Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 25 replies
  • Subscribers 29 subscribers
  • Views 5430 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is IPv6 actually desirable? (rfcat_vk)

Wayne Folta

I've tried to follow rfcat_vk's excellent documentation of the current state of IPv6 in SFOS. And I've been feeling like I'm missing out that my ISP doesn't offer IPv6 (they've said "coming soon" for a year now, maybe more). But the more I look into it, the less benefit I see. I almost don't want it to drop at this point.

It avoids NAT, but NAT doesn't really slow things down and the only IPv4 workaround I'm familiar with that I need is SIP ALG (which in SOFOS appears to work well). With most all critical communications using TLS, it doesn't seem like IPv6 actually adds much for security. In fact, it seems like a security wash in some ways with ICMP becoming so critical to IPv6 working.

It provides a little tracking advantage with the ability to have different, changing IP addresses for each machine that communicates with the outside world. Which is cool.

But at a minimum, I'd have to run the XGS in dual-stack mode indefinitely. For example, I have a VPN and I may need to reach it from an area or an ISP that doesn't provide IPv6, so I'll need IPv4 for that pretty much until IPv4 is turned off in the Western Hemisphere.

My ISP will benefit from IPv6: smaller routing tables, etc. But it really doesn't feel like I have any real draw to get IPv6. An advantage here and there, a new adventure, but pretty much completely balanced out by disadvantages.

What am I not seeing? (Besides my ISP getting IPv6 and setting a deadline after which it won't support IPv4.)

Thanks!



This thread was automatically locked due to age.
Parents
  • 0

    I'm also interested to see if anyone suggests something compelling that I've 'missed'

    I still see it as primarily a solution to deal with running out of IPv4 addresses. I just want to be able to switch over 'overnight' from IPv4 to IPv6 and not have to mess around with supporting a dual environment but so much is clearly not ready.

    i sometimes enjoy playing with the bleeding edge of technology. This is one area where I'll stay well clear until I'm forced to or all the players have their act together.

  • 0 in reply to JasP

    I don't think there's anything compelling unless you're in the middle ground of having a home lab with multiple servers of the same kind (say multiple web servers) that you want to expose to the outside world individually. If you move up a level, you could combine all of them behind something like nginx (I think) and still just DNAT port 80. But if they need to be separately accessible, IPv6 lets you expose all of them and then allow port 80 through to all of them.

    Otherwise, I don't see any advantages for us end users. I think at least some of the advantages years ago have been overcome by circumstances and are no longer straight-up advantages.

    Also, having a dual stack is not much more complicated than IPv6-only or IPv4-only, if at all. So basically, if my ISP goes IPv6-only or dual-stack, I'll follow their lead. (I figure a couple of key places I'd like to VPN back into the Sophos will be late in the switch to IPv6, so somebody, somewhere's gotta bridge the gap -- whether it's dual-stack or some kind of CGNAT-ish thing or whatever.

Reply
  • 0 in reply to JasP

    I don't think there's anything compelling unless you're in the middle ground of having a home lab with multiple servers of the same kind (say multiple web servers) that you want to expose to the outside world individually. If you move up a level, you could combine all of them behind something like nginx (I think) and still just DNAT port 80. But if they need to be separately accessible, IPv6 lets you expose all of them and then allow port 80 through to all of them.

    Otherwise, I don't see any advantages for us end users. I think at least some of the advantages years ago have been overcome by circumstances and are no longer straight-up advantages.

    Also, having a dual stack is not much more complicated than IPv6-only or IPv4-only, if at all. So basically, if my ISP goes IPv6-only or dual-stack, I'll follow their lead. (I figure a couple of key places I'd like to VPN back into the Sophos will be late in the switch to IPv6, so somebody, somewhere's gotta bridge the gap -- whether it's dual-stack or some kind of CGNAT-ish thing or whatever.

Children
No Data
Unfiltered HTML