4 ms·

Why can you not have NAT when running the network on IPv6? I've never seen anyone explain this

hvgk 5y ago
NAT is a workaround for the small amount of address space that was allocated originally. That's not the case on IPv6. I'm sure you can NAT stuff but why the hell would you want to do that and have to maintain all the stateful pain in the ass stuff required such as NAT tables which are going to be much larger.
- awestroke 5y ago
  To prevent the machines in the network from being exposed publicly
  - nybble41 5y ago
    If you have machines in the network which you don't trust to handle their own incoming connections securely you can block those connections at the firewall, without port or address translation. Ideally you'd put those on hosts on their own locked-down VLAN. NAT (or NAPT) doesn't add any security (see: NAT traversal) and having different internal vs. external addresses significantly increases the complexity of the system—not just the router but applications as well, which are forced to deal with their public addresses and ports differing from the ones they were assigned.
    - awestroke 5y ago
      I'd rather blacklist devices that I believe are somehow secure than blacklist devices that I think are insecure. How would you even keep on top of that in a large company network? Better to just default to hiding all devices behind the NAT
  - hvgk 5y ago
    That’s what firewalls are for.
makeworld 5y ago
You can, but the point is that you shouldn't have to because there are enough addresses. NAT only makes networking code for applications harder.
- warkdarrior 5y ago
  NAT complexity is only marginally more than for a stateful firewall, and is probably lower than for an application firewall. And you still want a stateful firewall in IPv6 networks!
  - ArchOversight 5y ago
    Not needing to do address translation is a large amount of code that you don't need to run to keep IP traffic flowing. Sure, you absolutely need a stateful firewall, but not needing address translation makes it easier to troubleshoot, makes it easier to establish end to end connectivity and no need to port forward or things of that nature so multiple clients can all use the same port.
  - throw0101a 5y ago
    With NAT you may need STUN, TURN, ICE, and probably a few more acronyms: * https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN * https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_... * https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab... Not sure if that's more or less complicated than already knowing your IP address and 'just' using UPnP/PCP: * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol
- benttoothpaste 5y ago
  But NAT can protect your internal addresses. If your ISP changes your IPv6 address/prefix, all devices in your network will change their addresses too. This is pain in the ass that can be alleviated by NAT.
edgyquant 5y ago
The whole point of a NAT is negated by a switch to IPv6
- x3n0ph3n3 5y ago
  No it's not -- maybe I'd prefer not to advertise how many devices I have on my network.
  - edgyquant 5y ago
    Wouldn’t that be the purpose of a router, not NAT? The two are often bundled together but they aren’t necessarily inclusive
  - lokedhs 5y ago
    IPv6 address randomisation fixes that, and it's enabled by default on most IPv6 stacks.
soneil 5y ago
You can. I've seen sites use it because they didn't have an allocation of their own, but they didn't want to rely on their ISP's numbering either. So they used 1:1 NAT between their carrier's space and their ULA space. Like renting a /8 and mapping it to 10/8. Except in v6land it's nowhere near as crazy as it sounds. NAT isn't required in v6, it's not wanted in v6, but it's perfectly possible. If you think about it, PAT/NAT (port-based NAT) doesn't happen at the IP stack, it happens at the port level.

hvgk 5y ago

NAT is a workaround for the small amount of address space that was allocated originally. That's not the case on IPv6. I'm sure you can NAT stuff but why the hell would you want to do that and have to maintain all the stateful pain in the ass stuff required such as NAT tables which are going to be much larger.

awestroke 5y ago
To prevent the machines in the network from being exposed publicly
- nybble41 5y ago
  If you have machines in the network which you don't trust to handle their own incoming connections securely you can block those connections at the firewall, without port or address translation. Ideally you'd put those on hosts on their own locked-down VLAN. NAT (or NAPT) doesn't add any security (see: NAT traversal) and having different internal vs. external addresses significantly increases the complexity of the system—not just the router but applications as well, which are forced to deal with their public addresses and ports differing from the ones they were assigned.
  - awestroke 5y ago
    I'd rather blacklist devices that I believe are somehow secure than blacklist devices that I think are insecure. How would you even keep on top of that in a large company network? Better to just default to hiding all devices behind the NAT
- hvgk 5y ago
  That’s what firewalls are for.

makeworld 5y ago

You can, but the point is that you shouldn't have to because there are enough addresses. NAT only makes networking code for applications harder.

warkdarrior 5y ago
NAT complexity is only marginally more than for a stateful firewall, and is probably lower than for an application firewall. And you still want a stateful firewall in IPv6 networks!
- ArchOversight 5y ago
  Not needing to do address translation is a large amount of code that you don't need to run to keep IP traffic flowing. Sure, you absolutely need a stateful firewall, but not needing address translation makes it easier to troubleshoot, makes it easier to establish end to end connectivity and no need to port forward or things of that nature so multiple clients can all use the same port.
- throw0101a 5y ago
  With NAT you may need STUN, TURN, ICE, and probably a few more acronyms: * https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN * https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_... * https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab... Not sure if that's more or less complicated than already knowing your IP address and 'just' using UPnP/PCP: * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol
benttoothpaste 5y ago
But NAT can protect your internal addresses. If your ISP changes your IPv6 address/prefix, all devices in your network will change their addresses too. This is pain in the ass that can be alleviated by NAT.

edgyquant 5y ago

The whole point of a NAT is negated by a switch to IPv6

x3n0ph3n3 5y ago
No it's not -- maybe I'd prefer not to advertise how many devices I have on my network.
- edgyquant 5y ago
  Wouldn’t that be the purpose of a router, not NAT? The two are often bundled together but they aren’t necessarily inclusive
- lokedhs 5y ago
  IPv6 address randomisation fixes that, and it's enabled by default on most IPv6 stacks.

soneil 5y ago

You can. I've seen sites use it because they didn't have an allocation of their own, but they didn't want to rely on their ISP's numbering either. So they used 1:1 NAT between their carrier's space and their ULA space. Like renting a /8 and mapping it to 10/8. Except in v6land it's nowhere near as crazy as it sounds. NAT isn't required in v6, it's not wanted in v6, but it's perfectly possible. If you think about it, PAT/NAT (port-based NAT) doesn't happen at the IP stack, it happens at the port level.