6 ms·

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT mak

> I don't want anything on my network to be globally routable. Then... don't route anything on your network. NAT is address translation, not routing. NAT makes it difficult for you to host services on your network, forcing dependency on cloud services, and when ISPs do it (CGNAT), it makes it just about impossible unless you want to thread your traffic back through a third-party service. If you want a good chance of keeping some semblance of an Internet around that isn't dominated by huge centralized services, the cargo cult of "NAT is security" needs to die hard.

michaelt 4y ago
Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providing routable addresses for home users, thus avoiding CGNAT. But zealous firewalling and the rise of mobile devices mean these days almost everything is sent over HTTPS to a cloud server. I haven't had software ask me to open a port on my router in a decade or more. Even games and video conferencing software know they have to work out-of-the-box on networks where the user can't adjust the NAT. So who's going to benefit from all this hassle - the 0.1% of users who are hosting websites from home?
- davikr 4y ago
  To "avoid domination by huge centralized services", of course. What if you want to run something like a website from your own IP, but you can't because you're behind CGNAT?
  - wankle 4y ago
    I use a public VPS and Wireguard. Costs $3.50 for the VPS which has a static IP. I host on my laptop. I can take my laptop anywhere in the world there's an Internet connection and my email and web sites continue to work right from the same VPS IP because my laptop connects to the Wireguard server on my VPS when it comes up.
    - lmm 4y ago
      That $3.50 will go up and up as IPv4 addresses get scarcer.
      - sgjohnson 4y ago
        Hetzner already charges €2.50/monthly for the IPv4 address alone.
- tenebrisalietum 4y ago
  Another reason is that NAT is making IPv4 live longer than it should, making IPv4 addresses more expensive. Maybe you don't want to host cloud services from your home, but if IPv4 addresses start costing millions of dollars (I know blocks of them can go for that much--if we're already there do you want to go further?), that drives up the cost for anyone using the Internet even if you are super okay with CG-NAT (which you shouldn't be). IPv6 will fix that.
- deleted 4y ago
  [deleted]
- unethical_ban 4y ago
  If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address. The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or incompetence of device manufacturers, primarily, holding us back. (and incompetence around IPv6 in general - I talked to a network guy at a large company recently and they were deploying /58s. WHY?!) The benefits of IPv6 may not be just for you - it's for the planet, it's for the developing nations, it's for the future where IPv4 does not cut it. It's bigger than your home network.
  - wankle 4y ago
    IPv4 cuts it everywhere. IPv6 does not do anything to save the planet. IPv6 does have privacy concerns stated by many on this page. IPv6 could be shut down tomorrow and the Internet would continue working well.
    - CircleSpokes 4y ago
      No it wouldn't. Basically all mobile networks would break and have to do even more layers of NAT to meet demand. > IPv6 does not do anything to save the planet. The world doesn't have enough IPV4 addresses. It literally solves the problem. It is crazy to me so many people here are arguing for multileveled NAT instead of the obvious solution we have had for 20 years.
      - wankle 4y ago
        > The world doesn't have enough IPV4 addresses. If 8 billion people wanted to host their own email and web, yes, we'd not have enough addresses for each person to have one. That isn't the case though. It will never be the case. If we look into the future and say well in 2023 5% of the world's population ran their own email and web for personal or business purposes and that number were to grow by 5% every year then in 20 years we would run out. That's a worse case, contrived scenario but even in that case, we'd still have 20 years to come up with something better than IPv6 that truly respects privacy and doesn't track each person.
- xjay 4y ago
