5 ms·

Peer-to-Peer NAT64 Network

104 points by Sami_Lehtinen 5y ago

jagger27 5y ago
I’m confused. Can I use this in an IPv4-only environment (i.e. my Stone Age ISP)?
- Aloha 5y ago
  It appears you can. https://p2p.nat64.dk/help https://p2p.nat64.dk/help
  - jagger27 5y ago
    Yes I read that and that’s why I’m confused. > In order to run an IPv4 peer you need access to IPv4 which can be through one or more layers of NAT. Before installing the software you should ask your network provider for a routed IPv6 prefix. If the provider gives you a functional /60 or shorter prefix free of charge I recommend that you make good use of that and do not install the IPv4 peer. If my ISP gave me a functional IPv6 prefix I wouldn’t be bothering with this.
    - dundarious 5y ago
      That's what that text is saying. If you have v6, just use it (and maybe run a v6 peer instead). If you _don't_ have a usable v6 prefix, then continue with the instructions.
      - jagger27 5y ago
        Ok.
- wmf 5y ago
  No, this is a workaround for people who don't have IPv4. If you have IPv4 you don't need this. It's for people on broken IPv6-only networks (i.e. basically nobody).
  - DarylZero 5y ago
    Huh? Almost all people have "broken" IPv6-only networks -- their computers don't have IPv4 addresses and must use NAT to access remote IPv4 nodes. The only routable IP address on a typical home computer is IPv6.
    - mindslight 5y ago
      Even in your paradigm, NAT is a mitigation for a security deficiency of IPv4 (servers get too much visibility into client identity). Rather than relying on each node to implement "privacy extensions" on its own, I think it makes sense to keep up v6 NAT for outgoing connections. For example, distribute every outgoing connection from a network to be uniform over the full address space + port. (There may be even better strategies, like emulating a certain number of discrete devices. But you get my point)
      - DarylZero 5y ago
        NAT isn't a security feature. It's forced on users when their ISP only allocates one IPv4 address per site.
        mindslight 5y ago
        NAT has been forced on users. But NAT is also a security feature. I'm not talking about the implicit stateful firewall that could just as well be explicitly deployed for a whole subnet. Rather I'm talking about hiding as much information as possible about devices on your network. If you have a /28 with an IP for each computer on your network, then surveillance companies can build separate profiles on your desktop, your laptop, your wife's laptop, your kid's laptop, etc. When they're all behind a single IP, then they lose those bits of information. Higher level protocols can leak much more information, but it's better to address the problem at every level rather than giving up.
        DarylZero 5y ago
        That's a rather useless form of "security." It's not even going to be effective in preventing the machines running web browsers from being distinguishable, if that's a real concern.
- cmeacham98 5y ago
  You can help the network by running an ipv4-only node. The people that benefit from this help are people on ipv6-only networks.
jordemort 5y ago
I appreciate the spirit in which this is offered but I'm pessimistic about the outcomes of any service that has people relaying strangers' traffic for them. It will be difficult to prevent this from being abused; I bet there's at least 5 different people working on abusing it since it was posted here.
- progval 5y ago
  It is addressed here: https://p2p.nat64.dk/v6peer https://p2p.nat64.dk/v6peer but I find it very unconvincing. While the arguments are technically correct, operators of Tor exit nodes know from experience this does not prevent their homes being raided.
  - DarylZero 5y ago
    Tor is a little difference, since the actual client is unknown to the exit node. v6peer isn't anonymous. The lack of anonymity should discourage abuse, though obviously, not prevent it completely.
    - deleted 5y ago
      [deleted]
blahgeek 5y ago
I think it’s a great idea from what I can see in https://p2p.nat64.dk/help https://p2p.nat64.dk/help But how is it possible to achieve this by simply changing the name server? How does this work?
- progval 5y ago
  They spoof the DNS to make you access a server they control (what they call a v6peer), that relays to another one (called a v4peer), that communicates with the v4 Internet. You can try it with github, for example (the real github.com does not support ipv6): $ dig @2a01:4f8:c2c:123f:69::1 +short github.com aaaa 2001:0:2e2b:288::8c52:7904 2a01:4f8:c2c:123f:69:0:8c52:7904 2a01:4f9:c010:3f02:69:0:8c52:7904 I'm guessing this doesn't work with DNSSEC, though. (EDIT: when first sending this comment I was confused because I tried it on a domain with AAAA records, which aren't spoofed)
floatboth 5y ago
Ooh. So now I can launch an ec2 instance without ipv4 and just use this to reach github from it? Awesome. Hopefully abuse won't ruin it instantly lol :/
- zokier 5y ago
  Well, you could also just use AWS' own NAT Gateway which also has NAT64 support. Admittedly natgw is not free service ($33/month+data charges)
deknos 5y ago
i am interested how this is set up. could you please do a git/docker/vm-setup so it's selfhostable? :D

104 points by Sami_Lehtinen 5y ago

jagger27 5y ago

I’m confused. Can I use this in an IPv4-only environment (i.e. my Stone Age ISP)?

