Dual Stack home network pros and cons

[Jeffrey Young]

I don't. know if this helps or not. But, even if his ISP doesn't support IPv6, he can go to Hurricane Electric and sign-up and use their IPv6 tunnel broker. They will assign you up to five delegated prefixes/subnets that are fully routable on the internet. The subnets are delegated and clients can be assigned via SLAAC or DHCPv6 running on your internal network. The service has been around for years and is still free.

Perhaps a wrong spot to mention here. I got excited about Hurricane Electric when I saw this thread and was hoping that it would solve my issue of having no IPv6 behind a GCNAT. I did sign up, and set up my router appropriately. IPv6 works both on my router and my clients get an IPv6 address and all the tests work. However, I can not reach my Router (or clients) from the internet using the assigned IPv6 as the CGNAT is in the way. This is further explained by Hurricane Electric. I know it is off topic, but I wanted to just say that Hurricane Electric is not a resolution for everyone looking to get an IPv6 through an IPv4 address.

 

[Tech9]

If only that were true. I am stuck behind a CGNAT in Canada

Your ISP doesn't have enough IPv4 addresses, not Canada.

Hurricane Electric is not a resolution for everyone looking to get an IPv6 through an IPv4 address.

Correct. With HE IPv6 tunnel you still use your IPv4 address.

 

[Treadler]

An interesting article on IPv6.

Your Wi-Fi router could tell everyone where you live — here's what you can do about it

Not everything that should be a secret actually is

www.tomsguide.com

 

[Tech9]

An interesting article on IPv6.

Very nice. How is a home user expected to test and report this?

 

[Treadler]

Very nice. How is a home user expected to test and report this?

My thoughts exactly.

 

[sfx2000]

An interesting article on IPv6.

Your Wi-Fi router could tell everyone where you live — here's what you can do about it

Not everything that should be a secret actually is

www.tomsguide.com

This isn't "news"

Explore IP Geolocation with Ipstack - Get Started Today

Uncover User Locations with Precision using ipstack - Discover Real-time IP Geolocation Data with location JSON API. Elevate your websites insights now!

ipstack.com

IP-API.com - Geolocation API

Free IP Geolocation API - lookup any IP address

ip-api.com

 

[Treadler]

This isn't "news"

Explore IP Geolocation with Ipstack - Get Started Today

Uncover User Locations with Precision using ipstack - Discover Real-time IP Geolocation Data with location JSON API. Elevate your websites insights now!

ipstack.com

IP-API.com - Geolocation API

Free IP Geolocation API - lookup any IP address

ip-api.com

It is to me.

 

[Tech9]

It helped locating the exact address though for years, 60 million gateways in the example. This is one of the issues I have with IPv6 - it's a fix over a fix over another fix. It turns out a single IP address is not exactly a needle in a haystack either. There are quite successful methods for targeted attacks. Blocking potentially malicious IPs is a bigger challenge. It says everywhere sysadmins have to apply IPv4 security to IPv6 as well. Good advice, but the tools available for IPv4 are not applicable to IPv6. Turn it on and hope for the best.

 

[Treadler]

It helped locating the exact address though for years, 60 million gateways in the example. This is one of the issues I have with IPv6 - it's a fix over a fix over another fix. It turns out a single IP address is not exactly a needle in a haystack either. There are quite successful methods for targeted attacks. Blocking potentially malicious IPs is a bigger challenge. It says everywhere sysadmins have to apply IPv4 security to IPv6 as well. Good advice, but the tools available for IPv4 are not applicable to IPv6. Turn it on and hope for the best.

I don’t like the apparent ability to harvest MAC address from IPv6 IP. Allegedly a deprecated feature, but the article above indicates there are still many devices still out there ‘giving everything away’.
An interesting conversation……..

 

[learning_curve]

An interesting article on IPv6.

