6 ms·

I run into NAT almost every single day. It wastes time, breaks things, consumes router resources, rules out certain technologies/products/services and duplicate

I run into NAT almost every single day. It wastes time, breaks things, consumes router resources, rules out certain technologies/products/services and duplicates so much work it's just unreal.

_red 10y ago
>consumes router resources Thats a weird claim to make against IPv4. Grab a calculator and see how much memory is required by a IPv6 /64 address space.
- ncw33 10y ago
  Not much! Just a few bytes for each packet. Running a NAT service requires a big table of all the active connections, ie. it's stateful - IPv6 with no NAT needs no per-connection state in the router so that's a big space-saving.
  - _red 10y ago
    So you don't want stateful inspection on your private LAN router? Its ok for every hacker to portscan the 100's of IoT devices in your house? You're a very trusting fellow.
    - deleted 10y ago
      [deleted]
    - woah 10y ago
      Are you recommending NAT as some sort security-by-accident measure?
    - lmm 10y ago
      How many IoT devices need to allow incoming connections at all? And how many connections do they need to make? IoT devices, if I had any use for them, would go on my private LAN. My private-public router can do complex stateful tracking, because it only has to handle a few connections at a time. Meanwhile my grown-up internet devices go on the public side and get actual internet access, meaning that e.g. two people inside my house can play an online game with a person outside my house, and aren't slowed down by a complex connection-tracking router. Also means my guests don't get access to my IoT devices.
      - buzer 10y ago
        > How many IoT devices need to allow incoming connections at all? And how many connections do they need to make? If they need outgoing connections, they likely also need incoming when we are speaking about stateless filtering. Without incoming connections only UDP would be allowed and it would be usually impossible to determine if the packet should be send again (it would only be possible if there was out of band method to detect it). Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.
        lmm 10y ago
        > Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets. I have more faith in that than I have faith in a router that does complex state-tracking logic to not contain RCE vulnerabilities itself.
  - proactivesvcs 10y ago
    As I understand it, there have been a few nation-scale Internet outages that have been a result of IPv4 address tables reaching their resource ceiling (not relating to NAT) - another example of how IPv4 is no longer fit for purpose regarding hardware resources.
    - tptacek 10y ago
      If 32 bit address tables are reaching capacity, increasing the size of the address space is unlikely to resolve the problem.
      - mikecb 10y ago
        Doesn't ipv6 include efficiencies for this, like hierarchical prefixes?
        tptacek 10y ago
        In practical reality, doesn't that just mitigate the strain caused by an explosion in the size of the address tables?
        mikecb 10y ago
        I guess it depends on how big the efficiency gain is, but afaik it's pretty big.
        toast0 10y ago
        A sometimes large but solvable part of the problem in ipv4 routing table sizes is numerically adjacent routes that could be aggregated into fewer announcements but aren't; ipv6 doesn't help with that. Another part of the problem is that many networks have lots of allocations that aren't adjacent, so they can't aggregate them; ipv6 should help with that as there's room for big allocations.
