tayga is the one that works on linux, sorry I forgot to mention that and from my post it looked like both are for Windows. Again I have never used them so you’ll have to look at the docs to set that up
Purely to reply to OPs original question:
- If you want to learn about IPv6 stuff, then sure, do it! It’s not a bad learning experience if you’re interested in networking!
- If you just want to have computers on a network, there’s not really any need.
If you do a lot of home-serving, then it plays out like this:
- If you want to directly expose a bunch of stuff, then IPv6 makes that easier.
- If you prefer to stick everything behind a reverse-proxy, IPv4 will work just fine!
But no matter what you do: Activate IPv6 to your modem no matter what! CG-NAT is bollocks!
cgnat let me rip youtube videos with “yt-dlp -4” without getting my ip blocked. “-4” tells it to use ipv4 which in my case is cgnatted and shared by many other isp customers so if they block me they block everyone else and Youtube are aware of that and let it slide it seems. If I use yt-dlp with ipv6 my ip gets blocked quite fast.
This is so beneficial for my archival backups that I don’t even want a dedicated ipv4 address.
3 Likes
Global IPv6 adoption was less than 15% ten years ago [0], now is a whopping 50% ! Some countries like France, India are exceptionally high [1].
The more I look at the situation, the stronger I feel 2026 is a tipping point for IPv6 adoption. Ten years ago you were early birds but definitely not if you board the wagon in now.
Most ppl certainly haven’t heard of it on media (myself included) that China has a mandate to be single-stack only by 2030 i.e. pure IPv6. I was so shocked when I read it. Only four years away.
My LAN’s IPv6 egress usage, consistently hovering around 30-35% for the few times I check in the past days. Like this moment of snapshot from Banana Pi BPI-R4:
Let me see if the percentage of IPv6 flows moves up in the coming years. So this reply is also for the future me.
[0] Google IPv6 worldwide adoption chart
[1] Google’s data on some countries like China though is completely wrong I think
True, but I’ve also backed up YouTube videos for over a year without CG-NAT, without ever getting banned. 
Here in Norway, it’s a government requirement that all public-facing government websites are reachable via IPv6. And once the external-facing stuff uses IPv6, there’s usually not much of a reason not to adopt IPv6 on the inside as well. And most ISPs prefer that their customers use IPv6 as well due to the cost of owning IPv4 ranges.
We’re still not quite there yet, but the ball has developed a good momentum over the last couple of years.
1 Like
Interesting to hear. So Norway is right at 50% on Google’s survey and at the world wide average. Not bad at all. With government initiatives, acceleration will pick up pretty fast.
I personally would deploy IPv6 but take that with a grain of salt as I’m fairly pro IPv6. The major benefit with v6 is the fact that is bypasses NAT and reduces routing latency which will improve network performance. Additionally IPv6 subnetting is much cleaner since you don’t need to worry about subnet sizes and DHCP. With IPv6 a device can have many different addresses including both private and public addresses which allows different addresses for various uses such as temporary addresses for privacy.
Just to be clear, you will still need IPv4 for legacy websites so dual stacking is still needed.
Hello everyone, I am currently jumping on the Networking train and learning about networks. I really like this thread but I have a question. If IPv6 removes the need for NAT, does that actually make a home network less secure, or is a properly configured IPv6 firewall just as secure as IPv4 with NAT?
This is a point of “ferocious debate”. Some will tell you that IPv6 cannot be as secure as IPv4 with NAT.
In my opinion these people are wrong. An IPv6 network is just as secure as a NATted IPv4 network assuming you configure your IPv6 firewall correctly - that is, default drop inbound. A standard practice since the dawn of stateful firewalls.
The example case of an IPv4 network with NAT vs an IPv6 network without NAT, where neither network has a firewall; systems behind the ipv4 router will not be connectable from the internet because their addresses are unroutable, systems behind the ipv6 router will be connectable if they have GUA addresses and if those systems don’t have their own firewall the services on them will be connectable from the internet.
An IPv6 network with NAT66 / which does not use GUAs would be equivalent to the NAT’d IPv4 case.
Never in my life have I seen a network without a stateful firewall on the router however.
for your consideration; NAT is not security - Kagi Search
2 Likes
People conflate NAT with firewall because its usually done by the same device, but they are two separate things.
If you have no firewall rejecting unsolicited incoming connections, the router will just route anything that states its destination is an internal address in the routers known subnets.
Now its true that if you add 2 or even more layers of NAT or even with CGNAT done by your ISP( that involves multiple layers of NAT) sending a packet to an internal address becomes hard or impossible because the internal ip is not in the subnets known by the public facing routers.
But you can just have a firewall on ipv6 that blocks unsolicited inbound traffic and you achieve the same effect much cheaply, as you are not relying on a clowncar of stacked routers to break routing.
In other words its like protecting the entrance to a venue with a door or with a labyrinth. A good enough labyrinth is going to be as effective as a door, but not as simple nor cheap.
On newer routers (such as my BPI-R4 running latest firmware), their firewalls have replaced “iptables” with “nftables”.
Unlike iptables where IPv4 and IPv6 are managed by two separate tables and two sets of separate rules, nftables unifies both IPv4 and Ipv6 under one single table. Most rules apply to both (except some protocol specific ones).
So yes, nftables-based firewalls ensure IPv6 as secure as IPv4 by design.
The thing id most like about ipv6 is ipsec baked into the protocol. As in not establishing a tunnel but cryptography on simple connection between peers. The problem is that is so god damn complicated and picky in comparison with tunneled VPNs thats just not worth it.
IPsec is no longer required to be baked into IPv6. I don’t want to use IPsec myself, see the wireguard paper intro and conclusion…
WireGuard is much less prone to catastrophic failure and misconfiguration than IPsec. It is
important to stress, however, that the layering of IPsec is correct and sound; everything is in the right place
with IPsec, to academic perfection. But, as often happens with correctness of abstraction, there is a profound
lack of usability, and a verifiably safe implementation is very difficult to achieve.
…
Described around the time of its introduction by Ferguson and Schneier [10],
“IPsec was great disappointment to us. Given the quality of the people that [sic] worked on it and the time
that was spent on it, we expected a much better result. [. . .] Our main criticism of IPsec is its complexity.”
There is little relationship between IPsec and IPv6. The only relationship that I’m aware of is that the idea of IPsec was conceived during the drafting of IPv6 standards. IPsec was first implemented on IPv4.
Now a bit off-topic:
What’s great about IPsec is that you can offload the heavy-lifting of the tunnel completely to hardware without any involvement of the CPU after the initial setup and the regular but sparse key updates.
It’s a feature in enterprise gears. And I know it’s possible on BPI-R4, had users chosen to run MediaTek’s firmware.
So “serious guys” do IPsec tunnels…
I had to help my american friend rip a youtube channel with thousand videos, he had both his ipv6 and ipv4 addresses blocked by youtube.