5 ms·

Is this common? Might be a bit slow here but this sounds like hoarding.

big_chungus 7y ago
I can only wish that I had this, but if I did, I'd absolutely keep it. I'd love to give every device on a home network a publicly-routable address. No more port forwarding, no more NAT garbage. On the other hand, I know a guy who got a /24 way back when; I think he just gave it back at some point, though not 100% sure.
- jesterson 7y ago
  It gives you some overhead on security side if you're concerned about it since you will need to filter incoming traffic once you device network interface becomes routable from internet.
  - Symbiote 7y ago
    A default deny firewall rule is either already present (like on a home router, including any IPv6 router), or easier to set up than NAT.
  - zAy0LfpBZLC8mAC 7y ago
    No, it doesn't. NAT does not prevent inbound connections, only a stateful firewall does, and if you do have that, then NAT does not add anything.
    - samoa42 7y ago
      nat ist stateful. if there is no state for the connection, it's probably denied.
      - zAy0LfpBZLC8mAC 7y ago
        No, it isn't, on both counts. First, NAT is not necessarily stateful, just the common home router PAT or the telco CGNAT varieties of NAT are. Second, NAT does not filter, that is what a firewall does. NAT only rewrites addresses. If there is no state for a connection in a stateful NAT, it looks up whether there are any rules for how to rewrite that connection, then adds a NAT state entry that specifies how to rewrite that connection (including, potentially, not at all), and in any case the (potentially rewritten) then gets forwarded--unless a firewall drops it.
    - jfindley 7y ago
      So how are you, with your publically routed IP of (for example) 56.10.10.100 planning to connect to the GP, who has (for example) a public egress IP of 73.100.100.10, but is in fact using NAT, and his desktop's real IP is 192.168.1.20? I feel like you might be trying to point out that NAT devices can be configured to forward all traffic to some backend device - while true this is disingenous because they are basically always not configured like this. I realise NAT is unpopular with networking purists, but trying to claim that it doesn't prevent inbound connections seems to be overstating your case quite severely. I'd also note that if your firewall is stateful or not is irrelevant for the point you were trying to make - oldfashioned stateless firewalls can also block inbound connections just fine.
      - zAy0LfpBZLC8mAC 7y ago
        > So how are you, with your publically routed IP of (for example) 56.10.10.100 planning to connect to the GP, who has (for example) a public egress IP of 73.100.100.10, but is in fact using NAT, and his desktop's real IP is 192.168.1.20? By sending a packet to them that has the destination address 192.168.1.20? You seem to be making the assumption that the only way to send a packet to the WAN interface of a NAT router is through the public internet. While being able to do that widens the attack surface, it absolutely is not the only way, and your threat model is broken if you assume that it is. > I realise NAT is unpopular with networking purists, but trying to claim that it doesn't prevent inbound connections seems to be overstating your case quite severely. No, that belief is one of the big myths that keeps people configuring insecure networks. > I'd also note that if your firewall is stateful or not is irrelevant for the point you were trying to make - oldfashioned stateless firewalls can also block inbound connections just fine. That's true and it's not. Of course, you can block all connections with a stateless firewall, and thus obviously also block all inbound connections. But a stateless firewall is very limited in selectively blocking specifically inbound connections across random protocols, and especially so if it doesn't know detailed information about your network and services to infer what constitutes a packet establishing a connection, while with a stateful firewall you can essentially just say "drop inbound connections" without any further details about your networks, and it'll do a good job at it. Plus, you could argue about whether, for example, dropping TCP SYNs but forwarding all other TCP packets actually counts as "blocking inbound connections", given that tons of potential "inbound packets" will be forwarded to your internal systems and you really rely on your internal systems not accepting any of them as "establishing a connection" or possibly just being vulnerable to those "inbound but not establishing a connection" sort of packets.
  - big_chungus 7y ago
    That is certainly true. Though were I really concerned, I could assign my firewall the entire block, filter traffic, and filter traffic on a given address to a given device. That aside, I trust myself to configure a deny rule and just let through what I need.
thdrdt 7y ago
Yes this is common. There are a ton of unused IPv4 adresses. Companies, governments, universities bought ranges and maybe use 10% of them.
icedchai 7y ago
Well, I am using it. In the 90's, anyone could register an IP block.

