Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm wondering if this is really the case, or, if when IPv6 does get widespread adoption, we will still hide all the machines on a network behind a single (or few) IP address under the assumption that this is more secure - or will we finally be able to configure our firewalls to handle all of that security?

And do you think that when IPv6 will finally get widespread adoption?

share|improve this question

9 Answers 9

up vote 13 down vote accepted

Do you think NAT is largely responsible for the delay in IPv6 adoption?

In one sense, absolutely. We were facing an IP allocation crisis early on, but now it's been largely resolved. If we didn't have cheap NAT, we would have had to move to IPv6 years ago just to keep up with all the internet connected devices that are proliferating.

However, keep in mind that the infrastructure is what's really preventing change. If infrastructure weren't a problem, then we would have transitioned long ago, even if NAT was available.

NAT was really a solution to avoid upgrading the infrastructure, but it's the infrastructure that is holding us back.

Will we hide behind a single IP address for security?

NAT has given us a certain amount of security, but at a big cost of liberty. I believe we'll see NAT or NAT like devices available for IPv6, but my expectation is that we'll forgo that for more liberty in how we use the internet. Push content is something that has suffered at the hands of NAT, and the iPhone, for instance, is now using a model where internet servers alert it for software and data use.

Firewalls will have characteristics of NATs, and we'll see NAT because that's how ISPs operate, but it will go away as people desire more powerful use of the internet.

When will IPv6 finally get widespread adoption?

It's going to be a gradual process. Europe and Japan already have made significant progress, but there's too much old equipment in the US to switch over quickly.

All the ISP level and above routers and equipment being purchased handles IPv6, but it's going to be about 3-5 years before the old equipment is cleared away enough that ISPs and hosting companies will fell comfortable starting to depreciate IPv4 in favor of IPv6.

The smaller high tech countries will switch first (smaller infrastructure), and the US will lag to a small degree. But I expect in 10 years or so the majority of internet traffic will be routed via IPv6, and most ISPs will have more IPv6 customers than IPv4 only.

-Adam

share|improve this answer
1  
I wouldn't say it's been "largely resolved". The crisis was delayed but not solved. Eventually we will run out of IPv4 addresses. –  Brad Wilson Apr 30 '09 at 16:51
3  
NAT does not enhance security. Your stateful firewall enhances security. Being behind a NAT doesn't make it any harder for me to break into your computer than a reasonable default firewall config would. –  Dustin Apr 30 '09 at 17:40
1  
@Dustin - There are certain attacks you CANNOT do through a NAT unless the user has configured it to allow inbound port connections, so while there is disagreement on the amount of security it provides, one cannot claim it doesn't enhance security at all. –  Adam Davis Apr 30 '09 at 19:06
3  
@Cristian - Of course, but it's the difference between opt-out and opt-in. You have to work to make NAT allow traffic through from the internet facing side without initiating it from the network side. With a full IP address everything comes through by default, and you have to do some work to change that. NAT is intrinsically more secure. –  Adam Davis May 30 '09 at 19:40
1  
@Adam, a default-deny firewall is a pretty ordinary part of any edge-router, even the consumer-grade WiFi ones. Even if they don't do NAT in an IPv6 world, we're not going to go back to default-permit edge-routers. –  Richard Gadsden Oct 16 '10 at 11:00

IMHO (as an IETF participant and previously as network manager at an ISP) - no NAT has not delayed IPv6 adoption.

IPv6 adoption is being held back for many reasons, amongst them:

  1. lack of suppliers of IPv6 global transit
  2. lack of support in core routers
  3. lack of support in customer routers
  4. lack of support in firewalls
  5. lack of support in client software
  6. lack of a "killer application"

For me, the (lack of) consumer router support is the real IPv6 killer - support at the core is steadily improving.

At the moment about the only consumer routers that handle IPv6 over an ADSL link are Cisco's, and even a low-end 800 series unit is quite a lot more expensive than a decent quality unit from most any other manufacturer.

share|improve this answer
    
Much of your list is likely due to NAT. e.g. It'd be a killer application if it meant things could get on the internet where they couldn't before due to scarcity of addresses. –  Dustin Apr 30 '09 at 17:35
1  
No, not one of those is due to NAT. There was an idea a couple of years ago for a free porn site only accessible over IPv6, but I don't recall what came of it. –  Alnitak Apr 30 '09 at 18:32
    
+1 For lack of Consumer Router support! We haven't (early 2011) run out of addresses yet! –  unixman83 Apr 4 '11 at 4:46
    
If every home needed a /28 or so to support all the devices, then we would have run out of IPv4 addresses a long time ago, so in that sense NAT defintely delayed IPv6. My business would need a /21 if there was no NAT. Some of the really big ISPs would need a /7 or even a /6 –  Richard Gadsden Apr 15 '11 at 11:16
    
You're right, but to be honest I don't think we'd have got IPv6 much quicker because of the other problems. Even now when we really are close to running out it's still hard to get an IPv6 consumer grade connection. –  Alnitak Apr 15 '11 at 11:21

The biggest blocker to widespread IPv6 adoption is end user equipment. Without the infrastructure being in place all the way to the end user, some IPv6 to IPv4 translation will be required.

share|improve this answer

I concur with Alnitak's pointing to CPE as a problem. Even with Cisco, you need an 877 (for ADSL) to get IPv6 — not an 857 — and ISPs are orders of magnitude more likely to go with modems that are as cheap as they can possibly find (i.e. ZyXEL 660); you're lucky if those support IPv**4** reasonably well.

