Member
To be fair that $8 is a flash sale price, normal renew is higher. But yeah my point stands. Why pay extra for less reachability? The NAT64 is another dependency that breaks. I had a $15/year NAT64 gateway from some reseller die on me, took 6 hours to notice because my monitoring was on the same box. Lesson learned.
I ran some quick tests from my home connection in Manchester. TREX anycast gave me 3.8ms overhead to a v4-only target, Vultr's resolvers 4.2ms. Within margin. Both solid. The real difference is TREX publishes their PoP list and Vultr doesn't, so harder to debug when something shifts.
This assumes you trust the IPv4 stack at all. Every open port on v4 is a scanned port. My Contabo v6-only box sees zero unsolicited connection attempts. The v4 boxes? Hundreds per minute, all noise, all logged, all wasted CPU. For a privacy-focused deployment the reduction in attack surface is not theoretical.
Member
Total beginner question: if I get a v6-only server, how do I reach it from my home network? My ISP only gives me v4. Is that what NAT64 is for, or do I need something else?
Member OP
NAT64 is for the *server* reaching IPv4 destinations, not for you reaching the server. Your home v4-only connection can still connect to a v6-only server if the server has a v4-to-v6 proxy, or if you use a v6 tunnel like Hurricane Electric. Most of us just use a CDN with v4 frontends, like Cloudflare, in front of the v6-only origin.
In Argentina the mobile situation is worse. Personal and Movistar have v6 but Claro is still v4-only on many plans. NAT64 from here to EU servers adds 180-220ms, unusable for real work. I keep everything on OVH's v4+v6 in Gravelines because the latency to Buenos Aires is already bad enough without adding translation overhead.
Following this thread closely. I have a side project on Vultr's v6-only in Silicon Valley and the Cloudflare v4 frontend covers 99% of users. The 1% are bots and old curl versions, which I can live with.
Same problem here. I use Miredo on my laptop when I need to admin v6-only boxes directly. It's clunky but works. Most of the time I just use the provider's web console or an intermediate jump host with v4+v6.
Member
True but overstated. Fail2ban, CrowdSec, proper key auth, the noise is automated and harmless. I've run v4-facing SSH for fifteen years, zero successful intrusions. The "attack surface" argument only wins if your threat model includes sophisticated adversaries, not script kiddies. For most of us the operational cost of v6-only exceeds the security benefit.
Member
This is a fair point about reseller NAT64. Hetzner's managed offering runs on their own infrastructure, same SLA as the compute instance. But I agree that adding any moving part adds failure modes. We see tickets where the v6 path is fine but NAT64 is down, and the customer blames the server.
