7

I came to know recently IPv4 public IP address pools are going to be exhausted soon. If IPv6 addresses are fully in use, all device vendors like Cisco, Fortinet, Palo Alto have to redesign their firewalls and routers to make them compatible for configuring IPv6 addresses. Then what is the situation for firewalls already deployed and working in production? And can we NAT IPv6 public IP with IPv4 private IP ranges?

  • 3
    "And can we NAT IPv6 public ip with ipv4 private ip ranges." Why would you do that? NAT is to preserve IPv4 long enough for IPv6 to become ubiquitous. IPv6 has enough addresses for every device to have a public IP address. See this answer about that. – Ron Maupin Aug 2 at 15:46
  • 2
    Check out Google's IPv6 Statistics page. Click on the Per-Country IPv6 Adoption tab to find the IPv6 adoption rate for your country (currently 41.99% in the U.S.). – Ron Maupin Aug 2 at 23:01
  • 6
    IPv6 has been supported on most major firewall and network vendors (including those listed) for many years. With the notable exception of public cloud, most areas of enterprise networking have had IPv6 support for multiple generations and pretty much every major host OS ships with V6 support on by default. The lack of IPv6 deployment isn't a function of capability but rather one of will/desire. In short, enterprises aren't demanding it from SP's and SP's try to be in the business of selling things the customer wants. – rnxrx Aug 3 at 2:01
  • 6
    In my country (Malaysia) IPv4 was exhausted in 2017. In the US this happened in 2015. Globally IPv4 addresses was exhausted in 2011 - since 2011 each region has been using the IPv4 addresses already allocated to them and have not been able to acquire additional addresses. Since 2015 no North American ISP has been able to acquire new IPv4 addresses. The last IPv4-only connection from an American ISP was probably in 2016 and since then all North American connections have been IPv6 ready – slebetman Aug 3 at 2:29
  • 2
    The fact that you didn't notice this shows how brilliantly successful the deployment of IPv6 was (in retrospect - I'm sure there was screaming and moaning when network engineers had to learn how to reconfigure and upgrade their networks). Yes, even your mobile phone connection is probably IPv6 – slebetman Aug 3 at 2:31
21

You're late to the game: IPv4 addresses are already exhausted, and have been for a number of years. All the major manufacturers have included IPv6 capability (in varying degrees) in their product for quite some time.

| improve this answer | |
  • 4
    Anecdote: This year, our company's phone provider switched us from ISDN to VoIP. I suggested they could piggyback our fat internet link instead of laying extra cable. They said, well, they'd need 2 IP addresses from our range then. I said, that our IPv4 range was completely in use, but I could spare them a million IPv6 addresses from our range. They said, nope, the newly installed VoIP device would need IPv4. D'uh – Hagen von Eitzen Aug 3 at 18:06
  • 5
    Telephone providers aren't exactly known for their leading-edge technology :) – Ron Trunk Aug 3 at 18:50
  • Unfortunately, a lot of brand new (!) (home consumer) equipment is still IPv4-only. – Martin Rosenau Aug 4 at 4:49
  • @MartinRosenau, a quick check of Linksys, DLink, and Netgear says all their latest home networking products are IPv6 compatible/ready. Many home network users are using IPv6 without knowing it because the ISP, router, and device OSes all support it and it is automatically configured. Over 40% of U.S. Google traffic is IPv6, so It is certainly making headway into home networking, and it is often unknown by the home users. I think it would help if the browsers would actually put in something that shows IPv4/IPv6 the way that plugins do because most people will not even think to use a plugin. – Ron Maupin Aug 4 at 15:54
  • @RonMaupin Please note that "consumer equpment" is not only routers, but also products being connected to the network - like "smart" TV sets or game consoles. One example: There are door cameras with internet access. According to some thread I found in some internet forum, nearly all manufacturers of such cameras seem to be "IPv4-only". These cameras will not work if the internet access does not support IPv4 "port forwarding". – Martin Rosenau Aug 5 at 5:13
9

And can we NAT IPv6 public ip with ipv4 private ip ranges.

Since IPv6 addresses are abundant and allocated as /56 even for private access, there's absolutely no need for NAT (which is a kludge to deal with IPv4 public address scarcity). NAT64 for IPv6 was defined but there's little support - and that's a good thing.

| improve this answer | |
3

I came to know recently ipv4 public ip address pools are going to exhausted soon.

Depending on your definition of "exhausted" they already are.

It's not like you can't get IPv4 though, just that the price is going up.

Realistically what will happen is that as prices rise companies will reevaluate where they are using their IPv4. Connections that would previously have come with a public v4 address as standard are likely to end up behind some form of IPv4 address sharing mechanism. Connections that have previously come with a block as standard may only come with a single address as standard with extra fees if you want a block.

If ipv6 address are in use fully. All devices vendor like cisco, fortinet, Paloalto has to redesign they firewalls and routers to make compatible for configuring IPv6 address.

Most vendors do now have support for IPv6, though exactly what features are supported can vary.

Then what is situation of firewall already deployed and working in production.

Highly variable :(

And can we NAT IPv6 public ip with ipv4 private ip ranges.

The problem is while you can easily encapsulate an IPv4 address inside an IPv6 address you can't do the reverse. For a v6 client connecting to a v4 server this means losing the true IP address of the client. For a v4 client connecting to a v6 server this would mean that your DNS gateway would have to be statefully tied to your NAT implementation (i'm not sure if anyone has actually implemented this or if everyone has dismissed it as too horrible).

| improve this answer | |
  • It is a feature that internal addresses are not visible through NAT, so useful that it will also be used for V6 LAN clients via NAT or at least Proxies. – eckes Aug 4 at 11:03
0

Then what is the situation for firewalls already deployed and working in production?

