IPv4 shortage is now becoming a reality - what is needed for IPv6 to work?

Question

Today I read that Microsoft has no more IPv4 addresses for its Azure cloud. Earlier this week I read that Latin America is out of IPv4 addresses as well. These are real - not predicted - IPv4 address shortages. I remember we had IPv6 day two years ago, but since then I haven't heard much about IPv6 in the news.

I would like to have a good understanding of what the change to IPv6 really means, and where we can expect problems.

Current situation

• I guess all modern operating systems are IPv6 ready: OSX, Windows, Linux, Android, iOS (no problem to be expected for most people).
• Internet providers: your connection to the internet, whether it's mobile or via cable or ADSL (my provider says it's completely IPv6 ready, but it's the only one this far in my country).
• Routers/modems may be a problem (and as my provider says it's completely IPv6 ready, I suppose the router works too).
• Hosting: I use a hosting provider for some websites that is not IPv6 ready. They promise to have this working this year. I guess many providers haven't got this working yet.
• Home devices: digital tv recorders, tv with wifi, thermostats, wireless loudspeakers etc - I have no idea if they are IPv6 ready.
• The internet at large: big websites like Google, Facebook - I guess they have this working.
• Internet exchanges like AIX - this should work.

Some questions

1. Home network: if my router is IPv6 ready, will it translate to IPv4 for devices that don't understand IPv6?
2. Can these home devices still use IPv4 when the rest of the home network is IPv4?
3. For sites that are still IPv4 only, will my computer or router switch automatically?
4. When I open whatismyip.com, I see an IPv4 address. I believe I can ask my provider to change to IPv6, but I guess that will disable large parts of the internet for me - will it? Can I still send mail, will DNS work?
5. When my provider changes to IPv6, will I still have an IPv4 address?
6. Does this have consequenses for TLS certificates?
7. With IPv6 NAT is obsolete I understand. Will this mean my wifi enabled tv is directly accessible from the outside? I guess the router firewall is still working, but now we can use a direct address from the outside?
8. I don't live in Latin America and don't use Azure. But what if I go to Brasil right now. Will I notice it?
9. Is there an easy way to test what works and what not without messing up the home network?

These are several situations and questions I can think of now. There are probably many more. What I want is a good picture of where we're standing now, and what we can expect to happen when this shortage becomes worldwide.

Answer 1

Answers to your questions:

1. No, just because device supports IPv6 it doesn't mean it support IPv4<>IPv6 transition mechanisms - they're not part of IPv6 protocol specification. So, it may support translating traffic from IPv4 to IPv6 and vice versa but it needs to support mechansism like NAT64.

2. Nodes communicate with the protocol of their choice, depending on the higher layer calls. If your browser points to a name, and the name resolves to IPv4 only, IPv4 will be called in to service it. If it resolves to both IPv6 and IPv4, IPv6 should take precedence, but a lot was done in recent years to make both calls simultaneusly and check which one is faster.

3. You need to have node that is dual-stacked, so supports both IPv4 and IPv6 or have support of translating between protocols somewhere along the way. If your router supports it - fine, if your ISP supports it - it's also fine.

4. You should see IPv6 as it should take precedence. If not, your IPv6 connectivity, at least to this specific site is broken. If you can use only IPv6 (you are not dual stacked) you can only reach around 4-5k prefixes around the internet, which is very small percent (out of 500k for IPv4). Normally, hosts are dual-stacked however, so you should be fine - using IPv6 for IPv6-enabled services, and IPv4 for all the rest.

5. That depends on the type of the service your ISP provides. You may have private IPv4 assigned to your internet interface, and it gets translated somewhere at the ISP edge. You may have public IPv4.

