Any benefit to disabling ipv6?

[ron_1]

So I recently installed a newer OS, and one of the things to do on my list of fresh install tweaks is to disable ipv6. But does it make any sense? Does it really do anything? Or is it just a waste of time and energy? What's the consensus today in the (almost) year 2024?

[Pentium4User]

A completely useless idea.

IPv4 has disadvantages (higher latencies, nasty workaround for address shortage) and is currently replaced by IPv6, although that process isn't over yet, sadly.

[Moonchild]

On the flipside, ipv6 has incomplete routing and almost always exposes your machine directly to the outside world, negating any natural protection NAT gives and often bypassing any ingress protection that your ISP might have in place. Any latency you may potentially lose with IPv4 NAT (which is extremely little as hardware routers are exceedingly good at it) you will lose twice over (or more) with IPv6 unless your ISP happens to have a full and complete IPv6 implementation on their local WAN (most don't, especially when dealing with DNS). If you want to label anything a "useless idea" it'd be thinking IPv6 is mature enough to use on residential nets.

Unless you are 100% sure your upstream is fully IPv6-ready AND you have a good IPv6 firewall and packet filter, I'd recommend disabling IPv6.

[ron_1]

Thanks MC.

[athenian200]

Well, I would say the biggest advantage is that it reduces attack surface and generally makes things less complicated. I mean, I usually don't go out of my way to disable it, but occasionally I find that leaving it enabled causes weird problems that go away when I disable it. Granted, mostly it's weird edge cases when an application wants to use an IPv6 address, and won't fall back to IPv4 without explicitly disabling IPv6. My ISP doesn't seem to have good compatibility with IPv6, and really sucks at routing things. After our area was sold to them, they were routing all our Internet through a single data center on the other side of the country. On top of that, I also have a domain registrar that doesn't support IPv6 DNS records at all, and only lets me configure the traditional IPv4 fields on my domain.

I think IPv6 is a bust, but no one wants to admit it. It has all the trappings of being a failed standard. They've been talking about it since 1998, the standard was only finalized in 2017, and five years later, it doesn't really seem to be going anywhere. But maybe that's just from where I'm sitting...

[Pentium4User]

IPv6 routing works fine, millions of machines use it every day, see Google's statistics:
https://www.google.com/intl/en/ipv6/statistics.html

Almost 45% of the Google users use that protocol. In some countries even more than 70%.

Although, there is a small amount of ISPs that are too incompetent to operate it properly.

Most people don't even know that they use IPv6 and it works fine.

For the firewall stuff: Windows and Linux have firewalls that perfectly work for IPv6 SPI and even home routers also have such firewalls.

For Windows: The built-in Firewall perfectly handles IPv6 SPI.
For Linux: Use firewalld (or any other implementation).

For those people who have problems with IPv6:
Discuss them, so they can be identified and fixed.
Disabling the protocol won't fix problems.

[Moonchild]

Although, there is a small amount of ISPs that are too incompetent to operate it properly.

From practical experience, those numbers feel VERY much off to me.
As a data point: I'm using Telia. That is one of the largest ISPs around. They do not even offer working ipv6 in their residential network.
I'm also in Sweden where internet penetration is very high (I'd say almost 100%) and many apartments come with a built-in WAN ethernet port, to give an indication.

For the record, you're one of the few visiting this forum with IPv6 even if it's fully set up to allow it. Even so, by far most of your posts are coming from an IPv6 tunneling IP meaning that at the very least routing was incomplete between your system and the (edge) server for the forum. I looked at how many people on this forum actually use IPv6 for their posting and it's somewhere in the range of 5% to at most 10% from a cursory glance (it may be less, just eyeballing it). So.... I'd rather believe what I measure myself and see in my own connectivity than some number from Google.
Also note their graph says: "We are continuously measuring the availability of IPv6 connectivity among Google users". That "availability" (not active usage!) will most likely be based on telemetry collected from Chrome to know whether the OS is set up to potentially use IPv6.

[Pentium4User]

I can only talk for Germany, but here many residential ISPs provide IPv6 (some small ones don't, sadly) and most residential customers will most likely use it without even knowing.
At least for Deutsche Telekom, I can confirm that IPv6 works perfectly fine in mobile and residual network.
They also operate (currently optional) NAT64 in their mobile network, don't know about general complaints here.

It seems to really depend on the ISP.
I am a customer of TAL.de and I chose them because they also connect businesses and provides static /48.

