5

I'm wondering if this is really the case, or, if when IPv6 does get widespread adoption, we will still hide all the machines on a network behind a single (or few) IP address under the assumption that this is more secure - or will we finally be able to configure our firewalls to handle all of that security?

And do you think that when IPv6 will finally get widespread adoption?

0

9 Answers 9

13

Do you think NAT is largely responsible for the delay in IPv6 adoption?

In one sense, absolutely. We were facing an IP allocation crisis early on, but now it's been largely resolved. If we didn't have cheap NAT, we would have had to move to IPv6 years ago just to keep up with all the internet connected devices that are proliferating.

However, keep in mind that the infrastructure is what's really preventing change. If infrastructure weren't a problem, then we would have transitioned long ago, even if NAT was available.

NAT was really a solution to avoid upgrading the infrastructure, but it's the infrastructure that is holding us back.

Will we hide behind a single IP address for security?

NAT has given us a certain amount of security, but at a big cost of liberty. I believe we'll see NAT or NAT like devices available for IPv6, but my expectation is that we'll forgo that for more liberty in how we use the internet. Push content is something that has suffered at the hands of NAT, and the iPhone, for instance, is now using a model where internet servers alert it for software and data use.

Firewalls will have characteristics of NATs, and we'll see NAT because that's how ISPs operate, but it will go away as people desire more powerful use of the internet.

When will IPv6 finally get widespread adoption?

It's going to be a gradual process. Europe and Japan already have made significant progress, but there's too much old equipment in the US to switch over quickly.

All the ISP level and above routers and equipment being purchased handles IPv6, but it's going to be about 3-5 years before the old equipment is cleared away enough that ISPs and hosting companies will fell comfortable starting to depreciate IPv4 in favor of IPv6.

The smaller high tech countries will switch first (smaller infrastructure), and the US will lag to a small degree. But I expect in 10 years or so the majority of internet traffic will be routed via IPv6, and most ISPs will have more IPv6 customers than IPv4 only.

-Adam

7
  • 2
    I wouldn't say it's been "largely resolved". The crisis was delayed but not solved. Eventually we will run out of IPv4 addresses. Apr 30, 2009 at 16:51
  • 3
    NAT does not enhance security. Your stateful firewall enhances security. Being behind a NAT doesn't make it any harder for me to break into your computer than a reasonable default firewall config would.
    – Dustin
    Apr 30, 2009 at 17:40
  • 1
    @Dustin - There are certain attacks you CANNOT do through a NAT unless the user has configured it to allow inbound port connections, so while there is disagreement on the amount of security it provides, one cannot claim it doesn't enhance security at all.
    – Adam Davis
    Apr 30, 2009 at 19:06
  • 3
    @Cristian - Of course, but it's the difference between opt-out and opt-in. You have to work to make NAT allow traffic through from the internet facing side without initiating it from the network side. With a full IP address everything comes through by default, and you have to do some work to change that. NAT is intrinsically more secure.
    – Adam Davis
    May 30, 2009 at 19:40
  • 1
    @Adam, a default-deny firewall is a pretty ordinary part of any edge-router, even the consumer-grade WiFi ones. Even if they don't do NAT in an IPv6 world, we're not going to go back to default-permit edge-routers. Oct 16, 2010 at 11:00
9

IMHO (as an IETF participant and previously as network manager at an ISP) - no NAT has not delayed IPv6 adoption.

IPv6 adoption is being held back for many reasons, amongst them:

  1. lack of suppliers of IPv6 global transit
  2. lack of support in core routers
  3. lack of support in customer routers
  4. lack of support in firewalls
  5. lack of support in client software
  6. lack of a "killer application"

For me, the (lack of) consumer router support is the real IPv6 killer - support at the core is steadily improving.

At the moment about the only consumer routers that handle IPv6 over an ADSL link are Cisco's, and even a low-end 800 series unit is quite a lot more expensive than a decent quality unit from most any other manufacturer.

5
  • Much of your list is likely due to NAT. e.g. It'd be a killer application if it meant things could get on the internet where they couldn't before due to scarcity of addresses.
    – Dustin
    Apr 30, 2009 at 17:35
  • 1
    No, not one of those is due to NAT. There was an idea a couple of years ago for a free porn site only accessible over IPv6, but I don't recall what came of it.
    – Alnitak
    Apr 30, 2009 at 18:32
  • +1 For lack of Consumer Router support! We haven't (early 2011) run out of addresses yet!
    – unixman83
    Apr 4, 2011 at 4:46
  • 1
    If every home needed a /28 or so to support all the devices, then we would have run out of IPv4 addresses a long time ago, so in that sense NAT defintely delayed IPv6. My business would need a /21 if there was no NAT. Some of the really big ISPs would need a /7 or even a /6 Apr 15, 2011 at 11:16
  • You're right, but to be honest I don't think we'd have got IPv6 much quicker because of the other problems. Even now when we really are close to running out it's still hard to get an IPv6 consumer grade connection.
    – Alnitak
    Apr 15, 2011 at 11:21
4

The biggest blocker to widespread IPv6 adoption is end user equipment. Without the infrastructure being in place all the way to the end user, some IPv6 to IPv4 translation will be required.

