Hacker News

points by shubhamjain 15 hours ago | 0 comments

India: 47M

China: 358M

Both countries have roughly the same population. The IPv4 problem has been swept under the rug with CGNAT and a normal person doesn't even notice it. But it sucks. Forget having a dedicated IP, even on a broadband connection, you don't get a public IP that's truly yours. According to IPInfo[1], there are around 1,000 users sharing my IP. I get flagged for malicious activity, and online gaming is impossible without a Tailscale relay.

Of course, much of this comes down to the bad luck (+ policies) of developing late, when most IPv4 blocks had already been allocated. But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks they'll probably never fully use, and may never sell. Meanwhile I am sharing a single public IP with a thousand strangers.

[1]: https://ipinfo.io/223.233.77.184

[2]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

[–] alibarber 9 hours ago

PSA that if you have a ham radio licence, anywhere in the world, there are IPv4 addresses available for you for the taking at ARDC (AMPR)[1].

You can either get a block of /24 to announce yourself (you've got to cover all the technical setup and costs of this) or use their free 44net.connect service and just organise a wireguard tunnel.

You cannot use it for anything commercial.

[1] https://wiki.ampr.org/wiki/Main_Page

[–] tcdent 8 hours ago

I have looked into acquiring an ipv4 block many times but never came across this. Thanks for the lead!

[–] kube-system 13 hours ago

> But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks

Maybe Apple and Ford, but it's more than fair that DoD has large blocks since they created ipv4 to connect themselves to other networks. It was only 10 years ago that the US government decided to give up control of IANA.

[–] Mogzol 9 hours ago

Sure there's historic reason that the DoD has such a large block, but it is definitely unfair in the modern world. There is no way they need or will ever use their massive block of addresses. They have 13 different /8 blocks, ~218 million unique addresses, that's over 5% of the entire IPv4 address space.

[–] kube-system 8 hours ago

The modern paradigm you're using as a comparison only exists because this network designed for the US military industrial complex was so freely open and fair that it is now used by everyone.

There were and still are are other global networks -- none of them come close to being anywhere near as open or interoperable. What's the next closest, PSTN maybe?

[–] sebmellen 3 hours ago

Seen differently, it’s fair for a founder who has relinquished most of their control over the system to retain 5% equity ¯\_(ツ)_/¯

[–] Marsymars 6 hours ago

My take is that the solution here isn't "give India more IPv4 addresses", it's "force more Americans onto CGNAT", so that it becomes untenable for service providers to treat IPv4 addresses as if they're tied to a single user, and to encourage people to use IPv6.

[–] matja 13 hours ago

s/IP/IPv4/g

Configuring my OS to prefer IPv6 addresses of DNS responses significantly reduced the number of web captchas I see (on NAT444 with native IPv6).

IPv4 is old and broken, use IPv6.

[–] malfist 13 hours ago

I'd love to do that, if my ISP would provide me an IPv6 address. Windstream doesn't provide IPv6s. They did a trial a few years ago rolling it out and then undid it.

It's crazy I can get fiber to my house in the US, but not IPv6.

[–] dijit 12 hours ago

iirc, hurricane electric was offering IPv6 via tunnelling somehow.

https://tunnelbroker.net

I was doing this back when I had BT in London, my internet speed back then was pretty abysmal and it would randomly drop routes- ironically this tunnel actually improved my internet (because of the routes not being dropped, not the speed).

[–] cowlevel 11 hours ago

They do this for free because they're a tier 1, meaning everyone pays to connect to them and they benefit from having more things hosted on their network. It's free because your ISP pays for it.

And they can always tell your ISP if they don't like paying to connect to the tunnelling server they should just implement v6.

[–] alibarber 9 hours ago

Annoyingly, this will not work over CGNAT as far as I know - the tunnel needs 'both ends' to be accessible directly from each other I think.

[–] bombcar 1 hour ago

There are cgnat provides who don’t also give you a real ipv6? Evil.

