<story><title>Tell HN: IPv6-only still pretty much unusable</title><text>Our Hosting provider, Hetzner, has recently started charging for public IPv4 addresses - as they should! Those numbers started getting expensive. This prompted me to try and set up a new server cluster using IPv6 exclusively, and see how far I could get before having to give in and purchase an additional v4 address.&lt;p&gt;The experiment ended much sooner than I had anticipated. Some of the road blocks I hit along the way:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  - The GitHub API and its code load endpoints are not reachable via IPv6, making it impossible to download release artefacts from many projects, lots of which distribute their software via GitHub exclusively (Prometheus for instance).
  - The default Ubuntu key servers aren&amp;#x27;t reachable via IPv6, making it difficult to install packages from third-party registries, such as Docker or Grafana. While debugging, I noticed huge swaths of the GPG infrastructure are defunct: There aren&amp;#x27;t many key servers left at all, and the only one I found actually working via IPv6 was pgpkeys.eu.
  - BitBucket cannot deploy to IPv6 hosts, as pipelines don&amp;#x27;t support IPv6 at all. You can self-host a pipeline runner and connect to it via v6, BUT it needs to have a dual stack - otherwise the runner won&amp;#x27;t start.
  - Hetzner itself doesn&amp;#x27;t even provide their own API via IPv6 (which we talk to for in-cluster service discovery. Oh, the irony.
&lt;/code&gt;&lt;/pre&gt;
It seems IPv6 is still not viable, more than a decade after launch. Do you use it in production? If so, how? What issues did you hit?</text></story><parent_chain><item><author>fernandomm</author><text>Let&amp;#x27;s not forget about the idea that ISPs would distribute a &amp;#x2F;56 range to residential users. You could split it in &amp;#x2F;64 ranges according to your requirements and everything would work fine.&lt;p&gt;There is only one &amp;quot;minor&amp;quot; issue: all major ISPs in my country ( Brazil ) only provide a single &amp;#x2F;64. You can&amp;#x27;t get another &amp;#x2F;64 unless you upgrade to a very expensive business plan.&lt;p&gt;That makes IPv6 not only useless but also a huge security issue.&lt;p&gt;1) I can&amp;#x27;t use my Mikrotik as a firewall. Trying to split a &amp;#x2F;64 range breaks things and some devices ( specially IOT ones ) will simply not work.&lt;p&gt;2) Routers provided by the ISPs here are very limited, specially for things like firewall rules. Some of them will only provide a On&amp;#x2F;Off switch, with Off option between the default one.&lt;p&gt;Although IPV4 + NAT had some issues, it ( accidentally? ) created a safe&amp;#x2F;sane default config for non-technical users. In order to open a port and expose a device, you have to explicitly add a rule on the firewall.&lt;p&gt;IPv6 is the other way around. In practice, all devices and ports are exposed unless you explicitly block it.&lt;p&gt;In the last 3 years I&amp;#x27;ve noticed criminals focusing more and more on IPv6 scans to compromise devices and create botnets since it&amp;#x27;s much easier to find exposed&amp;#x2F;unpatched devices as most users don&amp;#x27;t understand how to correctly configure a firewall.&lt;p&gt;Most of the time, the only viable solution is to disable IPv6.</text></item><item><author>redox99</author><text>IPv6 has been one of the biggest failures in the last couple of decades.&lt;p&gt;And I don&amp;#x27;t mean adoption, I mean the standard itself.&lt;p&gt;If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade.&lt;p&gt;Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.1.2.3.4).&lt;p&gt;Not having two sets of firewall rules and two sets of everything. I always disable IPv6 because it can bite you so hard when you don&amp;#x27;t realize that you are wide open to IPv6 connections because of different firewalls.&lt;p&gt;Edit: To make everything a bit clearer, the idea with this &amp;quot;ipv4+&amp;quot; is that you don&amp;#x27;t need the complexity of running both ipv4 and ipv6 as you do now.&lt;p&gt;And regarding compatibility, with ipv4+ if you have a 0.0.0.0.x.x.x.x ip address you would be able to talk to both ipv4+ aware and legacy ipv4 devices natively without any tunneling (because you also own the legacy, non quad 0 ip address). If you don&amp;#x27;t have such &amp;quot;quad 0 ip&amp;quot; (you are 1.1.1.1.x.x.x.x), only ipv4+ aware devices would be able to to connect to you, and for you to connect to non ipv4+ aware devices you would need either tunneling, or having a secondary, cgnat, &amp;quot;quad 0 ip&amp;quot;.</text></item></parent_chain><comment><author>bert64</author><text>Those ISPs are broken and not following the RFCs or RIR guidelines.&lt;p&gt;There&amp;#x27;s nothing stopping you from using NAT with IPv6, people just don&amp;#x27;t do it because the only benefit of NAT is conserving limited address space. NAT on IPv6 just brings all downsides and no benefit because you (should) have no shortage of address space. In any case v6 with nat is no worse than legacy ip with nat, its just stupid because they&amp;#x27;re forcing a newer and better protocol to run in a degraded mode.&lt;p&gt;Consumer oriented routers and firewalls do not allow arbitrary inbound IPv6 connections by default, you have to explicitly enable them.&lt;p&gt;I still don&amp;#x27;t get scanned over IPv6, despite having a static &amp;#x2F;56 range for more than 10 years. Everything that&amp;#x27;s reachable over legacy IP is also reachable over v6, and i have several v6-only devices because i simply don&amp;#x27;t have enough legacy addresses for everything. Scanning v6 is extremely difficult, while the legacy blocks get scanned continuously.&lt;p&gt;Modern operating systems are not sitting there with exposed services by default, you have to manually open them up if you want. Simply connecting a win11 box to an open IPv6 connection is not going to get you joined to a botnet like connecting a winxp machine directly to a legacy connection did.&lt;p&gt;Modern devices are often exposed to hostile networks&amp;#x2F;users - every time you connect a portable device to a public wifi network you are exposing your device to the operators and other users of the network. Depending how that network is configured, you might be exposed to the internet too. You don&amp;#x27;t have any separate device between you and the hostile network, you are relying on the configuration of your machine itself.&lt;p&gt;ISP supplied routers are limited and generally garbage, this is a problem for legacy ip just as much as v6.</text></comment>
<story><title>Tell HN: IPv6-only still pretty much unusable</title><text>Our Hosting provider, Hetzner, has recently started charging for public IPv4 addresses - as they should! Those numbers started getting expensive. This prompted me to try and set up a new server cluster using IPv6 exclusively, and see how far I could get before having to give in and purchase an additional v4 address.&lt;p&gt;The experiment ended much sooner than I had anticipated. Some of the road blocks I hit along the way:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  - The GitHub API and its code load endpoints are not reachable via IPv6, making it impossible to download release artefacts from many projects, lots of which distribute their software via GitHub exclusively (Prometheus for instance).
