3 ms·

Topology hiding. No, please don't tell me about socks or other proxy solutions.

by KonradKlause 15y ago

AndrewDucker 15y ago
I'm curious as to what topology is detectable from a standard IPv6 packet?
- KonradKlause 15y ago
  At home I have 10 computers. I want that only _one_ IPv6 address is visible to servers in the internet...
  - deleted 15y ago
    [deleted]
  - whynotmore 15y ago
    Why not do the opposite and give each computer hundreds of addresses?
    - KonradKlause 15y ago
      Because NAT is easier. And yes, NAT is bad, ugly and from hell.
      - count 15y ago
        How is NAT, which requires an intermediary (the NAT router/device) be configured and put in place in addition to the router, easier than IPv6 privacy addresses, where you just turn your computer on and let the router route?
  - sp332 15y ago
    Can't everyone just look up your IP block in a registry somewhere?
  - amazingman 15y ago
    So firewall the other 9.
viraptor 15y ago
> Topology hiding. == making VoIP deployment hard/impossible depending on your router and phone model. :(
- pilif 15y ago
  IMHO this is caused more by broken protocols than NAT in general. There's no reason to have the VoIP packets delivered directly instead of them being routed (on the protocol level, not IP-routing) over a central VoIP gateway. If the singalling protocols would allow for something like 'hi - my client $foo wants to talk to your client $bar. Please direct your response to me' and the other end would then send the packets with 'this is a packet from my client $bar to your client $foo - as you told me, I'm sending it to you', then there wouldn't be an issue - aside of a very small bit of additional latency and higher complexity of the gateway software. If these client IDs are opaque, then the network topology stays hidden, but NAT would be completely irrelevant in between. Now, personally, I'm really looking forward to having a /64 at the end of my cable modem. I will make splendid use of it and I will highly enjoy the additional uses I get from having my machines freely accessible to the internet. On the other hand, people got good at understanding the feature set NAT provides and, thus, at configuring NAT gateways which also don't allow incoming connections per default. That way, if I'm just a "normal user" and I buy myself a WiFi printer, I don't have to concern myself with configuring a firewall in order to ensure that it doesn't turn into an involuntary fax machine for example. This could of course be solved by correctly configured firewalls on these crappy blue box routers, but how many years will it take them to reach "correctly"? Will they actually be configurable enough? Or would they just drop anything with a SYN bit set? How would these crappy firewalls deal with incoming UDP? Block it unconditionally (thus breaking VoIP even more)? Add "connection" tracking? In that case, why not just NAT? I believe it's a good thing to have NAT back. Will I use it at home? Probably not. Will my parents use it at home? Likely. Would they be affected? Likely not as we already are used to deal with NATed clients.
  - adestefan 15y ago
    Consumer routers have included a statefull firewall for years. The only difference for the end user will be instead of configuring port forwarding you'll modify a firewall rule. The interface would be exactly the same.

Topology hiding. No, please don't tell me about socks or other proxy solutions.

AndrewDucker 15y ago

I'm curious as to what topology is detectable from a standard IPv6 packet?

KonradKlause 15y ago
At home I have 10 computers. I want that only _one_ IPv6 address is visible to servers in the internet...
- deleted 15y ago
  [deleted]
- whynotmore 15y ago
  Why not do the opposite and give each computer hundreds of addresses?
  - KonradKlause 15y ago
    Because NAT is easier. And yes, NAT is bad, ugly and from hell.
    - count 15y ago
      How is NAT, which requires an intermediary (the NAT router/device) be configured and put in place in addition to the router, easier than IPv6 privacy addresses, where you just turn your computer on and let the router route?
- sp332 15y ago
  Can't everyone just look up your IP block in a registry somewhere?
- amazingman 15y ago
  So firewall the other 9.

viraptor 15y ago

> Topology hiding. == making VoIP deployment hard/impossible depending on your router and phone model. :(

pilif 15y ago
IMHO this is caused more by broken protocols than NAT in general. There's no reason to have the VoIP packets delivered directly instead of them being routed (on the protocol level, not IP-routing) over a central VoIP gateway. If the singalling protocols would allow for something like 'hi - my client $foo wants to talk to your client $bar. Please direct your response to me' and the other end would then send the packets with 'this is a packet from my client $bar to your client $foo - as you told me, I'm sending it to you', then there wouldn't be an issue - aside of a very small bit of additional latency and higher complexity of the gateway software. If these client IDs are opaque, then the network topology stays hidden, but NAT would be completely irrelevant in between. Now, personally, I'm really looking forward to having a /64 at the end of my cable modem. I will make splendid use of it and I will highly enjoy the additional uses I get from having my machines freely accessible to the internet. On the other hand, people got good at understanding the feature set NAT provides and, thus, at configuring NAT gateways which also don't allow incoming connections per default. That way, if I'm just a "normal user" and I buy myself a WiFi printer, I don't have to concern myself with configuring a firewall in order to ensure that it doesn't turn into an involuntary fax machine for example. This could of course be solved by correctly configured firewalls on these crappy blue box routers, but how many years will it take them to reach "correctly"? Will they actually be configurable enough? Or would they just drop anything with a SYN bit set? How would these crappy firewalls deal with incoming UDP? Block it unconditionally (thus breaking VoIP even more)? Add "connection" tracking? In that case, why not just NAT? I believe it's a good thing to have NAT back. Will I use it at home? Probably not. Will my parents use it at home? Likely. Would they be affected? Likely not as we already are used to deal with NATed clients.
- adestefan 15y ago
  Consumer routers have included a statefull firewall for years. The only difference for the end user will be instead of configuring port forwarding you'll modify a firewall rule. The interface would be exactly the same.