4 ms·

NAT v4 addresses are no fun. IPv6 addressing is a big win there. Especially in the mobile space.

by scurvy 11y ago

the_mitsuhiko 11y ago
> NAT v4 addresses are no fun. Everybody runs behind a NAT anyways, most systems work just find with multiple layers of NATs. I have been running an internal double NAT for months and the only reason I removed one layer from my onion was that back to mac fails badly with multiple layers of NATs.
- scurvy 11y ago
  No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. As you just admitted, NAT breaks things. Double NAT and CGN breaks a lot more. What about people who have no choice or no say in whether or not their Internet is NAT'd? There are ISP's where customers don't get routed IPv4 addresses. They get RFC1918 addresses and lots of double NAT'ing occurs. It's a bad scene.
  - the_mitsuhiko 11y ago
    > No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is. > As you just admitted, NAT breaks things. And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact. When I run a server I already have to assume that clients are NATed and as such I design my system to work that way. IPV6 only is a non existing part of the internet and as such not really something to optimize for. I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it.
    - dasil003 11y ago
      So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future?
      - the_mitsuhiko 11y ago
        > So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future? My position is irrelevant in this discussion. I answered the following question based on my own experience in the field: > why pretty much anyone except google and facebook isn't?
    - pixl97 11y ago
      >For many of us, a NAT is considered a feature not a bug in fact. What? Nat is always a bug with a hack piled upon hack upon hack. The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. Protocols like uPNP have produced a plethora of critical exploits allowing an attacker full access to the NAT'ed network. Firewall controlled IPv4 with a 1:1 ratio of ip to host is always much easier to control the security risks with. Everyone else simply uses NAT because they have no other choice, there simply isn't IPs in the 4 address space to do whats needed. So yet again we have a implementation tragedy where everyone would be better off with it working, but no one will do it, leaving us with a hulking crapsack we are used to in every aspect of our life. Further reading: http://slatestarcodex.com/2014/07/30/meditations-on-moloch/ http://slatestarcodex.com/2014/07/30/meditations-on-moloch/
      - the_mitsuhiko 11y ago
        > The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. I'm sorry, but you are naive if you think that NATs will go away with IPv6 or that the absence of NATs would make it safer. In fact, NATs have found a way back to IPv6 and any deployment I have seen with IPv6 that was not done by a university actually goes through a NAT.
  - forgottenpass 11y ago
    Oh my god, it's so nice to live on a network of routable addresses. It felt weird for the first year at college but once you have it for a while the reduced overhead is so nice. When I started managing a /24, the network administration was so amazing. Like relaxing on a big squishy couch. The internal nameserver and the external nameserver... were the same nameserver with one set of records. The firewall was actually a firewall, not set of limitations that could be imposed by a firewall but were in fact a technical limitation of the network gateway. I miss it so much. Now I'm sitting on a network that uses a private block, VPN-ed into a network that uses ALL 3 1918 blocks (don't ask). From the computer I'm sitting at various subnets will be routed to the local network, and others to the remote network. There are systems that I can not communicate with on both networks. I will stand up SSH tunnels to whenever I need to talk to them.
  - Dylan16807 11y ago
    >Ever been to a university where everyone gets an non-RFC1918 IPv4 address? Heh, yep, with a firewall that dropped all incoming connections. Worse than configurable NAT.
    - Dylan16807 11y ago
      Huh, I wonder why that got a downvote. Anyway I found something funny, they finally 'fixed' the FAQ. In 2010 and earlier: > ResNet does not have a firewall , we simply block all incoming TCP connections outside of ResNet. From 2011 on: > ResNet have a firewall and we block all incoming TCP connections outside of ResNet.

NAT v4 addresses are no fun. IPv6 addressing is a big win there. Especially in the mobile space.

by scurvy 11y ago

NAT v4 addresses are no fun. IPv6 addressing is a big win there. Especially in the mobile space.

> NAT v4 addresses are no fun. Everybody runs behind a NAT anyways, most systems work just find with multiple layers of NATs. I have been running an internal double NAT for months and the only reason I removed one layer from my onion was that back to mac fails badly with multiple layers of NATs.

scurvy 11y ago
No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. As you just admitted, NAT breaks things. Double NAT and CGN breaks a lot more. What about people who have no choice or no say in whether or not their Internet is NAT'd? There are ISP's where customers don't get routed IPv4 addresses. They get RFC1918 addresses and lots of double NAT'ing occurs. It's a bad scene.
- the_mitsuhiko 11y ago
  > No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is. > As you just admitted, NAT breaks things. And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact. When I run a server I already have to assume that clients are NATed and as such I design my system to work that way. IPV6 only is a non existing part of the internet and as such not really something to optimize for. I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it.
  - dasil003 11y ago
    So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future?
    - the_mitsuhiko 11y ago
      > So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future? My position is irrelevant in this discussion. I answered the following question based on my own experience in the field: > why pretty much anyone except google and facebook isn't?
  - pixl97 11y ago
    >For many of us, a NAT is considered a feature not a bug in fact. What? Nat is always a bug with a hack piled upon hack upon hack. The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. Protocols like uPNP have produced a plethora of critical exploits allowing an attacker full access to the NAT'ed network. Firewall controlled IPv4 with a 1:1 ratio of ip to host is always much easier to control the security risks with. Everyone else simply uses NAT because they have no other choice, there simply isn't IPs in the 4 address space to do whats needed. So yet again we have a implementation tragedy where everyone would be better off with it working, but no one will do it, leaving us with a hulking crapsack we are used to in every aspect of our life. Further reading: http://slatestarcodex.com/2014/07/30/meditations-on-moloch/ http://slatestarcodex.com/2014/07/30/meditations-on-moloch/
    - the_mitsuhiko 11y ago
      > The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. I'm sorry, but you are naive if you think that NATs will go away with IPv6 or that the absence of NATs would make it safer. In fact, NATs have found a way back to IPv6 and any deployment I have seen with IPv6 that was not done by a university actually goes through a NAT.
- forgottenpass 11y ago
  Oh my god, it's so nice to live on a network of routable addresses. It felt weird for the first year at college but once you have it for a while the reduced overhead is so nice. When I started managing a /24, the network administration was so amazing. Like relaxing on a big squishy couch. The internal nameserver and the external nameserver... were the same nameserver with one set of records. The firewall was actually a firewall, not set of limitations that could be imposed by a firewall but were in fact a technical limitation of the network gateway. I miss it so much. Now I'm sitting on a network that uses a private block, VPN-ed into a network that uses ALL 3 1918 blocks (don't ask). From the computer I'm sitting at various subnets will be routed to the local network, and others to the remote network. There are systems that I can not communicate with on both networks. I will stand up SSH tunnels to whenever I need to talk to them.
- Dylan16807 11y ago
  >Ever been to a university where everyone gets an non-RFC1918 IPv4 address? Heh, yep, with a firewall that dropped all incoming connections. Worse than configurable NAT.
  - Dylan16807 11y ago
    Huh, I wonder why that got a downvote. Anyway I found something funny, they finally 'fixed' the FAQ. In 2010 and earlier: > ResNet does not have a firewall , we simply block all incoming TCP connections outside of ResNet. From 2011 on: > ResNet have a firewall and we block all incoming TCP connections outside of ResNet.