[–] jon128 12 hours ago

  Our free tunnel broker service enables you to reach the IPv6 Internet by tunneling over existing IPv4 connections from your IPv6 enabled host or router to one of our IPv6 routers.

  https://tunnelbroker.net/

[–] thayne 55 minutes ago

My ISP is only a few years old, but they don't support IPv6 at all. And when I complain about it to support, their response is basically "we don't see the point".

[–] sandeepkd 10 hours ago

This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6

[–] kstrauser 4 hours ago

> Most security conscious operators would only allow IPv4 instead of IPv6.

I strongly disagree. That's obsolete knowledge, thrown around by people who want to be considered security conscious but haven't actually updated their knowledge in many years. A statement with similar implications might be "security conscious operators require their users to rotate their passwords monthly", which is what a lot of people use to think a decade ago, and now what it really communicates is that you're talking to a dinosaur.

[–] asdf88990 1 hour ago

But IPv6 is complex and inherently globally accessible. Yes, NAT IS not supposed to be a firewall but it works like one nonetheless in many cases.

IPv6 will never replace IPv4 because it is a different protocol rather than merely a new version. The name is a lie.

[–] Karrot_Kream 6 hours ago

There's more that's been written about configuring/protecting IPv4 networks and if you learn about network security from a mentor or from coworkers at a job, rather than reading books/the internet/LLMs, you're more likely to learn about IPv4 security.

But if you've ever had to deal with endpoint security, if you're just doing static rule based blocking/throttling, /32 or /24 blocking is often your best option. Thanks to CGNAT this often means having a pretty large impact since an ISP's residential customer might end up getting randomly assigned a "bad" address and the cooldown for these rules is often months long or more.

In IPv6 land, you can just block a /128 or even a /64 and rarely hit anyone else in the crossfire.

[–] icedchai 5 hours ago

Blocking /128 is unlikely to block anyone for very long around here. Both the major ISPs give out /56 blocks with prefix delegation. In almost 4 years, mine hasn't changed.

[–] icedchai 5 hours ago

Most IPv4 "security" is a side-effect of NAT. NAT was not intended as a security feature, but it does provide a level of security in the common consumer implementation (PAT, single external IP, unroutable internal network.)

Otherwise, what are the practical differences?

[–] TacticalCoder 11 hours ago

> IPv4 is old and broken

IPv4 is old, very old. But how is it broken? It's literally been working just fine since it came out.

That there are limited addresses is something else: it doesn't mean it's broken.

I don't care that spying/surveillance devices have more trouble spying on me with IPv4 than with IPv6 and I don't care that some apps have a harder time establishing connection.

IPv4 works. SSH over IPv4 works. Browsing the Web over IPv4 works.

[–] Xirdus 5 hours ago

IPv4 stopped working fine some 30 years ago. The invention of NAT was caused by IPv4 not working fine (RFC 1631 was written under assumption it's a temporary solution). Hole punching is a thing solely because IPv4 stopped working fine. Much like Y2K, the reason IPv4 appears to work fine is because absolutely massive engineering effort was put to work around the parts that don't work fine.

[–] teddyh 8 hours ago

> IPv4 is old, very old. But how is it broken?

It is broken for you by upstream NAT and CGNAT.

[–] broken-kebab 7 hours ago

You mean it's fixed by NAT and CGNAT. Because it's works just fine for me.

[–] spauldo 5 hours ago

NAT and CGNAT break the basic idea of how the Internet was designed, forcing everyone into servers and consumers. We've just become used to it, and most people have never experienced it any other way.

The Internet was supposed to be a purely peer-to-peer network, where the addresses on each side of a connection pointed to an end node. That's why protocols like FTP or SIP break when NAT is used, and why you have to play games with port forwarding if you want to run services from your house (assuming you have a public IP address at all).

[–] broken-kebab 5 hours ago

It's slightly unrealic idea though, as most of internet users are consumers, and that's the role they really prefer. That's why Dropbox gained popularity in spite of, you know, the fact that we all can do it with FTP.

