Hot answers tagged

177

It's very bad. Here is a list of examples of what I have first hand experience with consumer ISPs doing to fight the shortage of IPv4 addresses: Repeatedly shuffling around IPv4 blocks between cities causing brief outages and connection resets for customers. Shortening DHCP lease times from days to minutes. Allow users to choose if they want network address ...


135

Before we started to run out of IPv4 addresses, we didn't (widely) use NAT. Every internet connected computer would have its own globally unique address. When NAT was first introduced, it was to move from giving ISP's customers 1 real address per device the customer used/owned to giving 1 customer 1 real address. That fixed the problem for a while (years) ...


82

Disclaimer: No offense, but this is a really bad idea. I do not recommend that anyone do this in real life. But if you give a bored IT guy a lab, funny things will happen! For this experiment, I used a Microsoft DNS server running on Server 2012 R2. Because of the complications of hosting a DNS zone in Active Directory, I created a new primary zone named ...


69

If you host multiple vhost domains with a single Nginx instance, you can't use the single combined listen directive listen [::]:80 ipv6only=off; for each of them. Nginx has a weird quirk where you can only specify the ipv6only parameter once for each port, or it will fail to start. That means you can't specify it for each vhost domain server block. As ...


54

That probably is about the only reason you would use the former construct, these days. The reason you're seeing this is probably that the default of ipv6only changed in nginx 1.3.4. Prior to that, it defaulted to off; in newer versions it defaults to on. This happens to interact with the IPV6_V6ONLY socket option on Linux, and similar options on other ...


39

Private IP addresses are routable, albeit they are not publicly routed. Basically, a router will route a private address to private/internal LAN, rather than to the internet. To expand my answer: a router can route a private address to the public side, via its default gateway. However, the packet will be "lost" in transit due to other routers dropping it, ...


34

Both of course. IPv4 will stay a long time, and it's way past time to start with IPv6.


34

Lack of IPv6 support on your site will hurt some of your users. According to stats published by Google 20-25% of users currently have IPv6. A large fraction of those users will need to go through some kind of NAT to reach IPv4-only services, which will make connectivity less reliable. The fraction of users without any IPv4 connectivity whatsoever is ...


30

IPv4 and IPv6 are separate protocols that don't talk to each other. You'll have to support both protocols for now. Getting IPv4 addresses is getting more difficult and expensive, but you'll have to make your service available over it because not all users will have IPv6. On the other side there will be users who don't have full IPv4 anymore. They might have ...


28

0.0.0.0/0 is the IPv4 everything - all possible IPv4 addresses. ::/0 is the IPv6 equivalent of that. You can, for example, allow IPv4 and disallow IPv6 or vice versa. @kasperd mentions: It should be noted that depending on implementation ::/0 can mean either all IPv6 addresses or all IPv4 and IPv6 addresses. That's because IPv4 addresses can be mapped ...


27

Short answer: it will work, technically, but you will have lots of undeliverable mail. Long answer: Take your SMTP logs. Sed out all the domain names you send mail to. Check if they have IPv6 DNS and MX. Once you get 100% (you won't, not anytime this decade), then you can try if the IPv6 IPs actually work. I don't have any interesting production logs at ...


23

IPv6/IPv4 preference is determined by the initiator of a connection, i.e. the web browser. The address selection rules are defined in RFC 6724. While these can be overridden, it is only by the user reconfiguring their operating system. The only way you can force someone to use IPv4 is to not offer IPv6 at all. Obviously this is not a practical solution even ...


22

The answer depends on your success criteria. But most likely will be no. If you are running a business where any undelivered mail means a measurable cost. Then the answer is no, IPv6-only is not viable yet. There are many providers including some large providers who are still running IPv4-only. The largest provider I know of with dual stack support is ...


21

Maxmind is a good service, though occasionally there can be errors, since we're now in the time period where IPv4 blocks are scarce, and are being traded and resold on a gray market. If you do find an actual error you can report it to them, though this doesn't appear to be an error. This is basically how I confirm the location of an IP address: First, I'll ...


21

One big symptom of IPv4 exhaustion I didn't see mentioned in other answers is that some mobile service providers started going IPv6-only several years ago. There's a chance you've been using IPv6 for years and didn't even know it. Mobile providers are newer to the Internet game, and don't necessarily have huge pre-existing IPv4 allocations to draw from. ...


