AWS: IPv4 addresses cost too much, so you’re going to pay Cloud giant AWS will start charging customers for public IPv4 addresses from next year, claiming it is forced to do this because of the increasing scarcity of these and to encourage the use of IPv6 instead. It is now four years since we officially ran out of IPv4 ranges to allocate, and since then, those wanting a new public …
Those charges scale brilliantly, so while it will encourage large deployments to scale their sprawl down a little, this is a large pot of practically free money that Amazon will not just give up once it's established.
For those IPv6 evangelists trying to hurry IPv4 to an early grave, this is not going to help speed things along.
Come on man, everyone knows Jeff was the 13th Disciple and the namesake of the missing part of the Bible.
Jeff 14:26 - ...and then Jesus woke up in a cold sweat...it was all a dream after all, damn those mushrooms. Then Jesus got up, met his mates at the pub and got wankered like he did every Sunday.
There's a nice write-up from RIPE about what happens if you run an "IPv6-mostly" network.
TL;DR: with modern Android/iOS/macOS devices it works quite well. If this level of interoperability had been specified 25 years ago, maybe we'd all be using IPv6 instead of RFC1918 behind our routers.
Unfortunately, since the vast majority of Internet content is still only on IPv4, you still need a NAT64 in your network. That's the fundamental problem: it means everyone still *needs* an IPv4 address, whether or not they use IPv6. But once you have an IPv4 address, there's little incentive to deploy IPv6, since everything of significance is already reachable via IPv4 (bar a few cat-feeders and Loops Of Zen)
"TL;DR: with modern Android/iOS/macOS devices it works quite well. " ... it could work well ... indeed with NAT64 and DNS-conversion etc ... provided by your mobile operator ... which is work for the mobile operator.
Which is doable, but it can be easier for mobile operator to put you behind CGNAT ... which do they. So, everybody, check it now: on your Android, turn off Wifi (so that you're only connected to mobile), and find your IP-address in your Android -> Settings. Mine is 10.149.142.255. So non-public, so my phone is behind NAT of my mobile operator. Easy for them.
Now with wifi back on: RFC1918 LAN address, plus ... IPv6 by my fixed ISP.
Whether it's NAT44 or NAT64, it still requires CGN to reach the majority of the Internet.
NAT44 means they have to give your device both an IPv4 and an IPv6 address. With NAT64, they only have to give your device an IPv6 address.
By the way, you don't need DNS64 any more, if your device has an embedded CLAT - which is true for iOS and Android, and macOS if you send it the appropriate signals via DHCP and RA options. In fact, you can even open a page by IP address like https://1.1.1.1/ and it works fine over a pure IPv6 connection. The CLAT embeds the IPv4 address inside an IPv6 prefix used by your NAT64 device.
"NAT44 means they have to give your device both an IPv4 and an IPv6 address." ... why?
My mobile operator has my phone on an RFC1918 address, so behind NAT (NAT44). But I have no IPv6 address from them. And yes, I cannot reach ipv6.google.com.
If operators were obliged to give IPv6 to customers (hello government!), the NAT64 could be become interesting. Until then: IPv6 is so scary!
My phone's IP is public IPv4 but the cable connection is public IPv6. From the same provider… The 6to4 gateway is handled by the network and this is the way it should be.
The transition to IPv6 is important but it's even more important that it should happen seamlessly with the great unwashed masses not needing to know or care.
I work in local Govt, and we are still IPv4. I have a friend who designs networks, and every now and again I ask him if he's deployed any IPv6 and it's been a 'no' so far. Checking a couple of academic institutions I've worked at, one still appears to be on the same class B as when they were allocated back in the day.
Just because acadmeic institutions are running IPv4 doesn't mean they're not also running IPv6.
We're involved in some international collaboration work and part of the requirements is that we have to support IPv6. (And that's not "Oh, wouldn't it be nice", it's a "You need IPv6 for this to work due to the number of endpoints involved.")