Aloha 5y ago
It appears you can. https://p2p.nat64.dk/help https://p2p.nat64.dk/help
- jagger27 5y ago
  Yes I read that and that’s why I’m confused. > In order to run an IPv4 peer you need access to IPv4 which can be through one or more layers of NAT. Before installing the software you should ask your network provider for a routed IPv6 prefix. If the provider gives you a functional /60 or shorter prefix free of charge I recommend that you make good use of that and do not install the IPv4 peer. If my ISP gave me a functional IPv6 prefix I wouldn’t be bothering with this.
  - dundarious 5y ago
    That's what that text is saying. If you have v6, just use it (and maybe run a v6 peer instead). If you _don't_ have a usable v6 prefix, then continue with the instructions.
    - jagger27 5y ago
      Ok.
wmf 5y ago
No, this is a workaround for people who don't have IPv4. If you have IPv4 you don't need this. It's for people on broken IPv6-only networks (i.e. basically nobody).
- DarylZero 5y ago
  Huh? Almost all people have "broken" IPv6-only networks -- their computers don't have IPv4 addresses and must use NAT to access remote IPv4 nodes. The only routable IP address on a typical home computer is IPv6.
  - mindslight 5y ago
    Even in your paradigm, NAT is a mitigation for a security deficiency of IPv4 (servers get too much visibility into client identity). Rather than relying on each node to implement "privacy extensions" on its own, I think it makes sense to keep up v6 NAT for outgoing connections. For example, distribute every outgoing connection from a network to be uniform over the full address space + port. (There may be even better strategies, like emulating a certain number of discrete devices. But you get my point)
    - DarylZero 5y ago
      NAT isn't a security feature. It's forced on users when their ISP only allocates one IPv4 address per site.
      - mindslight 5y ago
        NAT has been forced on users. But NAT is also a security feature. I'm not talking about the implicit stateful firewall that could just as well be explicitly deployed for a whole subnet. Rather I'm talking about hiding as much information as possible about devices on your network. If you have a /28 with an IP for each computer on your network, then surveillance companies can build separate profiles on your desktop, your laptop, your wife's laptop, your kid's laptop, etc. When they're all behind a single IP, then they lose those bits of information. Higher level protocols can leak much more information, but it's better to address the problem at every level rather than giving up.
        DarylZero 5y ago
        That's a rather useless form of "security." It's not even going to be effective in preventing the machines running web browsers from being distinguishable, if that's a real concern.
cmeacham98 5y ago
You can help the network by running an ipv4-only node. The people that benefit from this help are people on ipv6-only networks.

jordemort 5y ago

I appreciate the spirit in which this is offered but I'm pessimistic about the outcomes of any service that has people relaying strangers' traffic for them. It will be difficult to prevent this from being abused; I bet there's at least 5 different people working on abusing it since it was posted here.

progval 5y ago
It is addressed here: https://p2p.nat64.dk/v6peer https://p2p.nat64.dk/v6peer but I find it very unconvincing. While the arguments are technically correct, operators of Tor exit nodes know from experience this does not prevent their homes being raided.
- DarylZero 5y ago
  Tor is a little difference, since the actual client is unknown to the exit node. v6peer isn't anonymous. The lack of anonymity should discourage abuse, though obviously, not prevent it completely.
  - deleted 5y ago
    [deleted]

blahgeek 5y ago

I think it’s a great idea from what I can see in https://p2p.nat64.dk/help https://p2p.nat64.dk/help But how is it possible to achieve this by simply changing the name server? How does this work?

progval 5y ago
They spoof the DNS to make you access a server they control (what they call a v6peer), that relays to another one (called a v4peer), that communicates with the v4 Internet. You can try it with github, for example (the real github.com does not support ipv6): $ dig @2a01:4f8:c2c:123f:69::1 +short github.com aaaa 2001:0:2e2b:288::8c52:7904 2a01:4f8:c2c:123f:69:0:8c52:7904 2a01:4f9:c010:3f02:69:0:8c52:7904 I'm guessing this doesn't work with DNSSEC, though. (EDIT: when first sending this comment I was confused because I tried it on a domain with AAAA records, which aren't spoofed)

floatboth 5y ago

Ooh. So now I can launch an ec2 instance without ipv4 and just use this to reach github from it? Awesome. Hopefully abuse won't ruin it instantly lol :/

zokier 5y ago
Well, you could also just use AWS' own NAT Gateway which also has NAT64 support. Admittedly natgw is not free service ($33/month+data charges)

deknos 5y ago

i am interested how this is set up. could you please do a git/docker/vm-setup so it's selfhostable? :D