19

I believe that on Linux, binding to [::] (IPv6) results in receiving both IPv6 and IPv4 traffic (by default). I believe these are referred to as IPv4-mapped IPv6 addresses. netstat simply shows the IPv6 entry only, because there's technically only a single bind, that happens to support both IPv4 and IPv6. There's a bit of information on the Apache site. ...


18

To answer the question as it was stated ("how many IPs can a single DNS A record hold?") the answer is very simple: a single A record holds exactly one address. There can however be multiple A records for the same name.


18

There are two things you need: First you need an ISP that will act as the sponsoring LIR for you. Their role is just book keeping and maintaining the contractual chain between you and RIPE NCC. Then you'll need an ISP that will route your addresses and announce them to the rest of the world using BGP. Those two functions can be provided by a single ISP ...


16

Assuming the IP address you want to whitelist is 192.0.2.55: netsh advfirewall firewall add rule name="Allow from 192.0.2.55" dir=in action=allow protocol=ANY remoteip=192.0.2.55


16

With the ipv6only=off configuration style the IPv4 addresses might be shown as IPv6 addresses using the (software-only) IPv4-mapped IPv6 addresses in for example log files, environment variables (REMOTE_ADDR) etc.


15

Such preferences can be expressed using SRV records. Unfortunately those are not supported for HTTP. So you are left with a situation where the client alone is making the choice between IPv4 and IPv6. Many clients use the roundtrip time of SYN + SYN-ACK to decide which of the two to use. So by slowing down the sending of a SYN-ACK packet on IPv6, you can ...


14

The major RIRs ran out of space for normal allocations a while ago. For most providers therefore the only sources of IPv4 addresses are their own stockpiles and the markets. There are scenarios in which it is preferable to have a dedicated public IPv4 IP but it's not absolutely essential. There are also a bunch of public IPv4 addresses that are allocated ...


13

One possible reason for this issue is when the machine account password gets out of sync with the domain controller. This can happen, for example, if the computer account in Active Directory is manually removed and re-added, or if the client machine has been restored to an earlier point in time (machine account passwords are automatically changed every 30 ...


13

That is indeed one of the problems with CGN. Sharing a resource means that all suffer the consequences when one abuses the resource. A bank that I consulted for implemented IPv6 on the server side exactly for that reason: more and more users end up behind CGN, hopefully also with IPv6. When their security department has to block an IPv4 address of a CGN, ...


12

The network will keep working until your DHCP leases expire. After the leases expire devices may switch to RFC 3927 addresses. But those addresses are not predictable so you'd have to rely on MDNS to find them, and they are unlikely to work between a given pair of devices until both have switched from DHCP assigned addresses to RFC 3927 addresses. On the ...


11

Well. On the server side, specifying "proto" twice doesn't actually do anything - "proto udp6" will make it bind a dual-stack socket to handle v4+v6, overwriting the "proto udp" in the previous line. On a 2.3 client, having two remotes, with "udp6" and "udp" is the way to go, as the old socket code cannot failover itself properly. On a git master (2.4-to-...


10

@yoonix has sent a link that might have a solution. Link-local, also known as APIPA. 169.254.0.0/16 - This is the "link local" block. As described in RFC3927, it is allocated for communication between hosts on a single link. Hosts obtain these addresses by auto-configuration, such as when a DHCP server cannot be found. If I were your customer, I'd ...


10

Each IPv4 address will take up 16 bytes in the reply. Each IPv6 address will take up 28 bytes in the reply. It is strongly recommended that you ensure the reply will fit in 512 bytes. That would allow for about 25 IPv4 addresses and 14 IPv6 addresses (considering that you need some other information in the packet as well). The exact limit depends on the ...


10

If the ccTLD does not have IPv6 addresses for its name servers, an IPv6-only user may not be able to resolve any names under that TLD, even if those names are in IPv6-competent zones. Resolving follows a chain down from root, and if one link doesn't work, the entire thing fails. DNSSEC provides cryptographic authentication of DNS data. Like everything in ...


9

You are missing the IANA recovered pool ranges from APNIC there. But I would say blocking half the internet is quite rigorous. A common approach would be to install a firewall / fail2ban / ddos-filter / modsecurity / etc.


Only top voted, non community-wiki answers of a minimum length are eligible