Here in the Netherlands, as of 31 december 2021, IPv6 is compulsory for government websites and mailservers. See https://www.logius.nl/actueel/vanaf-31-december-moeten-websites-en-e-mails-van-overheidsinstellingen-bereikbaar-zijn-ipv6
So I checked my local government's website ... yup, IPv6 enabled.
Note: that does not mean they must use IPv6 on their LANs. But it is a first nice step.
They could. But as it turns out, the top-level/high-profile ones don't.
<government.nl> and <defensie.nl> both advertise AAAA records pointing back to Prolocation.net, whilst amsterdam.nl is likewise "self-hosted" IPv6 with Logius.
No CF doing a MITM on them.
I'm sure there's probably some local council or school districts behind Cloudflare, but good on them for trying to lead by example.
<gov.uk> also goes to "native" IPV6, albeit on a block owned by Fastly (of California)... <army.mod.uk> hits Cloudflare...
"those wanting a new public IPv4 address have had to rely on address ranges being recovered, either from from organizations that close down or those that return addresses they no longer require as they migrate to IPv6."
There's another source: existing ISP's that move most of their consumer customers to CGNAT and sell a part of their IPv4 addresses. And, this will be cursing in the church, CGNAT works quite nicely for regular customers like your neighbour and your sister. Not for us techy people, of course!
More cursing in the church: giving IPv6 to customers does not take away the need for their IPv4 connectivity: more than half of the webservers don't do IPv6 at all. We'll need dual stack for the next decade(s). With plain IPv4, or CGNAT-IPv4. And yes, I know there is IPv4-over-IPv6 etc ... but good luck introducing that to your 100.000+ customers and their installed base of routers.
Dual stack has been operational for at least a decade in France wth ISPs.
Ok, you need the right triple play box and usually a fiber access. though Free is known for also dong dual stack on xDSL lines.
Now I agree with you that we will have to dual stack for quite a while as there's still CPE, PE and backbone stuff here and there that don't handle IPv6 well or not at all, and you can't really force a company that owns it's PE to replace it because of IPv6.
Downvote because
"We'll need dual stack for the next decade(s)"
is oversimplification. We'll need coexistence for the next decade(s). Apps will need a dual-stack API, ditto. But read up on "IPv6-mostly" and you'll see that dual stack on the wire can start to go away now.
There's a write-up.
arthur@arthur[5]▶ host -t aaaa theregister.com
theregister.com has no AAAA record
arthur@arthur[5]▶ host -t aaaa www.theregister.com
www.theregister.com has no AAAA record
arthur@arthur[5]▶ host -t aaaa forums.theregister.com
forums.theregister.com has no AAAA record
[Well, someone has to do it.]
$ host www.theregister.com
www.theregister.com has address 104.18.5.22
www.theregister.com has address 104.18.4.22
And 104.18.5.22 is cloudflare, which offers IPv6, so I wonder why theregister has turned that off? Why, why, oh why? Turning it on for www.theregister.com should not be complicated. For forums.theregister.com there might be things with anti-spamming.
You're better off with just v6 than with just v4. I get a never-ending stream of hack attempts coming in over v4, but v6 is almost completely quiet (and my v6 subnets are big enough that it's hard to even find working IPs in the first place).
Public websites are mostly stuck with doing v4, but v6 gives a minor performance boost which translates into more users (and therefore more income) so not doing it is often not such a great choice.
ISSUE: None of your web servers has an IPv6 address.
www.theregister.com IPv6 address = None
SOLUTION:
1/ Login to your Cloudflare account.
2/ Click the Network app.
3/ Toggle IPv6 Compatibility On.
ISSUE: Your domain is insecure, because it is not DNSSEC signed.
Domain Registrar for www.theregister.com = CSC Corporate Domains, Inc.
SOLUTION:
1/ Login to your Cloudflare account.
2/ Go to DNS > Settings.
3/ For DNSSEC, click Enable DNSSEC.
(In the dialog, you have access to several necessary values to help you create a DS record at your registrar CSC.)
