<story><title>IPv6 Adoption Statistics</title><url>http://www.google.com/intl/en/ipv6/statistics.html</url></story><parent_chain></parent_chain><comment><author>IgorPartola</author><text>Every time IPv6 comes up on HN, around 50% of the comments seem to be about how IPv6 doesn&amp;#x27;t do NAT and how now every device you have is suddenly directly exposed to the internet. Let&amp;#x27;s clarify this a bit instead of answering individual commenters:&lt;p&gt;In IPv6, just like in IPv4, you have a firewall. In Linux, you use ip6tables instead iptables, for example. This is what keeps your devices on your network safe. If you were to start from scratch to set up a router with an IPv6 firewall, you&amp;#x27;d need just two rules: (1) allow packets in for already established connections and (2) drop every other incoming packet. If you know what you are doing, you can actually set this up yourself. I have, and while educational, it provided no real world benefit.&lt;p&gt;Most people don&amp;#x27;t want to bother with using iptables directly, so don&amp;#x27;t. Get a router that supports OpenWRT and flash it. For most of them, it&amp;#x27;s a really simple process (my TP-Link let me upload the binary to flash via the web GUI). Why OpenWRT? Well, it&amp;#x27;s secure and constantly updated, it supports IPv6 natively, and it comes with the IPv6 firewall that is configured in a fashion very similar to how you think of IPv4 (it even rate limits ping requests, etc.). As a bonus, if your ISP doesn&amp;#x27;t support IPv6, OpenWRT has an installable web GUI component for configuring an IPv6 tunnel. Lastly, even if you don&amp;#x27;t want IPv6 (yes, I see you there in the back, climbing back under your rock), still use OpenWRT. It seems to have a lot less bugs than commercial router firmware, and is a lot more stable and up to date than DD-WRT or Tomato.&lt;p&gt;Edit: One other misconception that comes up frequently is that IPv6 means that your privacy is at a more of a risk because your MAC address may be exposed. While in some configurations this can happen, IPv6 has what&amp;#x27;s called Privacy Extensions: in addition to your more permanent MAC-based IPv6 address (network prefix + munged MAC address), your OS will periodically generate a new random IPv6 address (network prefix + random number). This actually makes it marginally harder to track you since your exact IP address will change frequently, as seen by hosts you access. See &lt;a href=&quot;http://en.wikipedia.org/wiki/IPv6#Privacy&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;IPv6#Privacy&lt;/a&gt;.</text></comment>
<story><title>IPv6 Adoption Statistics</title><url>http://www.google.com/intl/en/ipv6/statistics.html</url></story><parent_chain></parent_chain><comment><author>pilif</author><text>After I switched ISP to one that supports native IPv6 (and generally is pure awesome), I noticed that my traffic at home went to about 50% IPv6, also thanks to YouTube supporting V6.&lt;p&gt;I also casually noticed that all but one address in my &amp;quot;Account Activity&amp;quot; view in Gmail are IPv6 addresses (ironically, the mobile phone got the one single IPv4 address in that list over 4G).&lt;p&gt;V6 works nicely and totally transparent causing zero trouble for me, even though there are some application protocols that don&amp;#x27;t handle V6 properly yet (Apple Remote Desktop and Air Video to give two examples).&lt;p&gt;One thing that&amp;#x27;s tricky about V6 is the fact that without NAT all your boxes are internet-reachable unless you have a firewall. That&amp;#x27;s easily added of course, but whereas we have protocols like upnp and nat-pmp to reconfigure NAT routers, there&amp;#x27;s nothing equivalent for various applications to tell the router to forward some V6 traffic.&lt;p&gt;So this is actually a step back what connectivity behind LANs is concerned.&lt;p&gt;I would love for applications to be able to ask the OS for their very own application specific v6 address. Then they could just listen on that instead of all interfaces (and listening on all interfaces would not include these application specific interfaces).&lt;p&gt;That way, I could theoretically get away without a restrictive firewall while still giving applications a way to be directly connected to. An attacker would have to scan a &amp;#x2F;48 (in my case) or a &amp;#x2F;64 (in the worst case) in order to find an open port given a known remote address.</text></comment>