15 ms·

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my netwo

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get people excited about the transition.

ArchOversight 4y ago
That's what a firewall is for, NAT does nothing here.
- IshKebab 4y ago
  In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.
  - deleted 4y ago
    [deleted]
  - justeleblanc 4y ago
    NAT cannot be misconfigured? Really?
    - lxgr 4y ago
      Unconfigured/not activated firewalls usually fail reachable; without explicit port forwarding or exposed hosts, NATs fail unreachable.
      - wolrah 4y ago
        > Unconfigured/not activated firewalls usually fail reachable Local firewalls on devices, maybe, but network firewalls generally are default-deny on untrusted interfaces, and between 0 and 1 interfaces are trusted by default. Back in 2007 Apple's Airport Extreme Base Station shipped with a firmware that defaulted to allowing all IPv6 traffic, which was quickly pointed out in the tech media and fixed in a patch a few months later. A few of the garbage pile combo modem/router devices distributed by ISPs have had similar issues over the years as well. That's not normal behavior though, when it's observed it's rightfully considered a security flaw and tends to get the kind of attention vendors don't want. If you know of a mainstream device that would "fail reachable" as you claim here, name and shame please. > without explicit port forwarding or exposed hosts, NATs fail unreachable. I work in VoIP and can say from plenty of direct experience this is not true. In the modern work from home era I've had to deal with a lot of the aforementioned garbage pile consumer devices and a recurring issue with some of our clients who had older phones is that their users' home routers did the laziest NAT possible and literally just opened a two way hole on port 5060 (SIP) so as long as the phone was communicating with our server and keeping the pinhole open *ANY* other traffic that hit port 5060 was also sent to the phone, which meant they got all kinds of "phantom calls" from bots looking for unprotected SIP relays. Newer phones generally have an option to only accept SIP messages from trusted servers, but older ones sometimes don't so when combined with badly implemented NAT that happens. And yea, obviously that's a consequence of a particularly bad NAT implementation, but your complaint is about an issue that would only occur in a particularly bad IPv6 implementation.
        hot_gril 4y ago
        It takes effort to make NAT that bad. Something jank like UPnP has to map the port, and even that requires action on the device's part. I don't quite understand your SIP example; how does the router know which IP is the phone's? Bad IPv6 is as simple as not having a firewall or default-allowing it like AirPort did. If Apple can make that mistake, a lot of random manufacturers can too. I can see the whole NATless firewall setup but wouldn't use it for a very long time, to let things settle.
    - joshspankit 4y ago
      Not without being entirely broken. I think you might be bringing in uPnP, DNZ, and other such features. NAT itself is more basic.
      - buzer 4y ago
        One could argue that if e.g. FTP is not working behind the NAT then the NAT is misconfigured. NAT needs to aware of certain protocols so that it can modify the application layer data. Of course, if the protocol added workaround for NAT and NAT is modifying that application layer data then it can cause another set of issues.
        bert64 4y ago
        IP networking was designed with separate layers, NAT breaks this by having to span multiple layers. Generally NAT gateways only support TCP/UDP, other protocols are simply not supported, which has basically stifled protocol innovation (eg look at SCTP, it has some neat features but is hardly ever used because of NAT). It gets even worse with higher level protocols like FTP. There is such a thing as FTPS (FTP over SSL) but it's rarely used because if you encrypt the traffic then the NAT gateway can't inspect and rewrite the traffic. The same is true of IPSEC/ESP, if you have an encrypted TCP packet encapsulated with ESP the NAT gateway can't keep track of which internal host to forward it to because it can't see the source and destination ports. A normal router does not need to care about anything further up the stack than IP. A firewall does, but even when a firewall doesn't explicitly support a particular protocol you could write a rule allowing any traffic with a particular protocol number between specific hosts is allowed, and anything else denied.
  - Arnavion 4y ago
    The amount of firewall config I have to write to let an incoming connection cross from WAN to LAN is the same regardless of whether it goes to a NAT'd IPv4 address or to an IPv6 address.
    - deleted 4y ago
      [deleted]
  - op00to 4y ago
    Consumer NAT firewalls have uPnP enabled, right?
    - bonsaibilly 4y ago
      Sometimes. Sometimes it even works, too.
    - IshKebab 4y ago
      Yeah often, but it only responds to requests from the local network.
- thesuitonym 4y ago
  I know, did you read my whole post?
  - dale_glass 4y ago
    It just makes little sense. With IPv6 instead of NAT deciding that port 2000 maps to 192.168.1.3 port 22, you have a firewall that may or not choose to route to xx:yy:zz or not, and to allow an incoming connection over port 22 to that host or not. If you don't want to accept incoming connections to a given machine or network on IPv6 without NAT that's very easy to have.
    - AnonymousPlanet 4y ago
      Maybe people don't want to disclose the number and purposes of interior machines?
      - silon42 4y ago
        Yeah, I had an idea to have an IP for each container (which means almost every "containerized" application soon, possibly even every browser window).
      - deleted 4y ago
        [deleted]
      - petertodd 4y ago
        IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total global internet traffic per year. Now, sometimes NAT is needed anyway: QubesOS supports IPv6 using NAT because it splits things up into many different VMs on one computer. But that's a pretty rare case.
