4 ms·

NAT hides all devices I have in my network from the world. Nobody from the outside will know who made request x from the n devices in the network. NAT is main

NAT hides all devices I have in my network from the world. Nobody from the outside will know who made request x from the n devices in the network. NAT is mainly privacy/obfuscation. Can you do that with a firewall? Another use case is connectivity: - digital ocean gives 16 ipv6 addresses, how can I vpn through it with more hosts without NAT? - me as a lone node on another network want to host a VPN but have a limited set of IPv6 addresses available. - tethering Note: I will actually be setting up a network with NATv6, DHCPv6 and a firewall in about a month, so I do need it, and since tools are available, I am not the only one.

spacechild1 6y ago
> NAT is mainly privacy/obfuscation. That is not the original purpose of NAT. What about IPv6 privacy extensions? > Another use case is connectivity: Ok, there might be valid use cases for NATv6 (I am not an expert), but it shouldn't be necessary for typical consumer home networks. I have no problems with NAT as long as it a) doesn't block incoming traffic (that is the job of a firewall) b) doesn't perform symmetric address/port translation (breaks peer-to-peer applications).
- adriancr 6y ago
  Not the original purpose of NAT, sure, but it achieves that goal much better then IPv6 Privacy extensions are a hack and still uniquely identify someone even if it changes once a day. NAT hides them all the time. If I have 100 nodes, good luck identifying them over PNAT as an ISP, without PNAT you have nice tags per each node... they change once a day but you match to last days traffic. Onto connectivity: a) block incoming traffic - sure - blocking with firewall, NAT is redundant, its a poor mans firewall BUT if you misconfigure the firewall or is disabled, you are screwed, whereas NAT just works. b) break peer-to-peer applications. Port NAT is needed for privacy, so this is a given. I also like it breaking peer-to-peer apps I only want specific nodes to be able to host stuff if ever. For home networks STUN/TURN works just fine without having external parties know who is placing the call.
  - spacechild1 6y ago
    STUN doesn't work for symmetric NATs and TURN is not a solution (the traffic gets relayed over the server, which defeats the purpose of a peer-to-peer system). Port restricted NAT is sufficient: it serves the actual purpose without breaking peer-to-peer systems. Note: I'm currently developing a peer-to-peer app.

spacechild1 6y ago

> NAT is mainly privacy/obfuscation. That is not the original purpose of NAT. What about IPv6 privacy extensions? > Another use case is connectivity: Ok, there might be valid use cases for NATv6 (I am not an expert), but it shouldn't be necessary for typical consumer home networks. I have no problems with NAT as long as it a) doesn't block incoming traffic (that is the job of a firewall) b) doesn't perform symmetric address/port translation (breaks peer-to-peer applications).

adriancr 6y ago
Not the original purpose of NAT, sure, but it achieves that goal much better then IPv6 Privacy extensions are a hack and still uniquely identify someone even if it changes once a day. NAT hides them all the time. If I have 100 nodes, good luck identifying them over PNAT as an ISP, without PNAT you have nice tags per each node... they change once a day but you match to last days traffic. Onto connectivity: a) block incoming traffic - sure - blocking with firewall, NAT is redundant, its a poor mans firewall BUT if you misconfigure the firewall or is disabled, you are screwed, whereas NAT just works. b) break peer-to-peer applications. Port NAT is needed for privacy, so this is a given. I also like it breaking peer-to-peer apps I only want specific nodes to be able to host stuff if ever. For home networks STUN/TURN works just fine without having external parties know who is placing the call.
- spacechild1 6y ago
  STUN doesn't work for symmetric NATs and TURN is not a solution (the traffic gets relayed over the server, which defeats the purpose of a peer-to-peer system). Port restricted NAT is sufficient: it serves the actual purpose without breaking peer-to-peer systems. Note: I'm currently developing a peer-to-peer app.