[–] throw0101c 4 hours ago

> It's slightly unrealic idea though, as most of internet users are consumers, and that's the role they really prefer.

Because just about all applications are currently architected in such a manner.

When Skype first came out many moons ago it allowed peer-to-peer connections with clients, but a lot of clients were behind NAT (especially ones that could not do PCP or UPnP), so Skype had to come up with the notion of "super nodes" that could do relaying.

Protocols like STUN/TURN/ICE/etc had to be developed to deal with all of this blocking of traffic.

If clients could know their 'real' addresses and allow things like PCP (which is often needed for (e.g.) video games), then perhaps there could me less strictly consuming and more collaborating.

[–] spauldo 4 hours ago

We couldn't do it with FTP. That's kinda the point. We didn't have static IP addresses for every machine or the entries in DNS to go with them.

The whole idea of "consumer" and "server" nodes is so baked into how people think about networking they don't even realize it. But that's not how the Internet was intended to be in the first place.

[–] wolrah 4 hours ago

> That's why Dropbox gained popularity in spite of, you know, the fact that we all can do it with FTP.

Dropbox gained popularity *BECAUSE IT MADE IT EASY TO DO THIS WHEN YOU'RE STUCK BEHIND NAT TRASH*. By the time it was even a thought in anyone's brain the internet had already been ruined by that garbage.

It would never have existed in a world without NAT because it wouldn't have been needed, syncing data between computers you owned that all had publicly routable addresses is a much simpler problem.

Every ISP that has CGNAT v4 without providing full v6 needs to be shut down. They are either incompetent or actively choosing to make their users' service less useful to restrict them and/or encourage "upgrades". Internet service has a public routable IP address, period.

[–] throw0101c 4 hours ago

> You mean it's fixed by NAT and CGNAT. Because it's works just fine for me.

CGNAT works for you? Do you play video games at all? Because there are all sorts of people for which it doesn't.

The fact that you may be fortunate enough to get a publicly-accessible IPv4 address on your WAN interface does not mean everyone else is. This type of attitude seems to be akin to "I gots mine."

[–] broken-kebab 3 hours ago

I don't play this kind of games at all, but I still can sympathize with you if it's your preferred pastime, and it doesn't work as good as you'd like. I just don't think it warrants a conclusion that those nets in which we are arguing are broken. They are tangibly, observably doing pretty well. And I find that the idea that in a shiny world of pure IPv6 central servers/nodes would decentralize themselves comes from deep misunderstanding about what "normal" humans want.

[–] Karrot_Kream 6 hours ago

Until a service's WAF catches your /32 because your ISP had previously handed it out to a spammer.

[–] broken-kebab 5 hours ago

There are working procedures to follow in such situations, and minimally competent ISPs deal with them well enough so that most users don't even know the problem exists.

[–] w3ll_w3ll_w3ll 13 hours ago

There is no need for that, every modern OS prefer IPv6 over IPv4

[–] matja 13 hours ago

Depends on the application, a web-browser that implements Happy Eyeballs protocol may prefer IPv4 if the IPv6 latency is higher.

[–] nomel 9 hours ago

I know little of this. How/why could one be higher latency over the other?

[–] winstonwinston 7 hours ago

Different paths. If you’ve got a “dual stack” on your computer, give it a try.

tracert -4 google.com

tracert -6 google.com

I do get very different hops and latency.

However for “happy eyeballs” algo to fallback to IPv4, latency needs to be very bad on IPv6.

[–] bombcar 1 hour ago

Happy eyeballs is more to fix totally broke ipv6 than speed differential.

For many years and even how there are networks that advertise they can do ipv6 and hand out real addresses but nothing works.

[–] icedchai 14 hours ago

A lot of the original /8 holders have sold off chunks to AWS and other cloud providers.

[–] cowlevel 11 hours ago

China mandates IPv6. So does the US, but the US drags their feet. Meanwhile in Europe it's near universal even though not mandated and no v4 shortage.

