6 ms·

I'd be interested to hear some of these legitimate use cases for IPv6 NAT.

by kenny_r 15y ago

KonradKlause 15y ago
Topology hiding. No, please don't tell me about socks or other proxy solutions.
- AndrewDucker 15y ago
  I'm curious as to what topology is detectable from a standard IPv6 packet?
  - KonradKlause 15y ago
    At home I have 10 computers. I want that only _one_ IPv6 address is visible to servers in the internet...
    - deleted 15y ago
      [deleted]
    - whynotmore 15y ago
      Why not do the opposite and give each computer hundreds of addresses?
      - KonradKlause 15y ago
        Because NAT is easier. And yes, NAT is bad, ugly and from hell.
        count 15y ago
        How is NAT, which requires an intermediary (the NAT router/device) be configured and put in place in addition to the router, easier than IPv6 privacy addresses, where you just turn your computer on and let the router route?
    - sp332 15y ago
      Can't everyone just look up your IP block in a registry somewhere?
    - amazingman 15y ago
      So firewall the other 9.
- viraptor 15y ago
  > Topology hiding. == making VoIP deployment hard/impossible depending on your router and phone model. :(
  - pilif 15y ago
    IMHO this is caused more by broken protocols than NAT in general. There's no reason to have the VoIP packets delivered directly instead of them being routed (on the protocol level, not IP-routing) over a central VoIP gateway. If the singalling protocols would allow for something like 'hi - my client $foo wants to talk to your client $bar. Please direct your response to me' and the other end would then send the packets with 'this is a packet from my client $bar to your client $foo - as you told me, I'm sending it to you', then there wouldn't be an issue - aside of a very small bit of additional latency and higher complexity of the gateway software. If these client IDs are opaque, then the network topology stays hidden, but NAT would be completely irrelevant in between. Now, personally, I'm really looking forward to having a /64 at the end of my cable modem. I will make splendid use of it and I will highly enjoy the additional uses I get from having my machines freely accessible to the internet. On the other hand, people got good at understanding the feature set NAT provides and, thus, at configuring NAT gateways which also don't allow incoming connections per default. That way, if I'm just a "normal user" and I buy myself a WiFi printer, I don't have to concern myself with configuring a firewall in order to ensure that it doesn't turn into an involuntary fax machine for example. This could of course be solved by correctly configured firewalls on these crappy blue box routers, but how many years will it take them to reach "correctly"? Will they actually be configurable enough? Or would they just drop anything with a SYN bit set? How would these crappy firewalls deal with incoming UDP? Block it unconditionally (thus breaking VoIP even more)? Add "connection" tracking? In that case, why not just NAT? I believe it's a good thing to have NAT back. Will I use it at home? Probably not. Will my parents use it at home? Likely. Would they be affected? Likely not as we already are used to deal with NATed clients.
    - adestefan 15y ago
      Consumer routers have included a statefull firewall for years. The only difference for the end user will be instead of configuring port forwarding you'll modify a firewall rule. The interface would be exactly the same.
nodata 15y ago
Privacy.
- deleted 15y ago
  [deleted]
- count 15y ago
  IPv6 privacy addresses are even more effective at this than NAT would be. Once the address is done being used, it goes away. You can still be tracked by your NAT'd address, as it will remain (relatively) static.
guan 15y ago
I don't know if this qualifies as legitimate, but Comcast has already decided to allocate /128 to customers with "directly connected CPE", which sounds like people who have just a cable modem and didn't pay for a "home gateway device". NAT could be useful if you plug that cable modem into a Linux box. http://blog.comcast.com/2011/11/ipv6-deployment-technology.html http://blog.comcast.com/2011/11/ipv6-deployment-technology.h...
- wmf 15y ago
  You're interpreting it wrong; Comcast is going to provide at least /64 to each customer but they just haven't turned on prefix delegation yet.
  - agwa 15y ago
    /64 is almost as bad and will lead to IPv6 NATing. What if you want multiple subnets (for example, a separate guest network, which some high-end consumer access points already tout as a selling point)? You don't want to sub-divide your /64 because then stateless auto configuration won't work. You could bridge multiple subnets with the same /64 prefix and use a layer 2 firewall (ebtables in Linux), but that's ugly. NAT is the only other option. That said, Comcast did leave open the possibility for shorter prefixes, possibly as early as 2012, and they have already received quite a thrashing on their IPv6 beta tester forums for using /64 prefixes. So they might eventually do the right thing. I'm optimistic :-).
