6 ms·

Why do they do that? They already have an /8 to themselves -- 10.0.0.0/8. Did they need an additional 16M IP addresses?

maccam94 8y ago
There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other machine (firewall willing). Until one day, IP exhaustion attacked. Thankfully NAT doesn't exist in IPv6, because 2^128 addresses should be enough for everybody.
- cortesoft 8y ago
  Everything having a publicly routable IP isn't an automatic good thing.
  - throwaway2048 8y ago
    NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.
    - dfox 8y ago
      Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.
      - pas 8y ago
        Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)
        oasisbob 8y ago
        I think the most productive way to look at it that for NAT/NAPT/cone NAT to work, a necessary prerequisite is a default-deny inbound firewall policy and stateful connection tracking. Once you have that, layering on NAT is possible. But the security implications were already addressed before you get to that point.
        zAy0LfpBZLC8mAC 8y ago
        A NAT doesn't drop anything. A NAT translates. A firewall drops. If you only have a NAT, your ISP (or anyone who has compromised their router, or possibly simply your neighbour when ISPs occasionally fail to isolate their customers on layer 2) still can send you packets addressed directly to your "internal" addresses. The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. NAT and "internal addresses" is as much a security mechanism as not telling anyone that there is a room called "living room" in your house. If you want to prevent strangers from getting into your living room, you don't use internal names for your rooms, you install a lock on the door.
        pas 8y ago
        By default a NAT is unconfigured, so it doesn't know what to translate into what. The usual practical deployment consists of a dynamic outgoing NAT setup and UPnP. So outgoing TCP/UDP/etc protocols are snooped and the incoming packets are translated accordingly. (Hence the UDP NAT hole punching technique.) This setup works well for SoHo sites. In this case without knowing my egress traffic, any incoming packet will be dropped by the NAT middlebox/facility/software/device/module/thing. So NATs do drop. And nice ones emit ICMP or TCP RST too. > The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. Yes, indeed. That's a different threat model though. And I agree that hosts should have a default deny ingress policy. Yet NATs do work wonderfully for SoHo networks. And of course a stateful firewall is just as easy to fool (circumvent) with a back-connecting connection as a NAT. And a NAT as described above or a stateful firewall that enables local network functions such as CIFS/SMB were just as vulnerable to the usual Blaster-type worms/malware. Again, of course, usually things go hand in hand. Firewalls usually have SNAT/DNAT capabilities, and SoHo shitboxes come with too much of every kind of NAT/firewall thingies already. And, I know the misery of interconnecting two internal networks both using the same 192.168.0.0/24 or whatever prefix, so I can't wait to get rid of this and move to proper v6. But the fact of life is that the typical NAT setup was very convenient for ticking the local network ingress security checkbox for ISPs for years (decades).
    - smsm42 8y ago
      NAT of course is not the best solution ever, but vast majority of currently used network nodes do not need publicly routed IPs in a limited global space. If anything, many of them are much better without one. Yes, I know, firewalls. But why not just avoid the issue by not having publicly accessible address for non-public systems in the first place?
      - oasisbob 8y ago
        Because NAT is an abominable hack with significant technical and administrative overhead. My home is not intended to be a public space. But, it has a unique address, just like any other bar or restaurant in the area. Being able to locate it with a unique identifier is valuable, even if I don't intend for my living room to be publicly accessible.
        smsm42 8y ago
        > Because NAT is an abominable hack with significant technical and administrative overhead. Agreed. But you can use private networks without NAT. In fact, 99% of traffic in the private network doesn't need NAT. Only outside traffic does, and only that which can't use proxies etc. - which is pretty small amount of overall traffic, I think.
        throwaway2048 8y ago
        attempting to proxy traffic like that is an even more massive mess, you have a solution in search of a problem here.
    - Florin_Andrei 8y ago
      > NAT does nothing meaningful securitywise that a firewall cannot achive One good thing about NAT is even if you screw up the firewall config, such as configure everything in "allow all" mode, your internal network is still secure, because private IPs are not routable at the Internet level. > and causes a lot of stupid problems. That is true.