I've never encountered problems with IPv6 here, although some services (newrelic and some web radios) provide non-working IPv6 addresses. The fault is at their side.

[athenian200]

IPv6 routing works fine, millions of machines use it every day, see Google's statistics:
https://www.google.com/intl/en/ipv6/statistics.html

The issue isn't on the device end, though, it's mostly on the infrastructure side. All my PCs can absolutely support IPv6. But there's a lot of old/legacy stuff in the chain, especially here in the US where the Internet has existed longer. And if there's anything in the chain that doesn't support IPv6, then it causes a lot of weird problems and latency.

I don't mean to say that IPv6 doesn't work at all, but the fact is that the problems it introduces are largely unnecessary, as people have long figured out how to get by with IPv4 and use various tricks involving NATs, VPNs, dynamic IPs, etc. We just don't live in a world where people rely on individual devices having a unique public IP anymore, now it is enough for every device sharing the same Internet connection to have one public address, while the internal network has its own private subnet. IPv6 would have been great if they had gotten the ball rolling and made it an official standard 20 years ago, but at this point it's just messing with mature technology not many people really want to switch over from.

A company like Google can afford to make sure all their datacenters are running IPv6, they even have Google Fi and their own domain registrar. Smaller companies and individuals have a bit less control. So I am sure IPv6 works fine with Google... it's not that people who use IPv6 can't use Google, I know people with IPv6-only setups who use Google all the time. The issue is that you can never predict when something will go wrong and you'll be troubleshooting an issue only to find IPv6 was the cause.

The irony is that as more places switch to IPv6, those still on IPv4 have an easier time as more and more addresses are freed up for them, reducing their incentive to switch.

EDIT: It does seem like Germany is pretty good at getting their citizens to go along with adopting new technology most other people are afraid of. For better or worse, it seems like Germans as a whole tend to heed the advice of experts, and are less likely to try and get away with avoiding work like that for as long as humanly possible to maximize their investment in older tech. Not sure why, just a trend I noticed... Germany is often an early adopter of new tech and moves a lot faster with it than the US.

[Pentium4User]

A company like Google can afford to make sure all their datacenters are running IPv6, they even have Google Fi and their own domain registrar. Smaller companies and individuals have a bit less control. So I am sure IPv6 works fine with Google... it's not that people who use IPv6 can't use Google, I know people with IPv6-only setups who use Google all the time. The issue is that you can never predict when something will go wrong and you'll be troubleshooting an issue only to find IPv6 was the cause.

Smaller datacenters here also offer IPv6. The reason not doing that is mostly not old hardware.
In networking, routers get replaced because they don't have enough throughput.
In datacenters, networking equipment older than 10-15 years is very unlikely because it is too slow.

I use IPv6 as a daily driver and I only see a few issues:

Blocking of ICMP messages breaks PMTU and creates a blackhole.
Issue: Clueless firewall admins, mostly not techable

Not listening on IPv6, but giving an IP address
Breaks NAT64 (in use here a T-Mobile)

Using invalid/unusable IPv6 addresses (seen one time on newrelic, but irrelevant for me and they were told about that, but they are that incompetent that they even don't want to understand that using mapped IPv4 isn't possible over the internet).

Then there is stuff like the Playstation that doesn't support IPv6 at all and doesn't work with CG-NAT nor DS-Lite.
Great work from Sony as many home users have CG-NAT or DS-Lite.
The Xbox supports IPv6 and works perfectly fine behind CG-NAT.

[Falna]

It does seem like Germany is pretty good at getting their citizens to go along with adopting new technology most other people are afraid of

There's an interactive map of IPv6 adoption at https://carteipv6.arcep.fr/ which does indeed show Germany at 4th in the World, behind France at 3rd and India at 1st. The figures are the an aggregate of adoption data measured by Google, Akamai, Facebook and Apnic.

There's more on the speed of adoption in France (in English) at https://en.arcep.fr/news/press-releases ... 10423.html, which shows that it's slow adoption by web hosting companies that's the biggest problem, at least in France.

[Pentium4User]

There's more on the speed of adoption in France (in English) at https://en.arcep.fr/news/press-releases ... 10423.html, which shows that it's slow adoption by web hosting companies that's the biggest problem, at least in France.

That chicken-egg problem can only be solved by implementing IPv6 wherever possible, so the argument "we don't support it because others don't support it" doesn't count.