4 ms·

> What problems would occur if we were just nat-ing everyone behind those 4 billion IPv4 addresses? Even with NAT'ing we're running out of IPv4 addresses. Now

> What problems would occur if we were just nat-ing everyone behind those 4 billion IPv4 addresses? Even with NAT'ing we're running out of IPv4 addresses. Now I NAT on IPv4 at home, even though my router/ISP supports IPv6. First thing I do on any Linux install at home is get rid of IPv6. I don't see where the problem is. I really don't see why my home machines should have an IPv6 IP: the outside world sees my router's IP and that's it. Now I'm certainly misunderstanding all the benefits and security that IPv6 would bring me at home but meanwhile I'll stay on IPv4 and I really don't see what the problem is either.

tadfisher 5y ago
Not a networking expert by any means, but having built out a home network, my understanding is as follows: Benefits-wise, your devices are addressable on the Internet, so it becomes simpler to create peer-to-peer connections, firewall traffic, and create segregated subnets. Security-wise, your devices are addressable on the Internet, so all the workarounds to punch through NAT with terrible security implications aren't needed (I'm thinking UPnP mostly, but STUN/TURN/ICE are easy to get wrong). Essentially, under IPv4+NAT, your devices are already "addressable" via a combination of your router's IP and some form of session token, but securing such traffic depends on the successful implementation of a NAT-traversal protocol by a third party.
- throw0101a 5y ago
  > Security-wise, your devices are addressable on the Internet Nope. By default home routers (e.g., Asus) will block incoming connections just like with IPv4. It may allow pings (ICMP) in, but that's usually it. You have to manually go in and tell the router to allow new connections in (either generally, or per service/port), just like the "DMZ" functionality with IPv4 many routers have.
  - spookthesunset 5y ago
    And to open up those incoming connections on IPv6, we'll invent some other variant of UPnP so users don't have to manually go punch holes into their firewall to allow peer to peer connections. IPv6 doesn't solve the problem of everything in the internal network being unable to accept incoming connections. With a NAT you need to set up port forwarding. With IPv6 you need to punch a hole into your firewall. Either way, home users will not be doing it by hand... we'll invent some protocol to do it and that protocol will have security issues.
    - viraptor 5y ago
      > we'll invent some other variant of UPnP We don't have to. UPnP works just fine with ipv6 already. (upnp v1.1, appendix A)
    - throw0101a 5y ago
      "UPnP Device Architecture V1.0 Annex A – IP Version 6 Support": * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf
  - lokedhs 5y ago
    > It may allow pings (ICMP) in, but that's usually it. I sure hope it does. Blocking ICMP can cause TCP connections to hang due to inability to do MTU size detection. With IPv4 this is usually not as visible, but with IPv6 if you block ICMP your connections will block as soon as you try to transfer a large block of data.
p1mrx 5y ago
> the outside world sees my router's IP and that's it. At some point, that will go away due to CGNAT. A lot of people have to share their public IPv4 address these days, which means no inbound port forwarding, and potentially getting banned from services if their "neighbors" misbehave. On the other hand, CGNAT does improve privacy to some extent.
lmm 5y ago
If it's working for you then great. NAT adds latency, makes the router more complex, and breaks peer-to-peer stuff (e.g. there's a game I like to play where you can have games on a LAN or over the internet, but what you can't do is have a game between two people who are behind a single IP address and other people on the internet, which became a problem when two of my friends moved in together); even in systems that have workarounds for NAT those workarounds generally add latency (e.g. your video chats might have to be routed through a central server rather than directly to friends). As IPv4 addresses become more scarce, you'll probably get put behind CGNAT (or have to pay extra to avoid it) which again adds more latency and cost. But sure the reality is that using IPv4 from behind NAT is tolerable for most people, so there's not a huge impetus to migrate.

tadfisher 5y ago

Not a networking expert by any means, but having built out a home network, my understanding is as follows: Benefits-wise, your devices are addressable on the Internet, so it becomes simpler to create peer-to-peer connections, firewall traffic, and create segregated subnets. Security-wise, your devices are addressable on the Internet, so all the workarounds to punch through NAT with terrible security implications aren't needed (I'm thinking UPnP mostly, but STUN/TURN/ICE are easy to get wrong). Essentially, under IPv4+NAT, your devices are already "addressable" via a combination of your router's IP and some form of session token, but securing such traffic depends on the successful implementation of a NAT-traversal protocol by a third party.

throw0101a 5y ago
> Security-wise, your devices are addressable on the Internet Nope. By default home routers (e.g., Asus) will block incoming connections just like with IPv4. It may allow pings (ICMP) in, but that's usually it. You have to manually go in and tell the router to allow new connections in (either generally, or per service/port), just like the "DMZ" functionality with IPv4 many routers have.
- spookthesunset 5y ago
  And to open up those incoming connections on IPv6, we'll invent some other variant of UPnP so users don't have to manually go punch holes into their firewall to allow peer to peer connections. IPv6 doesn't solve the problem of everything in the internal network being unable to accept incoming connections. With a NAT you need to set up port forwarding. With IPv6 you need to punch a hole into your firewall. Either way, home users will not be doing it by hand... we'll invent some protocol to do it and that protocol will have security issues.
  - viraptor 5y ago
    > we'll invent some other variant of UPnP We don't have to. UPnP works just fine with ipv6 already. (upnp v1.1, appendix A)
  - throw0101a 5y ago
    "UPnP Device Architecture V1.0 Annex A – IP Version 6 Support": * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf
- lokedhs 5y ago
  > It may allow pings (ICMP) in, but that's usually it. I sure hope it does. Blocking ICMP can cause TCP connections to hang due to inability to do MTU size detection. With IPv4 this is usually not as visible, but with IPv6 if you block ICMP your connections will block as soon as you try to transfer a large block of data.

p1mrx 5y ago

> the outside world sees my router's IP and that's it. At some point, that will go away due to CGNAT. A lot of people have to share their public IPv4 address these days, which means no inbound port forwarding, and potentially getting banned from services if their "neighbors" misbehave. On the other hand, CGNAT does improve privacy to some extent.

lmm 5y ago

If it's working for you then great. NAT adds latency, makes the router more complex, and breaks peer-to-peer stuff (e.g. there's a game I like to play where you can have games on a LAN or over the internet, but what you can't do is have a game between two people who are behind a single IP address and other people on the internet, which became a problem when two of my friends moved in together); even in systems that have workarounds for NAT those workarounds generally add latency (e.g. your video chats might have to be routed through a central server rather than directly to friends). As IPv4 addresses become more scarce, you'll probably get put behind CGNAT (or have to pay extra to avoid it) which again adds more latency and cost. But sure the reality is that using IPv4 from behind NAT is tolerable for most people, so there's not a huge impetus to migrate.