        4y ago
- hot_gril 4y ago
  NAT does nothing? The NAT setup is the reason incoming connections don't reach devices on the LAN. I get that you can phrase this as NAT actually being the thing forwarding the packets, and on a home ipv4 router without NAT the incoming packets would just go nowhere, but everyone is talking about the realistic options of NAT vs device having own public IP addr. I get that an ipv6 router can have a firewall with good defaults blocking incoming connections, emulating that aspect of a NAT.
  - Dagger2 4y ago
    Indeed, it does nothing. NAT won't stop an inbound connection to your network. You already needed to use a firewall for that in v4. The type of NAT we're talking about here *only* applies to outbound connections. It doesn't do anything at all to inbound connections.
tenebrisalietum 4y ago
> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of keeping some semblance of an Internet around that isn't dominated by huge centralized services, the cargo cult of "NAT is security" needs to die hard.
- michaelt 4y ago
  Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providing routable addresses for home users, thus avoiding CGNAT. But zealous firewalling and the rise of mobile devices mean these days almost everything is sent over HTTPS to a cloud server. I haven't had software ask me to open a port on my router in a decade or more. Even games and video conferencing software know they have to work out-of-the-box on networks where the user can't adjust the NAT. So who's going to benefit from all this hassle - the 0.1% of users who are hosting websites from home?
  - davikr 4y ago
    To "avoid domination by huge centralized services", of course. What if you want to run something like a website from your own IP, but you can't because you're behind CGNAT?
    - wankle 4y ago
      I use a public VPS and Wireguard. Costs $3.50 for the VPS which has a static IP. I host on my laptop. I can take my laptop anywhere in the world there's an Internet connection and my email and web sites continue to work right from the same VPS IP because my laptop connects to the Wireguard server on my VPS when it comes up.
mavhc 4y ago
NAT and a Firewall are two different concepts. What's wrong with a firewall that blocks everything by default, yet all your devices have a public IP?
- waych 4y ago
  Maybe you don't want to reveal your internal infrastructure to the world? Seems like basic opsec.
  - RealStickman_ 4y ago
    There's no chance of anybody guessing your infrastructure just by looking at your subnet. (Minimum is /64, which is HUGE!)
    - waych 4y ago
      Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.
      - bityard 4y ago
        Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941 https://www.rfc-editor.org/rfc/rfc4941
        waych 4y ago
        This helps mitigate correlations over time but doesn't do anything to mask the identity of the node within a given refresh interval (default one day).
        jlokier 4y ago
        Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order. Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT (If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.) That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.
lxgr 4y ago
> Everything on my network is going to go through my firewall anyway. Yes, and that's a very reasonable configuration. But UDP hole punching (very widely used for VoIP, online gaming etc.) works orders of magnitude better with IPv6 than with IPv4, since there is no address and port translation to worry about. With IPv4, it's very hit or miss, since it depends on both sides' NATs and also requires additional infrastructure (i.e. STUN discovery servers).
- throw0101c 4y ago
  > With IPv4, it's very hit or miss […] It's also probably impossible if you're with an ISP that does CG NAT.
  - alyandon 4y ago
    I've actually run into this helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo.
    - philjohn 4y ago
      At that point, would a cheap VPS not work instead?
      - birdman3131 4y ago
        No. Game servers usually want high clock speed.
        op00to 4y ago
        You’d just use the VPS as a proxy with a publicly accessible IP, and tunnel the connection back to your home. That would add latency that might be undesirable for a game, but maybe not.
        4y ago
jcalvinowens 4y ago
There is no downside to everything to be globally routable. It's completely orthogonal to firewalling. What is the risk you're picturing here? I'm really curious. Features like RFC4941/8981 mean nobody can infer anything about your network from the source addresses they see making requests out if it. If you want to use link-local V6 addresses and NAT to a global one, you can do that. But IMHO that's sacrificing one of the greatest advantages of IPv6 for no tangible benefit.
- thesuitonym 4y ago
  I'm not saying there's any downside, I'm just saying it's not the magic bullet "this is why you should use ipv6" that everyone seems to think it is. It's a complete non-issue that nobody really cares about.
  - growse 4y ago
    The point is that it gives you options. You might not want to have anything on a network reachable from the internet today, but next year you suddenly need that capability and it's useful to be able to take advantage of that, rather than wading through the buggy mess of NAT. > It's a complete non-issue that nobody really cares about. A significant number of people spend a significant amount of time trying to carve out and re-use address space in their existing IPv4 allocations and RFC1918 space. This becomes nightmarish the moment you start thinking about networks of any significant size and complexity. All of these problems go away with IPv6, and we care about that a lot.
  - jcalvinowens 4y ago
