topic Re: UK among nations that have done least in IPv6 Trial

UK among nations that have done least

jelv — Sat, 08 Dec 2012 13:33:20 GMT

http://www.bbc.co.uk/news/technology-20646710

Re: UK among nations that have done least

SimonHobson — Sat, 08 Dec 2012 19:13:38 GMT

Are we surprised ?
Err, not in the least

Re: UK among nations that have done least

itsme — Sat, 08 Dec 2012 21:57:32 GMT

Well I'm glad as I not planning to spend any money on new hardware for the next 5 years at least.

Re: UK among nations that have done least

MauriceC — Sun, 09 Dec 2012 20:38:28 GMT

Quote from: itsme
Well I'm glad as I not planning to spend any money on new hardware for the next 5 years at least.

You shouldn't need to unless you need to use some functionality specific to IPv6. The built in compatibility for IPv4 has been well tested worldwide now. What really does need to happen is for the 'backbone' suppliers and ISP's to invest in the upgraded infrastructure so that business an 'Joe Public' can select an appropriate time to make their own move. Currently we are in a Mexican stand-off where most ISP's claim no business case as a rational reason? True to some extent, but it could come and 'bite them in the bum' as both a technical challenge and equipment availability should it become higher profile as a requirement.
Most of the International backbone is already IPv6 (I've not checked details for a while) so why the delay downstream?
M

Re: UK among nations that have done least

SimonHobson — Mon, 10 Dec 2012 08:02:08 GMT

Quote from: MauriceC
... where most ISP's claim no business case as a rational reason?

Well yes, most users - and I really do mean most - don't know what IPv6 is, and don't know why they should want it. Most of my colleagues at work (and I work in an IT services company !) dread it's coming as they are "comfortable" with typing IPv4 addresses to access stuff.
I'm keen to crack on, but also more than a bit "apprehensive" as most of our IP related processes just won't scale. What works (address assignment, monitoring, traffic control & logging, etc) for a /24 network (254 addresses) just won't scale to a /64 with 65534 addresses

Quote
... so why the delay downstream?

A clue in the chorus to this classic

The larger ISPs (who serve the bulk of users) have engaged in a race to the bottom price wise, so they have no money left for maintaining what they have, let alone investing in upgrades. The core equipment may already be IPv6 capable (possibly with the addition of licences), but before that can be turned on and fed down to end users there is a whole other layer that users should not normally get to know about (it's invisible unless it goes wrong) - all that management layer that takes care of everything (creating new users, billing them, configuring their equipment when it connects, etc, etc).
That, in part, will have been behind the IPv6 trial Plusnet did - to get a feel for how end user kit would work and so on. I'm sure that they have people beavering away behind the scenes working on new systems.

Re: UK among nations that have done least

MJN — Thu, 10 Oct 2013 09:27:13 GMT

Quote from: SimonHobson
I'm keen to crack on, but also more than a bit "apprehensive" as most of our IP related processes just won't scale. What works (address assignment, monitoring, traffic control & logging, etc) for a /24 network (254 addresses) just won't scale to a /64 with 65534 addresses

Don't know how to break this to you Simon, but it might be worse than you thought! A /64 has 2^64 addresses in it - that's 18,446,744,073,709,551,616!
It is an interesting point you raise though... It's one thing updating hardware to support IPv6 but there's also the management-related aspects too which need consideration. For example, an Excel spreadsheet may more than suffice for the allocation management of a small IPv4 address range but trying to carry that across to do the same with IPv6 is going to need a rethink.
Edit: Whoa... This thread is 10 months old - sorry about digging that up. Hopefully it's still relevent though.

Re: UK among nations that have done least

SimonHobson — Thu, 10 Oct 2013 09:48:09 GMT

Quote from: MJN
Don't know how to break this to you Simon, but it might be worse than you thought! A /64 has 2^64 addresses in it - that's 18,446,744,073,709,551,616!

