4 ms·

I wish that instead of buying more IPv4 blocks, AWS would drastically lower the price of NAT gateways, then charge extra for EC2 instances and Fargate tasks wit

I wish that instead of buying more IPv4 blocks, AWS would drastically lower the price of NAT gateways, then charge extra for EC2 instances and Fargate tasks with public IPs, to make it a no-brainer to stop wasting public IPs. As it stands, it's cheaper to waste public IPs than to use NAT gateways. Addendum: I also wish I could volunteer to be switched over to CGNAT for my personal IPv4 traffic. This discussion got me thinking about what it would take to get my company's IPv4 footprint down to zero. Might as well do that for myself as well if I could.

moduspol 5y ago
Yep. Or even give me a CG-NAT adoption. I have plenty of use cases where I only use a public IP address in AWS for Internet connectivity without any need for new incoming connections. For those, I'd be totally fine with a CG-NAT address.
- mwcampbell 5y ago
  I wonder if we could hack that for ourselves by having our EC2 instances or Fargate tasks do all outgoing Internet access indirectly through Lambda functions.
remram 5y ago
I noticed that too on GCP. Many of my workloads don't need a public address but it's still simpler and cheaper to set one.
bob1029 5y ago
I've been making us use a NAT gateway for all of our EC2 instances since the dawn of time. Only those that need to be directly touched on specific ports get dedicated IPv4. I can count all of our public IPv4 addresses on 1 hand, and that includes a static comcast address for a branch office. Using auto-assigned IPv4 should not be default, IMO. If I just did what amazon wanted me to without thinking, we would be consuming 5-6x more IPv4 addresses than we otherwise need to.
- mwcampbell 5y ago
  Do you have any Internet-facing load balancers? IIUC, each AWS application load balancer gets a couple of public IPv4 addresses. So I guess if you have a single ALB and a couple of NAT gateways (in two availability zones), you could still end up with a total of 5 public IPv4 addresses.
  - olyjohn 5y ago
    Last time I set up an ALB, it required 8 IP addresses. I assume that is because it spins up extra instances on the backend as the load increases. Most of the time the hostname is only assigned to 2 IPs.
    - bradknowles 5y ago
      Two per AZ you operate in. If you want to be multi-AZ across four AZs, then 4*2 IP addresses.
wbl 5y ago
IPv6 makes addressing easy and addresses free. Let's not keep NAT alive.
- paranoidrobot 5y ago
  While I'm all for IPv6 - there's precious little about v6 that's easier. On top of that, there's a whole lot of software that either doesn't support v6, or has major problems.
  - wbl 5y ago
    If you want to lay out a structured space of addresses you can without worrying how much it will cost. Of course other problems don't change. It's been many years but most software I work with just works. Granted I don't work with a ton of old proprietary software.
  - Arnavion 5y ago
    Do you have examples of software that you can't use because it doesn't support IPv6? Of all the software I've used there isn't any, which is why I'm curious.
    - Ashaxyn 5y ago
      Almost every single old/retro multiplayer game that relies on ipv4 to connect that I've seen. :(
      - kazen44 5y ago
        is this not trivially fixable by running software that tunnels IPv4 into ipv6 between hosts who want to play multiplayer? I have seen some implementations of IPX which work by tunneling IPX inside IPv4.
  - tialaramex 5y ago
    > there's precious little about v6 that's easier. Somebody doesn't do any address or route planning. In IPv6 the amount of hosts in a subnet is totally unimportant (because there are always 64 bits for this). If you have, say, a thousand hosts you're going to need to buy decent network kit 'cos a pile of daisy-chained 5 port plastic home switches won't like that - but it's only a local problem, like buying enough cable. You can have however many subnetworks you felt was appropriate for managing and organising things, and only those need managing. However in IPv4 you need to know how many hosts there will be or might be in each subnet, in order to plan address allocation, and small changes can throw things into turmoil, you have to manage the individual host addresses. Suppose I have four subnets with 40-50 hosts in each - in IPv4 chances are that's four /26s. And then somebody wants to add 20 hosts to one of the larger subnets so now it won't fit in a /26 any more. Ugh. This is likely to involve a re-numbering programme that might take weeks or months. I may need to reach above me, to find somebody who has enough address space to trade with me, and they may in turn have to reach up too, or worse find the money to buy space. Suddenly what should have been an easy problem ("add twenty new hosts") is a nightmare with a budget and project management. IPv6 evaporates this entire class of problems. There might actually be people at large organisations whose job ceases to exist under IPv6. Certainly there are people whose job gets much easier and less stressful, and who don't have to say "No" as often any more.
lazyant 5y ago
Regarding NAT gateway pricing (~ $30/month or so iirc) we can use a micro (~ $10/month) Linux instance, it's quite literally about 2 commands (sysctl enable ip forwarding and a masquerade iptables command) or a short script to set it up.
- mwcampbell 5y ago
  But that's another thing to keep patched. I wonder if it would be feasible, when using a stripped-down container host OS like Bottlerocket, to configure one container host instance per availability zone to also do NAT. Note that I'm assuming a setup where the containers are running in ECS tasks that use the awsvpc network mode (i.e. each task has its own VPC network interface and private IP address), so security groups can be fine-grained. So even the tasks running on container hosts that do NAT would need the NAT.
  - otterley 5y ago
    Also, you need to deal with instance failure while minimizing downtime.
- notwedtm 5y ago
  Also, NAT gateways don't support TCP or ICMP fragementation. Not always a killer, but when it is, it is.
zxcvbn4038 5y ago
It really depends on your needs - I use nano sized SPOT instances for NAT gateways which only cost a penny a month. They in no way compete with the 40gbs capacity and high availability of the hardware NAT devices but if the majority of your traffic is internal, going to a peered VPC, or over IPV6 and you just need a means to make an occasional API call to one of the AWS endpoints that don’t yet support IPV6 (which is the majority of them), then it’s a perfectly viable solution - better then sharing a hardware NAT IMO because you can take advantage of network traffic within the same availability zone being free.
- otterley 5y ago
  How do you deal with failure or replacement of your NAT instances while minimizing downtime?

