6 ms·

Because there are 'only' 2^32, roughly four billion, IPv4 addresses. There are also over eight billion people on this planet, and many of them have multiple com

Because there are 'only' 2^32, roughly four billion, IPv4 addresses. There are also over eight billion people on this planet, and many of them have multiple computers (smartphones, tablets, laptops, desktops, etc). As a 'temporary' measure, Network Address Translation (NAT) was introduced so people could get one public IPv4 address and have multiple machines on the Internet behind it. The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet. This isn't a big deal for most consumption-based computing (fetching mail, watching videos), but there are use cases where you want to be able to talk to the other system, so yet another set of technologies had to be invented to allow punching holes through NAT (UPnP, NAT-PMP, PCP, STUN). But we're at the point in some place where there aren't even enough IPv4 addresses to give to ISP customers even if they're using NAT. So you have a private IP address for your home system, and then your router gets a private IP address on its "public" WAN connection, and you end up going two layers of NAT. There is an entire segment of IPv4 addresses (100.64.0.0/10) reserved for telco use and doubel-NATing: * https://en.wikipedia.org/wiki/Private_network#Dedicated_space_for_carrier-grade_NAT_deployment https://en.wikipedia.org/wiki/Private_network#Dedicated_spac... * https://en.wikipedia.org/wiki/IPv4_shared_address_space https://en.wikipedia.org/wiki/IPv4_shared_address_space We can continue this NAT-upon-NAT(-upon-NAT) silliness, or we can simply make the up-front investment and start pushing out IPv6 in more places. Your router still provides firewall protection, but reachability is a lot more straight-forward because the (potentially double) address translation goes away. Edit: fix a bunch of typos.