- pasbesoin 15y ago
  My opinion is that when you're dependent upon a (possibly recalcitrant) upstream provider, it's best to have means of dealing with whatever they give you. If in some circumstance someone hands you only one address (or, one address too few, perhaps), you can still hang your own network behind it.
- syncsynchalt 15y ago
  I think you're reading that wrong. The CPE (the cable modem itself) gets a /128, similar to the 10.0.0.0/8 address that it currently gets (that is not visible to the end user). They then go on to say that the home gateway gets a /64.
zobzu 15y ago
responses you might get (not that i agree): "we're used to the false sense of security from NAT and we like it" "we feel like NAT protects our privacy ('but we use gmail')" "its easier to setup than ndp proxying ('because i never heard of ndp before')" yada yada :-)
dspillett 15y ago
The only ones I can think of are: 1. Topology hiding: the outside world only sees one interface not potentially the rest of your network. Though I doubt this offers and security worth speaking of, some people might want to keep that part of their arrangement when they migrate from IPv4 to IPv6. 2. Selective address forwarding: your router could send packets for a particular IPv6 address to different machines LAN-side depending on various things like where the packets came from WAN-side. Of course there might be better ways to implement these things in the IPv6 spec already, I'm very behind the times in that respect and really must find time to read up on the subject (I purposely chose an ISP that fully supports IPv6 when I switched a few months ago, so I could try it all out when I have some time to play)
- throwaway64 15y ago
  a firewall can handle both those things without NAT
  - dspillett 15y ago
    In the case of splitting traffic between two hosts depending on some factor, what if you want outgoing requests from those services to appear to come from the same place (so the two machine appear to be one interface for outgoing connections as well as incoming ones)? You could use some sort of proxy services the the machines make the requests through (and the passes incoming requests back - you can avoid NAT in both directions that way) of course, but NAT seems (to me) to be a lighter solution for that use case.
agwa 15y ago
I suspect that there will still exist some situations where you only have a /128 but need to run a network behind it. I realize I'm in a tiny minority here, but when I travel I bring a WRT54GL, plug it into the hotel's Internet connection, and then plug my devices into it on my own private subnet. I kinda doubt hotels will be routing /64 to their guests, so NAT will be the only option. I hope that IPv6 NAT will be used rarely, but I'm grateful that I will have it in my toolbox for atypical situations where there are no other options.
- loup-vaillant 15y ago
  Noob question: what exactly are a /128 and a /64 ? How many public IPs do they provide? Do you have a link so I can learn how to interpret those /xx? Originally, I was under the impression that /n subnets have 2^n public IPs at there disposal. Could it be 2^(128-n) instead? But either way, a /64 should be plenty. However, you suggest here http://news.ycombinator.com/item?id=3261500 http://news.ycombinator.com/item?id=3261500 that /64 are not so great. I wonder why. Is there something special going on?
  - count 15y ago
    A /64 is a 64-bit network mask on the 128bit ipv6 address, effectively leaving you with 64 bits for host addresses on that subnet. A /128 is a 128bit mask, leaving you with 0 extra bits (ie: a single host address). 2^(128-n) is the way it works for HOST addresses (no '-1', as in ipv4, as there is no broadcast address in ipv6, and 128-128=0, so 2^0=1, a single host address). 2^n is the way it works for networks/subnets, so a /128 leaves 2^128 possible networks, each with 2^0 hosts on them, while a /127 leaves 2^127 networks, each with 2^1 hosts on them. A /64 is equal to the square of the entire existent ipv4 space (/32), and should be more than enough for any subnet anywhere, ever (it's roughly 18,446,744,073,709,551,615 IPs). The issue is that many of the 'fundamental' protocols are built on assumptions that the smallest network will be a /64, and if your ISP gives you 1 /64, you can't have more than one 'network' on your end of the connection - even if you can have 18 quintillion addresses, they all have to be on the same subnet, so no fire-walling/etc. within your network.