I can only wish that I had this, but if I did, I'd absolutely keep it. I'd love to give every device on a home network a publicly-routable address. No more port forwarding, no more NAT garbage. On the other hand, I know a guy who got a /24 way back when; I think he just gave it back at some point, though not 100% sure.

jesterson 7y ago
It gives you some overhead on security side if you're concerned about it since you will need to filter incoming traffic once you device network interface becomes routable from internet.
- Symbiote 7y ago
  A default deny firewall rule is either already present (like on a home router, including any IPv6 router), or easier to set up than NAT.
- zAy0LfpBZLC8mAC 7y ago
  No, it doesn't. NAT does not prevent inbound connections, only a stateful firewall does, and if you do have that, then NAT does not add anything.
  - samoa42 7y ago
    nat ist stateful. if there is no state for the connection, it's probably denied.
    - zAy0LfpBZLC8mAC 7y ago
      No, it isn't, on both counts. First, NAT is not necessarily stateful, just the common home router PAT or the telco CGNAT varieties of NAT are. Second, NAT does not filter, that is what a firewall does. NAT only rewrites addresses. If there is no state for a connection in a stateful NAT, it looks up whether there are any rules for how to rewrite that connection, then adds a NAT state entry that specifies how to rewrite that connection (including, potentially, not at all), and in any case the (potentially rewritten) then gets forwarded--unless a firewall drops it.
  - jfindley 7y ago
    So how are you, with your publically routed IP of (for example) 56.10.10.100 planning to connect to the GP, who has (for example) a public egress IP of 73.100.100.10, but is in fact using NAT, and his desktop's real IP is 192.168.1.20? I feel like you might be trying to point out that NAT devices can be configured to forward all traffic to some backend device - while true this is disingenous because they are basically always not configured like this. I realise NAT is unpopular with networking purists, but trying to claim that it doesn't prevent inbound connections seems to be overstating your case quite severely. I'd also note that if your firewall is stateful or not is irrelevant for the point you were trying to make - oldfashioned stateless firewalls can also block inbound connections just fine.
    - zAy0LfpBZLC8mAC 7y ago
      > So how are you, with your publically routed IP of (for example) 56.10.10.100 planning to connect to the GP, who has (for example) a public egress IP of 73.100.100.10, but is in fact using NAT, and his desktop's real IP is 192.168.1.20? By sending a packet to them that has the destination address 192.168.1.20? You seem to be making the assumption that the only way to send a packet to the WAN interface of a NAT router is through the public internet. While being able to do that widens the attack surface, it absolutely is not the only way, and your threat model is broken if you assume that it is. > I realise NAT is unpopular with networking purists, but trying to claim that it doesn't prevent inbound connections seems to be overstating your case quite severely. No, that belief is one of the big myths that keeps people configuring insecure networks. > I'd also note that if your firewall is stateful or not is irrelevant for the point you were trying to make - oldfashioned stateless firewalls can also block inbound connections just fine. That's true and it's not. Of course, you can block all connections with a stateless firewall, and thus obviously also block all inbound connections. But a stateless firewall is very limited in selectively blocking specifically inbound connections across random protocols, and especially so if it doesn't know detailed information about your network and services to infer what constitutes a packet establishing a connection, while with a stateful firewall you can essentially just say "drop inbound connections" without any further details about your networks, and it'll do a good job at it. Plus, you could argue about whether, for example, dropping TCP SYNs but forwarding all other TCP packets actually counts as "blocking inbound connections", given that tons of potential "inbound packets" will be forwarded to your internal systems and you really rely on your internal systems not accepting any of them as "establishing a connection" or possibly just being vulnerable to those "inbound but not establishing a connection" sort of packets.
- big_chungus 7y ago
  That is certainly true. Though were I really concerned, I could assign my firewall the entire block, filter traffic, and filter traffic on a given address to a given device. That aside, I trust myself to configure a deny rule and just let through what I need.

thdrdt 7y ago

Yes this is common. There are a ton of unused IPv4 adresses. Companies, governments, universities bought ranges and maybe use 10% of them.

icedchai 7y ago

Well, I am using it. In the 90's, anyone could register an IP block.