moduspol 5y ago

Yep. Or even give me a CG-NAT adoption. I have plenty of use cases where I only use a public IP address in AWS for Internet connectivity without any need for new incoming connections. For those, I'd be totally fine with a CG-NAT address.

mwcampbell 5y ago
I wonder if we could hack that for ourselves by having our EC2 instances or Fargate tasks do all outgoing Internet access indirectly through Lambda functions.

remram 5y ago

I noticed that too on GCP. Many of my workloads don't need a public address but it's still simpler and cheaper to set one.

bob1029 5y ago

I've been making us use a NAT gateway for all of our EC2 instances since the dawn of time. Only those that need to be directly touched on specific ports get dedicated IPv4. I can count all of our public IPv4 addresses on 1 hand, and that includes a static comcast address for a branch office. Using auto-assigned IPv4 should not be default, IMO. If I just did what amazon wanted me to without thinking, we would be consuming 5-6x more IPv4 addresses than we otherwise need to.

mwcampbell 5y ago
Do you have any Internet-facing load balancers? IIUC, each AWS application load balancer gets a couple of public IPv4 addresses. So I guess if you have a single ALB and a couple of NAT gateways (in two availability zones), you could still end up with a total of 5 public IPv4 addresses.
- olyjohn 5y ago
  Last time I set up an ALB, it required 8 IP addresses. I assume that is because it spins up extra instances on the backend as the load increases. Most of the time the hostname is only assigned to 2 IPs.
  - bradknowles 5y ago
    Two per AZ you operate in. If you want to be multi-AZ across four AZs, then 4*2 IP addresses.

wbl 5y ago

IPv6 makes addressing easy and addresses free. Let's not keep NAT alive.

paranoidrobot 5y ago
While I'm all for IPv6 - there's precious little about v6 that's easier. On top of that, there's a whole lot of software that either doesn't support v6, or has major problems.
- wbl 5y ago
  If you want to lay out a structured space of addresses you can without worrying how much it will cost. Of course other problems don't change. It's been many years but most software I work with just works. Granted I don't work with a ton of old proprietary software.
- Arnavion 5y ago
  Do you have examples of software that you can't use because it doesn't support IPv6? Of all the software I've used there isn't any, which is why I'm curious.
  - Ashaxyn 5y ago
    Almost every single old/retro multiplayer game that relies on ipv4 to connect that I've seen. :(
    - kazen44 5y ago
      is this not trivially fixable by running software that tunnels IPv4 into ipv6 between hosts who want to play multiplayer? I have seen some implementations of IPX which work by tunneling IPX inside IPv4.
- tialaramex 5y ago
  > there's precious little about v6 that's easier. Somebody doesn't do any address or route planning. In IPv6 the amount of hosts in a subnet is totally unimportant (because there are always 64 bits for this). If you have, say, a thousand hosts you're going to need to buy decent network kit 'cos a pile of daisy-chained 5 port plastic home switches won't like that - but it's only a local problem, like buying enough cable. You can have however many subnetworks you felt was appropriate for managing and organising things, and only those need managing. However in IPv4 you need to know how many hosts there will be or might be in each subnet, in order to plan address allocation, and small changes can throw things into turmoil, you have to manage the individual host addresses. Suppose I have four subnets with 40-50 hosts in each - in IPv4 chances are that's four /26s. And then somebody wants to add 20 hosts to one of the larger subnets so now it won't fit in a /26 any more. Ugh. This is likely to involve a re-numbering programme that might take weeks or months. I may need to reach above me, to find somebody who has enough address space to trade with me, and they may in turn have to reach up too, or worse find the money to buy space. Suddenly what should have been an easy problem ("add twenty new hosts") is a nightmare with a budget and project management. IPv6 evaporates this entire class of problems. There might actually be people at large organisations whose job ceases to exist under IPv6. Certainly there are people whose job gets much easier and less stressful, and who don't have to say "No" as often any more.

lazyant 5y ago

Regarding NAT gateway pricing (~ $30/month or so iirc) we can use a micro (~ $10/month) Linux instance, it's quite literally about 2 commands (sysctl enable ip forwarding and a masquerade iptables command) or a short script to set it up.

mwcampbell 5y ago
But that's another thing to keep patched. I wonder if it would be feasible, when using a stripped-down container host OS like Bottlerocket, to configure one container host instance per availability zone to also do NAT. Note that I'm assuming a setup where the containers are running in ECS tasks that use the awsvpc network mode (i.e. each task has its own VPC network interface and private IP address), so security groups can be fine-grained. So even the tasks running on container hosts that do NAT would need the NAT.
- otterley 5y ago
  Also, you need to deal with instance failure while minimizing downtime.
notwedtm 5y ago
Also, NAT gateways don't support TCP or ICMP fragementation. Not always a killer, but when it is, it is.

zxcvbn4038 5y ago

It really depends on your needs - I use nano sized SPOT instances for NAT gateways which only cost a penny a month. They in no way compete with the 40gbs capacity and high availability of the hardware NAT devices but if the majority of your traffic is internal, going to a peered VPC, or over IPV6 and you just need a means to make an occasional API call to one of the AWS endpoints that don’t yet support IPV6 (which is the majority of them), then it’s a perfectly viable solution - better then sharing a hardware NAT IMO because you can take advantage of network traffic within the same availability zone being free.

otterley 5y ago
How do you deal with failure or replacement of your NAT instances while minimizing downtime?