3 ms·
It's hard to understand why so many cloud service providers and software stacks are still v4-only considering the operational and development cost of v4+NAT (co
by zurn 11y ago
It's hard to understand why so many cloud service providers and software stacks are still v4-only considering the operational and development cost of v4+NAT (complexity, management, scaling limitations etc). For most systems it would be enough for the front load balancers to speak v4.
- endymi0n 11y agoFunny, I see it exactly the other way around. I want NAT+Firewall to have at least decent perimeter security in a private LAN, the 10/8 subnet is large enough to do anything I can ever imagine to be doing and IPv4 is so much easier to grok. For most systems it would be enough for the front load balancers to speak v6.
- kiallmacinnes 11y agoWanting a firewall is good, you can have that on v4 or v6. However, after you add 3 simple firewall rules, NAT provides no additional security. Drop state=INVALID Allow state=EATABLISHED,RELATED Drop all You're now just as secure as if you had a typical NAT setup, but without the decades of kludges that is NAT.
- zurn 11y agoThen you just have a system that has no security advantages but is harder to reason about due to the additional level of indirection in overloaded addressing (because of ambiguous addressing, management of forwarding rules, etc) vs normal firewalling without NAT. Which equates to some loss of security on the system level, because you can only effectively secure systems you understand.