ISSUE: Your web server supports TLS versions that should be phased out deliberately, because they are known to be fragile and at risk of becoming insufficiently secure. TLS 1.1 phase out
SOLUTION
1/ Login to your Cloudflare account.
2/ Go to Domain > “Crypto” tab
3/ choose the “Minimum TLS Version” as TLS 1.2
I dont think this is complicated. get on it.
tracert www.theregister.com
Tracing route to www.theregister.com [104.18.4.22]
over a maximum of 30 hops:
1 4 ms 3 ms 3 ms 192.168.0.1
2 * * * Request timed out.
3 14 ms 16 ms 19 ms glfd-core-2a-xe-801-0.network.virginmedia.net [80.7.14.1]
4 * * * Request timed out.
5 * * * Request timed out.
6 14 ms 14 ms 15 ms tele-ic-7-ae2-0.network.virginmedia.net [62.253.175.34]
7 15 ms 13 ms 14 ms 2-14-250-212.static.virginm.net [212.250.14.2]
8 14 ms 14 ms 30 ms 172.71.176.4
9 41 ms 16 ms 13 ms 104.18.4.22
Trace complete.
That only reflects your local (cable modem) and ISP setup. In order to work out what www.theregister.com is providing by way of AAAA address records, a DNS request for AAAA records is required.
Using a public DNS service that can query DNS records, in this case specifically AAAA records, we find that there are no AAAA records. While the end result is similar to your tracert example, even if AAAA records were published your test would not find them.
Assuming that you are using Windows, and Windows 10 or later, to force IPv6 resolution instead use the command
tracert -6 www.theregister.com
Also, do be wary of posting your Internet connection's public IP address. Assuming that what you posted is valid, we now know that according to GEO-IP lookups you live in Guildford.
Sometimes they can be quite accurate, but generally they have the region or country correct. There are quite a few competing GeoIP services out there and it's interesting to see the range of responses - this is also why one needs to be careful when considering using GeoIP filtering for services.
On that note, a number of years ago we received an additional /16 block from a sister company in another country. Even though we went through the whole rigmarole of updating IRR data and everything some NINE MONTHS before we started assigning addresses to customers, a couple of GeoIP providers hadn't yet updated their databases. In addition to having to tell our customers that "yeah, sorry, you're probably going to have to live with Youtube in Danish for a couple of more weeks, we're waiting for Google to update their filters" and them briefly being locked out of national sports broadcasts[0] until one specific GeoIP provider got around to reading our complaints[1]; the one that caused the most stir were the strictly geofenced online casinos / betting sites. Man, people were upset in the incoming tickets - I don't think I've ever seen so much desperation and bile in writing before or since[2].
So I agree with Nick - be very careful when using GeoIP data as a filter, and double check that your provider updates their data regularly. At the other end of the food chain, if you do get new customer IPs previously registered in a different country - try it out properly with (very friendly and patient) customers before launching in a larger scale. Getting the wrong country code attached will cause severe problems. For us I think it took about 6 months from launch before we got the last GeoIP provider to get their data right; then it was another year or so until THEIR customers had updated all THEIR filters and the tickets eventually stopped coming. At the end we were basically just responding to customers saying "We're sorry, but this is out of our hands; you need to contact the site in question to let them know that their filters need updating.".
[0] And, embarrassingly, some of our own TV offerings. We fixed that one PRETTY fast once we figured out that our IT team hadn't updated their load-balancer GeoIP databases in six years.
[1] Seriously, why have a form to submit corrections to the data if you're not going to look at it?
[2] I know that addiction is a serious issue, but half the time I just wanted to put "Seriously dude, it looks like we're doing you a favour cutting you off." in the ticket.
I saw an advertisement for "IPv6-only" VPS for cheap. I was very interested how that was working, so I ordered such a VPS ... and I was disappointed: IPv6 working, but IPv4 too ... behind NAT. So IPv4 after all.
