5 ms·

I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. I guess it will depen

by kuon 9y ago

I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. I guess it will depend on how ISP will deploy IPv6, but where I saw it deployed, the ISP did not provide NAT by default and all allocated IP were routable and inbound traffic was not blocked.

zAy0LfpBZLC8mAC 9y ago
> I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. The single IP does not prevent inbound connections. The stateful packetfilter does. This has nothing to do with NAT. Also, NAT is not usually done by the ISP, but by the customer's router.
- e12e 9y ago
  To be fair, the is might do carrier grade NAT, but then usually no/very limited filtering...
  - zAy0LfpBZLC8mAC 9y ago
    Well, but then, you arguable don't have a single, IP, but rather none at all. Also, as you usually still have only one (non-)IP, the CPE still does NAT as well. And in any case, NAT does not prevent inbound connections, not even CGN. CGN might prevent inbound connections from the public internet, but your ISP can still connect to your internal network if you don't have a stateful filter on your side.
- kuon 9y ago
  Most of the time the customer router is controlled by the ISP. And I don't see why you are so pedantic on this, the point is about how NAT is generally deployed, and for consumers, this is with a single IP, stateful firewall and UPnP for port forwarding. And this might change with IPv6.
  - zAy0LfpBZLC8mAC 9y ago
    No, that is how IP(v4) is commonly deployed: With a single IP, NAT, UPnP for port forwarding, and a stateful firewall. Yes, that could change with IPv6. But it still doesn't have anything to do with NAT. Just because stateful firewalling happens on the same device as NAT, doesn't somehow make it a property of NAT. There also usually is a web interface on the same device. Now, with IPv6 that could change as well. Does that mean that web interfaces are a property of NAT? Or that it would be sensible to say "NAT is commonly deployed with a web interface"?

by kuon 9y ago

zAy0LfpBZLC8mAC 9y ago

> I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. The single IP does not prevent inbound connections. The stateful packetfilter does. This has nothing to do with NAT. Also, NAT is not usually done by the ISP, but by the customer's router.

e12e 9y ago
To be fair, the is might do carrier grade NAT, but then usually no/very limited filtering...
- zAy0LfpBZLC8mAC 9y ago
  Well, but then, you arguable don't have a single, IP, but rather none at all. Also, as you usually still have only one (non-)IP, the CPE still does NAT as well. And in any case, NAT does not prevent inbound connections, not even CGN. CGN might prevent inbound connections from the public internet, but your ISP can still connect to your internal network if you don't have a stateful filter on your side.
kuon 9y ago
Most of the time the customer router is controlled by the ISP. And I don't see why you are so pedantic on this, the point is about how NAT is generally deployed, and for consumers, this is with a single IP, stateful firewall and UPnP for port forwarding. And this might change with IPv6.
- zAy0LfpBZLC8mAC 9y ago
  No, that is how IP(v4) is commonly deployed: With a single IP, NAT, UPnP for port forwarding, and a stateful firewall. Yes, that could change with IPv6. But it still doesn't have anything to do with NAT. Just because stateful firewalling happens on the same device as NAT, doesn't somehow make it a property of NAT. There also usually is a web interface on the same device. Now, with IPv6 that could change as well. Does that mean that web interfaces are a property of NAT? Or that it would be sensible to say "NAT is commonly deployed with a web interface"?