The real problem is everyone that thinks “I can wait to deploy IPv6”, “IPv6 is not my problem, I have more than enough IPv4 addresses for my future needs”. Guess what it doesn’t matter how many IPv4 address you have if the other person doesn’t have enough. This is Telstra saying to the world. We don’t have enough IPv4 address. We are going to have to deploy a CRAPPY transition mechanism to talk to the laggards in the world who haven’t deployed IPv6.
No one deploys DNS64 and NAT64 because they want to. They deploy it because they have to. It works if everything follows the model network it was designed to be used in. Step outside that network model and it breaks badly. If we where a smart country, *every* ISP in the country would be offering IPv6 to *every* customer today. If we where a smart country, *every* business would be using IPv6 to talk to their customers. If we where a smart country, there would be a ban on selling new IPv4-only equipment. Mark > On 7 Feb 2020, at 06:52, Pete Mundy <[email protected]> wrote: > > > Bugger! And what to do then when the user looses control over what they're > using... Ie the shift of DNS out of the local-admin's (and even OS') control > and directly into the apps, via DoH and QUIC ([1]). > > What a dog's breakfast :( > > Pete > > [1] https://youtu.be/4xGxotBk8AM?t=8727 > > >> On 6/02/2020, at 6:28 PM, Mark Andrews <[email protected]> wrote: >> >> Telstra need to be at least intercepting queries for ipv4only.arpa/AAAA to >> allow CLATs to discover the NAT64 prefix. >> >> Note that doesn’t work if you are using DoH, DoT, TSIG or any other >> cryptographic mechanism to protect your DNS queries. It also doesn’t work >> if you are using DNSSEC to verify the answers as IANA decided to sign >> ipv4only.arpa. >> >>> On 6 Feb 2020, at 16:03, Peter Tonoli <[email protected]> wrote: >>> Is there a higher chance of brokenness when users choose to use other DNS >>> services (i.e. Cloudflare / DoH), apart from Telstra, due to the lack of >>> WKP in the response from those providers? >>> >>> On 6/2/20 3:27 pm, Russell Langton wrote: >>>> - If Alice is connecting to a website with only a A DNS record, our DNS >>>> will spoof the website address with a Well Known Prefix (WKP) so it routes >>>> to the NAT64 gateway > > _______________________________________________ > AusNOG mailing list > [email protected] > http://lists.ausnog.net/mailman/listinfo/ausnog -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: [email protected] _______________________________________________ AusNOG mailing list [email protected] http://lists.ausnog.net/mailman/listinfo/ausnog
