6 ms·

> Azure's network team decided to unnecessarily use NAT for IPv6, making it exactly (100%!) as complex as IPv4... People like the NAT. It's a feature, not a bu

> Azure's network team decided to unnecessarily use NAT for IPv6, making it exactly (100%!) as complex as IPv4... People like the NAT. It's a feature, not a bug. If your selling point for IPv6 is "no more NAT" then no wonder it never went anywhere! P.S. No, "you're doing it wrong" and "you're not allowed to like the NAT" are not valid responses to user needs.

funcDropShadow 6y ago
What do people like about NAT? I am guessing that the perceived increase in security. But perhaps there are more real or perceived advantages.
- w7 6y ago
  What I find common is people conflate NAT with stateful firewalling, and believe that if you lose NAT you lose all forms of edge/perimeter network security. They don't understand that you can still filter and prevent unwanted packets from reaching hosts without NAT.
  - otabdeveloper4 6y ago
    Of course you can. But why would you? You're replacing something that is simple, easy to understand and works perfectly well with a nebulous something that invites user error and security nightmares. For example, my (modest) home LAN is five routers, a NAS/media server, a media player, two "smart TVs" and dozens of notebooks and phones connected via Wi-Fi. What do you propose? Manage a firewall on each of those devices? I suppose you mean setting up a firewall on the WAN link to block all incoming traffic? How is that different from a NAT? Merely a lack of 'masquerade' setting on the firewall rule? What's the benefit to me and why should I care? Or do you propose some sort of hybrid scheme to intelligently block traffic while making all my countless devices pingable from the Internet? Not in this timeline, sorry.
    - femiagbabiaka 6y ago
      Your home network and a cloud datacenter aren’t comparable. Many clouds have host level firewall policies as a core feature, and anyone competent is managing them profile-style using Terraform or an equivalent. It’s really quite easy from that perspective.
      - otabdeveloper4 6y ago
        > Your home network and a cloud datacenter aren’t comparable. Of course they are. I didn't need to think about firewall automation before, and now I do. For what gain? > anyone competent Not an option for most people. Let's make networking and security things more foolproof, not less, okay?
        femiagbabiaka 6y ago
        Nobody is stopping you from running a NAT gateway until 2120 at home. IPv6 solves specific problems in a datacenter context, namely address exhaustion. You'll never run into that problem at home.
        jiggawatts 6y ago
        You really are refusing to listen to what people are telling you. I have an Internet router, which uses NAT for IPv4, same as everyone else. If I want to punch a hole through for something like RDP or SSH, I have to use unique port numbers because I only have one Internet-facing IP address. Because there are only 3 billion IPv4 addresses for the whole World, all of them are regularly scanned by Bad People for open ports, making this RISKY. I also have IPv6 enabled on it. No NAT. If I want to punch a hole through for RDP or SSH, I can use the standard ports because each device has a unique Internet-facing IP address. My router alone has 2^64 (millions of trillions) of unique addresses, of which a random 5 or 6 have been allocated. There is no way anyone ever is going to be able to scan these. I can SAFELY open standard port numbers and not have to worry about drive-by attacks. THERE IS NO OTHER DIFFERENCE. The router works the same, the firewall works the same, the Internet works the same, the GUI is the same. IT IS ALL THE SAME! NAT is not magic. It is not a firewall. It is not necessary. It is not beneficial.
- znpy 6y ago
  > What do people like about NAT? NAT allows people to be very dumb about networking. Either you "open a port" or you don't. It works very well as long somebody else is managing the network for you and you just ask for stuff to happen and then that somebody else has to actually make it work.
  - jiggawatts 6y ago
    Replace the word NAT with Firewall and all security-related statements are the same.
- dx034 6y ago
  At home I really appreciate the NAT. I'm glad not every device has a public IP and gets hammered with attacks 24/7. It's not fail-safe but it definitely adds some security.. As for cloud, no idea what the benefit should be there.
  - coddle-hark 6y ago
    This is what a firewall is for.
    - dx034 6y ago
      Most people use ISP provided routers at home, firewalls in those aren't necessarily great.
      - jiggawatts 6y ago
        It would be literally the EXACT SAME firewall with IPv6 as with IPv4 NAT. Most IPv6 routers are also IPv4 routers and behave exactly the same for both. They share the same router code, the same firewall, etc...
dijit 6y ago
> "you're not allowed to like the NAT" Well, the bigger question might be why do they like NAT? If it's about having a single /128 address so they can do ACLs then that's easily fixed by just lowering the CIDR number. (unless you have an ancient version of fortigate on prem, which likely doesn't work with ipv6 anyway). If it's about not having things poking at your servers through the NAT then the "NAT" really isn't helping anything, it's the stateful firewall doing _all_ the work there and those things are entirely independent systems. -- They're just sold to consumers as a single package.
- otabdeveloper4 6y ago
  Again: "you're doing it wrong" and "you're not allowed to like the NAT" are not valid criticisms. People like NAT because it's an easy batteries-included way to manage, secure and understand your LAN. Taking it away and forcing them to migrate to an incompatible zoo of firewall technologies for no benefit is asinine. > They're just sold to consumers as a single package. Exactly. How in the world is this a bad thing now? Do we really want to make network security for the average do-it-yourself home LAN harder?
  - dijit 6y ago
    Nothing changes; the firewall instead says "do you want this port open to this device" [y/N]: Personally I think this is much easier to reason about. And all I'm saying is that the NAT part of it absolutely does nothing to defend you, it's trivially defeated, people just conflate the two.
    - otabdeveloper4 6y ago
      > the firewall instead says "do you want this port open to this device" [y/N] That's exactly what I don't want to do. I have over 20 devices in the home LAN at any given point in time; why do you want to make my life difficult for no good reason?
      - dijit 6y ago

funcDropShadow 6y ago

What do people like about NAT? I am guessing that the perceived increase in security. But perhaps there are more real or perceived advantages.