The AWS announcement "pay for public IPv4 address" is therefore more correct: Still IPv4 connectivy to the outside world, via NAT. And pay a little something if you want to be reachable via IPv4 / public IPv4 address
That's how I'd expect it to work. You could always turn off the IPV4 routing by changing the network configuration. What they meant by it Twas that if you hosted something on that system, including just an SSH connection, you'd have to use IPV6 to get to it. They would have left an IPV4 connection out to permit you to access sites that weren't IPV6-capable and because there's basically no IPV6-only network in existence and it's more work to set that up than to provide a CGNAT one.
"As one executive of a major corporation once put it: Couldn't they just use names instead /s"
Actually its probably a good interview question for networking candidates.
As far as I can see the reason is mostly that for packet switched networks the routing of packets is determined from the destination address (and of course efficiency - variable length addresses composed of ascii strings are going to trash router throughput ;)
Cell phone networks don't tie the phone number to any particular location so I imagine its not impossible at least for virtual circuit based networking - just a tad silly perhaps.
I don't doubt the said executive was just as daft as a brush and no better than he ought to be.
There are lots of IPV4 addresses that can be allocated. What you have to do is take unused address spaces away from companies hoarding them. Stop giving people public IP addresses they don't need.
For example, when I get a server I have to bloody well justify a second IP address and the answer could be "No, that's something you can use virtual hosting for" if I don't justify it right. Why the fuck should companies be hoarding all that address space if the world is running out?
There isn't that much unused address space out there. It's not worth the effort.
We were going through one /8 every three weeks or so before IANA runout, back in 2011, and demand will only have gone up since then. You could reclaim a dozen entire /8s and still not have enough for even a year of allocations. Plus there just plain isn't enough v4 address space out there in total, no matter how it's allocated, so all this is going to achieve is to buy some extra time to deploy v6... which we would just squander, because if you're not doing v6 at this point then it's not due to a lack of time.
There isn't that much unused address space out there. It's not worth the effort.
Last I heard, about 1/2 the allocated IPV4 spaces was unused. That is, not connected to an endpoint.
and demand will only have gone up since then
That does depend on what you mean by 'demand' (rate or integral). The major need for allocated IPV4 was for internal networking for ISPs. With that moved to IPV6, and the customers moved to NAT, the remaining demand is for end points (servers). That is still growing, (hence the massive increase in IPV4 costs), but not necessarily at the rate from when ISPs were using new allocated IPV4 for routing, let alone customer (smartphone) allocated IPV4
"Last I heard, about 1/2 the allocated IPV4 spaces was unused. That is, not connected to an endpoint."
I saw that report too, but that was about a decade ago. I don't have updated figures for today, but it's almost certainly lower. I'm sure there are still blocks out there that aren't used, but probably most of those are either held by companies for expansion because they routinely lease out addresses to customers and can't operate without spares, held by some company because they're planning to sell it when the price is nicest, or held by somebody so large that they can ignore requests for those addresses back. For instance, I don't think the US Department of Defense needs all the addresses they've got including three /8 blocks, but do you think you can convince them to give them up?
Your assumptions about demand may not be correct either. ISPs still need IPV4 addresses for routing. They can do multiple layers of NAT when the addresses run too low, but it's a pain for everybody. The more addresses they have, the simpler their networks are. ISPs could theoretically get away with having exactly one address for all of their clients, but they're not going to and we as clients don't want that. That remains a source of demand along with all the servers people would like connected to the internet.
We could go to more extreme methods to take addresses from places that fail to use them the way we'd like and reallocate them to someone else, but it will only slightly improve the situation for a few years. Is IPV6 so horrible that we can't take advantage of that larger source of addresses? Integers aren't expensive, and it's weird to end up treating them like a valuable mineral of which there is a limited supply and costly extraction for each chunk.
There isn't that much unused address space out there. It's not worth the effort.
Not true. There's the entire 'Class E' range that's sitting unused*. That's 240.x.x.x right up to the end of the 'net, so 268,435,456 IPv4 addresses being completely wasted. There have been suggestions over the years to release this range, along with some other reserved/experimental space, but the usual answer is "No, Use IPv6". Please..
