8 ms·

> I don't want to lose the security provided by NAT This grinds my gears so much. I hate everything about NAT. It is a pain to deploy, pain to debug, pain to c

> I don't want to lose the security provided by NAT This grinds my gears so much. I hate everything about NAT. It is a pain to deploy, pain to debug, pain to code, pain to think about, pain to workaround in other protocols. Just the elimination of NAT is enough benefit to use IPv6 over IPv4.

otabdeveloper4 5y ago
Most people love the NAT. There's no sense in pissing against the wind here and telling people they're idiots and shouldn't like what they like. (If we ever get to an IPv6 future, there will certainly be a NAT in it. Except this time more convoluted and hacky and brittle than it ever was back in the IPv4 days.)
- perryizgr8 5y ago
  > telling people they're idiots I never said that. > If we ever get to an IPv6 future, there will certainly be a NAT in it. That will indeed be a very sad day for mankind.
  - georgyo 5y ago
    That day has already passed: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/security-ipv6-nat.html#id-ipv6-nat-overview__d14963e63 https://www.juniper.net/documentation/us/en/software/junos/n... I'm used to be with you, but some things are only possible will NAT.
    - tuyiown 5y ago
      > I'm used to be with you, but some things are only possible will NAT. On ipv6 besides hiding (most common setup) a randomly assigned /64 ip address behind another /64 address I really don't see what any stateful firewall can't achieve
- stevefan1999 5y ago
  What? NAT hinders the deployment of P2P applications, how was that not a bane of NAT to get rid if it already?
  - endymi0n 5y ago
    Depending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a bug or a feature.
    - georgyo 5y ago
      There are many good reasons for IPv6 nat. Security is not one of them at all. There is no security gained from IPv6 nat, in fact some may even be lost. I think this page has a bunch of good examples on when IPv6 nat is useful: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 For why NAT doesn't actually add to security this is a decent article: https://www.internetsociety.org/blog/2015/01/ipv6-security-myth-3-no-ipv6-nat-means-less-security/ https://www.internetsociety.org/blog/2015/01/ipv6-security-m...
    - perryizgr8 5y ago
      > someone trying to defend a corporate network against them If nat is part of your security strategy, you need a new security strategy.
      - jve 5y ago
        Why? I mean, security is always defence-in-depth thing, a think that consists of multiple layers, etc. If you would have left out the "part of" words, then yeah, implying that NAT is the only defense, that strategy must be thrown out of the window. By the way, ~20 years ago, when ISP just gave public IP and that was directly hooked to PC... yeah, got bitten by some random script on internet that just deleted my files via SMB thanks to how insecure windows configuration was. Was grateful when router was my defense :) Not that something important was there for a kid, but credit goes to... NAT. I think that may have been the time when I learned something about open shares.
HWR_14 5y ago
NAT helps obfuscate how many devices are on my home network. I don't look forward to the day my ISP starts wanting to charge me per computer/phone/tablet I have.
- perryizgr8 5y ago
  They will probably give you an entire /64 subnet. You can use 2^64 devices. It will be fine :)
  - paranoidrobot 5y ago
    I suspect they're referring more to a policy thing. For instance carriers that forced phone makers to allow them to switch off using your phone as a Hotspot, unless you pay your carrier more.
  - deknos 5y ago
    you say this with the assumption that your devices will all implement a good ipv6 strategy and not suck. generally the ipv6 support in endpoint/iot devices really sucks.
- dsr_ 5y ago
  IPv6 offers randomly assigned addresses from the nice large subnet that you should have been given -- a /64 is 2^64 addresses, comfortably insanely larger than the entire IPv4 internet. Your ISP can look at how many addresses you sent traffic from in a particular time period, but that's not indicative of how many machines or NICs you have.
  - rhn_mk1 5y ago
    That would have been true if parcelling out a /64 was actually easy or common. In practice, it's designed that one /64 is one device, and it's really hard to split up that subnet, with SLAAC outright making it impossible. It's possible with some static configuration, but that's not something an average Joe is going to use, and router software I came across usually considers it an unsupported option. EDIT: disregard that, the /64 is actually the smallest subnet. It does hinder subnetting fun, but not allocation to devices. I'll leave the invalid post for the sake of transparency.
magicalhippo 5y ago
IPv6 isn't better in my experience. The software out there is frequently very immature and does not support typical use-cases. It's also so many new moving parts, so I find it very difficult to translate my IPv4 experience, making it a pain to work with. Every time something breaks on my network it's IPv6 related, and every time I have to go digging in RFC's and whatnot to figure out what to do. The main pain points with IPv4+NAT are still pain points with IPv6, namely dynamically open ports in the firewall. I'm sure IPv6 will be in a better place in 10-20 years time, and I'm sure a lot of my annoyance with it is due to my inexperience. One day...

otabdeveloper4 5y ago

Most people love the NAT. There's no sense in pissing against the wind here and telling people they're idiots and shouldn't like what they like. (If we ever get to an IPv6 future, there will certainly be a NAT in it. Except this time more convoluted and hacky and brittle than it ever was back in the IPv4 days.)

perryizgr8 5y ago
> telling people they're idiots I never said that. > If we ever get to an IPv6 future, there will certainly be a NAT in it. That will indeed be a very sad day for mankind.
- georgyo 5y ago
  That day has already passed: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/security-ipv6-nat.html#id-ipv6-nat-overview__d14963e63 https://www.juniper.net/documentation/us/en/software/junos/n... I'm used to be with you, but some things are only possible will NAT.
  - tuyiown 5y ago
    > I'm used to be with you, but some things are only possible will NAT. On ipv6 besides hiding (most common setup) a randomly assigned /64 ip address behind another /64 address I really don't see what any stateful firewall can't achieve
stevefan1999 5y ago
What? NAT hinders the deployment of P2P applications, how was that not a bane of NAT to get rid if it already?
- endymi0n 5y ago
  Depending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a bug or a feature.
  - georgyo 5y ago
    There are many good reasons for IPv6 nat. Security is not one of them at all. There is no security gained from IPv6 nat, in fact some may even be lost. I think this page has a bunch of good examples on when IPv6 nat is useful: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 For why NAT doesn't actually add to security this is a decent article: https://www.internetsociety.org/blog/2015/01/ipv6-security-myth-3-no-ipv6-nat-means-less-security/ https://www.internetsociety.org/blog/2015/01/ipv6-security-m...
  - perryizgr8 5y ago
    > someone trying to defend a corporate network against them If nat is part of your security strategy, you need a new security strategy.
    - jve 5y ago
      Why? I mean, security is always defence-in-depth thing, a think that consists of multiple layers, etc. If you would have left out the "part of" words, then yeah, implying that NAT is the only defense, that strategy must be thrown out of the window. By the way, ~20 years ago, when ISP just gave public IP and that was directly hooked to PC... yeah, got bitten by some random script on internet that just deleted my files via SMB thanks to how insecure windows configuration was. Was grateful when router was my defense :) Not that something important was there for a kid, but credit goes to... NAT. I think that may have been the time when I learned something about open shares.

HWR_14 5y ago

NAT helps obfuscate how many devices are on my home network. I don't look forward to the day my ISP starts wanting to charge me per computer/phone/tablet I have.

perryizgr8 5y ago
They will probably give you an entire /64 subnet. You can use 2^64 devices. It will be fine :)
- paranoidrobot 5y ago
  I suspect they're referring more to a policy thing. For instance carriers that forced phone makers to allow them to switch off using your phone as a Hotspot, unless you pay your carrier more.
- deknos 5y ago
  you say this with the assumption that your devices will all implement a good ipv6 strategy and not suck. generally the ipv6 support in endpoint/iot devices really sucks.
dsr_ 5y ago
IPv6 offers randomly assigned addresses from the nice large subnet that you should have been given -- a /64 is 2^64 addresses, comfortably insanely larger than the entire IPv4 internet. Your ISP can look at how many addresses you sent traffic from in a particular time period, but that's not indicative of how many machines or NICs you have.
- rhn_mk1 5y ago
  That would have been true if parcelling out a /64 was actually easy or common. In practice, it's designed that one /64 is one device, and it's really hard to split up that subnet, with SLAAC outright making it impossible. It's possible with some static configuration, but that's not something an average Joe is going to use, and router software I came across usually considers it an unsupported option. EDIT: disregard that, the /64 is actually the smallest subnet. It does hinder subnetting fun, but not allocation to devices. I'll leave the invalid post for the sake of transparency.

magicalhippo 5y ago

IPv6 isn't better in my experience. The software out there is frequently very immature and does not support typical use-cases. It's also so many new moving parts, so I find it very difficult to translate my IPv4 experience, making it a pain to work with. Every time something breaks on my network it's IPv6 related, and every time I have to go digging in RFC's and whatnot to figure out what to do. The main pain points with IPv4+NAT are still pain points with IPv6, namely dynamically open ports in the firewall. I'm sure IPv6 will be in a better place in 10-20 years time, and I'm sure a lot of my annoyance with it is due to my inexperience. One day...