4 ms·

Yes, and the problem is that people and organizations have grown very accustomed and appreciate all these band aids. It's very flawed, but the flaws are very w

Yes, and the problem is that people and organizations have grown very accustomed and appreciate all these band aids. It's very flawed, but the flaws are very well understood and people actually seem to like operating all these workarounds. Not saying that's good, just what I'm seeing in the field.

kevincox 3y ago
Who is appreciating these bandaids? Are you talking about the fact that NAT has a defacto inbound firewall? It would be pretty easy to implement that firewall without a NAT.
- formerly_proven 3y ago
  There's two different ways of looking at the internet. The greybeards philosophy is how it initially was. There aren't multiple networks, there is supposed to be ONE network, THE internet with ONE global address space. The philosophy of those who grew up with NAT, who think that sounds insane. The internet is just the glue network between heaps and heaps of separate networks, each with their own, enclosed address space. Why would you want all networks to be one network, why should your printer have a globally-unique globally-routable address? The two different philosophies don't tend to get along.
  - kevincox 3y ago
    You can still have unique addresses and private networks. For things that shouldn't be globally routable give them a unique internal address. For things that should be give them a unique public address. It still makes things simpler to not have the NAT.
  - Dagger2 3y ago
    The whole point of using NAT is that you want to be part of the one network but can't get enough address space for your bit of it. If you didn't, you wouldn't even have routing to the Internet in the first place and therefore would have no need for NAT. It's perfectly fine to run a separate network. You can do that and still access Internet hosts easily by having one machine that's on both networks and running a proxy on it. But nobody wants to do that. Almost everybody actually wants to be able to route to the Internet and back, so they set a router up to join the networks, and then (on v4) they have to NAT because nobody will give them enough v4 space for their network. Unfortunately there's a severe lack of understanding of basic networking concepts and of what routing and NAT are doing, even in people who work in the field.
    - otabdeveloper4 3y ago
      NAT is not because you lack address space. NAT is for anonymity and for having a single point of control. (The same reason people use SSH jump hosts.)
      - BenjiWiebe 3y ago
        NAT is because you lack address space. Single point of control? That's your router, no matter what types of NAT or firewalls you are using.
        otabdeveloper4 3y ago
        Yes, and literally the only reason I have a router is to make my LAN devices behind it unroutable from outside. (It says so in the name "router" itself.)
        BenjiWiebe 3y ago
        Actually that isn't quite correct. A router is needed to route packets both directions, in your case and in a no-NAT scenario. The ISP could make everything a flat L2 network between consumers (you'd plug a switch into your ISP handoff), but that would be a bad idea on a lot of levels.
        Dagger2 3y ago
        That doesn't make any sense, because if you didn't want anybody from outside your network to route packets onto it, why not just not have the router? You actually do want your LAN devices to be routable from the outside, because you want them to be able to talk to Internet hosts and you want those hosts to be able to reply. That's the real reason you have the router. What you probably don't want is for people outside your network to be able to initiate new connections to inside of it, and that's something you get with a firewall, running either on your devices or on the router. NAT only comes in to any of this if your ISP can't issue you enough address space to use on your LAN, without which your network won't be routable even with a router in place. NAT is the big hack to try and get routing to work without sufficient ISP-assigned address space. It's not needed for anonymity or for getting a single point of control.

kevincox 3y ago

Who is appreciating these bandaids? Are you talking about the fact that NAT has a defacto inbound firewall? It would be pretty easy to implement that firewall without a NAT.

formerly_proven 3y ago
There's two different ways of looking at the internet. The greybeards philosophy is how it initially was. There aren't multiple networks, there is supposed to be ONE network, THE internet with ONE global address space. The philosophy of those who grew up with NAT, who think that sounds insane. The internet is just the glue network between heaps and heaps of separate networks, each with their own, enclosed address space. Why would you want all networks to be one network, why should your printer have a globally-unique globally-routable address? The two different philosophies don't tend to get along.
- kevincox 3y ago
  You can still have unique addresses and private networks. For things that shouldn't be globally routable give them a unique internal address. For things that should be give them a unique public address. It still makes things simpler to not have the NAT.
- Dagger2 3y ago
  The whole point of using NAT is that you want to be part of the one network but can't get enough address space for your bit of it. If you didn't, you wouldn't even have routing to the Internet in the first place and therefore would have no need for NAT. It's perfectly fine to run a separate network. You can do that and still access Internet hosts easily by having one machine that's on both networks and running a proxy on it. But nobody wants to do that. Almost everybody actually wants to be able to route to the Internet and back, so they set a router up to join the networks, and then (on v4) they have to NAT because nobody will give them enough v4 space for their network. Unfortunately there's a severe lack of understanding of basic networking concepts and of what routing and NAT are doing, even in people who work in the field.
  - otabdeveloper4 3y ago
    NAT is not because you lack address space. NAT is for anonymity and for having a single point of control. (The same reason people use SSH jump hosts.)
    - BenjiWiebe 3y ago
      NAT is because you lack address space. Single point of control? That's your router, no matter what types of NAT or firewalls you are using.
      - otabdeveloper4 3y ago
        Yes, and literally the only reason I have a router is to make my LAN devices behind it unroutable from outside. (It says so in the name "router" itself.)
        BenjiWiebe 3y ago
        Actually that isn't quite correct. A router is needed to route packets both directions, in your case and in a no-NAT scenario. The ISP could make everything a flat L2 network between consumers (you'd plug a switch into your ISP handoff), but that would be a bad idea on a lot of levels.
        Dagger2 3y ago
        That doesn't make any sense, because if you didn't want anybody from outside your network to route packets onto it, why not just not have the router? You actually do want your LAN devices to be routable from the outside, because you want them to be able to talk to Internet hosts and you want those hosts to be able to reply. That's the real reason you have the router. What you probably don't want is for people outside your network to be able to initiate new connections to inside of it, and that's something you get with a firewall, running either on your devices or on the router. NAT only comes in to any of this if your ISP can't issue you enough address space to use on your LAN, without which your network won't be routable even with a router in place. NAT is the big hack to try and get routing to work without sufficient ISP-assigned address space. It's not needed for anonymity or for getting a single point of control.