5 ms·
No, it's not just a "religious" argument. NAT really does violate the way the internet was supposed to work; it causes real technical problems, not just aesthe
by phaedrus 18y ago
No, it's not just a "religious" argument. NAT really does violate the way the internet was supposed to work; it causes real technical problems, not just aesthetic ones. In fact, NAT is a nasty kludge by the strictest definition of the word. Have you ever written code that routes packets? I have! Not only does NAT break the end to end connectivity rule, but it also breaks data encapsulation. In order to work it has to open up the data and tweak IP and port numbers to give the illusion that the NATed networks have end to end connectivity. That's why NAT causes problems with VoIP and is stifles the development of new, innovative protocols because it doesn't transparently handle new protocols. IP was conceived in such a way that TCP, UDP, and other protocols could be layered on top of it, but because NATs break the encapsulation, with NAT each new protocol requires every router's NAT to be reprogrammed to know how to handle it.
If IP had been designed with NAT in mind, it might not be so broken now. That's one of the problems IPv6 is supposed to solve - it doesn't need a NAT, but it also works better over NAT than IPv4! So if you think NAT beats static IPs, you should actually prefer IPv6 because it has non-broken NAT support!
Furthermore, please define exactly what you mean when you say that applications which don't work with (leaky, broken IPv4 NAT) are "enlisting the Internet to accomplish things the apps should be doing for themselves, and are in fact breaking e2e." How exactly is an app supposed to "do something for itself" in getting a communication channel open when it can't get any packets through the NAT to communicate in the first place? For instance, most NATs don't allow unexpected incoming connections. Say I have a computer and a friend has another one on another ISP, so we're behind different NATs. Now say I'm developing (in fact I really am developing) an online MMO game. Without a public, static IP address for one of us, or a public server to bounce off of (which we don't have yet because we're only just starting our company) it will be impossible for us to connect directly to each other to test our setup over the internet. What IP:port would one of us type in to get to the other's machine? All each of us can reach is the public IP of the ISP's NAT. In order to make a connection, we have to punch out through the NAT first but punch out to where? We need a public IP, but in a world where every consumer is behind a NAT and all the IPv4 addresses are used up or cost more than we can afford, how are we going to get our start?
On the other hand, if the world, right now, switched to IPv6, we'd have no trouble connecting to each other to test our game server, and we could do it from a consumer home internet connection. Ah, but that's the real reason we're stuck with IPv4 and NAT. The internet was meant to be a network where every computer is equal, and in that environment anyone could set up a server and start doing business or providing their own content. No more. Now, thanks to a completely avoidable numbering shortage and a NAT-hell, the internet is getting to be more like television - big company's servers provide the content, and you consume it, just as the media companies and cable companies like it. You won't be able to say, "hell with their Terms of Service, I'll host my site myself". And fat chance making much money for yourself off your web-2.0 company if you are forced to host your servers with a bigger company in order to get a public IP. That's what the world without IPv6 looks like.
- tptacek 18y agoYou're really just saying the same thing as the preceding comment did, and your argument really is aesthetic. Real e2e apps don't care who's routing them or how they're being routed; they have a service model ("I need reliable delivery" or "I need real-time out-of-order"), and take care of the details themselves. This is exactly the dispute that killed multicast. The purists demand all-sources Deering multicast, the pragmatists think they can at least make it work with single-source, and the rest of the world just goes and builds apps that actually work using TCP and app-layer multicast. We should learn from that. Instead of asking everyone to forklift out their routers to switch in an expirimental protocol, we should embrace the constraints that we have and make stuff work regardless. Skype works even with double-sided NAT. So, yes, I definitely have built apps that route packets, and yes, I already did bring up the example of FTP, and yes, it's a bad example: it's the worst protocol in common use, and we're not really surprised that NAT causes problems with it. What's another common protocol that requires middleboxes to alter payloads? Note that the whole web works without that requirement. The reality is, it's just silly to assume that the future of the Internet is going to be controlled by apps that will only be able to rendesvouz using IANA-assigned IP addresses. The future is multicast, peer-to-peer, and presence-based, and it's going to come not from standards groups but from app developers. My AIM screen name is already 100x more valuable than my IP address, and Google is already 1000x more valuable than my domain name. Why exactly am I supposed to be psyched about "16:c4:d2:bc:23:71:85:a2:a6:17:7a:56:09:b5:e5:15"?
- phaedrus 18y agoYou still haven't answered my question - how can I, sitting behind one NAT, receive a connection from my friend behind another NAT, if neither allows direct incoming connections? All your multicast, peer-to-peer, etc. buzzwords don't mean a damn thing if the connection can't be made in the first place. No matter how you twist around and cloud the issue, the fact is somebody has got to have a public IP to make the rendesvouz work, and if those public IPs are not available to ordinary people who might be entrepreneurs prototyping new kinds of ways to use the internet, then those prototypes will not get off the ground. Edit: BTW, IPv6 is not an "experimental" protocol as you allude to it.