    - mprovost 10y ago
      Those were caused because Cisco by default (optimistically) partitioned a big chunk of the routing table memory for v6 routes. The fix was to reduce the memory usage for v6 and give that memory back for v4 routes. So really it was allocating so much space for v6 before there was any need that caused those outages.
  - deleted 10y ago
    [deleted]
- mitchty 10y ago
  The claim isn't about memory needed to flesh out an entire address range, but resources allocated to things like nat in ipv4. Why am I trying to fill out in memory an entire /64? More importantly what purpose will doing that for a home network that will at best have 100 nodes even with ipv6? The memory needed to route and track 100 ipv6 nodes vs 100 ipv4 is a rounding error. Even if I enabled privacy extensions the amount of addresses is miniscule. Nat sucks, end of story, and yes ipv6 requires more memory. It is a bigger address range after all. We also gain a lot of what we lost with ipv4 years ago.
- proactivesvcs 10y ago
  I don't need to grab a calculator to figure out what I have already witnessed. I've come across several routers that stop working (partially or completely) or spontaneously reboot when there are too many active NAT sessions. At a few customers I've had to set session limits to prevent some devices from being unable to talk to the WAN.
fps 10y ago
As a sysadmin, if I had limitless IPv4 addresses, I'd still use NAT on servers and clients because it's a useful security layer. There's little reason that individual devices need globally routable IP addresses.
- proactivesvcs 10y ago
  But with an extra layer to configure and for a vendor to properly implement, surely that also means it's an extra security liability?
- pdkl95 10y ago
  > it's a useful security layer No, it's not. As a sysadmin, you should know the difference between NAT and a stateful firewall, and that NAT alone doesn't prevent packets from being routed to local addresses. > There's little reason that individual devices need globally routable IP addresses. NAT has been more damaging to the development of network software than any other factor. NAT breaks the development of true network software, such that entire categories of software haven't even been considered. NAT forces extremely complicated hacks[1] and centralized management of true peer to peer connections. The benefit of the internet has been that any peer has the capability to publish. NAT breaks that benefit, turning the internet back into cable TV, where most people need an imprimatur[2] to publish. [1] http://www.brynosaurus.com/pub/net/p2pnat/ http://www.brynosaurus.com/pub/net/p2pnat/ [2] https://www.fourmilab.ch/documents/digital-imprimatur/ https://www.fourmilab.ch/documents/digital-imprimatur/
  - CountSessine 10y ago
    This needs to be repeated everywhere. There are too many system admins with dangerously bad ideas about IPv6 and NAT. NAT needs to die in a fire and if you're rolling out NAT for IPv6 you're wasting your time and your company's money for a bag of nothing.
Spooky23 10y ago
IPv6 != No NATing. Example: Verizon Wireless.
- proactivesvcs 10y ago
  Quite. But there's no need, nor excuse for NAT on IPv6.
- cm2187 10y ago
  You mean IPv6 != No Firewall. Firewall are going to cause pretty much the same problems as NAT.
- CountSessine 10y ago
  True, but that's just kind of dumb.

