IPv6 on UPC

macrubicon

kippy wrote: »

Can you give me an idea of these applications?
I can think of one or two but NONE that would be on labs of PC's.......

Not on a public board - resourceful lot students

In general we have issues with things session based. Also firewalls can get ansy when they see multiple service requests coming from the same IP and start shunning or blocking.

SAP, WorldSpan and any of the prometric / online test apps can cause huge issues.

kippy

macrubicon wrote: »

Not on a public board - resourceful lot students

In general we have issues with things session based. Also firewalls can get ansy when they see multiple service requests coming from the same IP and start shunning or blocking.

SAP, WorldSpan and any of the prometric / online test apps can cause huge issues.

I dont actually see HOW any college would require more public IP's than a business.
I've supports all of the above (bar wordspan) in a NATTED environment without any issues.
Perhaps you've had more specific tasks required of the apps but I really cant see why you would want/need this many public IP's.
I do realise the need for some alright, but dont get the reasoning for as many as you have or as many PC's in labs having public IPs.

macrubicon

There are fairly specific reason based, mainly, on how the services are utilised (and reused) for specific purposes.

Not that I'm trying to dodge answering but given that most of our students have a presence here I'm having to be purposefully cagey.

Could we move more to private IP's and NAT - yes.
Could doing this reduce our Public IP footprint - yes but not by much - maybe 1 Class C. This is mainly due to the apps that need the 1:1 relationship client to server.

We have an ever increasing Private IP base internally that is beind proxies and NAT'd firewalls, so in effect we are using reduction techniques and will continue to deploy them but we are always going to need a bit more than the norm due to the way things are used more so than the apps that are used.

kippy

macrubicon wrote: »

There are fairly specific reason based, mainly, on how the services are utilised (and reused) for specific purposes.

Not that I'm trying to dodge answering but given that most of our students have a presence here I'm having to be purposefully cagey.

Could we move more to private IP's and NAT - yes.
Could doing this reduce our Public IP footprint - yes but not by much - maybe 1 Class C. This is mainly due to the apps that need the 1:1 relationship client to server.

We have an ever increasing Private IP base internally that is beind proxies and NAT'd firewalls, so in effect we are using reduction techniques and will continue to deploy them but we are always going to need a bit more than the norm due to the way things are used more so than the apps that are used.

Fair enough.
Just trying to figure out in my head (i've worked in HP and fairly sizeable banks/institutions) what apps need that many public IP's.

As I said, I understand why you arent going to disclose them.

watty

Back in 1999 I think Limerick Institute of Tech was using less than 20. Everything else behind proxy.

watty

macrubicon wrote: »

There are fairly specific reason based, mainly, on how the services are utilised (and reused) for specific purposes.

Not that I'm trying to dodge answering but given that most of our students have a presence here I'm having to be purposefully cagey.

Security by obscurity isn't going to work...
It's easy to find out what IPs you have and scan the ports.

Captain Commie

well that was a waste of 15 mins on hold, called to see if could get a static ip and was told straight away no, but then tried to get me to call premium support

Jonathan

Has anyone managed to get an IPv6 address from UPC? I tried and couldn't.

@innovated Are you sure you had a proper IPv6 address or were you using a Teredo address?

Moriarty

No sign in Dublin 1 anyway. Anyone have any news on if there's a trial going on atm or if this is hot air?

blaz

Moriarty wrote: »

No sign in Dublin 1 anyway. Anyone have any news on if there's a trial going on atm or if this is hot air?

I have heard from a friend who lives in Dublin 4 that he got one assigned. Apparently you only get it via DHCP (if your DHCP client support IPv6), but not via neighbor discovery.

blaz

Update: I have been in contact with UPC (their core network engineers, not the support team in Ireland). As of yet, there is no IPv6 on UPC in Ireland, except for business customers on request (contact your account manager). For residential customers, don't expect anything anytime soon.

Jonathan

UPC acknowledging IPv6 for the first time:

http://support.upc.ie/app/answers/detail/a_id/340/

Kiall

About time an Irish ISP made a "public statement" on what their plans are

All this talk of recovering IPv4 blocks from the large institutions is not gonna happen. ever. hell will freeze over before we get enough to last 5 years back, never mind 50. Now - lets move onto something that actually has a chance in hell of happening .. IPv6!

