5 ms·

One thing that doesn't make sense to me is that people are comparing the number of internet-connected devices to the size of the IPv4 address space, implying ea

by cletus 16y ago

One thing that doesn't make sense to me is that people are comparing the number of internet-connected devices to the size of the IPv4 address space, implying each device needs its own IPv4 address. This is obviously not the case. NAT (Network Address Translation) techniques can hide thousands of devices behind one IP address. In fact, for security reasons, it's advisable to not have every device directly on the internet. I have an ADSL modem/router at home with NAT, which makes substandard firewall solutions as what is provided by Windows pretty much unnecessary. So perhaps we simply need to reclaim large blocks (particularly those universities and companies that have large A blocks of ~16 million addresses) and save IP addresses for each machine for ISPs, servers and those that actually need them. Of course that's hard to mandate but like many things you can solve it with market forces: charge people who have more than, say, 128 IP addresses on a scale such that the most economic thing to do is transition away from that and give up their addresses.

tjpick 16y ago
coming back after the fact and saying "I know you got a sweet deal on those IP addresses when they were going cheap but we've run out and want them back so we're going to charge you extra" isn't really going to fly. You could argue the same case with domain squatters, or real estate, but it just can't work that way. You could buy them back -- at a premium of course.
- bostonvaulter2 16y ago
  You could hypothetically charge a small yearly fee for each IP Address owned. Of course there would be lots of financial hurdles with this approach.
  - wmf 16y ago
    ARIN already charges fees for IP addresses; I suppose they take 'em back if you don't pay. https://www.arin.net/fees/fee_schedule.html https://www.arin.net/fees/fee_schedule.html Note that legacy holders don't pay fees on their massive /8s.
nileshtrivedi 16y ago
I think the article made it clear that IPv4 is running out of addresses DESPITE using NAT heavily. As far as reclaiming large A blocks is concerned, I read somewhere that we are exhausting addresses equivalent to an A-class block in 5 weeks. Easy to see that we are going to need a long-term solution anyhow.
- jodrellblank 16y ago
  I linked this elsewhere, but you can see here: http://twitter.com/ipv4countdown http://twitter.com/ipv4countdown from the history how fast they are being used up - a million every couple of days, or thereabouts.
loup-vaillant 16y ago
> implying each device needs its own IPv4 address. This implication is basically correct, actually. Sure, not every machine needs to be a server, but every people should have at least one. Everyone should have his own mail server. Every blogger should have his own web server. And so on. It's just a matter of basic civil liberties, like privacy and free speech, which currently aren't fully enabled, because most people don't have the amount of control they should have. If we let giant NAT routers spread further, such control will be effectively impossible. Even for computer nerds. Even for owners of a freedom box[1]. As a side note, the correct response for security is not using giant NAT routers. It's getting rid of Windows. [1]: http://wiki.debian.org/FreedomBox http://wiki.debian.org/FreedomBox
- deleted 16y ago
  [deleted]
- loupgarou21 16y ago
  You can running multiple web and mail servers behind a single IP address. I personally am not doing this though because I have 5 IP addresses allocated to me, so I take advantage of them.
  - loup-vaillant 16y ago
    Yes you can, but if you don't have a public IP yourself, you have to find someone willing to share his own (supposing IP already ran out). Most likely, you'd have to trust him. So for maximum independence, you need to have your own IP. I reckon relying on a friend is very close to ideal. But not strictly so.
- tptacek 16y ago