Most professional devices seem already to support IPv6. And the manufacturers of home equipment will tell you to buy a new device. (Unfortunately, equipment not supporting IPv6 is still sold!)

And can we NAT IPv6 public IP with IPv4 private IP ranges?

There is one major difference to "traditional" IPv4 NAT:

Using traditional IPv4 NAT the IP packets in the local network contain the public address of the web server. Only the address of the client (the local computer) is changed by the NAT.

Using two different protocols with different address lengths this is of course not possible; a NAT must replace both addresses.

The problem is the first packet being sent to some web server (to establish a connection). Neither using a "traditional" IPv4 NAT nor using IPv6-to-IPv6 NAT this is a problem:

If you want to connect to some web site, the local computer will send an IP packet to the address of that web site. Because the destination address in the IP packet in the local network equals the public IP address of the server, the NAT knows the public address of the server: It is the destination address in the local IP packet.

Connecting to an IPv4 server from an IPv6 client (NAT64 or 464xlat) is a bit more tricky, but it is still feasible:

Because the IP addresses in the local network are 128 bits long but the public IP address of the server is only 32 bits long, the addresses cannot be equal. However, the 32 bits of the IP address of the web server can simply be added to some 96-bit prefix to get the 128-bit IPv6 address of the server being used inside the network. The NAT can simply find out the public IP address of the server: It's the last 32 bits of the 128-bit destination address in the local IP packet.

The other way round is more difficult:

The network packets in the local network would only contain 32-bit addresses, but the public IP address of the web server would be a 128-bit address. This means that there is no possibility to send the complete public IP address of the server in the local packet.

The NAT must have some table to look up the public IP address of the server when the first IP packet of a new connection must be routed from the local network to the internet.

NAT46/DNS46 does exist; the software I have seen (it's source is available in the internet) assigns an IPv4 address (maybe in the range 10.x.x.x) to some IPv6-only server when the IPv4 address of that server is queried using DNS.

This is rather complicated and it will only work if the DNS server used is also located on the NAT router.

Another thing are proxy servers as they are used by many companies:

Unlike a NAT, a proxy server is routing TCP payload (OSI layer 5 and above). Thererfore, even a proxy server between two networks using completely different protocols (e.g. TCP/IP is used in one network and AppleTalk Data Stream Protocol is used in the other one) would work exactly the same way as a proxy server between two IPv4 networks. The same is true if one network is using TCP/IPv4 and the other one is using TCP/IPv6.

There may be companies using proxy servers that will still use IPv4-only in the local network when the internet is IPv6-only.

| improve this answer | |
-6

NAT between IP4 and IP6 is pointless.

NAT always changes only destination address (as in destination-NAT) or source address (as in source-NAT or masquerading). You will end up with a connection between an IP4 and an IP6 address. Neither of them supports such connection.

Well, you can do both (SNAT + DNAT) in a single host and even encode IP4 addresses in an IP6 addresses. This is sometimes done in order to inject some IP4 traffic in an IP6-only network.

... and NAT is invented in order to deal with the IP4 address scarcity in the first place. It is almost pointless in a hypothetical IP6-only world.

BUT: that's not how most of the Internet deals with the IP4 scarcity. What the world does: everyone keeps using IP4, IP4 addresses are just valued higher and spared for important purposes like servers. NAT use is intensified and becomes more complex, carrier-grade NAT is employed, 100.64/10 network block is designated, SNI is invented, etc, etc...

...everything because IP6 is an incredible mess, lacking the simplicity and the usefulness of the IP4, its complexity arising from the attempt to solve a single real (address scarcity) and a great deal of imaginary problems. Its adoption is slow and few people see it as the future of the Internet.

| improve this answer | |
  • 8
    ".everything because IP6 is an incredible mess, lacking the simplicity and the usefulness of the IP4, its complexity arising from the attempt to solve a single real (address scarcity) and a great deal of imaginary problems" That statement shows a real lack of understanding and experience with IPv6. IPv6 greatly simplifies things that are difficult or impossible with IPv4. Just removing broadcast, fragmentation, and NAT, adding some real scopes and flexibility to multicast, and the great flexibility that is added to addressing really helps a lot. Over 40% of U.S. Google traffic is IPv6. – Ron Maupin Aug 2 at 22:51
  • 8
    Politely, you need to get familiar with IPv6. I remember the same kinds of arguements when Netware went from IPX to IP, all the old schooners didn't want to learn and risk looking bad. Remember this saw: "If NAT is the answer then your design is flawed, fix the design." And yes I'm still occasionally adding NAT to networks where some design element is flawed, mostly IPv4 block duplication. – Criggie Aug 3 at 1:43
  • 3
    @fraxinus I'm sorry, but your view is simply incredibly outdated. To see how widely IPv6 has been implemented, see https://www.worldipv6launch.org/measurements/. – Ron Trunk Aug 3 at 13:15
  • While I do think the designers of IPv6 made some stupid decisions, I also feel that for a large ISP that is running out of IPv4, IPv6 with transition mechanisms is less horrible than IPv4 with ISP level v4 NAT. A similar story is true for very large buisnesses who are running out of private v4. Small buisinesses are likely to be dragged into the world of IPv6 by their ISPs. Where I think we are likely to see the biggest gap in v6 is medium buisinesses, there seems to be very little upside to a v6 migration for them. – Peter Green Aug 3 at 14:11
  • If NAT between ipv6 &ipv4 is pointless then how to overcome this issue natting ipv4 private ip with IPv6 public address – Sagar Uragonda Aug 6 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.