I'd be interested to hear some of these legitimate use cases for IPv6 NAT.

by kenny_r 15y ago

I'd be interested to hear some of these legitimate use cases for IPv6 NAT.

KonradKlause 15y ago

Topology hiding. No, please don't tell me about socks or other proxy solutions.

AndrewDucker 15y ago
I'm curious as to what topology is detectable from a standard IPv6 packet?
- KonradKlause 15y ago
  At home I have 10 computers. I want that only _one_ IPv6 address is visible to servers in the internet...
  - deleted 15y ago
    [deleted]
  - whynotmore 15y ago
    Why not do the opposite and give each computer hundreds of addresses?
    - KonradKlause 15y ago
      Because NAT is easier. And yes, NAT is bad, ugly and from hell.
      - count 15y ago
        How is NAT, which requires an intermediary (the NAT router/device) be configured and put in place in addition to the router, easier than IPv6 privacy addresses, where you just turn your computer on and let the router route?
  - sp332 15y ago
    Can't everyone just look up your IP block in a registry somewhere?
  - amazingman 15y ago
    So firewall the other 9.
viraptor 15y ago
> Topology hiding. == making VoIP deployment hard/impossible depending on your router and phone model. :(
- pilif 15y ago
  IMHO this is caused more by broken protocols than NAT in general. There's no reason to have the VoIP packets delivered directly instead of them being routed (on the protocol level, not IP-routing) over a central VoIP gateway. If the singalling protocols would allow for something like 'hi - my client $foo wants to talk to your client $bar. Please direct your response to me' and the other end would then send the packets with 'this is a packet from my client $bar to your client $foo - as you told me, I'm sending it to you', then there wouldn't be an issue - aside of a very small bit of additional latency and higher complexity of the gateway software. If these client IDs are opaque, then the network topology stays hidden, but NAT would be completely irrelevant in between. Now, personally, I'm really looking forward to having a /64 at the end of my cable modem. I will make splendid use of it and I will highly enjoy the additional uses I get from having my machines freely accessible to the internet. On the other hand, people got good at understanding the feature set NAT provides and, thus, at configuring NAT gateways which also don't allow incoming connections per default. That way, if I'm just a "normal user" and I buy myself a WiFi printer, I don't have to concern myself with configuring a firewall in order to ensure that it doesn't turn into an involuntary fax machine for example. This could of course be solved by correctly configured firewalls on these crappy blue box routers, but how many years will it take them to reach "correctly"? Will they actually be configurable enough? Or would they just drop anything with a SYN bit set? How would these crappy firewalls deal with incoming UDP? Block it unconditionally (thus breaking VoIP even more)? Add "connection" tracking? In that case, why not just NAT? I believe it's a good thing to have NAT back. Will I use it at home? Probably not. Will my parents use it at home? Likely. Would they be affected? Likely not as we already are used to deal with NATed clients.
  - adestefan 15y ago
    Consumer routers have included a statefull firewall for years. The only difference for the end user will be instead of configuring port forwarding you'll modify a firewall rule. The interface would be exactly the same.

nodata 15y ago

Privacy.

deleted 15y ago
[deleted]
count 15y ago
IPv6 privacy addresses are even more effective at this than NAT would be. Once the address is done being used, it goes away. You can still be tracked by your NAT'd address, as it will remain (relatively) static.

guan 15y ago

I don't know if this qualifies as legitimate, but Comcast has already decided to allocate /128 to customers with "directly connected CPE", which sounds like people who have just a cable modem and didn't pay for a "home gateway device". NAT could be useful if you plug that cable modem into a Linux box. http://blog.comcast.com/2011/11/ipv6-deployment-technology.html http://blog.comcast.com/2011/11/ipv6-deployment-technology.h...