I must have been half asleep when I wrote that

Re: UK among nations that have done least

nanotm — Fri, 11 Oct 2013 22:14:30 GMT

Quote from: MJN
It is an interesting point you raise though... It's one thing updating hardware to support IPv6 but there's also the management-related aspects too which need consideration. For example, an Excel spreadsheet may more than suffice for the allocation management of a small IPv4 address range but trying to carry that across to do the same with IPv6 is going to need a rethink.

yeah even a standard SQL data base wont do it unless an extended database licence is acquired by the company planning to run it.....in fact i'm not even sure that will be able to perform the task unless its on some seriously high end server, what with it needing to have multi access capabilities and to potentially search every entry for every client at the same time without any of them noticing the time lag, hell even the slipstream nix version of old couldn't handle more than 50 clients on a 2 million entry database doing a search, of course they could distribute the data base overlays to every client to reduce the load and increase responsiveness for up to 1000 simultaneous users but even that's pushing things (not to mention giving the keys to the kingdom to the natives)
a lot of the associated problems with ipv6 will need to be solved as well, its not like there is NAT to help with LAN isolations for non enterprise setups

Re: UK among nations that have done least

Krazeh — Sat, 12 Oct 2013 04:28:18 GMT

Quote from: nanotm
a lot of the associated problems with ipv6 will need to be solved as well, its not like there is NAT to help with LAN isolations for non enterprise setups

No, but there are firewalls.

Re: UK among nations that have done least

nanotm — Sat, 12 Oct 2013 07:18:32 GMT

indeed there are, real verifiable ones that don't require static holes
seriously though its about a lot more than a firewall, so much trouble for anyone that's not going to be running there own BGP (router or server based), which means there's still a giant sized problem to be figured out before it can be given true implementation.
if they stuck to providing 6 over 4 though that part of the problem is mitigated, but then your not getting any benefit from 6 /
some serious work needed before it can be rolled out as a true connection offering, its not like everyone is a geek who understands or has the money to setup a home gateway server in order to provide isolation for there equipment, and lets face it without isp's giving away routers that cost more than £30 three unlikely to be able to supply anything capable of doing the job either, and the answer so far seems to be "its ok our routing table wont list all the things you want to keep private .....how do they know if I want access to my NAS box when i'm away from home but don't want it accessible to anyone else in the world .....
so many problems but so far no tangible proof of how I can do both be secure but still create an unsolicited login from any computer in the world given the right credentials without needing some login sever over ipv6 ........ yet its possible to do just that currently...so its really not much of a push for the average consumer to want to jump at a headache like that when things work fine right now....

Re: UK among nations that have done least

Krazeh — Sat, 12 Oct 2013 11:09:31 GMT

Quote from: nanotm
indeed there are, real verifiable ones that don't require static holes

This makes no sense. If you want to allow traffic through firewall to a certain machine then you will add a rule allowing traffic on a specific port, intended for a specific IP address, to pass through. Consumer level firewalls, such as those found in the sort of routers provided by ISPs, allow this functionality. It is a perfectly normal way for a firewall to operate.

Quote from: nanotm
seriously though its about a lot more than a firewall, so much trouble for anyone that's not going to be running there own BGP (router or server based), which means there's still a giant sized problem to be figured out before it can be given true implementation.

Again, makes no sense. Routing for IPv6, from the perspective of a home user, is broadly the same as IPv4. All the home router needs to know is where to send traffic it receives that is intended for the internet, in just the same way as it needs to know that for IPv4. And like IPv4 it will simply be the gateway at the ISP. BGP becomes a consideration once the traffic is at the ISP but it's not a 'giant sized problem'; working out how to route traffic is not something holding up a roll out of IPv6.

Quote from: nanotm
if they stuck to providing 6 over 4 though that part of the problem is mitigated, but then your not getting any benefit from 6 /

I don't think you really understand what 6 over 4 is or how it operates.

Quote from: nanotm
some serious work needed before it can be rolled out as a true connection offering, its not like everyone is a geek who understands or has the money to setup a home gateway server in order to provide isolation for there equipment, and lets face it without isp's giving away routers that cost more than £30 three unlikely to be able to supply anything capable of doing the job either, and the answer so far seems to be "its ok our routing table wont list all the things you want to keep private .....how do they know if I want access to my NAS box when i'm away from home but don't want it accessible to anyone else in the world .....

The TG582N already supplied by Plus.Net, and several other consumer grade routers already on the market, are perfectly capable of routing IPv6 traffic and providing a SPI firewall that protects your
LAN while allowing you to allow traffic through to specific machines. And routing tables have nothing to do with the ability for you to access a NAS box while away from home while preventing anyone else from doing so. Routing tables simply provide routers with details of which interface to send out traffic they receive. Access to machines on a LAN from a remote location is down to firewall rules.

Quote from: nanotm
so many problems but so far no tangible proof of how I can do both be secure but still create an unsolicited login from any computer in the world given the right credentials without needing some login sever over ipv6 ........ yet its possible to do just that currently...so its really not much of a push for the average consumer to want to jump at a headache like that when things work fine right now....