[–] throwawayfifo 10 hours ago

>Meanwhile in Europe it's near universal

False: https://stats.labs.apnic.net/ipv6

[–] alibarber 9 hours ago

On HN, 'In Europe' means in one person's particular locale based on their experience and generalised across a continent of about 30 countries. But it's always better than in the US of course.

[–] efilife 3 hours ago

Can we stop this europe/us fight? This remark was completely unwarranted

[–] spauldo 5 hours ago

Unless I've missed something, the US only mandates it for government networks. I don't think there is any mandate for private entities to implement it.

[–] cowlevel 4 hours ago

A residential network that can't connect you to government websites is called a fraudulent business model. No different from selling a car that only transports up to 20kg.

[–] spauldo 4 hours ago

I guess I should clarify: the government mandate is that government sites are dual-stack. They have to support IPv6 in addition to IPv4.

[–] debugnik 9 hours ago

I wish, just 37.73% of IPv6-capable users in Europe according to APNIC despite much higher availability in transit AS. Highest subgroup is Western Europe at around 72.09%, which is still far from near universal. Similar per-country numbers from Cisco.

[–] swores 13 hours ago

> "India: 47M
> "China: 358M

> "Both countries have roughly the same population"

To save anyone else curious from looking it up - their populations are about 1.4 billion (1400 million) each.

[–] jagaerglad 11 hours ago

and one of the countries has an over-reported while the other is underreporting

[–] giancarlostoro 7 hours ago

What I really don't understand is IPv6 has been around... decades now... why the heck havent we started forcing it more and more?

[–] ajnin 2 hours ago

IPv6 brings more address space but also a whole bunch of other stuff, it is much more complex and changes basically everything to how you manage a network. The fact that it's not been widely adopted after 30 years indicates that people generally think the tradeoff is not worth it.

[–] spauldo 5 hours ago

A large chunk of IT people don't understand it. So they don't demand it from their vendors. The vendors see the lack of demand so they spend fewer resources on it. When someone wants to implement IPv6, they see the limited vendor support and decide against it.

The last three companies I've worked at have all been IPv4 only. I set up IPv6 in our lab, but neither the SCADA software nor the PLCs we use support it at all, and none of my coworkers can troubleshoot it if problems pop up.

I've got a buddy that's a technical manager at an ISP and he'll straight up tell you they don't do IPv6 because he and his people don't know it.

[–] icedchai 5 hours ago

Yep. I run into "enterprise" cloud environments where IPv6 is disabled, all the time. The sad thing is IPv6 is easier to understand than v4, just based on subnetting practices alone. The real problem is the average "IT" person doesn't understand hexadecimal.

[–] Mountain_Skies 7 hours ago

Attempts to force it get routed around.

[–] rayiner 15 hours ago

Wow I didn’t know CGNAT was a thing for home users.

[–] cykros 14 hours ago

It's something I've only recently been made aware of as well. Shocked we're not seeing more push for ipv6 everywhere given that it sounds common enough. If I don't have an IP address, I'm not getting the Internet I'm paying for; I'm getting access to a network that happens to itself have a connection to the Internet. Not unlike some of the BBS's in the early 90s which had Internet access -- I might be dialed in, but that didn't mean my computer itself was on the Internet.

[–] orangeboats 14 hours ago

I can't tell if this is sarcasm, Poe's law and all.

But if you are living in a Western country, then you are probably blessed with CGNAT-free residential internet.

[–] timpera 14 hours ago

I don't think it's sarcasm, I didn't know this was a thing either! At first, I thought OP was writing about their mobile connection.

Some carriers in my country have recently started to share the same IP between 4 customers, each having a port range (1-16363, ...), but you can always request a full IP for free.

[–] orangeboats 14 hours ago

That explains a lot of the sentiments I've seen on HN then...

I, unfortunately, have been on CGNATed residential internet since 2016, though I used to still get a public IP on request (they stopped doing that though.) I live in South East Asia, for context.

