IPv6 in Connecticut

walden

I just wanted to start a thread with regards to the status of IPv6 in Connecticut.

I just chatted with a [person? AI bot?] on the Frontier website asking if could activate IPv6 on my account, knowing the answer would be no, but they confirmed that it's still being worked on. They said I'd get a notification when it's activated.

Other than that, I've just read some old Reddit posts about the steps remaining before they can activate it. I think the basic gist is they switched to a different vendor for the back-end network equipment and were waiting on licensing stuff. Assuming the licensing has been worked out, then they had to put it all together and test it before releasing it to the public.

I did try a Hurricane Electric 6to4 tunnel which worked, but speeds were around 600 Mbps on a 1gig plan, so I went back to just using IPv4.

terabitz

99% of Frontier's footprint does not have IPv6. The only parts that do are former SNET/AT&T areas in Connecticut, and IIRC it's only the VDSL (former U-Verse) and early GPON deployments that support it. Newer FTTP deployments (especially XGS-PON) do not support it.

cshilton

I should have read your post to see that you tried the HE tunnel. ~~There are issues but you can use a Hurricane Electric tunnel on Frontier. That's what I do.~~ I'd definitely say that the HE tunnel isn't for everyone.

walden

cshilton

I might try it again, because my MikroTik router just got an update that enables fasttrack for IPv6, which in MikroTik speak means faster speed as data makes its way through the firewall rules. Maybe that'll result in something closer to 1000 Mbps.

cshilton

walden Where are you testing? I run an OpenBSD unix box as a router, think OpnSense, and I just spent a bunch of time getting the hardware to do full GigE, "north and south" as our network guy at work used to say through the firewall. Our network guy was just quoting the Palo Alto Guys who were keen to caution that their lower end hardware couldn't always keep up with full GigE throughput while also filtering traffic. I've updated my hardware and my speed tests are now in the 890 ~ 940 range over mixed IPv4 / IPv6. Given that my IPv6 is an HE tunnel, I'll take it but I haven't found an IPv6 only speedtest that's on the same continent, North America, as me. So I don't trust the results. I guess I could iperf back and forth between a virtual that I strategically locate. I should add that my speed tests don't change when I turn on IPv6 on my client.

walden

cshilton

Just using speedtest.net.

I just reactivated the Hurricane Electric 6to4 tunnel.

With my firewall "fasttrack" turned on, 738/730.
Turned off, 720/450.

Maybe I'll keep the 6to4 tunnel on now that my router helps with faster speed. With IPv4, speedtests are always 900+ Mbps. This is still slower, but not too bad. I'll be able to start getting comfortable with IPv6 this way.

ipv6tech

I've been running Frontier and Cox cable together for 9 months. Typically more of my traffic is routing over Cox using v6 than over Frontier. Let's hope they can make some progress on v6 this year. It's been frustrating to see this conversation and process take so long.

cshilton

walden To some degree, I think that's life with firewalls and speed test. It took me about 4 years to finally get to the place where I get 90% of full speed through a very complicated firewall. Most of this is because I'm a part of the self hosting crowd. I lived with 700+ Mb/s out of 1Gb/s as good enough for at least two years.

I do draw the line at other places however and IPv6 is one of them. Here's a list of Hurricane Electric Tunnel IPv6 pros and cons for your consumption before you get so deep into things that you only have the illusion of a choice.

IPv6 with HE Pros

Static IPv6 assignment.
Fairly simple configuration.
Restores end-to-end principle to my internet connection. For a self-hosting user, this is a must. I've tested this from places in Europe, the Caribbean, Africa as well as all over North America. I can tether my laptop to the internet via my phone and I can directly maintain servers through the IPv6 connection from the tethering.
Provides really flexible networking setup. Again this is good for self-hosting users.

IPv6 with HE Cons

Despite the fact that IPv6 is fairly old, for many it's still a new and alien technology. There are a lot of xenophobic people out there and you won't get any help from any of them, even the ones that have implemented IPv6 on their side. One of the things you will have to do is put a step called turn off IPv6 into your testing regime. This is not specific to HE.
Continuing from above, a lot of people are xenophobic and don't like the way that Hurricane Electric has built the tunnelbroker service. Expect a stone wall when you run into these people. The specific example here is Netflix who consider tunnelbroker to be a VPN service that hides your location. I will note that Netflix has really good reasons to think this way.
Geolocation is significantly less accurate in IPv6 then it is in IPv4. While geolocation will never be a particularly accurate service, it's good enough on IPv4 that the people who provide streaming content rely on geolocation. It's worth noting that under HE's tunnelbroker service geolocation can be setup to be much more accurate than it is under IPv4. Sadly, you spend a lot of time talking to the wall when you try to explain this to tech support outside of HE.
The net effect of the above is that if you want to do: HE tunneled IPv6, SLAAC, and subscribe to streaming services to watch content on your network, you'll have to either block AAAA resolution for certain domains, and or arrange for "happy eyeballs" to make everything work by rejecting outbound IPv6 connections by network at your firewall. I do both and it works very well. This is reasonably easy in OpnSense. With other firewalls, your mileage may vary.
The tunnelbroker service is a side project at Hurricane Electric. There isn't a large staff to monitor for and remedy abuse. Since it can also be used as an IP address hiding service people come out of the woodwork and abuse the automation toolkit to creatively "hack the internet" via tunnelbroker.net accounts. Each time this happens, you get to modify your DNS block AAAA / block outbound IPv6 to this network again so that normal things can work again.

At the end of the day, I'll say that tunnelbroker is a very technical service. I'd further say that while I love it, and I use it on a Verizon FiOS line where native IPv6 is available, I would only recommend it to people who are pretty technical. I'm partially retired and consulting these days so I have the time to deal with it but 4 years ago when I was full-time employed, I frequently found babysitting the HE tunnel was an unhappy chore.

cshilton

Here are two examples of problems that I've had to overcome with my HE tunnel. I'm not going to go deeply into cause/politics here because in each of these cases all parties acted the way they should have.

Netflix

Sometime in the distant past maybe ten years ago or so, some jerk in Europe realize that he could bypass geolocation and view the US Netflix catalog from nearly anywhere by creating a Tunnelbroker connection to the New York endpoint and consuming Netflix only via IPv6. Netflix eventually figured this out and kick-banned either portions of the entirety of HE's IPv6 space. Concurrently, HE figured out what was going on and took steps to block the abuser. Then they talked to the Netflix engineers in an attempt to remove the kick-ban. Netflix declined to remove the ban. When Netflix did the ban, I wish , they would have done this by sending a TCP RST on initial connection attempt but they instead decided to just drop the inbound packets. My personal experience debugging this was the night I debugged this issue. We really didn't get anywhere until I turned of SLAAC and rebooted my Apple TV. Above I said that "turn off IPv6" has to be in your toolkit for debugging problem. This experience is why. At the end of the day, my research showed that I had to block outbound connection to anything DNS identified as Netflix with a TCP RST to make happy eyeballs work. Figuring what addresses to block was not a simple thing. To make things worse, Netflix implements a lot of their stuff in AWS. At the end of the day, I have to block selective /48s from AWS address space to use Netflix in my house. This solution has required at least one tune since I implemented it.

Google

This started a few years ago but Google finally got tired of things and kick-banned HE IPv6 addresses perhaps three years ago. Some mal-actor decided to skew Google search results by building a robot to flood google with crafted searches. Google's initial reaction was to force a CAPTCHA check on searches that came from HE. Google eventually just blocked all searches from HE's IPv6 range. Again, HE's network engineers tried to work with Google's engineers but they couldn't resolve the problem in a way that made using Google from an HE IPv6 address seamless. In my case, I just added a whole bunch of google hostnames to my DNS/IP based blocker.

My solution

I've got a three-fold solution for these problems.

I maintain a list of domains that my DNS resolver will not give out AAAA answers to.
Once every fifteen minutes. I resolve a list of names to IPv6 addresses by using Cloudflare's resolvers. I filter the addresses up to /48 address blocks and then configure my firewall to block connection to the resulting addresses with a TCP RST. Happy eyeballs sees this RST and forces an IPv4 connection to the service. This is a cover in case a device could find the IPv6 address of a service in the first place.
Once every 15 minutes I generate a list of internal IPv6 addresses via NDP on my SLAAC server by MAC address. The listed MAC addresses belong to Apple TVs, iPads, and iPhones. If any of these devices attempts to open a TCP connection to 443 on an external IPv6 address, they get a TCP RST.

I found this reasonable to do because my firewall is an OpenBSD box running pf so running python scripts out of cron is easy and modifying the firewall by adding address blocks to a table.

Notes

Hurricane Electric will give you two kinds of address in tunnelbroker. You get a /64 for your network automatically and you can ask for a /48 for your own use. HE says that many of the issues that I'm seeing are mitigated by asking for the /48, ignoring the /64 and cutting your network address from the /48 that you received. I've had my tunnelbroker account since 2008 or so and it's been in heavy use since at least 2010. Moving out of the /64 would be difficult but I am working on that. But honestly, I can't say I've done a good test.

CommunityMember

cshilton HE says that many of the issues that I'm seeing are mitigated by asking for the /48, ignoring the /64 and cutting your network address from the /48 that you received.

Pretty sure the various fixes only works with a paid HE network service agreement with a dedicated delegated /48 (or whatever block size you contract for), as the free tunnelbroker IP ranges are blocked by many/most streamers, because of abuse including being used to bypass geoblocks[0]. Offering a useful free service seems to attract certain types of customers (which results in the usual "and this is why we can't have nice things" result).

The other thing is HE and Cogent do not peer with IPv6, and that causes additional issues (which sometimes falls back to IPv4, but it makes the experience worse).

The only correct fix is for Frontier to roll out proper IPv6 support. Note that some of the ONTs that Frontier has deployed do not properly support IPv6. Those older ONTs would need to be replaced (which is, of course, is an expense they would prefer not to incur).

[0] One can have issues with the various streamers geoblocking decisions, but it does not change the fact that they exist.

cshilton

When I corresponded with the tech at Hurricane Electric about 1 year ago, he explained to me that that the streamers have the addresses for the /64 blocks that you automatically get when you sign up for a tunnelbroker account. From tunnelbroker you can ask for one /48 per tunnel IIRC. I did that a long while ago and was only using one of them. This week I came up to my place in Massachusetts:

I enumerated how I was using the /64 up here
I changed SLAAC to hand out a piece of the /48 they gave me instead
I reconfigured the rest of the network to use only the /48 as well (that was basically listing all the places where I did static assignments)

That seems to have eliminated a lot of the problems that I have connecting to streaming services. I’m going to try this in my other place as soon as I can. I originally thought that the streamers had kick-banned 2001:470 but now I think that it’s smaller than that. My problem is that my network at home has too many static assignments to simply change my SLAAC assignment and cross my finger. For me, this renumbering resulted from a terraform and ansible project that I undertook to clean up DNS resolution and other things on both of my networks. That forced me to write ansible to calculate and setup the IP parameters on FreeBSD, OpenBSD, and Rocky Linux.

neel

When I had Verizon Fios I didn’t have native IPv6 in NYC. I have a L2TP VPN to a BuyVM BGP VPS where I have static IPv6 prefixes.

I moved and we now have T-Mobile where the VPS also gives IPv4. Yes, I know T-Mobile home internet sucks but it’s uploads are 30-80 Mbps versus 35 on Spectrum and 20 on Verizon 5G. We lack Fios where I live now but I’m trying to get it wired anyways.

cshilton

I took the second step today and moved the network at my home out of HE’s default, /64 space into the /48 that I got from the tunnelbroker.net program. Again things seem far better now that I’m out of the /64 space.

WebinTheWorld

i just hope Frontier will implement V6 faster in Connecticut. It presents new challenges but I can learn. Soon I fear that there will be greater shortages of V4 addresses and providers will continue slow walk V6 roll out and charge more for artificial scarcity. With V6 addresses are practically Unlimited.