expensive in chassis routers
However, I believe there is a solution: Swap ISP's to IPv6 only, swap to IPv4 unless there is an IPv6 route present then directly forward. This solves quite a few issues: Once every ISP has IPv6 you can drop ipv4 and swap directly to ipv6 without having to split your TCAM. This works because IPv6 can encode IPv4 in it.
jrm4 13 hours ago
Hot take: IPv4 might be techinically worse, but it's "politically" (in the classic sense of the word) better.
IPv6 essentially enables "universal internet IDs" for every device, which could streamline a lot of things, but enable a lot of weird surveillance/power balance issues that the cruft of IPv4 is actually incidentally helping guard against.
Again, I'm old enough to remember when e.g. the ISPs were going to try to charge per device in each household.
ninkendo 12 hours ago
This hasn’t been the case in decades, every OS defaults to randomly generating the trailing 64 bits of your address and cycling through new addresses periodically. Your IPv6 address is only fixed to your device if you choose to configure it that way.
Since the network half (leading 64 bits) is as fixed as your IPv4 address was, and the host half is random and constantly changing, an IPv6 address is exactly as uniquely identifying as an IPv4 address used to be.
blahaj 13 hours ago
> Again, I'm old enough to remember when e.g. the ISPs were going to try to charge per device in each household.
I don't really see that coming again and if it does you can just do NAT66 just like you can do NAT4.
jrm4 12 hours ago
You and I can, yes.
But, network effects.