    > It's a complete non-issue that nobody really cares about. Huh. IMHO it's the single most desirable feature, and the only reason I care about it at all. If you're approaching this from the home networking point of view, than I suppose I agree: even the most complex home network is just too simple for anything like this to matter much. As the network gets bigger, that sweet sweet global routability starts to make a lot of things a lot simpler... I'm lucky to have worked on an enormous deployment of V6-only servers, and it's downright magical in comparison to anything of comparable scale I've seen before or since. But yes, my home network is three NAT'd /24's because I'm too lazy to figure out how to make prefix delegation work...
Asooka 4y ago
Also I'm not going to expect my ISP to actually give me more than one address, so if I have multiple devices at home, I will need to do NAT. Heck, back in the day they used to set TTL to 1 so the packets weren't routable at all without mangling them via iptables. Maybe that will be harder now than 20 years ago since everything connects online...
- cassianoleal 4y ago
  ISPs are expected to delegate a /56 or /64 prefix to customers. Some are even delegating /48s. Mine delegates a /56. That should be enough for all your devices to randomly rotate IPs for a lifetime or a few without any NAT.
  - Arnavion 4y ago
    https://news.ycombinator.com/item?id=24999906 https://news.ycombinator.com/item?id=24999906 Shitty ISPs do exist, or at least they existed two years ago.
    - cassianoleal 4y ago
      Sure they exist, but should you expect your ISP to be shitty? Sounds like a terrible deal for you.
      - JohnFen 4y ago
        In large swaths of the US, you don't have a choice about what ISP you have available. If you happen to have a shitty one (and most aren't great), there's nothing you can really do about it.
        hot_gril 4y ago
        The bad ones won't even give you IPv6 to begin with, haha. Not that I want it anyway.
throw0101c 4y ago
> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, that goes along with non-global addresses: * https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_... Your end-user device knows its address and the address of the other connection point, and can tell the firewall to open a rule between only those two IPs: * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol * http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf Further, because you don't have only one external IP, you don't have to futz around with non-default ports if you want multiple instances of the same service (e.g., Minecraft), because each instance can have its own IP. Further, if you want certain devices to not able to get outside: (a) give them static assignments and block them at the firewall, (b) don't give them a default route so they are subnet-local, or (c) give them site-local addresses via ULA and do not set up NTPv6 translation.
- gxt 4y ago
  How does that protect privacy of the private network? I don't want to divulge any information about internal topology.
  - adgjlsfhk1 4y ago
    what do you mean by topology? the only information leaked would be the number of computers making requests.
    - Faark 4y ago
      And what computer is making what requests. Now that i think about it, this cloud be the reason why youtube started making recommendations based on stuff i just watched in private browser tabs...
audunw 4y ago
> as if that's something that anybody wants. Of course I do. Why would you not want the option of easily allowing a device to be globally routable if you need it to be? I think routers should be more explicit about how you set up each new device on a private network anyway. Guest wifi can have a sane default. Private wifi could make a notification pop up on your trusted device, asking you if you want the now device to have access to the internet, and if the internet should have access to the device, and if so, which subnets/countries should be able to access it through which ports.
- aflag 4y ago
  Most people don’t need it, so that’s why they don’t want it. OP didn’t say people object to it, just that it’s not something most people cares about.
  - hot_gril 4y ago
    It's fairly common to want P2P connections, even if the users aren't aware of it. A lot of online games rely on NAT traversal, sometimes automatically picking a host based on whoever's NAT it can get past. I don't remember the details, but even the Nintendo Switch cares about NAT. A lot of would-be P2P applications end up using a relay server to get around that restriction, which adds significant cost and latency. Sure it's a well-established workaround by now, but it'd be nice not to rely on it.
1vuio0pswjnm7 4y ago
The article uses gaming and IPSEC as examples but not, say, ad servers and "tech" company websites or other websites desperate to collect data. Interesting coincidence. As the parent suggests, IPv6 creates more work to prevent more exfiltration. It is already difficult enough with IPv4. Could IPv6 fix a web infested with "tech" company intermediaries and return it to one where all participants can connect directly and if desired publish to audiences (without "tech" interplopers). That sort of proposal would make an interesting read for end users.
- 1vuio0pswjnm7 4y ago
  Toward that end, CJDNS has been most interesting use of IPv6 I have seen to date.
topranks 4y ago
NATs at very least complicate things. Even if you never allow anything in from outside that wasn’t established from the inside first, it still removes an added layer of complexity from things.
HyperSane 4y ago
Verizon wants $500 to enable IPv6 on an LTE SIM.
qalmakka 4y ago
NAT is not only bad because you don't have publicly routable addresses, but because it's a hack and a pretty "clever" one at that, aka, incredibly nasty. If we had networking protocols that took into account the complexities of private addresses it could probably work - but we don't have such a luxury. The entire TCP/IP stack assumes peer to peer connections, and NAT is literally a spanner in the works for all that.
bert64 4y ago
Routable does not mean reachable. A firewall is perfectly capable of controlling traffic between two routable addresses, without the added burden and complexity of having to translate the traffic to/from a non routable address. The whitehouse has a public address, everyone knows its address and yet random people can't just walk in through the front door.

