3 ms·

FTA: "More address bits? Well perhaps not all that much. The space created by NATs operates from within a 96-bit vector of address and port components, and the

FTA: "More address bits? Well perhaps not all that much. The space created by NATs operates from within a 96-bit vector of address and port components, and the usable space may well approach the equivalent of a 50-bit conventional address architecture. On the other hand, the IPv6 address architecture has stripped off some 64 bits for an interface identifier and conventionally uses a further 16 bits as a site identifier. The resulting space is of the order of 52 bits. It’s not clear that the two pools of address tokens are all that much different in size." Well, if you want to ignore the fact that IPv6 can utilize the same port combinations as IPv4, then your math works. If you actually compare apples to apples though, it's fundamentally flawed. That said, I happen to be a fan of NAT - just not for the reasons outlined here.

sp332 9y ago
IPv6 doesn't officially support NAT, so it's a stretch to include the port numbers as host identifiers the way IPv4 NAT can.
- SwellJoe 9y ago
  "the way IPv4 NAT must in order to be remotely usable on the modern internet" FTFY
  - sp332 9y ago
    Sure, but that's not really an excuse to use it for IPv6.
- gerdesj 9y ago
  Not sure what you are on about. IPv6 has Unique Local Addressing (RFC 42193) and Network Prefix Translation (RFC 6296). Care to guess what those do when combined? Now given that the smallest subnet in IPv6 is /64 then you are unlikely to need to bother with port mapping as well. I will grant you that putting 65000 odd IPs on a system may not be the most efficient way of doing things. Anyway at least you get a choice in the matter. Many problems with, for example, VoIP are fixed with symmetric NAT which falls out of this scheme right away. My problem with IPv6 is how you get "tied" to your initial ISP in an intimate way due to getting all your IP addressing from them. SLAAC does go a long way to fix this but it is a little like ISP assigned email addresses stopping people from moving away. Also, consider what happens when you have multiple internet connections perhaps for redundancy/backup. You actually need NPT to get that to work in any meaningful way unless you pay for private address space and take a deep dive into BGP etc.
  - sp332 9y ago
    With IPv4 you can have a load-balancing NAT where requests are routed round-robin to different servers, and all the servers respond directly to the client using the same source IP without going through the router. I don't really see how those RFCs make that possible.
    - gerdesj 9y ago
      No, that is a proxy of some sort. HA Proxy, Squid, nginx, Apache int al for application layer. IPv6 can do exactly the same - its actually nothing to do with the IP stack (or even IP - you could use IPX/SPX or whatever) At a lower layer, you can get a similar effect with VRRP/CARP. For example I have two pfSense (FreeBSD) routers at work that present an additional set of "virtual" IPs in a master/slave HA setup. I can reboot or power off either of them and the virtual addresses will move to the other if needed, along with all state entries - handy for system updates without loss of service. I also have a couple of HA Proxy systems that are NATed through those virtual addresses. Those proxies have multiple backends that actually serve content. So: 1 IP -> two firewall/routers -> two HA proxies -> many app servers. I can take out any one bit of each stage and still maintain service. Actually its a bit more complex than that due to virtualisation. If I only had one internet connection then that would be fine but I have five. I think I've given a flavour here and in other comments I've left around here that IPv6 isn't too hard and doing away with NAT is actually a good thing but IPv6 is seriously rubbish when it comes to multi-link (ISP) and rapidly becomes seriously hard and that actually a form of NAT in the form of ULA and NPT is the "fix". ULA is analogous to say 192.168.0 and NPT makes one IPv6 prefix map to another one (which could include ULA) - that's NAT by another name. You also have port mapping as well - just like IPv4 NAT. I could buy what's know as PI address space at something like £3000 per year and get that routed instead - I would then have multiple links for redundancy but not for bandwidth utilisation and besides I would not get my four FTTC (VDSL) providers to do it anyway. IPv6 does not address the whole internet connectivity thing across the whole stack - it is only concerned with logical addressing at one point and fixes only a few problems. It does fix address exhaustion very nicely despite what armchair commentators state. It will fix the rapid proliferation of routing table entries on the global internet, except that PI addresses will screw that up royally. It does do away with NAT, which really is a good thing. Except multi link screws that up. SLAAC makes setting up a network really easy. Except multi link screws that up. DHCPv6 - the darling of "enterprise" anally retentives that don't get it will probably screw something else up. Recently I decided to put a Lets Encrypt cert on my laptop. Now I do have a block of eight IPv4 addresses at home but all of them (the six usable) were already mapped on port 80 and 443/tcp to various things. I put in a AAAA record on my DNS server (and an inbound firewall rule) and got a cert. Most people have a single static IPv4 if they are lucky or a dynamic one which will change (OK - dynamic DNS) However, if you have IPv6 at the ISP, you will normally get the same prefix. At worse you get a /64, better a /56 and the intended allowance of all was /48. At worse you have billions of globally routable addresses. Security risk being globally routable? meh! every single home router I know of (IPv4 and/or 6) defaults to deny inbound. They all have a firewall that applies that policy. NAT is not a firewall and it does not give you any real, tangible, additional security. Actually, many consumer router/firewalls try to be helpful by providing UPnP support enabled out of the box - to make your gaming/music streaming/whatever experience easy. Hmmm, I'm really starting to waffle here - sorry - but I think if you have got this far, you might have an idea that NAT is the least of your worries.
- zokier 9y ago
  Seems bit odd statement to make as you don't really need any protocol level support to do NAT. You just need to rewrite some headers on the router and do conntracking and there's your NAT.

sp332 9y ago

IPv6 doesn't officially support NAT, so it's a stretch to include the port numbers as host identifiers the way IPv4 NAT can.