6. For SSL/TLS you're using names, not IPs directly. You should be fine.

7. Yes, while there are still works to provide NAT services for IPv6, general idea about IPv6 was to stop doing NAT, and provide global connectivity. It means that with IPv6 assignment, your entire internal network may be directly reachable from other parts of the internet, if you're using IPv6 addresses from the Global Unicast space. For IPv6 you can use other types, like for example Link Local only, which would provide internal connectivity, but block ability to access from remote locations. Generally, you should filter the traffic at the edge of your network if you don't want the internet to access your resources/nodes.

8. Unfortunately, I don't understand the question. Cloud services are usually OK with IPv6, Amazon at least is.

9. Start from here: http://test-ipv6.com/

Answer 2

What will happen (and is happening now) is that most of the users (eg. home users) will be put behind carrier-grade NAT. There is pretty-much enough IPv4 addresses for those who really need them (globally looking, not saying company XYZ has enough of them). This means you will pay X money for an internet connection, and you will have to pay Y more money, to get a public IPv4 address (where you can get one at all).

This means most home users will still have a working (but NAT-ted) connection, and people needing a public IPv4 address will be able to buy/rent it. This will free alot of addresses in some places.

IPv6 will be (and currently is, depending on the country, ISP,..) deployed in parallel to current IPv4 infrastructure. Depending on access type, this may need just a click in a dashboard, software update, or a hardware upgrade too.

For your questions:

Home network: if my router is IPv6 ready, will it translate to IPv4 for devices that don't understand IPv6?

Mostly, no. Most home routers don't support such translations. But this won't be a problem due to carrier grade NAT (so you still get IPv4 connectivity).

Can these home devices still use IPv4 when the rest of the home network is IPv6?

If you have IPv4 connectivity (through NAT or some kind of translation mechanism on your router), then yes. Otherwise, no.

For sites that are still IPv4 only, will my computer or router switch automatically?

If you have IPv4 connectivity, or some kind of translation mechanism, then yes, your computer will use IPv4. Otherwise no. But you shouldn't worry about this much... when there are alot of IPv6 only-people, and those sites start losing visitors/customers, they'll switch to IPv6.

When I open whatismyip.com, I see an IPv4 address. I believe I can ask my provider to change to IPv6, but I guess that will disable large parts of the internet for me - will it? Can I still send mail, will DNS work?

Usually, most ISPs will give you dual-stack connectivity, so you'll have IPv4 and IPv6 addresses/connectivity. You may have to ask your ISPs helpdesk for more info.

When my provider changes to IPv6, will I still have an IPv4 address?

As I have said before, this is not just a simple turn-off/turn-on switch. Most likely you will have both addresses (connectivity via both) for some time (even if IPv4 is using NAT).

Does this have consequenses for TLS certificates?

Not really. "Names" are used for TLS. You might have problems if you use ancient software which doesnt support IPv6 at all, but this is not TLS specific.

With IPv6 NAT is obsolete I understand. Will this mean my wifi enabled tv is directly accessible from the outside? I guess the router firewall is still working, but now we can use a direct address from the outside?

Yes, it will be accessible (that's the point!), but it will probably be firewalled by default on your router.

I don't live in Latin America and don't use Azure. But what if I go to Brasil right now. Will I notice it?

Not really. If you signed up for an internet connection, you'd probably get put behind NAT or be dual-stacked, but most users wouldn't notice that (they usually have no idea about IPs, addresses, etc... alot of people called my ISPs helpdesk when Facebook was down for ~30 minutes, complaining that their internet doesn't work)

Is there an easy way to test what works and what not without messing up the home network?

Yes, as mentioned in a previous post, try http://test-ipv6.com/

Answer 3

To answer the fundamental question "What is needed for IPv6 to work?" Before anything else, you need an internet provider who can (and does) provide IPv6 connectivity. In the US, that's still very much a bad joke on consumers -- esp. for business ISPs. Then your network has to support IPv6: router, computers, game consoles, etc. I am unaware of any "home networking" gear capable of "NAT64" -- a proxy between the two networks. In fact, many small business routers lack that capability.

Answer 4

Home network: if my router is IPv6 ready, will it translate to IPv4 for devices that don't understand IPv6?

