2 ms·

> The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. I'm so

> The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. I'm sorry, but you are naive if you think that NATs will go away with IPv6 or that the absence of NATs would make it safer. In fact, NATs have found a way back to IPv6 and any deployment I have seen with IPv6 that was not done by a university actually goes through a NAT.

gwright 11y ago
This doesn't sound right to me. There is no need to do address translation in IPv6 networks. It may be that there is still a firewall in place with rules about incoming and outgoing connections, though. In the IPv4 realm the term NAT is often interpreted to mean connection rules in addition to network address translation. It is the address translation that is the source and focus of much criticism of IPv4 "NAT" and it is exactly that feature that is unneeded in the IPv6 realm. So while network address translation is superfluous in IPv6, there is still an argument to be made for network access rules. I would be interested to here what technical arguments were being made for true network address translation in an IPv6 network.
- the_mitsuhiko 11y ago
  > There is no need to do address translation in IPv6 networks. There is no need, but typically desire. Which company is comfortable leaking out individual employees IP addresses if they can avoid it? There are more downsides from a security point of view than upsides.
  - gwright 11y ago
    That can be done with randomized assignment of addresses to hosts rather than dynamic address translation. Everyday you come to work you get a different address. No need to do that dynamically at the network border or on a per connection basis. But thank you for pointing out explicitly one of the 'reasons' that is given for IPv6 NAT.
- stock_toaster 11y ago
  > This doesn't sound right to me. There is no need > to do address translation in IPv6 networks. It may > be that there is still a firewall in place with rules > about incoming and outgoing connections, though. Multi-wan egress balancing (without bgp) is one usecase for NAT66 (NPTv6).
rjsw 11y ago
I have native IPv6 at home, it doesn't use NAT.

gwright 11y ago

This doesn't sound right to me. There is no need to do address translation in IPv6 networks. It may be that there is still a firewall in place with rules about incoming and outgoing connections, though. In the IPv4 realm the term NAT is often interpreted to mean connection rules in addition to network address translation. It is the address translation that is the source and focus of much criticism of IPv4 "NAT" and it is exactly that feature that is unneeded in the IPv6 realm. So while network address translation is superfluous in IPv6, there is still an argument to be made for network access rules. I would be interested to here what technical arguments were being made for true network address translation in an IPv6 network.

the_mitsuhiko 11y ago
> There is no need to do address translation in IPv6 networks. There is no need, but typically desire. Which company is comfortable leaking out individual employees IP addresses if they can avoid it? There are more downsides from a security point of view than upsides.
- gwright 11y ago
  That can be done with randomized assignment of addresses to hosts rather than dynamic address translation. Everyday you come to work you get a different address. No need to do that dynamically at the network border or on a per connection basis. But thank you for pointing out explicitly one of the 'reasons' that is given for IPv6 NAT.
stock_toaster 11y ago
> This doesn't sound right to me. There is no need > to do address translation in IPv6 networks. It may > be that there is still a firewall in place with rules > about incoming and outgoing connections, though. Multi-wan egress balancing (without bgp) is one usecase for NAT66 (NPTv6).

rjsw 11y ago

I have native IPv6 at home, it doesn't use NAT.