SwellJoe 9y ago
"the way IPv4 NAT must in order to be remotely usable on the modern internet" FTFY
- sp332 9y ago
  Sure, but that's not really an excuse to use it for IPv6.
gerdesj 9y ago
Not sure what you are on about. IPv6 has Unique Local Addressing (RFC 42193) and Network Prefix Translation (RFC 6296). Care to guess what those do when combined? Now given that the smallest subnet in IPv6 is /64 then you are unlikely to need to bother with port mapping as well. I will grant you that putting 65000 odd IPs on a system may not be the most efficient way of doing things. Anyway at least you get a choice in the matter. Many problems with, for example, VoIP are fixed with symmetric NAT which falls out of this scheme right away. My problem with IPv6 is how you get "tied" to your initial ISP in an intimate way due to getting all your IP addressing from them. SLAAC does go a long way to fix this but it is a little like ISP assigned email addresses stopping people from moving away. Also, consider what happens when you have multiple internet connections perhaps for redundancy/backup. You actually need NPT to get that to work in any meaningful way unless you pay for private address space and take a deep dive into BGP etc.
- sp332 9y ago
  With IPv4 you can have a load-balancing NAT where requests are routed round-robin to different servers, and all the servers respond directly to the client using the same source IP without going through the router. I don't really see how those RFCs make that possible.
  - gerdesj 9y ago
    No, that is a proxy of some sort. HA Proxy, Squid, nginx, Apache int al for application layer. IPv6 can do exactly the same - its actually nothing to do with the IP stack (or even IP - you could use IPX/SPX or whatever) At a lower layer, you can get a similar effect with VRRP/CARP. For example I have two pfSense (FreeBSD) routers at work that present an additional set of "virtual" IPs in a master/slave HA setup. I can reboot or power off either of them and the virtual addresses will move to the other if needed, along with all state entries - handy for system updates without loss of service. I also have a couple of HA Proxy systems that are NATed through those virtual addresses. Those proxies have multiple backends that actually serve content. So: 1 IP -> two firewall/routers -> two HA proxies -> many app servers. I can take out any one bit of each stage and still maintain service. Actually its a bit more complex than that due to virtualisation. If I only had one internet connection then that would be fine but I have five. I think I've given a flavour here and in other comments I've left around here that IPv6 isn't too hard and doing away with NAT is actually a good thing but IPv6 is seriously rubbish when it comes to multi-link (ISP) and rapidly becomes seriously hard and that actually a form of NAT in the form of ULA and NPT is the "fix". ULA is analogous to say 192.168.0 and NPT makes one IPv6 prefix map to another one (which could include ULA) - that's NAT by another name. You also have port mapping as well - just like IPv4 NAT. I could buy what's know as PI address space at something like £3000 per year and get that routed instead - I would then have multiple links for redundancy but not for bandwidth utilisation and besides I would not get my four FTTC (VDSL) providers to do it anyway. IPv6 does not address the whole internet connectivity thing across the whole stack - it is only concerned with logical addressing at one point and fixes only a few problems. It does fix address exhaustion very nicely despite what armchair commentators state. It will fix the rapid proliferation of routing table entries on the global internet, except that PI addresses will screw that up royally. It does do away with NAT, which really is a good thing. Except multi link screws that up. SLAAC makes setting up a network really easy. Except multi link screws that up. DHCPv6 - the darling of "enterprise" anally retentives that don't get it will probably screw something else up. Recently I decided to put a Lets Encrypt cert on my laptop. Now I do have a block of eight IPv4 addresses at home but all of them (the six usable) were already mapped on port 80 and 443/tcp to various things. I put in a AAAA record on my DNS server (and an inbound firewall rule) and got a cert. Most people have a single static IPv4 if they are lucky or a dynamic one which will change (OK - dynamic DNS) However, if you have IPv6 at the ISP, you will normally get the same prefix. At worse you get a /64, better a /56 and the intended allowance of all was /48. At worse you have billions of globally routable addresses. Security risk being globally routable? meh! every single home router I know of (IPv4 and/or 6) defaults to deny inbound. They all have a firewall that applies that policy. NAT is not a firewall and it does not give you any real, tangible, additional security. Actually, many consumer router/firewalls try to be helpful by providing UPnP support enabled out of the box - to make your gaming/music streaming/whatever experience easy. Hmmm, I'm really starting to waffle here - sorry - but I think if you have got this far, you might have an idea that NAT is the least of your worries.
zokier 9y ago
Seems bit odd statement to make as you don't really need any protocol level support to do NAT. You just need to rewrite some headers on the router and do conntracking and there's your NAT.