At this point, I'd expect most computers will Just Work if presented with CPE that is advertising an IPv6 route, but other devices may be a different story. Does that cheap consumer inkjet with a WLAN card support IPv6? My Siemens DECT/SIP phone doesn't. (In Japan, it's another story, as there are fixed-line phones on sale there that require IPv6.)

Administrative networks (i.e. Comcast's IP link to your cable box) will be IPv6 soon, if not already, because RFC 1918 doesn't provide enough address space. Cellular networks have it easy because the devices tend to be centrally provisioned. For the bits that connect the user's computers with the Intarwebz, I suspect it'll be several more years outside of Japan.

Incidentally, the free pr0n site is ipv6experiment dot com, but it's still not live. (That link is completely work-safe, as the nasty stuff is several clicks away.)

share|improve this answer

Here's an interesting thought:

NAT may actually help adoption of IPV6. The average Internet consumer, not hosting their own private services, could continue using private (RFC1918) IPV4 addresses internally while their public Internet connection transitioned to IPV6. At least, I don't remember hearing anything to the contrary.

Consider the effect of this... if we took back all the IPV4 addresses used by people just playing WoW and updating their Facebook accounts, we wouldn't have much the shortage anymore. And, what would those users care? Chances are, most of them never knew what their external IP was anyway. Not to mention that it's ubiquitously dynamic, and thus already prone to change.

Meanwhile, the public services du jour (let's say, eg., Google) need to retain IPV4 addresses until the number of dotted-decimal hits dwindles down near zero. Those guys aren't using NAT anyway. Load-balancing, maybe, but the more commonly-referenced port-address translation A.K.A. NAT overload, which facilitates IP reduction? Nah.

share|improve this answer
    
No, I disagree. The consumer equipment would still need to be upgraded. Somebody has to pay. –  unixman83 Apr 4 '11 at 4:47

I think that NAT is partially responsible for the delay in the need for IPv6 adoption, as it helped prevent the world from running about of assignable IPv4 addresses. I'm certain that NAT will remain in widespread use even under IPv6 for reasons of security, control, and management.

I think in five years well begin to see a significant increase in IPv6 usage, but I'm not going to predict whether it'll be 5% or 50% penetration.

share|improve this answer
1  
NAT does not in any way enhance security. It also makes management extremely difficult when you have to connect two networks together that are using the same IP address space, for example. –  Dustin Apr 30 '09 at 17:37
1  
@Dustin: A machine behind NAT cannot be hacked directly from the internet. Of course NAT enhances security. There's no end-all-be-all and no golden bullet, but saying there is no security enhancement is just silly. Your other criticism of NAT is reasonable, but I never said NAT is the most wonderful thing in the world. –  Eddie Apr 30 '09 at 19:08
    
@Eddie: you can block incoming connections using a properly configured firewall on the gateway, even if you don't use NAT. What NAT itself gives you is pseudo-security; btw NAT = SNAT + DNAT. –  Cristian Ciupitu May 30 '09 at 10:08
    
@Eddie, that's a default-deny firewall. If you had a NAT router that was default-allow, then it would be just as insecure as any other default-allow system. People think that NAT gives some security because NAT and default-deny firewalls came in at the same time and on the same devices. –  Richard Gadsden Oct 16 '10 at 11:41
    
@Richard Gadsen, @Cristian Ciupitu, I understand what you both say. I'm just reacting to the absolutist statement that NAT does not in any way enhance security, which is silly. –  Eddie Oct 18 '10 at 15:47

I think IPv6 adoption will speed up when everything needs an IP address but can't all be expected to connect to a router.

Things such as phones, cars, thermostats, and your refrigerator's RFID scanner.

share|improve this answer

NAT lets you turn IPv4 addresses into Autonomous System numbers (more or less), so yes, I think it's responsible for the delay.

share|improve this answer
2  
"NAT lets you turn IPv4 addresses into AS's" - what on earth do you think that means? –  Alnitak May 26 '09 at 8:49

Yes, I fully believe it has slowed adoption. Hardware follows need and demand. Had we a demand for IPV6 due to loss of IPv4 addresses years ago, we would long since have the hardware available to support it. Why is there limited hardware now? Because there was no demand 1 year ago.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.