  - zaarn 8y ago
    Routable != Reachable, which is obvious once you actually setup a firewall once. My IPv6 /48 is entirely routable. The reachable portions are some ports in the list of popular protocols like SSH, HTTPS and similar. The good part is that the entire /48 is reachable from within and simplifies OpenVPN routing a lot compared to IPv4, which requires a bit of outbound NAT hackery so it doesn't have to traverse the firewall three times (OpenVPN->WAN->LAN instead of OpenVPN->LAN)
- d215 8y ago
  I don't know if you're being ironic, but NAT64[0] is (sort of unfortunately) an actual existing technology and in use as well. [0] https://en.wikipedia.org/wiki/NAT64 https://en.wikipedia.org/wiki/NAT64
  - plq 8y ago
    You need NAT whenever you can't change your peers' routing table, for whatever reason. It's used extensively in IPv4 world for LAN=>WAN connectivity because your only peer (your ISP) won't agree to send all traffic for 192.168.0.0/24 to your home. Its most popular use case disappearing doesn't make it any less useful for the narrow set of circumstances when it's basically your only option.
  - zaarn 8y ago
    NAT64 is NAT in reverse, essentially. Your internal, IPv6 network can use it to contact an IPv4 host by embedding the target address. This is arguably better than current NAT44. The NAT64 only needs to track which ports and IPs are used on the IPv4 side which should become easier as more hosts don't require an IPv4 anymore. It's a last-stage transitional method IMO, when most but not all of the internet is IPv6.
- tonysdg 8y ago
  Technical arguments aside, props for the Avatar: The Last Airbender reference.
jlgaddis 8y ago
Well, see, compared to what most of us are used to nowadays, IP networking looked a little bit different back then. In 1981, RFC791 [0] came about, describing a way of doing IP addressing on the ARPANET (based upon "classful networks" [1]). In accordance with this scheme, you would get either a /8 ("Class A"), a /16 ("Class B"), or a /24 ("Class C") -- depending on how many hosts you had (or thought you might reasonably have). This is the main reason why you see some organizations with a /8 today that you wouldn't expect. Classless routing ("CIDR") [2] -- or, more specifically, variable length subnet masking (VLSM), what we're all familiar with today -- didn't officially exist until RFC1518 [3] and RFC1519 [4] (fall 1993). CIDR was introduced as a solution to a problem people were already starting to experience then: a shortage of IPv4 addresses! (Yes, 25 years ago, they realized they were running out of IPv4 addresses and started working on solutions. IPv6 [5] first emerged as a "draft standard" in late 1998 -- but only officially became an "Internet standard" last summer!) [0]: https://tools.ietf.org/html/rfc791 https://tools.ietf.org/html/rfc791 [1]: https://en.wikipedia.org/wiki/Classful_network https://en.wikipedia.org/wiki/Classful_network [2]: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing [3]: https://tools.ietf.org/html/rfc1518 https://tools.ietf.org/html/rfc1518 [4]: https://tools.ietf.org/html/rfc1519 https://tools.ietf.org/html/rfc1519 [5]: https://tools.ietf.org/html/rfc8200 https://tools.ietf.org/html/rfc8200
- pas 8y ago
  How come IPv6 wasn't standardized before 2017? I suspect there's some kind of story there. Do you happen to know the details? Any links/pointers? Thanks!
  - zAy0LfpBZLC8mAC 8y ago
    It's just nonsense. In the IETF's nomenclature, the label "Internet Standard" is used to refer to, and I quote: A specification for which significant implementation and successful operational experience has been obtained may be elevated to the Internet Standard level. An Internet Standard (which may simply be referred to as a Standard) is characterized by a high degree of technical maturity and by a generally held belief that the specified protocol or service provides significant benefit to the Internet community. A specification that reaches the status of Standard is assigned a number in the STD series while retaining its RFC number. See also https://tools.ietf.org/html/rfc2026#section-4.1.3 https://tools.ietf.org/html/rfc2026#section-4.1.3 Most internet standards are not "Internet Standard"s, as can be seen by the fact that IPv6 got assigned the standard number 86, and up until last year, IPv6 wasn't either, but it still was a perfectly fine and well-documented standard, and has been for a long time.
gwright 8y ago
Using NAT and the IPv4 private address ranges sounds at first like a good solution but it creates some operational problems when two organizations want to connect their networks or when two organizations merge.