Without IPv6 my only choice would have been relying on a centralized service like Zerotier and Tailscale.

[–] fishtacos 14 hours ago

My current setup is CGNAT on 5G WAN (T-Mobile US), which obviously doesn't open public ports besides needed NAT.

Worse is I have IPv6 connectivity for devices, yet still no open ports available, so no serving available. And I only receive a /64 so no delegation available through router.

So now it's Hurricane Electric tunnel to their nearest (in my city) hosted node for IPv6 and a prepaid 50 USD/year node (technically x2 since I wanted a backup to play around with) for IPv4 port forwarding.

Both options are acceptable because the needed infra is close by in the largest metroplex in Texas, it just sucks to have to do all this extra work to replicate what I could do with a dial-up ISP.

I'll say this - having LLM assistants handle the nasty routing and firewall rules needed to make this hodge podge work without needing to be a network engineer has been very helpful.

[–] myself248 10 hours ago

I converted from residential-class to business-class cable a few years ago. In both cases, I had routable IPv4 addresses.

I was just looking at flipping back, but now it seems the default for new resi accounts is CGNAT. They say they'll give me a real IP upon request at no additional charge, but it's anyone's guess how long that holds out.

They don't do IPv6 at all.

Michigan USA.

[–] sandos 14 hours ago

In Sweden CGNAT was not a thing for a long time, the large incumbents still have their huge blocks of IPs so its "just" go to them if you want a pulic IP. Apparently smaller ISPs do use CGNAT, so its fairly common.

Me as somewhat of a nerd, even doubt if I need a public IP, seeing how cyber security is looking today.

[–] xattt 10 hours ago

Bell in Canada continues to offer only IPv4 on their fibre network. I fully expect for them to somehow crap up the transition to IPv6 by putting up CGNAT because fuck you, customer.

[–] TheCycoONE 7 hours ago

Fascinating. The resellers, particularly TechSavvy have ipv6. For TechSavvy I believe it was dynamic /64 by default but static /56 for free on request.

[–] throw0101a 3 hours ago

> For TechSavvy I believe it was dynamic /64 by default but static /56 for free on request.

"On request" meaning you told your CPE equipment to send a DHCP-PD packet, i.e., you didn't have to call them and ask for something special with your account.

[–] allthetime 3 hours ago

an ipv4 for every man woman and child!

[–] wtch98 12 hours ago

Most people don't care about a private IP, which is why they cost about $20-$25 each (which would be about $2 a year to finance). I've used Airtel in the past and they certainly offer a dedicated IP. Currently I'm with TATA and Vodafone in India

Indeed a shared IP is arguably a benefit in that it makes fingerprinting harder.

If your ISP had customers who were interested it could spend $150k on a /19 block giving 8000 IPv4 addresses and charge an extra ₹100 a month for them and after two years it would be in profit.

In fact I think Jio and Airtel offer static IPs for residential use for something like ₹300 a month, which given how cheap IPv4 addresses are is a massive money spinner, but I have't spoken to anyone living in India about ISPs for a couple of years.

[–] lifeisloving 7 hours ago

CGNAT is awesome, you cant IP ban me anymore and I dont need a VPN turned on for silly things, and I can control fingerprinting (mostly), CGNAT is great for anonymity. If I want a static it cost me ~10.00 a month, im fine with that.

[–] oefrha 2 hours ago

On the other hand, sometimes you get randomly banned due to someone else’s action on the CGNAT IP. Wikipedia is an obvious example.

[–] creatonez 3 hours ago

"swept under the rug with CGNAT" is a really funny way to say "solved by IPv6"

[–] jon128 12 hours ago

End users do notice CGNAT when their internet voice/video calls keep dropping for no apparent reason.

[–] bell-cot 14 hours ago

Yep. And, insult to injury, the /4's and /8's of little-unused IPv4 special-use addresses - https://en.wikipedia.org/wiki/Ipv4#Special-use_addresses