I'm glad at least 1 Irish ISP isn't going to implement large scale NAT - hopefully none of them will! I can't even begin to imagine the PITA LSN would be

L1011

watty wrote: »

Back in 1999 I think Limerick Institute of Tech was using less than 20. Everything else behind proxy.

That's being sensible; the other end of the scale is Apple where every network printer they have has a public (but unroutable from external, obviously) IP address!

Kiall

MYOB wrote: »

That's being sensible; the other end of the scale is Apple where every network printer they have has a public (but unroutable from external, obviously) IP address!

Thats only being sensible if you care about "everyone else" .. Don't get me wrong, I would never use public IPv4's for anything I didn't explicitly want over the internet access to. But this makes Apple's ops and security team jobs much easier.

BUT - Everything in our office has a public IPv6 address. (Everything that supports IPv6 that is..) I can see why this ease of access appealed to the Apple ops team..

To those who suggest this kind of crap:

watty wrote: »

If you don't want Pwnd, turn off all IP6 for now.

We're yet to get "Pwnd" .. Maybe you know something we don't? Care to share?

SickBoy

MYOB wrote: »

That's being sensible; the other end of the scale is Apple where every network printer they have has a public (but unroutable from external, obviously) IP address!

:eek:

Sparky

Jonathan wrote: »

UPC acknowledging IPv6 for the first time:

http://support.upc.ie/app/answers/detail/a_id/340/

Our connection has had an IPv6 address for the last 9 months but its only a 6to4. None the less ipv6 sites are working.

http://[2620:0:1cfe:face:b00c::3]/ loads up facebook

Regards security. We have iptables blocking it anyways unless we allow it

My router supports IPv6 either via DHCPv6 or a 6to4 tunnel. I've tried it with tunnelling and it works, just a bit slower. Nothing via DHCPv6 as of yet.

For some reason, when I have 6to4 enabled, the DNS seems to revert to the UPC default (with the search page for invalid domains) despite me having manually specified other static IPv4 DNS servers. I'd assume that the IPv6 DNS is taking over, but why would it be using UPC's search page?

Jonathan

Sparky wrote: »

Our connection has had an IPv6 address for the last 9 months but its only a 6to4. None the less ipv6 sites are working.

http://[2620:0:1cfe:face:b00c::3]/ loads up facebook

Regards security. We have iptables blocking it anyways unless we allow it

But thats a 2002::/16 address, not a AS6830 address. That address will load on almost every Windows machine anyway because they enable Teredo by default.

maggy_thatcher

UTV internet have turned on 6to4 as well in the last couple of days. I only noticed because something seems to be up with ie.archive.ubuntu.com (lots of 'Forbidden' errors), and it was connecting via an IPv6 link.


The IPv6 addresses are working from all my devices (Mac, Linux & Android), and they're not running any local level 6to4 software, so it's definitely implemented at the ISP level.

Jonathan

Recompiled OpenWrt with 6to4 support last night and I did indeed get 2002::/16 addresses.

I might change the default route on my machines from my HEAnet sixxs tunnel over to the 6to4 address which would mean I can relax the firewalling currently in place to ensure no Linux ISOs are shared via the tunnel.

Probably still keep the sixxs addresses for external access because they are static rather than based on a dynamic UPC address..

Capt'n Midnight

Kiall wrote: »

All this talk of recovering IPv4 blocks from the large institutions is not gonna happen. ever. hell will freeze over before we get enough to last 5 years back, never mind 50. Now - lets move onto something that actually has a chance in hell of happening .. IPv6!

http://www.theregister.co.uk/2011/03/24/microsoft_ip_spend/

Nortel Networks, the bankrupt networking hardware vendor, has sold 666,624 IPv4 addresses to Microsoft for $7.5m, according to Delaware bankruptcy court documents.

That’s $11.25 per address

each of these lines is worth $188 million dollars
http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.txt
Love the way that 240- is reserved for future use ( $3 Bn worth )

Here is an old map if anyone wants to fill in the gaps :pac:
http://xkcd.com/195/

Kiall

That's exactly why I believe nobody is going to hand back blocks to the RIRs .. They are just too valuable to give away for free..

Also .. It looks like IrishBroadband have setup a 6to4 relay .. I can't (easily) test it though since we have 6to4 blocked at our firewall..