[44net] Fwd: A new era of IPv4 Allocations

Begin forwarded message: From: "Antonios Chariton (daknob)" <daknob(a)daknob.net> Subject: Re: [44net] A new era of IPv4 Allocations Date: 30 July 2021 at 15:32:26 CEST To: Mario Lorenz <ml(a)vdazone.org> That’s what people want to do though. They want to use an amateur radio resource (44.0/10) to talk to people on the Internet that are not licensed. Normally in RF you use a ham radio frequency to only talk to radio amateurs. In the IP world, the src and dst can be different. People want to use an amateur radio resource to talk to a commercial resource, and a commercial resource to talk to a ham radio resource. These two networks can interconnect. EchoLink now bridges the Internet with the amateur radio spectrum. But we don’t use IP addresses on EchoLink, we use our callsigns, transmitted over IP packets. And similarly, when we do IP / Internet connectivity over amateur radio spectrum, we use IP addresses on top of callsigns. We have collected minutes of meetings that we did as the TAC, and they capture a part of the total work that has been put through this. However, at this time, they are not public. Is there something specific that you’re looking for? I could help provide more information on that. The TAC discussed and proposed the PDF document you see, and more importantly the resolution at the end of it. Everything else is me trying to answer questions, provide reasoning and context, and try to address things not covered in the document. The reason we decided on me for this role (but still representing the TAC’s opinion, not giving my own) is that if we had to find a time to meet and discuss every single e-mail that we receive here and jointly write a response to that would massively increase the latency of answers you receive from minutes or hours to days or weeks. In order to make sure that I can still represent the opinion of the TAC, we discuss all e-mail asynchronously and a corrective statement needs to be issued, we will do so promptly, with a text that has been approved from all of us. So far, we are not working on any such response, and all TAC members agree with the responses provided by me. We only want to preserve some IP space that can be used for ham-to-ham communication. How they communicate is up to them. If they want to use radio-only, they can get an allocation off this space and build a radio-only network. If they want to communicate with carrier pigeons only, they can get an allocation and build a carrier-pigeon-only network. If they are okay with using tunnels *through* the Internet, then they can do that. We just want to make sure that we have some space reserved for this type of communication. Going back to the RF analogy, ALL amateur radio space is for ham-to-ham only. In our proposal SOME of the space is for ham-to-ham, and the rest is for ham-to-Internet-and-possibly-hopefully-some-hams-too. If anything, and we go by RF standards, advertisement of 44/8 should be prohibited on the Internet as non-hams can reach you. This is partly true: there is not a “single 44.128/10” but anyone can create their own network within this space. However, if some of these networks don’t want to talk to everything else, then this is working as intended, and they are by design not reachable. We hope that most of the networks there would want to be interconnected and they can do so through radio links, VPNs, Internet tunnels, satellites, or any other technology they see fit. One of them (but not a mandatory or the only one) will be the ARDC-provided PoPs. They will act as one of the many methods people could use to make sure that these networks talk to each other. The only exception that would make the single static route argument not true is that if a single user wants to participate in more than one of those networks, and none of them, by design and choice, want to be interconnected with anything else. In this extreme case this person would need to use one static route per such network. This is still far less and changes much less frequently than if it’s a free-for-all where everyone can do whatever they want in any part of the IPv4 space. I thought that people that actually set it up themselves would speak up, instead of me, where I just got to read and hear about it, but if nobody did it, I will come back to you with a proper statement. I just felt that it would be better to hear this from the people that were there for it. This is an important distinction and something we still allow: the ONLY thing we say is that 44.128/10 MUST NOT be reachable from a non-44.128/10 address. By definition, that means that no part of this space may appear on the Internet. Of course, the exception here is that ARDC will still advertise it to combat hijacking, etc. but will DROP ALL traffic sent to it. It will be dropped at the edge and not forwarded anywhere. With this definition you can then create any type of construct you want on top of that. We only want to provide this guarantee to you. Depending on local or national or international laws you may have to do different