w7 6y ago
What I find common is people conflate NAT with stateful firewalling, and believe that if you lose NAT you lose all forms of edge/perimeter network security. They don't understand that you can still filter and prevent unwanted packets from reaching hosts without NAT.
- otabdeveloper4 6y ago
  Of course you can. But why would you? You're replacing something that is simple, easy to understand and works perfectly well with a nebulous something that invites user error and security nightmares. For example, my (modest) home LAN is five routers, a NAS/media server, a media player, two "smart TVs" and dozens of notebooks and phones connected via Wi-Fi. What do you propose? Manage a firewall on each of those devices? I suppose you mean setting up a firewall on the WAN link to block all incoming traffic? How is that different from a NAT? Merely a lack of 'masquerade' setting on the firewall rule? What's the benefit to me and why should I care? Or do you propose some sort of hybrid scheme to intelligently block traffic while making all my countless devices pingable from the Internet? Not in this timeline, sorry.
  - femiagbabiaka 6y ago
    Your home network and a cloud datacenter aren’t comparable. Many clouds have host level firewall policies as a core feature, and anyone competent is managing them profile-style using Terraform or an equivalent. It’s really quite easy from that perspective.
    - otabdeveloper4 6y ago
      > Your home network and a cloud datacenter aren’t comparable. Of course they are. I didn't need to think about firewall automation before, and now I do. For what gain? > anyone competent Not an option for most people. Let's make networking and security things more foolproof, not less, okay?
      - femiagbabiaka 6y ago
        Nobody is stopping you from running a NAT gateway until 2120 at home. IPv6 solves specific problems in a datacenter context, namely address exhaustion. You'll never run into that problem at home.
      - jiggawatts 6y ago
        You really are refusing to listen to what people are telling you. I have an Internet router, which uses NAT for IPv4, same as everyone else. If I want to punch a hole through for something like RDP or SSH, I have to use unique port numbers because I only have one Internet-facing IP address. Because there are only 3 billion IPv4 addresses for the whole World, all of them are regularly scanned by Bad People for open ports, making this RISKY. I also have IPv6 enabled on it. No NAT. If I want to punch a hole through for RDP or SSH, I can use the standard ports because each device has a unique Internet-facing IP address. My router alone has 2^64 (millions of trillions) of unique addresses, of which a random 5 or 6 have been allocated. There is no way anyone ever is going to be able to scan these. I can SAFELY open standard port numbers and not have to worry about drive-by attacks. THERE IS NO OTHER DIFFERENCE. The router works the same, the firewall works the same, the Internet works the same, the GUI is the same. IT IS ALL THE SAME! NAT is not magic. It is not a firewall. It is not necessary. It is not beneficial.
znpy 6y ago
> What do people like about NAT? NAT allows people to be very dumb about networking. Either you "open a port" or you don't. It works very well as long somebody else is managing the network for you and you just ask for stuff to happen and then that somebody else has to actually make it work.
- jiggawatts 6y ago
  Replace the word NAT with Firewall and all security-related statements are the same.
dx034 6y ago
At home I really appreciate the NAT. I'm glad not every device has a public IP and gets hammered with attacks 24/7. It's not fail-safe but it definitely adds some security.. As for cloud, no idea what the benefit should be there.
- coddle-hark 6y ago
  This is what a firewall is for.
  - dx034 6y ago
    Most people use ISP provided routers at home, firewalls in those aren't necessarily great.
    - jiggawatts 6y ago
      It would be literally the EXACT SAME firewall with IPv6 as with IPv4 NAT. Most IPv6 routers are also IPv4 routers and behave exactly the same for both. They share the same router code, the same firewall, etc...

dijit 6y ago

> "you're not allowed to like the NAT" Well, the bigger question might be why do they like NAT? If it's about having a single /128 address so they can do ACLs then that's easily fixed by just lowering the CIDR number. (unless you have an ancient version of fortigate on prem, which likely doesn't work with ipv6 anyway). If it's about not having things poking at your servers through the NAT then the "NAT" really isn't helping anything, it's the stateful firewall doing _all_ the work there and those things are entirely independent systems. -- They're just sold to consumers as a single package.

otabdeveloper4 6y ago
Again: "you're doing it wrong" and "you're not allowed to like the NAT" are not valid criticisms. People like NAT because it's an easy batteries-included way to manage, secure and understand your LAN. Taking it away and forcing them to migrate to an incompatible zoo of firewall technologies for no benefit is asinine. > They're just sold to consumers as a single package. Exactly. How in the world is this a bad thing now? Do we really want to make network security for the average do-it-yourself home LAN harder?
- dijit 6y ago
  Nothing changes; the firewall instead says "do you want this port open to this device" [y/N]: Personally I think this is much easier to reason about. And all I'm saying is that the NAT part of it absolutely does nothing to defend you, it's trivially defeated, people just conflate the two.
  - otabdeveloper4 6y ago
    > the firewall instead says "do you want this port open to this device" [y/N] That's exactly what I don't want to do. I have over 20 devices in the home LAN at any given point in time; why do you want to make my life difficult for no good reason?
    - dijit 6y ago