  The sad part to me is that the original IP header included variable-length addresses up to 128 bits, using two 4-bit fields called Source Address Length (SAL), and Destination Address Length (DAL). [1] Early hardware implementations could have settled on 32-bit, but 48-bit would make more sense to be in line with EUI-48/MAC-48 (ethernet frame). The world could then gradually upgrade hardware over the decade to handle a larger address. [1] https://www.rfc-editor.org/ien/ien28.pdf https://www.rfc-editor.org/ien/ien28.pdf
- AtlasBarfed 4y ago
  I've always posited that web services didn't become widespread because of the church of REST, or even that the HTTP protocol is that amazing. It's because you could get through the firewall without a four month review with the firewall team. Well, and you could reuse web tools and software. Ok, that's probably it, but the firewall convenience is DEFINITELY a thing.
- bert64 4y ago
  Pushing all your traffic through a third party cloud server causes a lot of problems. It costs that third party real money to run that server... What happens when they decide to shut if off because they no longer want to bear the costs? Your applications are a ticking timebomb... What about privacy? What if the operator of that server decides to fund it through selling your data? Sending your traffic through a third party server adds latency, sometimes a LOT of latency if that server is far away. This is very bad for certain latency sensitive things (gaming, calls etc). If you're dependent on a third party server then you're screwed if it goes down, even if your own connection is fine. Doing away with that and going back to peer to peer is MUCH better in most cases.
tinus_hn 4y ago
With NAT it is impossible to make a mistake that causes machines with a private address to become reachable to the internet. That is a reality that is not going anywhere, no matter if you like it or not, no matter if you think it is stupid or not.
- unethical_ban 4y ago
  Every home router could be built with a default deny inbound for traffic, with big flashing lights saying "do not override this". IPv6 has private addressing and a form of NAT as well, were it to be the will of router mfg'ers and network admins. No need to stay on a legacy protocol.
- tenebrisalietum 4y ago
  UPnP? Also STUN makes your private addresses reachable without you making any mistake at all. Your comment is a good example of the NAT cargo cult mentality that is damaging to the Internet.
  - tinus_hn 4y ago
    Similarly, your comment is a good example of the anti NAT cargo cult mentality that people think is smart but really isn’t. The reality is that NAT has greatly improved the security of the internet, because before NAT people were exposing everything, including services like Windows file sharing, to the internet. NAT enabled those people to use multiple devices in their home and in return prevented them from unwittingly hosting things to the internet, which causes them to be hacked and turned into bots that harass the rest of the internet. Yes that still happens but not at the scale it happened before everyone was behind a NAT perimeter. If you want to see what could happen look up the SQL Slammer worm and imagine what could have happened if such a worm would have targeted a service more common than SQL Server. It’s really nice to be able to host things on a consumer connection but it requires thought and management that most consumers just can’t and won’t care to provide and the damage they can cause is not only to themselves but to the rest of the internet as well. This capability really is better off by default. And all those handwavy ‘workarounds’ for the ‘cargo cult mentality’, you typically can’t tell everyone on your network how to manage their computer to ‘just have their services listen on the local address’ and you can’t ‘just change the defaults of all routers’. But NAT makes it impossible for the default to be wrong and that is its great advantage. Sure NAT has a lot of disadvantages and breaks the original idea of the internet with every host equally able to host services. But just as Postel’s law just doesn’t work out, every host being able to host services doesn’t work out. Because the internet is not a playground full of friendly colleagues and hasn’t been for a long time. It’s a war zone that requires strong, watertight defenses by default. And if you’re smart and careful enough to safely host a service to the internet, surely you can manage to forward a port.