osrec 5y ago
In your first line, I guess you mean to say ipv4 not ipv6.
ugjka 5y ago
there's also NAT64, 464XLAT that do ipv6 to ipv4 sorcery
- throw0101a 5y ago
  Beyond an ELI5, but correct. If you are on an IPv4-only or IPv6-only network, you can reach the other through various mechanisms. A lot of mobile/cell networks are IPv6-only, and so the telcos need a way to allow clients to reach IPv4-only systems.
TuringNYC 5y ago
Totally silly question, but isn't the NAT-upon-NAT(-upon-NAT) a bit of protection in the sense of additional privacy, and hence a good thing? Doesn't this mean the website cannot directly tie back an incognito user back to a specific IP but instead to just a pool?
- Saris 5y ago
  Yes, but you could also randomize your IPv6 address constantly too. Downside of CGNAT and NAT at home is difficulty of getting some services to work, or hosting a server.
  - beerandt 5y ago
    It still boils down to everyone gets an identifying number, whether it's an ipv4 address or an ipv6 block. Any randomized ipv6 address from that block is still as "unique" an identifier as an ipv4 address.
  - rollcat 5y ago
    Also, creating/using P2P applications. I needed to look up UDP hole punching and now I wish I hadn't.
    - r3muxd 5y ago
      out of curiosity, what did you end up going with? I had to host a UDP game server recently and couldn't find a good solution. If only ngrok supported UDP...
      - tekknik 5y ago
        DMZ it and firewall up the host.
      - rollcat 5y ago
        It was just research. I'm interested in audio&video over IP, I already had a good grip on HLS, RTP, and a few others, and wanted to dive into WebRTC, RTSP, etc. I don't know but all of this feels like there's a simpler solution (like HLS vs DASH) waiting to be discovered.
WanderPanda 5y ago
> NAT-upon-NAT(-upon-NAT) But there is also a fundamental limit of 2^16 = 65536 concurrent connections, right?
- 2fastpost 5y ago
  Yes, from one NAT IP using the same protocol to a single public IP using a particular port. Change any of those and you can do 2^16 concurrent connections more per change. In other words, NAT works on the five-tuple of: protocol, source IP, source port, destination IP and destination port.
swsieber 5y ago
Playing Nintendo Switch online doesn't work if you're double NAT'd unless you go through some router hoops. It seems small, but it's quite aggravating if you're not tech oriented like the majority of the people on this forum.
tsaoutourpants 5y ago
> But we're at the point in some place where there aren't even enough IPv4 addresses to give to ISP customers even if they're using NAT. Er, that's a slight exaggeration. It's not uncommon to have 2,000 or more NAT clients behind a single public IP address. 2K * 4B = 8 trillion possible hosts... about 1,000 hosts per living person.
- kaliszad 5y ago
  Well, it has limits. You can hide 2000 people behind an address but they might have sporadic connection issues, long held connections such as SSH sessions will be very annoying to support [0] or the users will have to resort to frequent keepalives to make it work regardless, which produces more traffic to destinations you probably don't have in a cache. In some jurisdictions you have to log which customer used what IP (and port) at which point. You can do static assignments but you will have customers (customer homes, e.g. family with perhaps 10 devices or so could be realistic) for which 1000 ports just will not be enough do you will have to dynamically assign spare ports and log those. You might also get more support calls, because the NAT is dropping connections to radically in a peak e.g. a soccer match or whatever. Also the CG-NAT gateway isn't for free and the bigger it needs to be, the pricier it is. Also you might still need to buy some IPv4, perhaps more than you would need to buy if you deployed IPv6 and used it for the connections, where it is possible, taking e.g. almost the full load to Google/ YouTube and Facebook off your gateway. [0] https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-ssh-sessions-yours-might-be-too/ https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-...
unfocused 5y ago
I just found some of my old posts on my old site from 2003, where I complain about NAT and UPNP. It's nearly 20 years, and the problems have stayed the same :( NAT was the bandaid that became the permanent solution. It was never meant to be permanent, but because of these, so many weird hacks and designs have been made to compensate for it.
raxxorrax 5y ago
> The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet That can also be pretty awesome given that so many devices now may not work in the interest of their users. It is a hassle for IOT, but we have long since then solutions for that and maybe those are better anyway. My provider only supplies IPv6 and you always connect to IPv4 through a transport. That is sometimes down or has too many concurrent users. Makes the net almost unusable still. Perhaps I should learn Hindi.
- ipv6_or_nat 5y ago
  You need a firewall if your end points are publicly reachable, not NAT.
  - raxxorrax 5y ago
    Completely true, I wasn't too serious about that, just pointing out that there were unintended benefits.
  - tekknik 5y ago
    NAT still provides some layer of protection, especially if you don’t trust the firewall software. This is going to open up a can of worms once everybody gets global addresses and can’t figure out how to configure their firewall.
    - ipv6_or_nat 5y ago
      What?! You don’t trust the firewalls software so you are good to trust the NAT software?
      - tekknik 5y ago
        Windows firewall? no. iptables? yes. Why? because I know how to configure one and not the other. Also because of things like this: https://www.enterprisenetworkingplanet.com/security/qa-behind-the-windows-firewall-exploit/ https://www.enterprisenetworkingplanet.com/security/qa-behin...

osrec 5y ago

In your first line, I guess you mean to say ipv4 not ipv6.

ugjka 5y ago

there's also NAT64, 464XLAT that do ipv6 to ipv4 sorcery

throw0101a 5y ago
Beyond an ELI5, but correct. If you are on an IPv4-only or IPv6-only network, you can reach the other through various mechanisms. A lot of mobile/cell networks are IPv6-only, and so the telcos need a way to allow clients to reach IPv4-only systems.

TuringNYC 5y ago

Totally silly question, but isn't the NAT-upon-NAT(-upon-NAT) a bit of protection in the sense of additional privacy, and hence a good thing? Doesn't this mean the website cannot directly tie back an incognito user back to a specific IP but instead to just a pool?

Saris 5y ago
Yes, but you could also randomize your IPv6 address constantly too. Downside of CGNAT and NAT at home is difficulty of getting some services to work, or hosting a server.
- beerandt 5y ago
  It still boils down to everyone gets an identifying number, whether it's an ipv4 address or an ipv6 block. Any randomized ipv6 address from that block is still as "unique" an identifier as an ipv4 address.
- rollcat 5y ago
  Also, creating/using P2P applications. I needed to look up UDP hole punching and now I wish I hadn't.
  - r3muxd 5y ago
    out of curiosity, what did you end up going with? I had to host a UDP game server recently and couldn't find a good solution. If only ngrok supported UDP...
    - tekknik 5y ago
      DMZ it and firewall up the host.
    - rollcat 5y ago
      It was just research. I'm interested in audio&video over IP, I already had a good grip on HLS, RTP, and a few others, and wanted to dive into WebRTC, RTSP, etc. I don't know but all of this feels like there's a simpler solution (like HLS vs DASH) waiting to be discovered.

WanderPanda 5y ago

> NAT-upon-NAT(-upon-NAT) But there is also a fundamental limit of 2^16 = 65536 concurrent connections, right?

2fastpost 5y ago
Yes, from one NAT IP using the same protocol to a single public IP using a particular port. Change any of those and you can do 2^16 concurrent connections more per change. In other words, NAT works on the five-tuple of: protocol, source IP, source port, destination IP and destination port.

swsieber 5y ago

Playing Nintendo Switch online doesn't work if you're double NAT'd unless you go through some router hoops. It seems small, but it's quite aggravating if you're not tech oriented like the majority of the people on this forum.

tsaoutourpants 5y ago

> But we're at the point in some place where there aren't even enough IPv4 addresses to give to ISP customers even if they're using NAT. Er, that's a slight exaggeration. It's not uncommon to have 2,000 or more NAT clients behind a single public IP address. 2K * 4B = 8 trillion possible hosts... about 1,000 hosts per living person.

kaliszad 5y ago
Well, it has limits. You can hide 2000 people behind an address but they might have sporadic connection issues, long held connections such as SSH sessions will be very annoying to support [0] or the users will have to resort to frequent keepalives to make it work regardless, which produces more traffic to destinations you probably don't have in a cache. In some jurisdictions you have to log which customer used what IP (and port) at which point. You can do static assignments but you will have customers (customer homes, e.g. family with perhaps 10 devices or so could be realistic) for which 1000 ports just will not be enough do you will have to dynamically assign spare ports and log those. You might also get more support calls, because the NAT is dropping connections to radically in a peak e.g. a soccer match or whatever. Also the CG-NAT gateway isn't for free and the bigger it needs to be, the pricier it is. Also you might still need to buy some IPv4, perhaps more than you would need to buy if you deployed IPv6 and used it for the connections, where it is possible, taking e.g. almost the full load to Google/ YouTube and Facebook off your gateway. [0] https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-ssh-sessions-yours-might-be-too/ https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-...

unfocused 5y ago

I just found some of my old posts on my old site from 2003, where I complain about NAT and UPNP. It's nearly 20 years, and the problems have stayed the same :( NAT was the bandaid that became the permanent solution. It was never meant to be permanent, but because of these, so many weird hacks and designs have been made to compensate for it.

raxxorrax 5y ago

> The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet That can also be pretty awesome given that so many devices now may not work in the interest of their users. It is a hassle for IOT, but we have long since then solutions for that and maybe those are better anyway. My provider only supplies IPv6 and you always connect to IPv4 through a transport. That is sometimes down or has too many concurrent users. Makes the net almost unusable still. Perhaps I should learn Hindi.

ipv6_or_nat 5y ago
You need a firewall if your end points are publicly reachable, not NAT.
- raxxorrax 5y ago
  Completely true, I wasn't too serious about that, just pointing out that there were unintended benefits.
- tekknik 5y ago
  NAT still provides some layer of protection, especially if you don’t trust the firewall software. This is going to open up a can of worms once everybody gets global addresses and can’t figure out how to configure their firewall.
  - ipv6_or_nat 5y ago
    What?! You don’t trust the firewalls software so you are good to trust the NAT software?
    - tekknik 5y ago
      Windows firewall? no. iptables? yes. Why? because I know how to configure one and not the other. Also because of things like this: https://www.enterprisenetworkingplanet.com/security/qa-behind-the-windows-firewall-exploit/ https://www.enterprisenetworkingplanet.com/security/qa-behin...