You would do it in exactly the same way as you do currently, with the slight exception that you won't need to use NAT in conjunction with firewall rules. You'll just use firewall rules to allow specific traffic through to the machine you want to allow access to.
Please, go away and do some real reading into the topics you're trying to discuss. It's admirable that you're trying to become involved but your posts continue to display a fundamental lack of knowledge/misunderstanding of the topics involved. And I'm not sure it's something that can be resolved by simply responding to posts you make. You need to look at more comprehensive material than can be placed in a forum posts.

Re: UK among nations that have done least

nanotm — Sat, 12 Oct 2013 12:47:02 GMT

how does that work then, I mean sure I can setup static (always open) rules to allow traffic through the firewall at the router but that requires disabling the SPI entirely, meaning my router is just a glorified switch, at least with ipv4 it has nat which blocks curious passers by (but nothing actively seeking access)
without a gateway server or gateway router you cant isolate devices from gaining internet connection if they are capable of it whilst retaining full lan functionality, you also cant go over the isp's nominal 8 device limit provided under there RiR, meaning lots of folks wont be able to use there gear under an ipv6 only connection in the same way they currently do.
6 over 4 is a way of creating a vpn which used to be called a pass-through connection from one device to another ignoring and refusing to interact with anything else along the route which aside from utilising the shared ipv4 address at the user end(s) provides ipv6 connection without the downsides of needing to interact with a whole bunch of servers
the primary difference between ipv4 and ipv6 is under ipv4 every router shares a single address to all connected equipment, under ipv6 every device (including the router) gets its own ip address, which completely changes the management and access of the devices, in terms of the router this means they will need to be completely overhauled, currently ipv6 connectivity on things like the tg582n is provided at the system operating level, this is the primary reason why such devices require the firewall to be switched off when allowing traffic forwarding over ports (which are providing ipv6 connectivity) maybe there will be a way in the future for them to provide an complete firmware rewrite that removes ipv4 connectivity but until then there will be no real firewall options, everything thus far is based on nat traversal settings and there is no way of limiting a device from obtaining ipv6 connectivity (a key problem if you look into the idea of running a dual stack system as part of the transition strategy)
routing tables are the only way of implementing firewall rules under ipv6 if you don't have control over both you have zero control over your connection's security, that means your running a gateway product (currently those things start at the so-ho end with a price point of £150 for a very incapable device) and your immediately in the fall back position of relying on software firewalls on devices, that of course isn't the dns lookup tables which are public access records which is where the problems stem from given the strange way all the companies preferred to run down the cg-nat route 15 years ago instead of evolving and utilising the ipv6 options (its been around and in commercial trials for various things since 1994, and getting commercially used since 1998 in various secure networks, widely available internet has only bee available in the uk since 1996 and the ipv4 address crunch was identified in 1997, bt's answer was to slow down the roll out of internet connectivity.....)

Re: UK among nations that have done least

pwatson — Sat, 12 Oct 2013 12:52:09 GMT

Quote from: nanotm
how does that work then, I mean sure I can setup static (always open) rules to allow traffic through the firewall at the router but that requires disabling the SPI entirely,

I'll stop you there as this seems to be the stumbling block... What makes you think that opening up nominated ports to nominated addresses on the secure side of the firewall means that the entire firewall has to be turned off?

Re: UK among nations that have done least

nanotm — Sat, 12 Oct 2013 12:55:14 GMT

the manual of the router stating that it does,
how to port forward "do xyz", *please note this disabled the spi firewall and changes NAT to open or loose*
its a really good indicator of there being a problem with using dmz or port forwarding rules

Re: UK among nations that have done least

Krazeh — Sat, 12 Oct 2013 12:58:45 GMT

Quote from: nanotm
you also cant go over the isp's nominal 8 device limit provided under there RiR, meaning lots of folks wont be able to use there gear under an ipv6 only connection in the same way they currently do.

What?? This makes no sense.