But I wonder how loudly Amazon would scream if it's peers started charging a mere 0.005c an hour for every IP address it routes? Filtering that mess has always been a bit of an overhead.
*Or is it? Routers often wouldn't let you configure addresses in the 240. space, but you could use something like GateD and use it instead. It's a relatively simple config change to release that space.. but what might be exposed, if that happened? I did come across one client who was using it on a VPN in a semi-risky security by obscurity kinda way given that space can't currently be routed on the public Internet.
The entire class E range is only 16 /8s, that would also not even be a year of allocations.
For ARIN, maybe, but they've always been very generous. Alternatively it's over 1m new /24s that the RIRs could fight over. There are some other smaller chunks that were reserved for experimental purposes and never really used that could also be released. Then again, it would also mean a load of new routes and route objects scattered across the various big cloud providers and further router bloats. But releasing the E-space has been discussed many times in the past, and Amazon/Google/MS's solution is, of course for them to be given the new /8s to (mis)manage.
Every time a company switches to IPv6 they free up some IPv4 making it easier for the people who don't want to switch. Not everyone can be on IPv4 but some people can stay there for ever. Only once you can't do something you need to do will the IPv4 people be forced to switch.
There's probably some out there to be used, but not as much as you think. It's also quite unpopular. Your justification of a second IP address is one of those things that nobody really wants to do if they don't have to, because sharing one IP address, while sometimes practical, always introduces more complexity than just having multiple addresses for separate systems. For example, if you're doing something as simple as running multiple HTTP servers on multiple servers because they either need more resources or different software that can be run on one*, then multiple IP addresses allow you to uniquely identify each server involved and using one requires that something intercept the SNI request to do the internal direction, which is another possible point of failure and requires configuration. If they're constrained enough, then you do that anyway, but if they're not, you avoid it. This is why we should want to get to IPV6 and retire IPV4; there is no real reason that we can't use longer addresses, and the limited quantity of shorter ones requires us to do otherwise useless work.
* Whether those servers are VMs on the same hardware or separate hardware devices doesn't really matter in this situation.
- In 1995, while working for a division of GE (General Electric) in Connecticut, my workstation had a 3.X.X.X address (I guess GE got in line early on.)
- While supporting two ".com's" (1996 - 2000) from home I was required to have a static IP (the local phone company charged me $40 per month for the 1.5 Mbit DSL line + $40 per month for the static IP.)
- For many years earlier this century, while installing Solaris on various Sun boxes an "Are you sure you don't want to install IPv6?" message would appear.
- Working in IT from the time of the Intel 8088 until 2021, I never encountered an IPv6 setup at any of my employers (lots of 10.X.X.X though even for companies trading securities around the globe.)
Coincidentally I am in the process of selling my legacy class-C /24 IPv4 range.
I migrated most of my systems to IPv6 (my ISP gave me a /48 range). The effect of migrating to IPv6 with a single IPv4 address has been minimal.
I use a private IPv4 range inside the LAN for printers and phones etc. But I also run a full IPv6 internal range as a /64 subset of my /48. I have no idea what I'll use the rest of the range for.
For a smallish business, you only need one IPv4 address and even then it doesn't need to be static if you use an external smart host for mail and web services.
Anyway, if you want to buy an IPv4 /24 in the APNIC region, give me a hoy.
The price varies. It's dropped over the past months but looks like it's stabilised. At one stage last year it was over $60USD per address.
The broker expects it to rise in the mid-term so I'm in the market waiting for good offers rather than selling at market price.
Long term the strength of the US technology sector is a big factor. When companies start firing the IPv4 price droops.
Also you ask most IT bods who aren't networking people and most will simply say that IPv4 is just easier to deal with quickly as we've had years and years of getting comfy with it. IPv6 is just too much trouble for very little gain for most people so we badger the networking bods to keep the IPv4 lights on and everyone's happy.
Like most things in IT if you want to happen, you have to force the issue and never take no for an answer else we'll continue to be held over a barrel by out dependency on IPv4.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