ArchOversight 4y ago

That's what a firewall is for, NAT does nothing here.

IshKebab 4y ago
In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.
- deleted 4y ago
  [deleted]
- justeleblanc 4y ago
  NAT cannot be misconfigured? Really?
  - lxgr 4y ago
    Unconfigured/not activated firewalls usually fail reachable; without explicit port forwarding or exposed hosts, NATs fail unreachable.
    - wolrah 4y ago
      > Unconfigured/not activated firewalls usually fail reachable Local firewalls on devices, maybe, but network firewalls generally are default-deny on untrusted interfaces, and between 0 and 1 interfaces are trusted by default. Back in 2007 Apple's Airport Extreme Base Station shipped with a firmware that defaulted to allowing all IPv6 traffic, which was quickly pointed out in the tech media and fixed in a patch a few months later. A few of the garbage pile combo modem/router devices distributed by ISPs have had similar issues over the years as well. That's not normal behavior though, when it's observed it's rightfully considered a security flaw and tends to get the kind of attention vendors don't want. If you know of a mainstream device that would "fail reachable" as you claim here, name and shame please. > without explicit port forwarding or exposed hosts, NATs fail unreachable. I work in VoIP and can say from plenty of direct experience this is not true. In the modern work from home era I've had to deal with a lot of the aforementioned garbage pile consumer devices and a recurring issue with some of our clients who had older phones is that their users' home routers did the laziest NAT possible and literally just opened a two way hole on port 5060 (SIP) so as long as the phone was communicating with our server and keeping the pinhole open *ANY* other traffic that hit port 5060 was also sent to the phone, which meant they got all kinds of "phantom calls" from bots looking for unprotected SIP relays. Newer phones generally have an option to only accept SIP messages from trusted servers, but older ones sometimes don't so when combined with badly implemented NAT that happens. And yea, obviously that's a consequence of a particularly bad NAT implementation, but your complaint is about an issue that would only occur in a particularly bad IPv6 implementation.
      - hot_gril 4y ago
        It takes effort to make NAT that bad. Something jank like UPnP has to map the port, and even that requires action on the device's part. I don't quite understand your SIP example; how does the router know which IP is the phone's? Bad IPv6 is as simple as not having a firewall or default-allowing it like AirPort did. If Apple can make that mistake, a lot of random manufacturers can too. I can see the whole NATless firewall setup but wouldn't use it for a very long time, to let things settle.
  - joshspankit 4y ago
    Not without being entirely broken. I think you might be bringing in uPnP, DNZ, and other such features. NAT itself is more basic.
    - buzer 4y ago
      One could argue that if e.g. FTP is not working behind the NAT then the NAT is misconfigured. NAT needs to aware of certain protocols so that it can modify the application layer data. Of course, if the protocol added workaround for NAT and NAT is modifying that application layer data then it can cause another set of issues.
      - bert64 4y ago
        IP networking was designed with separate layers, NAT breaks this by having to span multiple layers. Generally NAT gateways only support TCP/UDP, other protocols are simply not supported, which has basically stifled protocol innovation (eg look at SCTP, it has some neat features but is hardly ever used because of NAT). It gets even worse with higher level protocols like FTP. There is such a thing as FTPS (FTP over SSL) but it's rarely used because if you encrypt the traffic then the NAT gateway can't inspect and rewrite the traffic. The same is true of IPSEC/ESP, if you have an encrypted TCP packet encapsulated with ESP the NAT gateway can't keep track of which internal host to forward it to because it can't see the source and destination ports. A normal router does not need to care about anything further up the stack than IP. A firewall does, but even when a firewall doesn't explicitly support a particular protocol you could write a rule allowing any traffic with a particular protocol number between specific hosts is allowed, and anything else denied.