  Why is a native IPv4 address a "basic civil liberty"? It's a technical detail. Surely the "liberty" is "first class citizen of the Internet", right? "The ability to publish content, the ability to build applications, the ability to pass traffic"? If IP addresses were truly and in principle a right, then surely everyone would also be entitled to an ASN and the right to publish their IP address on the provider of their choosing. But they aren't; it costs hundreds of thousands of dollars to go from a standing start to default-less full peer. Without peering, the IP address is just a totem. You think it matters, but it doesn't; you've simply been licensed to speak on the Internet by your ISP. That doesn't really bother me, but it should bother you, if you take your principles seriously. IPv6 isn't going to solve that problem (IPv6 does not magically end BGP RIB bloat). But overlay networks, which don't care whether they're running on top of IPv4, CLNP, IPX, or IPv6, do solve it.
MarkSweep 16y ago
I would think it would be easy to provide the security side-effect of NAT through firewalls in routers. The concept of "you can't talk to me unless I initiated a connection" does not seem to require NAT.
- dfox 16y ago
  It is easy, the one iptables rule that does it is in fact slightly longer to write than rule for NAT, but at least makes sense and does not involve words like "MASQUERADE" :)
LaGrange 16y ago
Actually, we still need external-to-internal connections (e.g. p2p file transfers, not only Bittorrent, but also IM file transfer, VoIP, game servers and so on) so the NAT gets punched through routinely. The security isn't really provided by NAT, it's provided by the firewall; yes, a stateful protecting the entire end-user network is desirable, but NAT isn't really required for that to function effectively. Even security-by-obscurity in case of a NAT router is doubtful, unless it's fronting a relatively big network. For home networks, the address of the network is identifying enough. By monitoring traffic you can even guess how big the network is.
BerislavLopac 16y ago
Actually, that is the reason why the conversion to IPv6 has stalled for so long. Which is a bad thing, since for one, it's much simpler to set up networks if you don't have to worry about NATs, and second NAT make many of useful technologies (like some P2P applications much more difficult). And we shouldn't forget that IPv6 is not only about a larger address space; it brings many useful standards like mandatory network layer security, jumbograms etc.
- cletus 16y ago
  But my point is that the safest thing for most end-devices is NOT to be directly addressable from the wider internet. Any network admin will tell you that so it'll be interesting to see how that unfolds in the IPv6 world (if it ever unfolds).
  - loup-vaillant 16y ago
    The safest thing for most end-devices is not being servers in the first place. Now, if the device is cracked through one of its client software (NATs don't prevent that), then it could start up a rogue server, while if it were behind a NAT it couldn't. That's no worse for the machine itself (it's hosed anyway), but you could argue that's worse for the rest of the network. I think it's not. Botnets are annoying and dangerous when they act as clients. Spam, DDoS, automatic attacks are all client behaviour. Even if you want server behaviour, connections don't have to be initiated from the outside. The compromised device just have to know the relevant IP, and initiate the connexion itself. Finally, if you want to block incoming connections anyway, a plain firewall is cleaner. At least FTP will work.
    - jauer 16y ago
      The point about NAT blocking unforwarded servers, not necessarily true: http://samy.pl/pwnat/ http://samy.pl/pwnat/ The goal of some botnets is to set up servers for software distribution or to host phishing sites. You can't characterize botnets activity as simply client behavior. Thanks to UPnP being enabled on most modern consumer routers you can't even count on the NAT protecting you from having a unauthorized server. Having end-devices NOT be servers is ignoring the fact that the UI for many home devices is delivered over a embedded web server. This is becoming more commonplace over time. Ultimately you need a firewall that controls inbound and outbound traffic.
jodrellblank 16y ago
which makes substandard firewall solutions as what is provided by Windows pretty much unnecessary. Ahem. Are you, perhaps, basing this on Windows XP from several years ago instead of Windows 7? Because 7 (and 2008 R2 Server) have pretty comprehensive looking firewalling.

