Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Hyperoptic: IPv6 and Out-of-Order Packets (zakkemble.net)
70 points by speckx 55 days ago | hide | past | favorite | 14 comments


FWIW, IPv6 has worked just fine for me since they enabled it (I don't think I had it when I initially got them as my ISP). I also have found them pretty responsive to even technical feedback, but maybe I've just been lucky.

Of course, there was that one time they "upgraded" our building and forgot to re-plug my line to the router, but, oh well..

Overall, this seems like a super niche topic for HN. :)


Mine was working perfectly fine until they performed an "upgrade" to the infrastructure on our estate last week. Now I'm seeing pretty similar symptoms as described in the blog post (e.g very flappy ipv6 connectivity).


Same, haven't had any problems with IPv6 via Hyperoptic. He might just be unlucky having some defective equipment upstream.


I believe it heavily depends on what kind of infrastructure you are using with them.

If you are on their old legacy network (aka, you have a RJ45 Ethernet jack into your house) you will likely going to have more issues than if you are on their (X)GPON network.

I had IPv6 working for a while on mine, but realize that for some insane reason that there was basically only one v6 prefix across my entire distribution switch (basically the switch shared with a few 100 other properties). so anytime that i was going to get a v6 i was effectively stealing it from another flat/house.

unfortunately trying to get in touch with anyone from Hyper-optic is really tricky, so I just gave up

they have since upgraded some of the infrastructure in the path, mostly moving away from Huawei to Nokia, but I am not entirely sure that has improved the situation.


This can be fixed by the ISP by using MPLS control word.

https://datatracker.ietf.org/doc/html/rfc4448#section-4.6


Another long network debug that stared by enabling IPv6. Keep it off. :)

Working > New


I would argue that having to pay more than $20 for an address, having to do weird NAT hole punching to get a direct connection between two machines, and having an internet that can easily be completely scanned by hackers are all things that are not "working".

Working for you != working for everyone

Basically functioning != Working as well as it could

There are more advantages to IPv6. We don't see all of the advantages because we can't use them, because we are still largely stuck in an IPv4 world. This is a problem caused by not enabling IPv6.


My ISP provides me with upto 8 ipv4 addresses if I want them. At auction an IPv4 to buy is only $20 each. not $20 a month, $20. Having an ISP rips you off is not mitigated with ipv6, you still have an ISP that rips you off.

I have to put firewall rules in anyway (as I don't want a random device on the internet to be able to talk to my bathroom speaker), so what's the difference?

I get an RTP stream pushed from a source, if I want it on my laptop I dst-nat it to my laptop, if I want it on my desktop I dst-nat it to my desktop, no need to change the destination on the source IP. How would I do that with ipv6 - DNS I guess, if the source supports DNS lookups (some do, most don't)

I also have the advantage of being able to steer outgoing traffic via either my DSL or via my 4g depending on various rules (including source IP, target IP, protocol, src/dest ports, DSCP tags etc). I believe I can do this with NPT on ipv6, same as on ipv4.

But sure, security through obscurity is useful.

In any case I still have to maintain an ipv4 network as some services still won't work on ipv6 only subnets (even with NAT64 and DNS64), so the choice is either having an ipv4 network, or having an ipv4 and ipv6 network.

The former is less work and more secure.


> My ISP provides me with upto 8 ipv4 addresses if I want them.

It's great that your ISP does that. Mine doesn't, maybe it would for an extra charge if I got some kind of business account. Which makes sense, as the IPv4 addresses your ISP own are a valuable resource.

At the hacker space I'm part of we need to use a reverse proxy to run all our services on a single IPv4 address we get from our ISP.

> I have to put firewall rules in anyway (as I don't want a random device on the internet to be able to talk to my bathroom speaker), so what's the difference?

If, for example, two friends want to play a FPS game with each other they could connect directly. They still need to "punch" out to get the firewall open, but you lose the step where you have to guess at which port the message may end up. Right now I hear that with some ISP's you don't even get a public IP on your router, so even NAT hole punching doesn't work.

Not a lot of games currently provide the option to connect directly, but that's because it often doesn't work well behind NAT on IPv4 networks.

> I get an RTP stream pushed from a source

This sounds like a pretty niche application, but sure. I don't have the immediate best Ipv6 solution for you. Maybe you could switch which device has the RTP-receive IPv6 address (one device can have multiple IPs), you could do NAT on IPv6 for this application.

Right now you're using the NAT as a kind of forwarder to send the data to different hosts, so if you have a router you can run software on you could just have it forward to both devices on the local network.

> I also have the advantage of being able to steer outgoing traffic via either my DSL or via my 4g depending on various rules

Aren't these features of your router, not of your IP stack?

> In any case I still have to maintain an ipv4 network as some services still won't work on ipv6 only subnets.

You're right, it doesn't always make sense for an individual to switch. That's why we're still stuck on old technology.

But prices for IPv4 addresses are going up. There are already VPS's that charge less if you don't need IPv4. Availability of IPv6 for consumers is going up; In India it's near 80%. At some point, some kind of service in India is going to not bother to get IPv4.


The "punch out" part is the problem. You can't "punch out" without using special tricks (send UDP source port 1234 to target port 1234 on both machines at the same time and then pretend that UDP is an established connection to get through your stateful firewall)

If your firewall randomises your source ports then sure, you have to use the birthday problem style tricks that tailscale uses, it's not onerous though.

> Aren't these features of your router, not of your IP stack?

Yes, and that's where I want them to stay. Which means NATing depending on which direction I want to send the traffic (and get return traffic) -- even if I have a BGP handoff upstream. So ipv6 doesn't get rid of NAT's use, just changes it to a 1:1 mapping which is a minor benefit (and renames it to NPT)

> This sounds like a pretty niche application, but sure.

The internet has two sets of people

1) Consumers who just want to establish https connections to server, in which case they don't care about NAT, CGNAT, etc

2) People with niche applications

NAT is a very useful tool, and the ipv6 fanboys that go on about how evil it is just want to take that ability away from people because they don't understand it. Most of the arguments against NAT stem from a time when stateful firewalls were not a thing.

> Right now you're using the NAT as a kind of forwarder to send the data to different hosts, so if you have a router you can run software on you could just have it forward to both devices on the local network.

Yes, this software runs at a layer 4 level and forwards the selected traffic by translating the address. That's exactly what NAT is, it's great.

I'd be quite happy running an ipv6 network with network translation but given that far too many things simply don't work on an ipv6 only network (tv, nintendo switch, zscaler laptop), and those that do require 64 translation (github)

IPv4 addresses are not increasing in cost by the way - in nominal terms let alone adjusted for inflation. In real terms they're 20% cheaper than 2019

https://auctions.ipv4.global/prior-sales


However if you have weird connection issues, starting by disabling IPv6 is often a very reasonable move if IPv6 was enabled.

Of course, once you figure out it's IPv6 related you can then work on figuring out what's actually going on.


Good thing James Watt didn't think along the same lines 250 years ago :)


I'm on Hyperoptic and use IPv6 regularly. Pretty sure it was enabled by default.

I haven't had the same problems this guy has, although I do believe his issues are real.


You can’t even access certain parts of the internet without ipv6 these days.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: