11 ms·

Most people love the NAT. There's no sense in pissing against the wind here and telling people they're idiots and shouldn't like what they like. (If we ever ge

Most people love the NAT. There's no sense in pissing against the wind here and telling people they're idiots and shouldn't like what they like. (If we ever get to an IPv6 future, there will certainly be a NAT in it. Except this time more convoluted and hacky and brittle than it ever was back in the IPv4 days.)

perryizgr8 5y ago
> telling people they're idiots I never said that. > If we ever get to an IPv6 future, there will certainly be a NAT in it. That will indeed be a very sad day for mankind.
- georgyo 5y ago
  That day has already passed: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/security-ipv6-nat.html#id-ipv6-nat-overview__d14963e63 https://www.juniper.net/documentation/us/en/software/junos/n... I'm used to be with you, but some things are only possible will NAT.
  - tuyiown 5y ago
    > I'm used to be with you, but some things are only possible will NAT. On ipv6 besides hiding (most common setup) a randomly assigned /64 ip address behind another /64 address I really don't see what any stateful firewall can't achieve
stevefan1999 5y ago
What? NAT hinders the deployment of P2P applications, how was that not a bane of NAT to get rid if it already?
- endymi0n 5y ago
  Depending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a bug or a feature.
  - georgyo 5y ago
    There are many good reasons for IPv6 nat. Security is not one of them at all. There is no security gained from IPv6 nat, in fact some may even be lost. I think this page has a bunch of good examples on when IPv6 nat is useful: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 For why NAT doesn't actually add to security this is a decent article: https://www.internetsociety.org/blog/2015/01/ipv6-security-myth-3-no-ipv6-nat-means-less-security/ https://www.internetsociety.org/blog/2015/01/ipv6-security-m...
  - perryizgr8 5y ago
    > someone trying to defend a corporate network against them If nat is part of your security strategy, you need a new security strategy.
    - jve 5y ago
      Why? I mean, security is always defence-in-depth thing, a think that consists of multiple layers, etc. If you would have left out the "part of" words, then yeah, implying that NAT is the only defense, that strategy must be thrown out of the window. By the way, ~20 years ago, when ISP just gave public IP and that was directly hooked to PC... yeah, got bitten by some random script on internet that just deleted my files via SMB thanks to how insecure windows configuration was. Was grateful when router was my defense :) Not that something important was there for a kid, but credit goes to... NAT. I think that may have been the time when I learned something about open shares.
      - kuschku 5y ago
        NAT is not a defense in ANY way. Your router’s stateful firewall, that’s what saved you. But that’s separate and continues working with IPv6

perryizgr8 5y ago

> telling people they're idiots I never said that. > If we ever get to an IPv6 future, there will certainly be a NAT in it. That will indeed be a very sad day for mankind.

georgyo 5y ago
That day has already passed: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/security-ipv6-nat.html#id-ipv6-nat-overview__d14963e63 https://www.juniper.net/documentation/us/en/software/junos/n... I'm used to be with you, but some things are only possible will NAT.
- tuyiown 5y ago
  > I'm used to be with you, but some things are only possible will NAT. On ipv6 besides hiding (most common setup) a randomly assigned /64 ip address behind another /64 address I really don't see what any stateful firewall can't achieve

stevefan1999 5y ago

What? NAT hinders the deployment of P2P applications, how was that not a bane of NAT to get rid if it already?

endymi0n 5y ago
Depending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a bug or a feature.
- georgyo 5y ago
  There are many good reasons for IPv6 nat. Security is not one of them at all. There is no security gained from IPv6 nat, in fact some may even be lost. I think this page has a bunch of good examples on when IPv6 nat is useful: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 For why NAT doesn't actually add to security this is a decent article: https://www.internetsociety.org/blog/2015/01/ipv6-security-myth-3-no-ipv6-nat-means-less-security/ https://www.internetsociety.org/blog/2015/01/ipv6-security-m...
- perryizgr8 5y ago
  > someone trying to defend a corporate network against them If nat is part of your security strategy, you need a new security strategy.
  - jve 5y ago
    Why? I mean, security is always defence-in-depth thing, a think that consists of multiple layers, etc. If you would have left out the "part of" words, then yeah, implying that NAT is the only defense, that strategy must be thrown out of the window. By the way, ~20 years ago, when ISP just gave public IP and that was directly hooked to PC... yeah, got bitten by some random script on internet that just deleted my files via SMB thanks to how insecure windows configuration was. Was grateful when router was my defense :) Not that something important was there for a kid, but credit goes to... NAT. I think that may have been the time when I learned something about open shares.
    - kuschku 5y ago
      NAT is not a defense in ANY way. Your router’s stateful firewall, that’s what saved you. But that’s separate and continues working with IPv6