There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other machine (firewall willing). Until one day, IP exhaustion attacked. Thankfully NAT doesn't exist in IPv6, because 2^128 addresses should be enough for everybody.

cortesoft 8y ago
Everything having a publicly routable IP isn't an automatic good thing.
- throwaway2048 8y ago
  NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.
  - dfox 8y ago
    Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.
    - pas 8y ago
      Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)
      - oasisbob 8y ago
        I think the most productive way to look at it that for NAT/NAPT/cone NAT to work, a necessary prerequisite is a default-deny inbound firewall policy and stateful connection tracking. Once you have that, layering on NAT is possible. But the security implications were already addressed before you get to that point.
      - zAy0LfpBZLC8mAC 8y ago
        A NAT doesn't drop anything. A NAT translates. A firewall drops. If you only have a NAT, your ISP (or anyone who has compromised their router, or possibly simply your neighbour when ISPs occasionally fail to isolate their customers on layer 2) still can send you packets addressed directly to your "internal" addresses. The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. NAT and "internal addresses" is as much a security mechanism as not telling anyone that there is a room called "living room" in your house. If you want to prevent strangers from getting into your living room, you don't use internal names for your rooms, you install a lock on the door.
        pas 8y ago
        By default a NAT is unconfigured, so it doesn't know what to translate into what. The usual practical deployment consists of a dynamic outgoing NAT setup and UPnP. So outgoing TCP/UDP/etc protocols are snooped and the incoming packets are translated accordingly. (Hence the UDP NAT hole punching technique.) This setup works well for SoHo sites. In this case without knowing my egress traffic, any incoming packet will be dropped by the NAT middlebox/facility/software/device/module/thing. So NATs do drop. And nice ones emit ICMP or TCP RST too. > The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. Yes, indeed. That's a different threat model though. And I agree that hosts should have a default deny ingress policy. Yet NATs do work wonderfully for SoHo networks. And of course a stateful firewall is just as easy to fool (circumvent) with a back-connecting connection as a NAT. And a NAT as described above or a stateful firewall that enables local network functions such as CIFS/SMB were just as vulnerable to the usual Blaster-type worms/malware. Again, of course, usually things go hand in hand. Firewalls usually have SNAT/DNAT capabilities, and SoHo shitboxes come with too much of every kind of NAT/firewall thingies already. And, I know the misery of interconnecting two internal networks both using the same 192.168.0.0/24 or whatever prefix, so I can't wait to get rid of this and move to proper v6. But the fact of life is that the typical NAT setup was very convenient for ticking the local network ingress security checkbox for ISPs for years (decades).
  - smsm42 8y ago
    NAT of course is not the best solution ever, but vast majority of currently used network nodes do not need publicly routed IPs in a limited global space. If anything, many of them are much better without one. Yes, I know, firewalls. But why not just avoid the issue by not having publicly accessible address for non-public systems in the first place?
    - oasisbob 8y ago
      Because NAT is an abominable hack with significant technical and administrative overhead. My home is not intended to be a public space. But, it has a unique address, just like any other bar or restaurant in the area. Being able to locate it with a unique identifier is valuable, even if I don't intend for my living room to be publicly accessible.
      - smsm42 8y ago
        > Because NAT is an abominable hack with significant technical and administrative overhead. Agreed. But you can use private networks without NAT. In fact, 99% of traffic in the private network doesn't need NAT. Only outside traffic does, and only that which can't use proxies etc. - which is pretty small amount of overall traffic, I think.
        throwaway2048 8y ago
        attempting to proxy traffic like that is an even more massive mess, you have a solution in search of a problem here.
  - Florin_Andrei 8y ago
    > NAT does nothing meaningful securitywise that a firewall cannot achive One good thing about NAT is even if you screw up the firewall config, such as configure everything in "allow all" mode, your internal network is still secure, because private IPs are not routable at the Internet level. > and causes a lot of stupid problems. That is true.
- zaarn 8y ago
  Routable != Reachable, which is obvious once you actually setup a firewall once. My IPv6 /48 is entirely routable. The reachable portions are some ports in the list of popular protocols like SSH, HTTPS and similar. The good part is that the entire /48 is reachable from within and simplifies OpenVPN routing a lot compared to IPv4, which requires a bit of outbound NAT hackery so it doesn't have to traverse the firewall three times (OpenVPN->WAN->LAN instead of OpenVPN->LAN)
d215 8y ago
I don't know if you're being ironic, but NAT64[0] is (sort of unfortunately) an actual existing technology and in use as well. [0] https://en.wikipedia.org/wiki/NAT64 https://en.wikipedia.org/wiki/NAT64
- plq 8y ago
  You need NAT whenever you can't change your peers' routing table, for whatever reason. It's used extensively in IPv4 world for LAN=>WAN connectivity because your only peer (your ISP) won't agree to send all traffic for 192.168.0.0/24 to your home. Its most popular use case disappearing doesn't make it any less useful for the narrow set of circumstances when it's basically your only option.
- zaarn 8y ago
  NAT64 is NAT in reverse, essentially. Your internal, IPv6 network can use it to contact an IPv4 host by embedding the target address. This is arguably better than current NAT44. The NAT64 only needs to track which ports and IPs are used on the IPv4 side which should become easier as more hosts don't require an IPv4 anymore. It's a last-stage transitional method IMO, when most but not all of the internet is IPv6.
tonysdg 8y ago
Technical arguments aside, props for the Avatar: The Last Airbender reference.