- Arnavion 4y ago
  The amount of firewall config I have to write to let an incoming connection cross from WAN to LAN is the same regardless of whether it goes to a NAT'd IPv4 address or to an IPv6 address.
  - deleted 4y ago
    [deleted]
- op00to 4y ago
  Consumer NAT firewalls have uPnP enabled, right?
  - bonsaibilly 4y ago
    Sometimes. Sometimes it even works, too.
  - IshKebab 4y ago
    Yeah often, but it only responds to requests from the local network.
thesuitonym 4y ago
I know, did you read my whole post?
- dale_glass 4y ago
  It just makes little sense. With IPv6 instead of NAT deciding that port 2000 maps to 192.168.1.3 port 22, you have a firewall that may or not choose to route to xx:yy:zz or not, and to allow an incoming connection over port 22 to that host or not. If you don't want to accept incoming connections to a given machine or network on IPv6 without NAT that's very easy to have.
  - AnonymousPlanet 4y ago
    Maybe people don't want to disclose the number and purposes of interior machines?
    - silon42 4y ago
      Yeah, I had an idea to have an IP for each container (which means almost every "containerized" application soon, possibly even every browser window).
    - deleted 4y ago
      [deleted]
    - petertodd 4y ago
      IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total global internet traffic per year. Now, sometimes NAT is needed anyway: QubesOS supports IPv6 using NAT because it splits things up into many different VMs on one computer. But that's a pretty rare case.
      - 4y ago
hot_gril 4y ago
NAT does nothing? The NAT setup is the reason incoming connections don't reach devices on the LAN. I get that you can phrase this as NAT actually being the thing forwarding the packets, and on a home ipv4 router without NAT the incoming packets would just go nowhere, but everyone is talking about the realistic options of NAT vs device having own public IP addr. I get that an ipv6 router can have a firewall with good defaults blocking incoming connections, emulating that aspect of a NAT.
- Dagger2 4y ago
  Indeed, it does nothing. NAT won't stop an inbound connection to your network. You already needed to use a firewall for that in v4. The type of NAT we're talking about here *only* applies to outbound connections. It doesn't do anything at all to inbound connections.

tenebrisalietum 4y ago

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of keeping some semblance of an Internet around that isn't dominated by huge centralized services, the cargo cult of "NAT is security" needs to die hard.

michaelt 4y ago
Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providing routable addresses for home users, thus avoiding CGNAT. But zealous firewalling and the rise of mobile devices mean these days almost everything is sent over HTTPS to a cloud server. I haven't had software ask me to open a port on my router in a decade or more. Even games and video conferencing software know they have to work out-of-the-box on networks where the user can't adjust the NAT. So who's going to benefit from all this hassle - the 0.1% of users who are hosting websites from home?
- davikr 4y ago
  To "avoid domination by huge centralized services", of course. What if you want to run something like a website from your own IP, but you can't because you're behind CGNAT?
  - wankle 4y ago
    I use a public VPS and Wireguard. Costs $3.50 for the VPS which has a static IP. I host on my laptop. I can take my laptop anywhere in the world there's an Internet connection and my email and web sites continue to work right from the same VPS IP because my laptop connects to the Wireguard server on my VPS when it comes up.