  - The default Ubuntu key servers aren&amp;#x27;t reachable via IPv6, making it difficult to install packages from third-party registries, such as Docker or Grafana. While debugging, I noticed huge swaths of the GPG infrastructure are defunct: There aren&amp;#x27;t many key servers left at all, and the only one I found actually working via IPv6 was pgpkeys.eu.
  - BitBucket cannot deploy to IPv6 hosts, as pipelines don&amp;#x27;t support IPv6 at all. You can self-host a pipeline runner and connect to it via v6, BUT it needs to have a dual stack - otherwise the runner won&amp;#x27;t start.
  - Hetzner itself doesn&amp;#x27;t even provide their own API via IPv6 (which we talk to for in-cluster service discovery. Oh, the irony.
&lt;/code&gt;&lt;/pre&gt;
It seems IPv6 is still not viable, more than a decade after launch. Do you use it in production? If so, how? What issues did you hit?</text></story><parent_chain><item><author>fernandomm</author><text>Let&amp;#x27;s not forget about the idea that ISPs would distribute a &amp;#x2F;56 range to residential users. You could split it in &amp;#x2F;64 ranges according to your requirements and everything would work fine.&lt;p&gt;There is only one &amp;quot;minor&amp;quot; issue: all major ISPs in my country ( Brazil ) only provide a single &amp;#x2F;64. You can&amp;#x27;t get another &amp;#x2F;64 unless you upgrade to a very expensive business plan.&lt;p&gt;That makes IPv6 not only useless but also a huge security issue.&lt;p&gt;1) I can&amp;#x27;t use my Mikrotik as a firewall. Trying to split a &amp;#x2F;64 range breaks things and some devices ( specially IOT ones ) will simply not work.&lt;p&gt;2) Routers provided by the ISPs here are very limited, specially for things like firewall rules. Some of them will only provide a On&amp;#x2F;Off switch, with Off option between the default one.&lt;p&gt;Although IPV4 + NAT had some issues, it ( accidentally? ) created a safe&amp;#x2F;sane default config for non-technical users. In order to open a port and expose a device, you have to explicitly add a rule on the firewall.&lt;p&gt;IPv6 is the other way around. In practice, all devices and ports are exposed unless you explicitly block it.&lt;p&gt;In the last 3 years I&amp;#x27;ve noticed criminals focusing more and more on IPv6 scans to compromise devices and create botnets since it&amp;#x27;s much easier to find exposed&amp;#x2F;unpatched devices as most users don&amp;#x27;t understand how to correctly configure a firewall.&lt;p&gt;Most of the time, the only viable solution is to disable IPv6.</text></item><item><author>redox99</author><text>IPv6 has been one of the biggest failures in the last couple of decades.&lt;p&gt;And I don&amp;#x27;t mean adoption, I mean the standard itself.&lt;p&gt;If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade.&lt;p&gt;Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.1.2.3.4).&lt;p&gt;Not having two sets of firewall rules and two sets of everything. I always disable IPv6 because it can bite you so hard when you don&amp;#x27;t realize that you are wide open to IPv6 connections because of different firewalls.&lt;p&gt;Edit: To make everything a bit clearer, the idea with this &amp;quot;ipv4+&amp;quot; is that you don&amp;#x27;t need the complexity of running both ipv4 and ipv6 as you do now.&lt;p&gt;And regarding compatibility, with ipv4+ if you have a 0.0.0.0.x.x.x.x ip address you would be able to talk to both ipv4+ aware and legacy ipv4 devices natively without any tunneling (because you also own the legacy, non quad 0 ip address). If you don&amp;#x27;t have such &amp;quot;quad 0 ip&amp;quot; (you are 1.1.1.1.x.x.x.x), only ipv4+ aware devices would be able to to connect to you, and for you to connect to non ipv4+ aware devices you would need either tunneling, or having a secondary, cgnat, &amp;quot;quad 0 ip&amp;quot;.</text></item></parent_chain><comment><author>crest</author><text>RouterOS v7 supports DHCPv6 prefix delegation. You can request a delegated &amp;#x2F;64 per downstream interface and announce itself as router using these prefixes. You can still use your MikroTik device as router, stateful firewall, proxy. You don&amp;#x27;t have to mess with smaller than &amp;#x2F;64 allocations on links unless your provider forces a broken CPE on you that doesn&amp;#x27;t support DHCPv6 prefix delegation.&lt;p&gt;Have you actually seen any large scale deployments of CPEs without an active IPv6 firewall blocking incoming connections by default?</text></comment>