2

I concur with Alnitak's pointing to CPE as a problem. Even with Cisco, you need an 877 (for ADSL) to get IPv6 — not an 857 — and ISPs are orders of magnitude more likely to go with modems that are as cheap as they can possibly find (i.e. ZyXEL 660); you're lucky if those support IPv4 reasonably well.

At this point, I'd expect most computers will Just Work if presented with CPE that is advertising an IPv6 route, but other devices may be a different story. Does that cheap consumer inkjet with a WLAN card support IPv6? My Siemens DECT/SIP phone doesn't. (In Japan, it's another story, as there are fixed-line phones on sale there that require IPv6.)

Administrative networks (i.e. Comcast's IP link to your cable box) will be IPv6 soon, if not already, because RFC 1918 doesn't provide enough address space. Cellular networks have it easy because the devices tend to be centrally provisioned. For the bits that connect the user's computers with the Intarwebz, I suspect it'll be several more years outside of Japan.

Incidentally, the free pr0n site is ipv6experiment dot com, but it's still not live. (That link is completely work-safe, as the nasty stuff is several clicks away.)

1

Here's an interesting thought:

NAT may actually help adoption of IPV6. The average Internet consumer, not hosting their own private services, could continue using private (RFC1918) IPV4 addresses internally while their public Internet connection transitioned to IPV6. At least, I don't remember hearing anything to the contrary.

Consider the effect of this... if we took back all the IPV4 addresses used by people just playing WoW and updating their Facebook accounts, we wouldn't have much the shortage anymore. And, what would those users care? Chances are, most of them never knew what their external IP was anyway. Not to mention that it's ubiquitously dynamic, and thus already prone to change.

Meanwhile, the public services du jour (let's say, eg., Google) need to retain IPV4 addresses until the number of dotted-decimal hits dwindles down near zero. Those guys aren't using NAT anyway. Load-balancing, maybe, but the more commonly-referenced port-address translation A.K.A. NAT overload, which facilitates IP reduction? Nah.

1
  • No, I disagree. The consumer equipment would still need to be upgraded. Somebody has to pay.
    – unixman83
    Apr 4, 2011 at 4:47
0

I think that NAT is partially responsible for the delay in the need for IPv6 adoption, as it helped prevent the world from running about of assignable IPv4 addresses. I'm certain that NAT will remain in widespread use even under IPv6 for reasons of security, control, and management.

I think in five years well begin to see a significant increase in IPv6 usage, but I'm not going to predict whether it'll be 5% or 50% penetration.

7
  • 1
    NAT does not in any way enhance security. It also makes management extremely difficult when you have to connect two networks together that are using the same IP address space, for example.
    – Dustin
    Apr 30, 2009 at 17:37
  • 1
    @Dustin: A machine behind NAT cannot be hacked directly from the internet. Of course NAT enhances security. There's no end-all-be-all and no golden bullet, but saying there is no security enhancement is just silly. Your other criticism of NAT is reasonable, but I never said NAT is the most wonderful thing in the world.
    – Eddie
    Apr 30, 2009 at 19:08
  • @Eddie: you can block incoming connections using a properly configured firewall on the gateway, even if you don't use NAT. What NAT itself gives you is pseudo-security; btw NAT = SNAT + DNAT. May 30, 2009 at 10:08
  • @Eddie, that's a default-deny firewall. If you had a NAT router that was default-allow, then it would be just as insecure as any other default-allow system. People think that NAT gives some security because NAT and default-deny firewalls came in at the same time and on the same devices. Oct 16, 2010 at 11:41
  • @Richard Gadsen, @Cristian Ciupitu, I understand what you both say. I'm just reacting to the absolutist statement that NAT does not in any way enhance security, which is silly.
    – Eddie
    Oct 18, 2010 at 15:47
0

I think IPv6 adoption will speed up when everything needs an IP address but can't all be expected to connect to a router.

Things such as phones, cars, thermostats, and your refrigerator's RFID scanner.

0

NAT lets you turn IPv4 addresses into Autonomous System numbers (more or less), so yes, I think it's responsible for the delay.

1
  • 2
    "NAT lets you turn IPv4 addresses into AS's" - what on earth do you think that means?
    – Alnitak
    May 26, 2009 at 8:49
0

Yes, I fully believe it has slowed adoption. Hardware follows need and demand. Had we a demand for IPV6 due to loss of IPv4 addresses years ago, we would long since have the hardware available to support it. Why is there limited hardware now? Because there was no demand 1 year ago.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .