APNIC Blog

> 2. In many situations, we dont want devices on the internet at all, and on private only networks. ...

Unique Local Addressing (RFC 4193) solves this problem and requires no coordination with outside parties. The network admin gets to choose the scope of the ULA prefix, so you can trivially make your ULA traverse multiple LANs if you wish. (This addresses your first point, too.)

> 3. There is a lack of clearly communicated best practices for the industry.

Eh? This is the first hit for "IPv6 BCP": https://www.apnic.net/community/ipv6-program/ipv6-bcp

> 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec)...

Then -uh- don't use IPSec and block IPSec connection establishment attempts at your border firewalls. Or, because implementation of IPSec is -sadly- not a requirement for IPv6 implementers, use an IPv6 implementation that doesn't implement it.

Edit: You are aware that OpenVPN uses TLS for session authentication and IPSec for transport of tunnelled data? :)

> 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft).

Are you talking about IPv6 over Teredo tunnels? If you are, then get a packet dump and fire up Wireshark... Teredo doesn't encrypt the traffic that it tunnels. If you aren't, and you're talking about something that's wrapping traffic…

Great feedback, I'll add a little more to the site to describe how it all works. Until then...

At a 30,000ft view, the site works by building an in-memory routing table at boot time that has an entry for every route on the internet and which ASN (autonomous system number) announces it. From there, it stitches together data on the organization that the ASN belongs to, and geolocation data, and then exposes it in the API/UI. Under the hood it's using a treebitmap[1] data structure, which means that it can do _very_ fast lookups when given a particular ip address or ip address range.

Zooming in a little more, the main data source is MRT dumps from the RIPE RIS project[2]. There are a number of routers that RIPE (one of the 5 regional internet registries that hand out ASNs and IPs) that rely on network operators to share their view of every route on the internet. These routers are probably some of the most well-connected routers in the world. For the purposes of this service, MRT dumps are effectively a point-in-time snapshot of the routing table of that router. IP Guide parses that file, rebuilds it in memory, and attaches other relevant data to each IP range (also known as a "prefix").

This allows the service to stay fast and stateless, which was one of the main things I was trying to optimize for when building it.

[1]: https://blog.apnic.net/2021/06/04/storing-and-retrieving-ip-prefixes-efficiently/
[2]: https://ris.ripe.net/docs/10_routecollectors.html

The general arguments here are that CDNs have replaced tier1 ISPs as the predominant force on the Internet. Geoff Huston has written about this over the last ~10 years[0][1].

So the question as to alternatives is void - the problem is CDNs MitM'ing yur datas across multiple domains, and the loss of the nostalgia (or whatever) for the tier1 ISPs (who were all horrible in their own ways).

I don't particularly subscribe to the harms Geoff purports, but I cannot fault his analysis of the situation. If you haven't read it before, it is worth the read.

If you want a free and open Internet, then you don't want someone else's TLS proxy between every consumer and every producer. This ignores the problems of DDoS, scaling, etc. Buuutttttt.... 99% of websites don't have those problems, so why are you building a solution which trades decentralization for it?

Anyhow, sounds like you're into all the wonderful things Cloudflare (and every other CDN) provides. Great. That's fine, just don't be angry when the free and open Internet promised to all of us in the 1990s requires 3rd party gate keepers. And no, there aren't solutions to all the problems.

0: https://blog.apnic.net/2016/10/28/the-death-of-transit/
1: https://www.thousandeyes.com/blog/internet-report-evolution-network-architecture

An excellent find!

> We will be destroying all “raw” DNS data as soon as we have performed statistical analysis on the data flow. We will not be compiling any form of profiles of activity that could be used to identify individuals, and we will ensure that any retained processed data is sufficiently generic that it will not be susceptible to efforts to reconstruct individual profiles. Furthermore, the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC’s non-disclosure policies.

So it's a 5 year research program, with options to extend it as a research program. To me, that means they intend to keep DNS data for up to 5 years (or longer) before performing statistical analysis and processing on it. Here is APNIC Labs's privacy policy http://labs.apnic.net/privacy.shtml and APNIC's privacy policy https://www.apnic.net/about-apnic/corporate-documents/documents/corporate/privacy/#2.4

So much for "privacy-first".

Using LD_PRELOAD for IPv4 seems to me like using the wrong tool for the job.

> "Most of the apps I use support IPv6 but there are some cases when lack of IPv4 connectivity on my machine negatively affects experience."

Just install clatd to get 464XLAT so hardcoded ipv4 get routed to 192.0.0.1 (the clat iface is the default gw for ipv4) which does NAT64 through tayga too.

IMHO the best strategy is a mix of strategies:

- 1. Clatd doing 464XLAT (RFC 6877) so:

- 1.1 Stateful protocol translation (RFC 6146) at CG-NAT64

- 1.2 Stateless protocol translation (RFC 6145) at the UE

- 2. DNS64 (RFC 6147) mechanisms at the DNS server returning padded AAAA for A only entries

- 3. IPv4 embedding into IPv6 addresses (RFC 6052 section 2.2)

Suggested reading: https://www.apnic.net/wp-content/uploads/2017/01/IPv6_Migration_Strategies_for_Mobile_Networks_Whitepaper.pdf

The vast majority of people will not see EDE errors. Even when they are set there is no guarantee that downstream resolvers have it enabled. The default in Unbound is disabled and people rarely check logs. Even if someone is using DoH their browser would have to translate the specific text to the user if it received such an error. Here [1] are some notes on the support of EDE around the internet.

As a side note I do not see that error for that domain. I get an A record which belongs to Cloudflare. Cloudflare could just as easily drop that domain into an account that displays the censored error message as text/plain to the user and close the connection.

streameast.app. 282 IN A 172.64.80.1 [1] - https://blog.apnic.net/2023/09/28/extended-dns-errors-unlocking-the-full-potential-of-dns-troubleshooting/