jlgaddis 8y ago

Well, see, compared to what most of us are used to nowadays, IP networking looked a little bit different back then. In 1981, RFC791 [0] came about, describing a way of doing IP addressing on the ARPANET (based upon "classful networks" [1]). In accordance with this scheme, you would get either a /8 ("Class A"), a /16 ("Class B"), or a /24 ("Class C") -- depending on how many hosts you had (or thought you might reasonably have). This is the main reason why you see some organizations with a /8 today that you wouldn't expect. Classless routing ("CIDR") [2] -- or, more specifically, variable length subnet masking (VLSM), what we're all familiar with today -- didn't officially exist until RFC1518 [3] and RFC1519 [4] (fall 1993). CIDR was introduced as a solution to a problem people were already starting to experience then: a shortage of IPv4 addresses! (Yes, 25 years ago, they realized they were running out of IPv4 addresses and started working on solutions. IPv6 [5] first emerged as a "draft standard" in late 1998 -- but only officially became an "Internet standard" last summer!) [0]: https://tools.ietf.org/html/rfc791 https://tools.ietf.org/html/rfc791 [1]: https://en.wikipedia.org/wiki/Classful_network https://en.wikipedia.org/wiki/Classful_network [2]: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing [3]: https://tools.ietf.org/html/rfc1518 https://tools.ietf.org/html/rfc1518 [4]: https://tools.ietf.org/html/rfc1519 https://tools.ietf.org/html/rfc1519 [5]: https://tools.ietf.org/html/rfc8200 https://tools.ietf.org/html/rfc8200

pas 8y ago
How come IPv6 wasn't standardized before 2017? I suspect there's some kind of story there. Do you happen to know the details? Any links/pointers? Thanks!
- zAy0LfpBZLC8mAC 8y ago
  It's just nonsense. In the IETF's nomenclature, the label "Internet Standard" is used to refer to, and I quote: A specification for which significant implementation and successful operational experience has been obtained may be elevated to the Internet Standard level. An Internet Standard (which may simply be referred to as a Standard) is characterized by a high degree of technical maturity and by a generally held belief that the specified protocol or service provides significant benefit to the Internet community. A specification that reaches the status of Standard is assigned a number in the STD series while retaining its RFC number. See also https://tools.ietf.org/html/rfc2026#section-4.1.3 https://tools.ietf.org/html/rfc2026#section-4.1.3 Most internet standards are not "Internet Standard"s, as can be seen by the fact that IPv6 got assigned the standard number 86, and up until last year, IPv6 wasn't either, but it still was a perfectly fine and well-documented standard, and has been for a long time.

gwright 8y ago

Using NAT and the IPv4 private address ranges sounds at first like a good solution but it creates some operational problems when two organizations want to connect their networks or when two organizations merge.