wmf 15y ago
You're interpreting it wrong; Comcast is going to provide at least /64 to each customer but they just haven't turned on prefix delegation yet.
- agwa 15y ago
  /64 is almost as bad and will lead to IPv6 NATing. What if you want multiple subnets (for example, a separate guest network, which some high-end consumer access points already tout as a selling point)? You don't want to sub-divide your /64 because then stateless auto configuration won't work. You could bridge multiple subnets with the same /64 prefix and use a layer 2 firewall (ebtables in Linux), but that's ugly. NAT is the only other option. That said, Comcast did leave open the possibility for shorter prefixes, possibly as early as 2012, and they have already received quite a thrashing on their IPv6 beta tester forums for using /64 prefixes. So they might eventually do the right thing. I'm optimistic :-).
pasbesoin 15y ago
My opinion is that when you're dependent upon a (possibly recalcitrant) upstream provider, it's best to have means of dealing with whatever they give you. If in some circumstance someone hands you only one address (or, one address too few, perhaps), you can still hang your own network behind it.
syncsynchalt 15y ago
I think you're reading that wrong. The CPE (the cable modem itself) gets a /128, similar to the 10.0.0.0/8 address that it currently gets (that is not visible to the end user). They then go on to say that the home gateway gets a /64.

zobzu 15y ago

responses you might get (not that i agree): "we're used to the false sense of security from NAT and we like it" "we feel like NAT protects our privacy ('but we use gmail')" "its easier to setup than ndp proxying ('because i never heard of ndp before')" yada yada :-)

dspillett 15y ago

The only ones I can think of are: 1. Topology hiding: the outside world only sees one interface not potentially the rest of your network. Though I doubt this offers and security worth speaking of, some people might want to keep that part of their arrangement when they migrate from IPv4 to IPv6. 2. Selective address forwarding: your router could send packets for a particular IPv6 address to different machines LAN-side depending on various things like where the packets came from WAN-side. Of course there might be better ways to implement these things in the IPv6 spec already, I'm very behind the times in that respect and really must find time to read up on the subject (I purposely chose an ISP that fully supports IPv6 when I switched a few months ago, so I could try it all out when I have some time to play)

throwaway64 15y ago
a firewall can handle both those things without NAT
- dspillett 15y ago
  In the case of splitting traffic between two hosts depending on some factor, what if you want outgoing requests from those services to appear to come from the same place (so the two machine appear to be one interface for outgoing connections as well as incoming ones)? You could use some sort of proxy services the the machines make the requests through (and the passes incoming requests back - you can avoid NAT in both directions that way) of course, but NAT seems (to me) to be a lighter solution for that use case.

agwa 15y ago

I suspect that there will still exist some situations where you only have a /128 but need to run a network behind it. I realize I'm in a tiny minority here, but when I travel I bring a WRT54GL, plug it into the hotel's Internet connection, and then plug my devices into it on my own private subnet. I kinda doubt hotels will be routing /64 to their guests, so NAT will be the only option. I hope that IPv6 NAT will be used rarely, but I'm grateful that I will have it in my toolbox for atypical situations where there are no other options.

loup-vaillant 15y ago
Noob question: what exactly are a /128 and a /64 ? How many public IPs do they provide? Do you have a link so I can learn how to interpret those /xx? Originally, I was under the impression that /n subnets have 2^n public IPs at there disposal. Could it be 2^(128-n) instead? But either way, a /64 should be plenty. However, you suggest here http://news.ycombinator.com/item?id=3261500 http://news.ycombinator.com/item?id=3261500 that /64 are not so great. I wonder why. Is there something special going on?
- count 15y ago
  A /64 is a 64-bit network mask on the 128bit ipv6 address, effectively leaving you with 64 bits for host addresses on that subnet. A /128 is a 128bit mask, leaving you with 0 extra bits (ie: a single host address). 2^(128-n) is the way it works for HOST addresses (no '-1', as in ipv4, as there is no broadcast address in ipv6, and 128-128=0, so 2^0=1, a single host address). 2^n is the way it works for networks/subnets, so a /128 leaves 2^128 possible networks, each with 2^0 hosts on them, while a /127 leaves 2^127 networks, each with 2^1 hosts on them. A /64 is equal to the square of the entire existent ipv4 space (/32), and should be more than enough for any subnet anywhere, ever (it's roughly 18,446,744,073,709,551,615 IPs). The issue is that many of the 'fundamental' protocols are built on assumptions that the smallest network will be a /64, and if your ISP gives you 1 /64, you can't have more than one 'network' on your end of the connection - even if you can have 18 quintillion addresses, they all have to be on the same subnet, so no fire-walling/etc. within your network.