by cletus 16y ago

tjpick 16y ago

coming back after the fact and saying "I know you got a sweet deal on those IP addresses when they were going cheap but we've run out and want them back so we're going to charge you extra" isn't really going to fly. You could argue the same case with domain squatters, or real estate, but it just can't work that way. You could buy them back -- at a premium of course.

bostonvaulter2 16y ago
You could hypothetically charge a small yearly fee for each IP Address owned. Of course there would be lots of financial hurdles with this approach.
- wmf 16y ago
  ARIN already charges fees for IP addresses; I suppose they take 'em back if you don't pay. https://www.arin.net/fees/fee_schedule.html https://www.arin.net/fees/fee_schedule.html Note that legacy holders don't pay fees on their massive /8s.

nileshtrivedi 16y ago

I think the article made it clear that IPv4 is running out of addresses DESPITE using NAT heavily. As far as reclaiming large A blocks is concerned, I read somewhere that we are exhausting addresses equivalent to an A-class block in 5 weeks. Easy to see that we are going to need a long-term solution anyhow.

jodrellblank 16y ago
I linked this elsewhere, but you can see here: http://twitter.com/ipv4countdown http://twitter.com/ipv4countdown from the history how fast they are being used up - a million every couple of days, or thereabouts.

loup-vaillant 16y ago

> implying each device needs its own IPv4 address. This implication is basically correct, actually. Sure, not every machine needs to be a server, but every people should have at least one. Everyone should have his own mail server. Every blogger should have his own web server. And so on. It's just a matter of basic civil liberties, like privacy and free speech, which currently aren't fully enabled, because most people don't have the amount of control they should have. If we let giant NAT routers spread further, such control will be effectively impossible. Even for computer nerds. Even for owners of a freedom box[1]. As a side note, the correct response for security is not using giant NAT routers. It's getting rid of Windows. [1]: http://wiki.debian.org/FreedomBox http://wiki.debian.org/FreedomBox

deleted 16y ago
[deleted]
loupgarou21 16y ago
You can running multiple web and mail servers behind a single IP address. I personally am not doing this though because I have 5 IP addresses allocated to me, so I take advantage of them.
- loup-vaillant 16y ago
  Yes you can, but if you don't have a public IP yourself, you have to find someone willing to share his own (supposing IP already ran out). Most likely, you'd have to trust him. So for maximum independence, you need to have your own IP. I reckon relying on a friend is very close to ideal. But not strictly so.
tptacek 16y ago
Why is a native IPv4 address a "basic civil liberty"? It's a technical detail. Surely the "liberty" is "first class citizen of the Internet", right? "The ability to publish content, the ability to build applications, the ability to pass traffic"? If IP addresses were truly and in principle a right, then surely everyone would also be entitled to an ASN and the right to publish their IP address on the provider of their choosing. But they aren't; it costs hundreds of thousands of dollars to go from a standing start to default-less full peer. Without peering, the IP address is just a totem. You think it matters, but it doesn't; you've simply been licensed to speak on the Internet by your ISP. That doesn't really bother me, but it should bother you, if you take your principles seriously. IPv6 isn't going to solve that problem (IPv6 does not magically end BGP RIB bloat). But overlay networks, which don't care whether they're running on top of IPv4, CLNP, IPX, or IPv6, do solve it.

MarkSweep 16y ago

I would think it would be easy to provide the security side-effect of NAT through firewalls in routers. The concept of "you can't talk to me unless I initiated a connection" does not seem to require NAT.

dfox 16y ago
It is easy, the one iptables rule that does it is in fact slightly longer to write than rule for NAT, but at least makes sense and does not involve words like "MASQUERADE" :)

LaGrange 16y ago

Actually, we still need external-to-internal connections (e.g. p2p file transfers, not only Bittorrent, but also IM file transfer, VoIP, game servers and so on) so the NAT gets punched through routinely. The security isn't really provided by NAT, it's provided by the firewall; yes, a stateful protecting the entire end-user network is desirable, but NAT isn't really required for that to function effectively. Even security-by-obscurity in case of a NAT router is doubtful, unless it's fronting a relatively big network. For home networks, the address of the network is identifying enough. By monitoring traffic you can even guess how big the network is.

BerislavLopac 16y ago

Actually, that is the reason why the conversion to IPv6 has stalled for so long. Which is a bad thing, since for one, it's much simpler to set up networks if you don't have to worry about NATs, and second NAT make many of useful technologies (like some P2P applications much more difficult). And we shouldn't forget that IPv6 is not only about a larger address space; it brings many useful standards like mandatory network layer security, jumbograms etc.

cletus 16y ago
But my point is that the safest thing for most end-devices is NOT to be directly addressable from the wider internet. Any network admin will tell you that so it'll be interesting to see how that unfolds in the IPv6 world (if it ever unfolds).
- loup-vaillant 16y ago
  The safest thing for most end-devices is not being servers in the first place. Now, if the device is cracked through one of its client software (NATs don't prevent that), then it could start up a rogue server, while if it were behind a NAT it couldn't. That's no worse for the machine itself (it's hosed anyway), but you could argue that's worse for the rest of the network. I think it's not. Botnets are annoying and dangerous when they act as clients. Spam, DDoS, automatic attacks are all client behaviour. Even if you want server behaviour, connections don't have to be initiated from the outside. The compromised device just have to know the relevant IP, and initiate the connexion itself. Finally, if you want to block incoming connections anyway, a plain firewall is cleaner. At least FTP will work.
  - jauer 16y ago
    The point about NAT blocking unforwarded servers, not necessarily true: http://samy.pl/pwnat/ http://samy.pl/pwnat/ The goal of some botnets is to set up servers for software distribution or to host phishing sites. You can't characterize botnets activity as simply client behavior. Thanks to UPnP being enabled on most modern consumer routers you can't even count on the NAT protecting you from having a unauthorized server. Having end-devices NOT be servers is ignoring the fact that the UI for many home devices is delivered over a embedded web server. This is becoming more commonplace over time. Ultimately you need a firewall that controls inbound and outbound traffic.

jodrellblank 16y ago

which makes substandard firewall solutions as what is provided by Windows pretty much unnecessary. Ahem. Are you, perhaps, basing this on Windows XP from several years ago instead of Windows 7? Because 7 (and 2008 R2 Server) have pretty comprehensive looking firewalling.