5 ms·

kudos to this well-researched post. As a student with a server in a dorm room, I really hope they don't take away my public IP address.

smoyer 9y ago
There are advantages to being on a private network behind a firewall ... and they could still offer a DNS name and routing to your computer if it was on a private network. It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world. This is a win for you from a security perspective - having additional layers of security won't hurt you.
- plange 9y ago
  NAT is not security at all.
- Symbiote 9y ago
  NAT is not an additional layer of security. I run our servers on public IP addresses, behind a firewall. Troubleshooting and debugging is made much easier, and there's never any conflict with VPNs etc. > It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world Port 80, please. With NAT, you can't offer that to more than one computer.
  - imjustapie 9y ago
    You nailed it! Students love that they can just spin up a whole new web server, no questions asked. I certainly won't be where I am on sysadmin-type skills without the kind of tinkering that the un-NAT'd network affords.
  - shif 9y ago
    But you can, a simple reverse proxy can let the same port be used for multiple servers and pick based on hostname or query (for http). reverse proxies like nginx also have plain tcp support so it allows you to easily run several services
    - srj 9y ago
      You have to scale the reverse proxy, and you've added another point of failure. Not to mention - who runs it? It needs to be trusted to terminate TLS or do 5-tuple proxying based on the SNI destination (not all clients send SNI). Also if the MIT student is doing something akin to protocol level development it's possible a middle proxy will prevent them from doing their work. There is also the hassle factor. You may stop people from ever trying something because of the added hoops they must go through.
    - Symbiote 9y ago
      So, now I have to run a reverse proxy -- another point of failure, another thing to debug when something's not working. That's a hack to work around a shortage of IP addresses. Why would I use one, when I don't have that shortage?
      - compuguy 9y ago
        Well, you can have tons of static IP addresses, or funding to support MIT and future IT upgrades.
  - compuguy 9y ago
    That's great and all, but the majority of us have lived in a IPv4 NAT world for most of our lives. A previous poster even mentioned that a student group runs a cloud hosting service on campus, making some of this moot: "SIPB (MIT's volunteer student computing group) offers free "cloud hosting" to anyone with an Athena account. http://xvm.mit.edu/" http://xvm.mit.edu/"

smoyer 9y ago

There are advantages to being on a private network behind a firewall ... and they could still offer a DNS name and routing to your computer if it was on a private network. It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world. This is a win for you from a security perspective - having additional layers of security won't hurt you.

plange 9y ago
NAT is not security at all.
Symbiote 9y ago
NAT is not an additional layer of security. I run our servers on public IP addresses, behind a firewall. Troubleshooting and debugging is made much easier, and there's never any conflict with VPNs etc. > It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world Port 80, please. With NAT, you can't offer that to more than one computer.
- imjustapie 9y ago
  You nailed it! Students love that they can just spin up a whole new web server, no questions asked. I certainly won't be where I am on sysadmin-type skills without the kind of tinkering that the un-NAT'd network affords.
- shif 9y ago
  But you can, a simple reverse proxy can let the same port be used for multiple servers and pick based on hostname or query (for http). reverse proxies like nginx also have plain tcp support so it allows you to easily run several services
  - srj 9y ago
    You have to scale the reverse proxy, and you've added another point of failure. Not to mention - who runs it? It needs to be trusted to terminate TLS or do 5-tuple proxying based on the SNI destination (not all clients send SNI). Also if the MIT student is doing something akin to protocol level development it's possible a middle proxy will prevent them from doing their work. There is also the hassle factor. You may stop people from ever trying something because of the added hoops they must go through.
  - Symbiote 9y ago
    So, now I have to run a reverse proxy -- another point of failure, another thing to debug when something's not working. That's a hack to work around a shortage of IP addresses. Why would I use one, when I don't have that shortage?
    - compuguy 9y ago
      Well, you can have tons of static IP addresses, or funding to support MIT and future IT upgrades.
- compuguy 9y ago
  That's great and all, but the majority of us have lived in a IPv4 NAT world for most of our lives. A previous poster even mentioned that a student group runs a cloud hosting service on campus, making some of this moot: "SIPB (MIT's volunteer student computing group) offers free "cloud hosting" to anyone with an Athena account. http://xvm.mit.edu/" http://xvm.mit.edu/"