things, but we only want to provide this very simple guarantee. Nothing more, nothing else. If it’s illegal to use 44.128/10 in some countries based on this guarantee, then you can always use 44.0/10. If it’s illegal for a country to use 44.0/10 and can only use 44.128/10, then they have to move to this part by law. We can’t be certain, I agree with what you say. What we can do is make it much better than it is right now. We think that even if we can’t provide a perfect solution, we should still make steps to improve the situation. If you are in this 44.128/10 network, it’s extremely less likely for non-hams to reach you. If you are connected to the Internet, and you advertise your space with BGP, it is in fact *guaranteed* for non-ham traffic to reach you. You could argue that you could deploy ACLs or Firewalls, or any measure like that, and this would help you only accept 44/8 traffic. But this is still worse: packets on the Internet today can be spoofed. A non radio amateur could send a spoofed packet appearing from 44/8 from a commercial ISP, and it would get through your firewall and possibly over your RF links just fine. Moreover, if two 44/8 networks connect with intermediate hops over the Internet, e.g.: 1. 44.1.2.3 2. 44.3.2.1 3. 192.0.2.15 4. 193.5.16.50 5. 44.4.6.7 6. 44.7.6.5 (Which I assume is what you want to do if you want to be on the Internet BGP and block all incoming traffic from non-44/8 hosts) Then hosts #3 and #4 that are non-hams can easily modify any and all traffic and cause a transmission in a ham band of packets that are not from a ham. This is much more common than you can imagine, and not always done maliciously. If I am node #1 and I do a traceroute to node #6, due to the way the traceroute utility works, nodes #3 and #4 will generate a new packet themselves (TTL Exceeded) and send it back to #2, who will forward it over a ham link to #1. Node #2 probably did something illegal, as they transmitted a packet that was not generated by a radio amateur (it’s a non-manned station / router of Cogent / Telia / Hurricane Electric, …) over a ham band. If you have the knowledge that any host you traceroute within 44.128/10 is (to the best of your knowledge and ability to tell) a radio amateur, and that these packets will not travel raw over the Internet, and no packets from the Internet can be introduced into this connection (because it’s inside a VPN for example), then you can be sure that running the traceroute command will not cause a number of people to break the law along the way. Now for the use case where you want to be on the Internet with 44.0/10 addresses, but don’t want to drop all incoming traffic that is not sourced from 44/8, then it is normal to expect that all these port scans that people do will reach all IPv4 addresses in your network. Since you know this is going to happen, you cannot use any radio link in a non-ham band, as it is guaranteed that these stations will transmit a message over an amateur radio band that is not from a licensed user. Even with a stateful firewall that only allows outgoing connections, all responses you get from Facebook, Netflix, Altavista, etc. will be from a non-radio-amateur and you will be transmitting them over a band illegally. If this law applies to you, then you cannot use the ham bands to “communicate with the open Internet”. I think that we both agree on that. Now moving to the case of “communicating through the Internet”. Let’s examine that. If the network does not appear via BGP on the Internet, then everyone has to set up tunnels to interconnect everything. You can’t just send traffic to a commercial ISP and have it delivered. It will be dropped by ARDC. This guarantees that the traceroute problem I described earlier (and any other similar case) won’t happen. The only routers and equipment that participates in this network is (or must be) owned and operated legally by hams. You don’t rely on Internet infra and expect any guaranteed. This means that it is almost guaranteed to not break the law or at least it is much much much much much much more certain that such a system would not break the law than talking transparently “through the Internet”. I agree that we must address this work, and it could be a lot of it. Unfortunately the best the TAC can do is to include these resolutions for the board to vote on (give enough help, time, …). Anything else will have to come from the Board as we do not have any authority to help in any other way. There are a lot of people that would have to renumber e.g. 200 hosts that we saw earlier, or possibly more. But I think this is a testament that the current network is not easy to use: you may have 20 users, but a single person was managing it and has to renumber everyone. If anyone participating was an expect, they would simply have to renumber their own hosts, that would be less than 200 for a typical setup. And the current users force their world view upon future users and also a large part of this network. I don’t think that it’s about who wins and who gets forced to submission. The TAC tries to