michaelt 4y ago

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providing routable addresses for home users, thus avoiding CGNAT. But zealous firewalling and the rise of mobile devices mean these days almost everything is sent over HTTPS to a cloud server. I haven't had software ask me to open a port on my router in a decade or more. Even games and video conferencing software know they have to work out-of-the-box on networks where the user can't adjust the NAT. So who's going to benefit from all this hassle - the 0.1% of users who are hosting websites from home?

davikr 4y ago
To "avoid domination by huge centralized services", of course. What if you want to run something like a website from your own IP, but you can't because you're behind CGNAT?
- wankle 4y ago
  I use a public VPS and Wireguard. Costs $3.50 for the VPS which has a static IP. I host on my laptop. I can take my laptop anywhere in the world there's an Internet connection and my email and web sites continue to work right from the same VPS IP because my laptop connects to the Wireguard server on my VPS when it comes up.
  - lmm 4y ago
    That $3.50 will go up and up as IPv4 addresses get scarcer.
    - sgjohnson 4y ago
      Hetzner already charges €2.50/monthly for the IPv4 address alone.
tenebrisalietum 4y ago
Another reason is that NAT is making IPv4 live longer than it should, making IPv4 addresses more expensive. Maybe you don't want to host cloud services from your home, but if IPv4 addresses start costing millions of dollars (I know blocks of them can go for that much--if we're already there do you want to go further?), that drives up the cost for anyone using the Internet even if you are super okay with CG-NAT (which you shouldn't be). IPv6 will fix that.
deleted 4y ago
[deleted]
unethical_ban 4y ago
If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address. The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or incompetence of device manufacturers, primarily, holding us back. (and incompetence around IPv6 in general - I talked to a network guy at a large company recently and they were deploying /58s. WHY?!) The benefits of IPv6 may not be just for you - it's for the planet, it's for the developing nations, it's for the future where IPv4 does not cut it. It's bigger than your home network.
- wankle 4y ago
  IPv4 cuts it everywhere. IPv6 does not do anything to save the planet. IPv6 does have privacy concerns stated by many on this page. IPv6 could be shut down tomorrow and the Internet would continue working well.
  - CircleSpokes 4y ago
    No it wouldn't. Basically all mobile networks would break and have to do even more layers of NAT to meet demand. > IPv6 does not do anything to save the planet. The world doesn't have enough IPV4 addresses. It literally solves the problem. It is crazy to me so many people here are arguing for multileveled NAT instead of the obvious solution we have had for 20 years.
    - wankle 4y ago
      > The world doesn't have enough IPV4 addresses. If 8 billion people wanted to host their own email and web, yes, we'd not have enough addresses for each person to have one. That isn't the case though. It will never be the case. If we look into the future and say well in 2023 5% of the world's population ran their own email and web for personal or business purposes and that number were to grow by 5% every year then in 20 years we would run out. That's a worse case, contrived scenario but even in that case, we'd still have 20 years to come up with something better than IPv6 that truly respects privacy and doesn't track each person.
xjay 4y ago
The sad part to me is that the original IP header included variable-length addresses up to 128 bits, using two 4-bit fields called Source Address Length (SAL), and Destination Address Length (DAL). [1] Early hardware implementations could have settled on 32-bit, but 48-bit would make more sense to be in line with EUI-48/MAC-48 (ethernet frame). The world could then gradually upgrade hardware over the decade to handle a larger address. [1] https://www.rfc-editor.org/ien/ien28.pdf https://www.rfc-editor.org/ien/ien28.pdf
AtlasBarfed 4y ago
I've always posited that web services didn't become widespread because of the church of REST, or even that the HTTP protocol is that amazing. It's because you could get through the firewall without a four month review with the firewall team. Well, and you could reuse web tools and software. Ok, that's probably it, but the firewall convenience is DEFINITELY a thing.
bert64 4y ago
Pushing all your traffic through a third party cloud server causes a lot of problems. It costs that third party real money to run that server... What happens when they decide to shut if off because they no longer want to bear the costs? Your applications are a ticking timebomb... What about privacy? What if the operator of that server decides to fund it through selling your data? Sending your traffic through a third party server adds latency, sometimes a LOT of latency if that server is far away. This is very bad for certain latency sensitive things (gaming, calls etc). If you're dependent on a third party server then you're screwed if it goes down, even if your own connection is fine. Doing away with that and going back to peer to peer is MUCH better in most cases.

tinus_hn 4y ago

With NAT it is impossible to make a mistake that causes machines with a private address to become reachable to the internet. That is a reality that is not going anywhere, no matter if you like it or not, no matter if you think it is stupid or not.

unethical_ban 4y ago
Every home router could be built with a default deny inbound for traffic, with big flashing lights saying "do not override this". IPv6 has private addressing and a form of NAT as well, were it to be the will of router mfg'ers and network admins. No need to stay on a legacy protocol.
tenebrisalietum 4y ago
UPnP? Also STUN makes your private addresses reachable without you making any mistake at all. Your comment is a good example of the NAT cargo cult mentality that is damaging to the Internet.
- tinus_hn 4y ago
  Similarly, your comment is a good example of the anti NAT cargo cult mentality that people think is smart but really isn’t. The reality is that NAT has greatly improved the security of the internet, because before NAT people were exposing everything, including services like Windows file sharing, to the internet. NAT enabled those people to use multiple devices in their home and in return prevented them from unwittingly hosting things to the internet, which causes them to be hacked and turned into bots that harass the rest of the internet. Yes that still happens but not at the scale it happened before everyone was behind a NAT perimeter. If you want to see what could happen look up the SQL Slammer worm and imagine what could have happened if such a worm would have targeted a service more common than SQL Server. It’s really nice to be able to host things on a consumer connection but it requires thought and management that most consumers just can’t and won’t care to provide and the damage they can cause is not only to themselves but to the rest of the internet as well. This capability really is better off by default. And all those handwavy ‘workarounds’ for the ‘cargo cult mentality’, you typically can’t tell everyone on your network how to manage their computer to ‘just have their services listen on the local address’ and you can’t ‘just change the defaults of all routers’. But NAT makes it impossible for the default to be wrong and that is its great advantage. Sure NAT has a lot of disadvantages and breaks the original idea of the internet with every host equally able to host services. But just as Postel’s law just doesn’t work out, every host being able to host services doesn’t work out. Because the internet is not a playground full of friendly colleagues and hasn’t been for a long time. It’s a war zone that requires strong, watertight defenses by default. And if you’re smart and careful enough to safely host a service to the internet, surely you can manage to forward a port.