Jakarta is a different world. Telkomsel has v6 on mobile but most fixed-line providers (First Media, Biznet) are v4-only. I run HE tunnels on three client sites because there is no native alternative at any price.
The "just use native" crowd needs to look outside EU/US. APNIC ran out of v4 in 2011 and we're still waiting for v6 deployment to catch up. Tunnel brokers are infrastructure here, not legacy.
That's a fair geographic correction. I should have qualified: in RIR regions with mature v6 deployment (RIPE, ARIN), tunnel brokers as default advice for new users on cheap VPS are doing more harm than good. In APNIC and parts of LACNIC, they're still necessary.
But even then: a WireGuard tunnel to a VM with native v6 is architecturally cleaner than 6in4 through a third-party broker. The "use HE" answer is lazy. "Rent a 3 EUR VM in Singapore and tunnel yourself" is better advice for Jakarta.
Member
Mexico City checking in. Totalplay finally enabled v6 on my fiber plan last month but they CGNAT the v4 and don't route v6 to residential static IP tiers. I had to downgrade to dynamic to get v6 at all. ISP logic is mysterious.
Kept the HE tunnel as backup. Two paths to v6, neither great.
The HE tunnelbroker website still runs on Perl and looks like 2007. That alone should tell you something about maintenance investment.
I migrated everything to my own 6in4 endpoint on a Vultr VM last year. Same encapsulation, I control the filtering, and Vultr's DDoS mitigation actually sees the inner packet because I terminate and re-encapsulate on my side.
Member
This is the key insight. Broker tunnels hide the inner flow from your provider's edge. Self-terminating on a VM you control lets you apply your own filtering before re-encapsulation or native handoff.
For production: own your tunnel endpoints. For home lab: whatever, use HE. The problem is people treating the home lab solution as production architecture.
Member
Also in Tallinn, also on Telia DS-Lite. I tried the HE tunnel but their closest PoP is Frankfurt and I was seeing 40-50ms added to every v6 flow. For SSH it's fine. For game streaming to my living room TV it was unusable.
Switched to a local VPS provider (Veebimajutus.ee) that has native v6 and runs a WireGuard bounce. 15ms total. The "free" tunnel wasn't actually free once I accounted for latency cost.
Following this thread with interest. I'm on a Contabo NAT VPS in Singapore and was about to ask about HE tunnel setup. Reading the above: is there a Singapore-based alternative with native v6 in the same price range? Don't need much, just want to run a small Matrix homeserver that federates over v6.
Hetzner Singapore starts at 4.51 EUR for CX11, which is roughly 2x your Contabo price but gives you a /64 native. No tunnel needed.
If you're locked into Contabo: they have a Singapore datacenter but I don't know if their NAT instances there get v6. Their routing is... variable. You might ask in the Contabo-specific thread first.
Contabo Singapore is still v4-only on the cheap tiers last I checked. Their "v6 ready" flag in the control panel only applies to EU locations. Source: I migrated from Contabo SG to Hetzner SG six months ago for exactly this reason.
Karachi here. PTCL has v6 on paper but it's broken in practice - RA storms, no PD, CPE crashes. I run HE tunnels for two small hosting clients because the alternative is explaining to their customers why v6 works on mobile JAZZ but not on fiber.
The "tunnel brokers are legacy" argument is privilege. Try operating in a market where the incumbent ISP's v6 implementation is held together with hope.