mavhc 4y ago

NAT and a Firewall are two different concepts. What's wrong with a firewall that blocks everything by default, yet all your devices have a public IP?

waych 4y ago
Maybe you don't want to reveal your internal infrastructure to the world? Seems like basic opsec.
- RealStickman_ 4y ago
  There's no chance of anybody guessing your infrastructure just by looking at your subnet. (Minimum is /64, which is HUGE!)
  - waych 4y ago
    Every packet leaving an IPv6 network that isn't NATed has an effective node ID in the packet. No need to guess just look at the packets.
    - bityard 4y ago
      Most devices support privacy extensions (temporary v6 addresses) for this exact reason. https://www.rfc-editor.org/rfc/rfc4941 https://www.rfc-editor.org/rfc/rfc4941
      - waych 4y ago
        This helps mitigate correlations over time but doesn't do anything to mask the identity of the node within a given refresh interval (default one day).
      - jlokier 4y ago
        Those IPv6 privacy extensions still reveal when the same node connects to a sequence of destinations within the address change interval, though. E.g. observers can see a single device connects to Facebook, OnlyFans, Pornhub and PayPal in that order. Behind a NAT, observers can only make that connection (using only addresses) for the network as a whole, instead of an individual device on the network. So the privacy extensions are weaker than NAT (If the IPv6 privacy extensions used a different address for each connection, they would be more like NAT in this regard.) That said, other observable clues still allow connections from a single device to be associated, NAT or not. There's TCP OS fingerprinting for example, and the close timing of related connections.

lxgr 4y ago

> Everything on my network is going to go through my firewall anyway. Yes, and that's a very reasonable configuration. But UDP hole punching (very widely used for VoIP, online gaming etc.) works orders of magnitude better with IPv6 than with IPv4, since there is no address and port translation to worry about. With IPv4, it's very hit or miss, since it depends on both sides' NATs and also requires additional infrastructure (i.e. STUN discovery servers).

throw0101c 4y ago
> With IPv4, it's very hit or miss […] It's also probably impossible if you're with an ISP that does CG NAT.
- alyandon 4y ago
  I've actually run into this helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo.
  - philjohn 4y ago
    At that point, would a cheap VPS not work instead?
    - birdman3131 4y ago
      No. Game servers usually want high clock speed.
      - op00to 4y ago
        You’d just use the VPS as a proxy with a publicly accessible IP, and tunnel the connection back to your home. That would add latency that might be undesirable for a game, but maybe not.
        4y ago

jcalvinowens 4y ago

There is no downside to everything to be globally routable. It's completely orthogonal to firewalling. What is the risk you're picturing here? I'm really curious. Features like RFC4941/8981 mean nobody can infer anything about your network from the source addresses they see making requests out if it. If you want to use link-local V6 addresses and NAT to a global one, you can do that. But IMHO that's sacrificing one of the greatest advantages of IPv6 for no tangible benefit.

thesuitonym 4y ago
I'm not saying there's any downside, I'm just saying it's not the magic bullet "this is why you should use ipv6" that everyone seems to think it is. It's a complete non-issue that nobody really cares about.
- growse 4y ago
  The point is that it gives you options. You might not want to have anything on a network reachable from the internet today, but next year you suddenly need that capability and it's useful to be able to take advantage of that, rather than wading through the buggy mess of NAT. > It's a complete non-issue that nobody really cares about. A significant number of people spend a significant amount of time trying to carve out and re-use address space in their existing IPv4 allocations and RFC1918 space. This becomes nightmarish the moment you start thinking about networks of any significant size and complexity. All of these problems go away with IPv6, and we care about that a lot.
- jcalvinowens 4y ago
  > It's a complete non-issue that nobody really cares about. Huh. IMHO it's the single most desirable feature, and the only reason I care about it at all. If you're approaching this from the home networking point of view, than I suppose I agree: even the most complex home network is just too simple for anything like this to matter much. As the network gets bigger, that sweet sweet global routability starts to make a lot of things a lot simpler... I'm lucky to have worked on an enormous deployment of V6-only servers, and it's downright magical in comparison to anything of comparable scale I've seen before or since. But yes, my home network is three NAT'd /24's because I'm too lazy to figure out how to make prefix delegation work...

