4 ms·

You can, but the point is that you shouldn't have to because there are enough addresses. NAT only makes networking code for applications harder.

warkdarrior 5y ago
NAT complexity is only marginally more than for a stateful firewall, and is probably lower than for an application firewall. And you still want a stateful firewall in IPv6 networks!
- ArchOversight 5y ago
  Not needing to do address translation is a large amount of code that you don't need to run to keep IP traffic flowing. Sure, you absolutely need a stateful firewall, but not needing address translation makes it easier to troubleshoot, makes it easier to establish end to end connectivity and no need to port forward or things of that nature so multiple clients can all use the same port.
- throw0101a 5y ago
  With NAT you may need STUN, TURN, ICE, and probably a few more acronyms: * https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN * https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_... * https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab... Not sure if that's more or less complicated than already knowing your IP address and 'just' using UPnP/PCP: * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol
benttoothpaste 5y ago
But NAT can protect your internal addresses. If your ISP changes your IPv6 address/prefix, all devices in your network will change their addresses too. This is pain in the ass that can be alleviated by NAT.
- lokedhs 5y ago
  You can use link-local addresses for that. There addresses are only available inside the local network and are never routed. When you use IPv6 your interfaces have multiple addresses, at least one external and one link-local.

warkdarrior 5y ago

NAT complexity is only marginally more than for a stateful firewall, and is probably lower than for an application firewall. And you still want a stateful firewall in IPv6 networks!

ArchOversight 5y ago
Not needing to do address translation is a large amount of code that you don't need to run to keep IP traffic flowing. Sure, you absolutely need a stateful firewall, but not needing address translation makes it easier to troubleshoot, makes it easier to establish end to end connectivity and no need to port forward or things of that nature so multiple clients can all use the same port.
throw0101a 5y ago
With NAT you may need STUN, TURN, ICE, and probably a few more acronyms: * https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN * https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_... * https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab... Not sure if that's more or less complicated than already knowing your IP address and 'just' using UPnP/PCP: * http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol

benttoothpaste 5y ago

But NAT can protect your internal addresses. If your ISP changes your IPv6 address/prefix, all devices in your network will change their addresses too. This is pain in the ass that can be alleviated by NAT.

lokedhs 5y ago
You can use link-local addresses for that. There addresses are only available inside the local network and are never routed. When you use IPv6 your interfaces have multiple addresses, at least one external and one link-local.