I run into NAT almost every single day. It wastes time, breaks things, consumes router resources, rules out certain technologies/products/services and duplicates so much work it's just unreal.

_red 10y ago

>consumes router resources Thats a weird claim to make against IPv4. Grab a calculator and see how much memory is required by a IPv6 /64 address space.

ncw33 10y ago
Not much! Just a few bytes for each packet. Running a NAT service requires a big table of all the active connections, ie. it's stateful - IPv6 with no NAT needs no per-connection state in the router so that's a big space-saving.
- _red 10y ago
  So you don't want stateful inspection on your private LAN router? Its ok for every hacker to portscan the 100's of IoT devices in your house? You're a very trusting fellow.
  - deleted 10y ago
    [deleted]
  - woah 10y ago
    Are you recommending NAT as some sort security-by-accident measure?
  - lmm 10y ago
    How many IoT devices need to allow incoming connections at all? And how many connections do they need to make? IoT devices, if I had any use for them, would go on my private LAN. My private-public router can do complex stateful tracking, because it only has to handle a few connections at a time. Meanwhile my grown-up internet devices go on the public side and get actual internet access, meaning that e.g. two people inside my house can play an online game with a person outside my house, and aren't slowed down by a complex connection-tracking router. Also means my guests don't get access to my IoT devices.
    - buzer 10y ago
      > How many IoT devices need to allow incoming connections at all? And how many connections do they need to make? If they need outgoing connections, they likely also need incoming when we are speaking about stateless filtering. Without incoming connections only UDP would be allowed and it would be usually impossible to determine if the packet should be send again (it would only be possible if there was out of band method to detect it). Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.
      - lmm 10y ago
        > Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets. I have more faith in that than I have faith in a router that does complex state-tracking logic to not contain RCE vulnerabilities itself.
- proactivesvcs 10y ago
  As I understand it, there have been a few nation-scale Internet outages that have been a result of IPv4 address tables reaching their resource ceiling (not relating to NAT) - another example of how IPv4 is no longer fit for purpose regarding hardware resources.
  - tptacek 10y ago
    If 32 bit address tables are reaching capacity, increasing the size of the address space is unlikely to resolve the problem.
    - mikecb 10y ago
      Doesn't ipv6 include efficiencies for this, like hierarchical prefixes?
      - tptacek 10y ago
        In practical reality, doesn't that just mitigate the strain caused by an explosion in the size of the address tables?
        mikecb 10y ago
        I guess it depends on how big the efficiency gain is, but afaik it's pretty big.
        toast0 10y ago
        A sometimes large but solvable part of the problem in ipv4 routing table sizes is numerically adjacent routes that could be aggregated into fewer announcements but aren't; ipv6 doesn't help with that. Another part of the problem is that many networks have lots of allocations that aren't adjacent, so they can't aggregate them; ipv6 should help with that as there's room for big allocations.
  - mprovost 10y ago
    Those were caused because Cisco by default (optimistically) partitioned a big chunk of the routing table memory for v6 routes. The fix was to reduce the memory usage for v6 and give that memory back for v4 routes. So really it was allocating so much space for v6 before there was any need that caused those outages.
- deleted 10y ago
  [deleted]
mitchty 10y ago
The claim isn't about memory needed to flesh out an entire address range, but resources allocated to things like nat in ipv4. Why am I trying to fill out in memory an entire /64? More importantly what purpose will doing that for a home network that will at best have 100 nodes even with ipv6? The memory needed to route and track 100 ipv6 nodes vs 100 ipv4 is a rounding error. Even if I enabled privacy extensions the amount of addresses is miniscule. Nat sucks, end of story, and yes ipv6 requires more memory. It is a bigger address range after all. We also gain a lot of what we lost with ipv4 years ago.
proactivesvcs 10y ago
I don't need to grab a calculator to figure out what I have already witnessed. I've come across several routers that stop working (partially or completely) or spontaneously reboot when there are too many active NAT sessions. At a few customers I've had to set session limits to prevent some devices from being unable to talk to the WAN.

fps 10y ago

As a sysadmin, if I had limitless IPv4 addresses, I'd still use NAT on servers and clients because it's a useful security layer. There's little reason that individual devices need globally routable IP addresses.

proactivesvcs 10y ago
But with an extra layer to configure and for a vendor to properly implement, surely that also means it's an extra security liability?
pdkl95 10y ago
> it's a useful security layer No, it's not. As a sysadmin, you should know the difference between NAT and a stateful firewall, and that NAT alone doesn't prevent packets from being routed to local addresses. > There's little reason that individual devices need globally routable IP addresses. NAT has been more damaging to the development of network software than any other factor. NAT breaks the development of true network software, such that entire categories of software haven't even been considered. NAT forces extremely complicated hacks[1] and centralized management of true peer to peer connections. The benefit of the internet has been that any peer has the capability to publish. NAT breaks that benefit, turning the internet back into cable TV, where most people need an imprimatur[2] to publish. [1] http://www.brynosaurus.com/pub/net/p2pnat/ http://www.brynosaurus.com/pub/net/p2pnat/ [2] https://www.fourmilab.ch/documents/digital-imprimatur/ https://www.fourmilab.ch/documents/digital-imprimatur/
- CountSessine 10y ago
  This needs to be repeated everywhere. There are too many system admins with dangerously bad ideas about IPv6 and NAT. NAT needs to die in a fire and if you're rolling out NAT for IPv6 you're wasting your time and your company's money for a bag of nothing.

Spooky23 10y ago

IPv6 != No NATing. Example: Verizon Wireless.

proactivesvcs 10y ago
Quite. But there's no need, nor excuse for NAT on IPv6.
cm2187 10y ago
You mean IPv6 != No Firewall. Firewall are going to cause pretty much the same problems as NAT.
CountSessine 10y ago
True, but that's just kind of dumb.