Your Wi-Fi router could tell everyone where you live — here's what you can do about it

Not everything that should be a secret actually is

www.tomsguide.com

This isn't "news"

Explore IP Geolocation with Ipstack - Get Started Today

Uncover User Locations with Precision using ipstack - Discover Real-time IP Geolocation Data with location JSON API. Elevate your websites insights now!

ipstack.com

IP-API.com - Geolocation API

Free IP Geolocation API - lookup any IP address

ip-api.com

FWIW I use IPv4 and IPv6 provided via a FTTH Dual Stack (ISP supplied) modem, set on bridge mode, to my Asus Router (forum sig). I'm in Vietnam.
There's no "old-style" MAC address configured IPv6 EUI-64 IPv6 addresses in use at all (neither the Router's WAN IPv6 address and/or any of the LAN Device's individual IPv6 Addresses, as all of these devices, are new / recent purchase devices, using privacy extensions and all of their IPv6 addresses are configured using a SLAAC, predetermined, LAN IPv6 Prefix (length 64 in my case) by default, which is periodically rotated (see the following) - Plus... the WAN IPv6 address itself, is periodically rotated for security as well (Thanks ISP)

Any of those Geolocation Tests that are run on any of the current valid IPv6 addresses, gets the right country etc, but then gets completely mis-directed to a City and Lat / Lon figs that are over 300 miles away from where I am (Thanks again ISP )

Both IPv4 and IPv6 work flawlessly for me and the usage that I require from them, on my modem/router setup. The only outstanding IPv6 issues AFAIK are:

ASUS: IPv6 DDNS 100% reliable functionality. This is nearly fixed (apparently) but can be worked-around meantime, if/when using the right DDNS provider.

Merlin: Making the VPN Director - VPN Client, capture both IPv4 AND iPv6 data from any LAN devices that are running both protocols. IPv6 data is currently not captured, so if IPv6 is active on the device(s) that the VPN Director - VPN Client is "applying rules" for, then the VPN connection, erroneously, provides the correct remote IPv4 data, but also, the local IPv6 data at the same time. This, has already been fixed on the VPN Director - VPN Server, in a previous Merlin release, but a VPN Client fix will follow in a future release AFAIK. Meantime, I use a 3rd party VPN Client on any such LAN devices if/when full VPN is needed.

This article: https://www.theregister.com/2022/03/22/legacy_ipv6_addressing_standard_enables/ is (perhaps understandably) more factual, detailed and accurate IMHO on the base subject of "How legacy IPv6 addresses can spoil your network privacy" if anybody is still concerned about their own setup.

 

[Tech9]

What do you use IPv6 for @learning_curve? Do you have an IPv4 public address available?

 

[learning_curve]

What do you use IPv6 for @learning_curve? Do you have an IPv4 public address available?

IPv6 for many things where suited. One example being: SSH (including rsync / terminal / SFTP etc) to IPv6 only remote servers, of which there's quite a few - in my case. If (out of curiosity) I speed test connections to some sites, connecting via IPv6 is often, moderately faster, plus some browsers, do favour IPv6 by default too. I know lots might say; Why IPv6? / Doesn't work properly / I've got CGNAT, so it's too complicated etc. Horses for courses... It's fine for my use.

IPv4 public address available? Yes, but not pingable, by choice, as you'd expect.

IPv6 is more popular here in SE Asia / Asia probably... because nowhere here really, were early IPv4 adopters like North America / Europe were etc.
Within quite a different subject thread, but one that was relevant to IPv6, Merlin added these two posts (which supports the previous sentence):

Management of DDNS when using IPv6 / Overcoming the default: notify_rc("restart_ddns"); command

The final re-edited / updated / posted errors removed, version of all of this now: The setup that I was using was as follows: Asus DDNS **.asuscomm.com is configured via the GUI page: **/Advanced_ASUSDDNS_Content.asp & No-IP DDNS **.ddns.net was configured via CLI in a new file here...

www.snbforums.com

Management of DDNS when using IPv6 / Overcoming the default: notify_rc("restart_ddns"); command

The final re-edited / updated / posted errors removed, version of all of this now: The setup that I was using was as follows: Asus DDNS **.asuscomm.com is configured via the GUI page: **/Advanced_ASUSDDNS_Content.asp & No-IP DDNS **.ddns.net was configured via CLI in a new file here...

www.snbforums.com

 

[Tech9]

IPv6 is more popular here in SE Asia / Asia probably... because nowhere here really, were early IPv4 adopters like North America / Europe were etc.