Quote from: nanotm
the primary difference between ipv4 and ipv6 is under ipv4 every router shares a single address to all connected equipment, under ipv6 every device (including the router) gets its own ip address, which completely changes the management and access of the devices, in terms of the router this means they will need to be completely overhauled, currently ipv6 connectivity on things like the tg582n is provided at the system operating level, this is the primary reason why such devices require the firewall to be switched off when allowing traffic forwarding over ports (which are providing ipv6 connectivity) maybe there will be a way in the future for them to provide an complete firmware rewrite that removes ipv4 connectivity but until then there will be no real firewall options, everything thus far is based on nat traversal settings and there is no way of limiting a device from obtaining ipv6 connectivity

Under IPv4 most connected equipment on a home LAN shares a single address due to the fact that there simply isn't enough IP addresses to go around. If there was then NAT would probably never have come around, or certainly not be used to the extent it is. It would be far better for anything that needs to access the internet to have it's own public address. As for the TG582N what do you mean IPv6 connectivity is provided at the system operating level? It doesn't require the firewall to be switched off when port forwarding while using IPv6 and it doesn't need IPv4 connectivity removing. It operates in dual stack configuration and allows the use of NAT and firewall for IPv4 traffic and firewall for IPv6 traffic.

Quote from: nanotm
routing tables are the only way of implementing firewall rules under ipv6 if you don't have control over both you have zero control over your connection's security, that means your running a gateway product (currently those things start at the so-ho end with a price point of £150 for a very incapable device) and your immediately in the fall back position of relying on software firewalls on devices, that of course isn't the dns lookup tables which are public access records which is where the problems stem from given the strange way all the companies preferred to run down the cg-nat route 15 years ago instead of evolving and utilising the ipv6 options

Routing tables have nothing to do with firewall rules. They're completely separate things which perform entirely different functions. And what has DNS got to do with anything? Or CG-NAT for that matter?

Quote from: nanotm
the manual of the router stating that it does,

Which router is this?

Re: UK among nations that have done least

ejs — Sat, 12 Oct 2013 13:12:24 GMT

The only available release notes for the 10.2 firmware for technicolor routers including the 582n mentions IPv6 stateful firewall support in the new features added in 10.2.
Unfortunately there's no firewall that will protect you from largely nonsensical forum posts sprinkled with technical jargon.

Re: UK among nations that have done least

pwatson — Sat, 12 Oct 2013 13:13:43 GMT

Googling around I can see that advice for some routers is to disable SPI for port forwarding but this doesn't apply to *all* routers... Even those that do suggest turning off SPI don't suggest that this leaves the router with no firewall at all.

Re: UK among nations that have done least

nanotm — Sat, 12 Oct 2013 16:02:10 GMT

indeed that's because NAT is considered to be some sort of firewall, even though it will totally ignore all traffic targeted at the open ports.....which is why upnp is far superior to static entries, of course upnp doesn't work for allowing external access on the fly through a router, for that you require a gateway server of some description to provide the discrimination between allowed and disallowed traffic.

@Krazneh
theres a wealth of information on the problems caused by routers that were not initially designed to support ipv6 functionality and how its been flashed into them at the operating system level which whilst providing the capability is causing problems in other aspects of the device either by disabling functions or through limiting the number of devices
as for the nominal number of devices supported on a retail connection that information is provided by the various isp's, I have in the past made enquiries about such things and been informed that the majority have picked 8 per dynamic or fixed ip (some have lower numbers) for retail and as contracted for business connections, if that is correct and they "choose" to change this over to a "per connection" (as was indicated would be the case in a whitepaper on the issue) basis under ipv6, then this would give each residential customer a maximum of 8 connected devices including there router, unless of course your ipv6 network is different

Re: UK among nations that have done least

MJN — Sat, 12 Oct 2013 16:08:32 GMT

Nanotm, you are getting very confused (again).
ISPs do not limit the number of devices you can connect, only the number of addresses they assign to you.
Thus, in IPv4, you would typically need to use NAT (actually PAT) to allow a greater number of devices to connect than you have IPv4 addresses assigned. For dynamic allocations you would usually get just a single IPv4 address, but static blocks of upto 8 are often available (for an additional fee or as part of a business connection agreement).
With IPv6 you will at the very least get a /64 but more likely a /58 or greater so there's no concerns there and certainly no need for any NAT to multiplex it further.
PLEASE stop spreading misinformation. You do not know enough about the subject and a little knowledge is dangerous.

Re: UK among nations that have done least

Anonymous — Sat, 12 Oct 2013 16:11:05 GMT

Are you sure that you are not getting confused with the maximum WAN address block size that an ISP might allocate a residential customer ?
i.e. a /29 block of 8 IPv4 addresses.

If you are right though, if a customer is using NAT on a single WAN IP address, what difference does it make to the ISP how many devices are using the customers LAN ?