Asooka 4y ago

Also I'm not going to expect my ISP to actually give me more than one address, so if I have multiple devices at home, I will need to do NAT. Heck, back in the day they used to set TTL to 1 so the packets weren't routable at all without mangling them via iptables. Maybe that will be harder now than 20 years ago since everything connects online...

cassianoleal 4y ago
ISPs are expected to delegate a /56 or /64 prefix to customers. Some are even delegating /48s. Mine delegates a /56. That should be enough for all your devices to randomly rotate IPs for a lifetime or a few without any NAT.
- Arnavion 4y ago
  https://news.ycombinator.com/item?id=24999906 https://news.ycombinator.com/item?id=24999906 Shitty ISPs do exist, or at least they existed two years ago.
  - cassianoleal 4y ago
    Sure they exist, but should you expect your ISP to be shitty? Sounds like a terrible deal for you.
    - JohnFen 4y ago
      In large swaths of the US, you don't have a choice about what ISP you have available. If you happen to have a shitty one (and most aren't great), there's nothing you can really do about it.
      - hot_gril 4y ago
        The bad ones won't even give you IPv6 to begin with, haha. Not that I want it anyway.

throw0101c 4y ago

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, that goes along with non-global addresses: * https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_... Your end-user device knows its address and the address of the other connection point, and can tell the firewall to open a rule between only those two IPs: * https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol * http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf Further, because you don't have only one external IP, you don't have to futz around with non-default ports if you want multiple instances of the same service (e.g., Minecraft), because each instance can have its own IP. Further, if you want certain devices to not able to get outside: (a) give them static assignments and block them at the firewall, (b) don't give them a default route so they are subnet-local, or (c) give them site-local addresses via ULA and do not set up NTPv6 translation.

gxt 4y ago
How does that protect privacy of the private network? I don't want to divulge any information about internal topology.
- adgjlsfhk1 4y ago
  what do you mean by topology? the only information leaked would be the number of computers making requests.
  - Faark 4y ago
    And what computer is making what requests. Now that i think about it, this cloud be the reason why youtube started making recommendations based on stuff i just watched in private browser tabs...

audunw 4y ago

> as if that's something that anybody wants. Of course I do. Why would you not want the option of easily allowing a device to be globally routable if you need it to be? I think routers should be more explicit about how you set up each new device on a private network anyway. Guest wifi can have a sane default. Private wifi could make a notification pop up on your trusted device, asking you if you want the now device to have access to the internet, and if the internet should have access to the device, and if so, which subnets/countries should be able to access it through which ports.

aflag 4y ago
Most people don’t need it, so that’s why they don’t want it. OP didn’t say people object to it, just that it’s not something most people cares about.
- hot_gril 4y ago
  It's fairly common to want P2P connections, even if the users aren't aware of it. A lot of online games rely on NAT traversal, sometimes automatically picking a host based on whoever's NAT it can get past. I don't remember the details, but even the Nintendo Switch cares about NAT. A lot of would-be P2P applications end up using a relay server to get around that restriction, which adds significant cost and latency. Sure it's a well-established workaround by now, but it'd be nice not to rely on it.

1vuio0pswjnm7 4y ago

The article uses gaming and IPSEC as examples but not, say, ad servers and "tech" company websites or other websites desperate to collect data. Interesting coincidence. As the parent suggests, IPv6 creates more work to prevent more exfiltration. It is already difficult enough with IPv4. Could IPv6 fix a web infested with "tech" company intermediaries and return it to one where all participants can connect directly and if desired publish to audiences (without "tech" interplopers). That sort of proposal would make an interesting read for end users.

1vuio0pswjnm7 4y ago
Toward that end, CJDNS has been most interesting use of IPv6 I have seen to date.

topranks 4y ago

NATs at very least complicate things. Even if you never allow anything in from outside that wasn’t established from the inside first, it still removes an added layer of complexity from things.

HyperSane 4y ago

Verizon wants $500 to enable IPv6 on an LTE SIM.

qalmakka 4y ago

NAT is not only bad because you don't have publicly routable addresses, but because it's a hack and a pretty "clever" one at that, aka, incredibly nasty. If we had networking protocols that took into account the complexities of private addresses it could probably work - but we don't have such a luxury. The entire TCP/IP stack assumes peer to peer connections, and NAT is literally a spanner in the works for all that.

bert64 4y ago

Routable does not mean reachable. A firewall is perfectly capable of controlling traffic between two routable addresses, without the added burden and complexity of having to translate the traffic to/from a non routable address. The whitehouse has a public address, everyone knows its address and yet random people can't just walk in through the front door.