The actual reason is this:

List of countries by IPv4 address allocation - Wikipedia

en.wikipedia.org

Your country has 169 IPv4 addresses per 1000. In USA they have 4911 per 1000. See post #249.

 

[learning_curve]

The actual reason is this:

List of countries by IPv4 address allocation - Wikipedia

en.wikipedia.org

Your country has 169 IPv4 addresses per 1000. In USA they have 4911 per 1000. See post #249.

Semantics? It's essentially the same thing isn't it? AKA There was only so many IPv4 public addresses & other counties were in the "queue" first
Vietnam wasn't even properly open to the world (tourism / businesses etc until 1997) but ironically, initially, being way behind the world in almost everything, does seem to have worked out well, as they've caught up pretty fast! It's FTTH everywhere by default c/w IPv6 (if users choose to use it), unlike say, my home country (the UK) where it's still a complete mishmash of old copper / twisted pair / fibre main route only cables & one of the biggest ISP's, only using DOCSIS 3.1 everywhere, thus not providing any IPv6 at all. Even on special request! Full, complete 5G rollout, might just change things for both countries however...

 

[Tech9]

It's essentially the same thing isn't it?

I call it unfair to reserve 50% of all available (whatever it is) for yourself, but this is what happened.

 

[Gary_Dexter]

It is to me.

And interestingly both sites give me 2 completely different "locations" over ~150 miles away from each other

 

[RMerlin]

I call it unfair to reserve 50% of all available (whatever it is) for yourself, but this is what happened.

Universities and large corporations like Ford grabbed a whole /8 for themselves back in the early days, most of which is being wasted. I know a very few of them relinquished part of that IP space, but still a lot remains wasted.

 

[sfx2000]

Universities and large corporations like Ford grabbed a whole /8 for themselves back in the early days, most of which is being wasted. I know a very few of them relinquished part of that IP space, but still a lot remains wasted.

Much like the US DoD having huge blocks of ipv4 space...

Pentagon explains odd transfer of 175 million IP addresses to obscure company

Something weird happened minutes before Trump left—US says it was security research.

arstechnica.com

 

[sfx2000]

Universities and large corporations like Ford grabbed a whole /8 for themselves back in the early days, most of which is being wasted. I know a very few of them relinquished part of that IP space, but still a lot remains wasted.

And ISP's I'll add - I think they're hoarding IPv4 space - my WAN connection is assign a public routable IP address with a /22 netmask (255.255.252.0), which means I could legit subnet out 1022 public IP's on my LAN if I were so inclined - as routing has to follow rules...

ipcalc 174.65.89.162/22
Address:   174.65.89.162        10101110.01000001.010110 01.10100010
Netmask:   255.255.252.0 = 22   11111111.11111111.111111 00.00000000
Wildcard:  0.0.3.255            00000000.00000000.000000 11.11111111
=>
Network:   174.65.88.0/22       10101110.01000001.010110 00.00000000
HostMin:   174.65.88.1          10101110.01000001.010110 00.00000001
HostMax:   174.65.91.254        10101110.01000001.010110 11.11111110
Broadcast: 174.65.91.255        10101110.01000001.010110 11.11111111
Hosts/Net: 1022                  Class B

What would be more appropriate perhaps is assigning a /29, which would give me 6 host IP's that would be public...

 

[sfx2000]

If (out of curiosity) I speed test connections to some sites, connecting via IPv6 is often, moderately faster, plus some browsers, do favour IPv6 by default too. I know lots might say; Why IPv6? / Doesn't work properly / I've got CGNAT, so it's too complicated etc. Horses for courses... It's fine for my use.

Totally cool - ipv6, newer equipment, better peering, focus on the future rather than invest in legacy...

Much like what is happening in the developing world - they're getting the latest/greatest 5G mobile - because it costs just as much to build towers, lay fiber, acquire handsets whether it's 2g/3g/4g/5g - much is greenfield...

I can bet that those networks are ipv6 first - mostly because there is no legacy to worry about...