It is likely that for the forseeable future your ISP will put some mechanism in place to allow IPv4-only clients on your network to access resources on the IPv4 internet. As the IPv4 crisis bites deeper ISPs will increasingly turn to mechanisms that allow them to provide you with access to resources on the IPv4 internet without giving you a dedicated public IPv4 address. Eventually I would expect such mechanisms to be phased out but likely not for a long time.

There are at least five options available to the ISP for doing this.

• Assign you a private V4 IP and run a conventional V4 NAT at the ISP level.
• Use "ds-lite" which tunnels IPv4 packets over IPv6 to a special NAT at the ISP.
• Use "464XLAT" where your router performs a stateless NAT46 and then the ISP performs stateful NAT64.
• Use "map-e", in this system each client is assigned an IP address with a restricted set of ports. The client's router performs NAT using the restricted port set and then tunnels the packets over IPv6 to a special device at the ISP. Traffic returning to the client is encapsulated in IPv6 and then sent to the relavent client based on IP and port.
• Use "map-t", similar to MAP-e the client gets a restricted port set, but rather than being encapsulated the traffic is translated to IPv6 for it's journey over the ISPs access network.

Your router may need replacement or a firmware upgrade to support the latter four options.

The advantage of the latter two options is that the ISPs equipment is "mostly stateless", meaning that asymmetric routing and re-routes won't break things.

It is unlikely at IPv4-only clients on your network will be able to access IPv6 only resources on the internet.

Can these home devices still use IPv4 when the rest of the home network is IPv4?

Both IPv4 and IPv6 can run together on the home network.

For sites that are still IPv4 only, will my computer or router switch automatically?

If your computer has both IPv4 and IPv6 addresses (see above comments about IPv4-only devices) then it will be able to access both IPv4 and IPv6 servers. If it gets both IPv4 and IPv6 addresses from DNS then it will typically try IPv6 first, then fall back to IPv4 if that fails.

If your ISP implements NAT64/DNS64 then your computer will be able to access IPv4-only servers via the NAT64 using the DNS records synthisised by the NAT64.

When I open whatismyip.com, I see an IPv4 address. I believe I can ask my provider to change to IPv6, but I guess that will disable large parts of the internet for me - will it? Can I still send mail, will DNS work?

You should not be asking your provider to "change to IPv6". You should be asking them to supply IPv6 in addition to IPv4.

"what is my IP" type sites can be misleading because they typically only show one address. You should use a site like test-ipv6.com

When my provider changes to IPv6, will I still have an IPv4 address?

It is likely that at some point your provider will start charging extra for public IPv4 addresses.

It is likely that for the forseeable future your ISP will provide some mechanism for accessing resources on the IPv4 internet. As mentioned above that may be traditional v4 NAT or it may be an IPv6 based mecahnism like NAT64 or DS-lite.

Does this have consequenses for TLS certificates?

Not really. TLS certificates are based around hostnames not IP addresses.

With IPv6 NAT is obsolete I understand.

Well IPv6 NAT exists but it's strongly discouraged.

Will this mean my wifi enabled tv is directly accessible from the outside? I guess the router firewall is still working, but now we can use a direct address from the outside?

It is possible to do an "outgoing connections only" firewall for IPv6. What any given router actually does is down to the router vendor. Some may well default to wide-open.

Note that because IPv6 addresses are typically big and sparse scanning attacks are largely impractical in IPv6.

I don't live in Latin America and don't use Azure. But what if I go to Brasil right now. Will I notice it?

Probablly not honestly, at least as a tourist. Mobile networks and public wifi tend to involve being behind a NAT you don't control anyway.

Is there an easy way to test what works and what not without messing up the home network?

It depends what exactly you want to test. There are sites like test-ipv6.com which can check your IPv6 connectivity.

If you want to check what would work in an IPv6-only world then your best bet would probablly be a VM of some sort. Of course you need to get IPv6 working on your networ before you can do that.