create space for both use cases so we all win, and we are all happy. Like any rule in any civilized society, some people will have to make some sacrifices to co-exist. They will have to understand why they need to do this, and then they will have to give the others space to grow and have fun as well. Under no circumstances do we want a minority of very vocal people that shout to bend the majority to their will, simply because they can’t shout loud enough. And it seems that this happens frequently on the modern world. We have to understand that by forcing people to do anything, we only drive them away. I would consider it a failure if people gave up on a project or hobby or resource just because the environment there does allow room for them to grow, and I did not do my best to speak up for them. We have to understand that not everyone can shout. We are all different, and we all want different things, and we all have different needs. Some people are too shy to shout. Some people have weak vocal cords. Some people don’t speak the language we shout in. If we let these people be ignored, and we only do what these few vocal people say, then we will create something that is only inclusive and welcome to people that can and want to shout. This almost certainly guarantees a toxic environment that people will slowly start to abandon and leave it be, simply because it’s not what they want to do. If someone creates their own “People that shout” club, then that’s fine. They can all gather every week and shout to each other. I personally don’t want to join this club, I find no value in it. But we should collectively never allow these people to take over a public resource for all of us, that can benefit all of us, as this is dangerous. Just because they have the privilege to shout does not mean that other voices should not be heard. And not only that, but we should make all these decisions proportionately. Because this is a common resource, for all of us. Not only for some of us. Speaking personally, I will continue to be an ally and use my privilege of being able to shout to defend all these users and protect them and make sure that their voices are heard. We want people to use their 44 IPs on the Internet! We are happy to see them do it, and we are really looking forward to all the nice things they can achieve by doing so. We just want to make sure that they’re not the only ones, and we leave some room for people that like something different. The current proposal gives enough space for now and in the future for people to do any of the two, or both things, as they wish. It’s about choice. First of all, we do not remove the option for Direct BGP, and we won’t force anyone to use ARDC’s PoPs. That’s our goal. We reserve just as much space for Direct BGP as we reserve for non-Internet communication. Each user can decide which part of the network they want to be in, and they also have the option of picking both. Destruction is indeed sometimes necessary, but of course I think that we all agree that we should try to limit it. We don’t want to destroy anything. We just want to make a change over the next year so that it’s easier for everyone to move on in the future. We want to look at the long-term benefit of the network over the short-term trouble of renumbering a part of it. We are interested in the opposing views, the voices of the people that want to renumber, and we want to hear from all of you. This is why we started this thread a few days ago so we can get to hear all of you, and discuss with you. The PDF does not include a proposal that is final and that we have sent to the Board for a vote. It only includes *what we want to propose* and why we arrived at it after 4 months of work. If we get a good recommendation and we see the value in that, we would be happy to change it. It has not reached the Board and the Board is not going to vote on it if we don’t tell them we want them to. As I said earlier, there’s nothing yet to reject. There’s no official motion made to the Board, and we will only send one after we get to hear you. I am aware that the bands are different for different regions of the world, but I do not want to make the example complicated. I thought that it was enough for people to understand my point, even if it’s region-specific, and that you can easily replace those numbers with your local ones. I did not see a benefit in being extremely precise in something that is not related to the point I try to make when the audience can probably understand it. If you did not get my point because of the fact that two digits are off, then I can rephrase the sentence with these digits as they stand around the world. First of all, it may be illegal in some areas of the world, e.g. I think the U.K. or Greece. But I think that’s not your point ;) If your radio supports both bands and you’re licensed for both, then you can talk to both using the same radio. If you’re not licensed for one of them, but a friend is, and you want to talk over it, you can set up a cross-band repeater (netmap, …) to allow you to do this. Antonis