7 ms·
NAT is such a trashy abstraction. IPv4 needs to die.
by jjoonathan 3y ago
NAT is such a trashy abstraction. IPv4 needs to die.
- trustingtrust 3y agoYou'll hate CG-NAT even more then.
- lorenzo95 3y agoheh ... It's all IPv6 ULA here with Nat66
- i80and 3y agoThe first time I encountered CGNAT was such a rude shock. I don't think it should be legal to market it as "internet" to consumers
- sgt 3y agoIf your ISP gives you CGNAT, then the best thing you can do is to request a static public IP address. Will probably cost a little bit more but well worth it.
- kazinator 3y agoYou need NAT (or something else that is worse in some respects, like port forwarding) in any situation in which your subnet is given only one address upstream, even if it is an IPv6 address.
- xxpor 3y agoIf your ISP doesn't do PD with v6, their implementation sucks. Even my crappy 6rd setup from CenturyLink gives me iirc an entire /48.
- midasuni 3y agoMany ISPs suck. That’s not controversial. We have to deal with the world we live in, not the world we’d like.
- pantalaimon 3y agoThat's why variable length SLAAC has been proposed https://datatracker.ietf.org/doc/draft-mishra-6man-variable-slaac/08/ https://datatracker.ietf.org/doc/draft-mishra-6man-variable-...
- yrro 3y agooh no
- growse 3y ago> Many ISPs suck. That’s not controversial. > We have to deal with the world we live in, not the world we’d like. No we don't. Some choose to just put up with shittiness, others enact change.
- kazinator 3y agoOP here. Your "ISP" is a sysadmin at work who gives you one address to your cube. You otherwise like the work and the team, and the compensation is fine. Now what?
- growse 3y ago> Now what? You advocate for change. You make the case. You might not win the battle, but you're by no means forced to accept the status quo. The more who fight the battle, the more win. The more win, the faster progress, which benefits us all.
- kazinator 3y agoI set up NAT, I move on. If you can solve a problem technically, without involving people, that is best.
- paulddraper 3y agoYeah, but there's no reason to do that with IPv6
- midasuni 3y agoI have a few devices on my home internet, on a handful of 192.168 subnets The other week I moved my ISP. The AS my house belonged to obviously changed to the new ISP, and I got a new v4 IP All I had to do was update my Wan router to forward trafffic from the new Ip. Instead with ipv6 I would have to change every node on my network, update my internal DNS. Now in theory I could have my own /48 which I take with me. That relies on my new ISP being willing to advertise it (which my current one does) but it’s not particularly common. However a week ago my phone line was cut. I got a 5g mifi out and moved my wan connectivity through that until the cable was fixed. Again a nice simple masquerade on that interface and all was good (well not that good - very poor signal where I live) But the elephant in the room is of course all that ipv6 stuff aside, I still need to run a dual stack (or use trashy nat abstractions). It increases my work for no benefit. But taking about work, how about there? I have a fleet of vehicles on internal 172.16/12 subnets, they plug together and route to each other, and route from where they are via a variety of vpn connectivity (hoping that at least one method will work, as there’s rarely a signal in the basements these park) If I moved them to ipv6 then again I’m back to having to move my /48s. Except these vehicles get internet from various sporting venues - most of which struggle to turn off MITM/443 or unblock UDP, that’s just not going to work in a world where they turn up at 10am Saturday morning and need to be working 2 hours later. What business benefit is there for me to double the workload and double the risk by moving to dual stack?
- pixl97 3y agoI do believe there is some kind of 1:1 NAT with IPv6 these days, which is way better than 1:Many of IPv4. There are so many potentially useful applications that are DOA because of v4 NAT being everywhere.
- midasuni 3y agoThose applications are DOA because of firewall administrators that barely allow tcp/443 through.
- deleted 3y ago[deleted]
- 3y ago
- mindslight 3y agoIs there a better way to not unnecessarily leak addressing metadata to adversarial remote nodes and middle boxes? IPv6 with assigning end users a whole /64 and end-devices continually churning through privacy addresses is a start. But even then some form of NAT is still required to nimbly use source prefixes from different horizon providers - eg to avoid spilling your geographic location or opening yourself up to low-effort legal shakedowns. An example: on my local network I've got an everyday web browsing VM and a torrent VM. They each have static 192.168.x.x addresses, both so I can ssh in for administration and also to control their view of network services. They each see a completely different Internet horizon through the router - the web browsing goes out from a rotating datacenter IP, and the torrent one goes out from a consumer VPN. Each of those outgoing horizons uses NAT - any of my hosts using that rotating data center IP appears the same, and any of my host using the consumer VPN appears the same as every other customer using that same VPN node. What is the no-NAT equivalent of this? Make that rotating data center IP and VPN external IP into subnet allocations, somehow feed that addressing information back to the hosts that are using it, and dual-home each VM with two routable addresses? For equivalent mixing on the consumer VPN there would also need to be some ARP-like protocol that let me continually rotate the address.
- jandrese 3y agoWhy not just use a VPN in both cases? That’s more or less what your NAT solution is doing, except without the encryption to the data center.
- mindslight 3y agoIt is a wireguard tunnel to the data center, but my comment was focused on the addressing.
- 3np 3y ago> What is the no-NAT equivalent of this? At least for web-browsing and other HTTP/TCP use-cases: Cut off internet from your hosts and use centralized local proxies for all outgoing connections. Presumably you already have reverse proxies in place for the incoming. There is no need for NAT if all the traffic is taken care of in higher layers. This reduces your consideration to the internet-facing forward- and reverse-proxies only. Sounds like you already have bittorrent figured out via VPN (Wireguard I guess? Well there we have one more UDP exit-point to consider). BTW, I largely agree with your sentiment: Benefit of (especially migrating to) IPv6/DS for individual networks is often unclear or questionable and metadata privacy is a valid consideration where I believe correct solutions are not readily available and understood even by your well-intentioned and seasoned senior admins. Maybe globally the number of people who will get this right ranges in the 1000s? 10,000s if we're lucky? How many networks do we need to migrate again for "IPv4 to die"? I guess the only way forward is for more people to do that migration and share their findings and solutions, though ;)
- riffic 3y agobe mindful of the Lindy effect, an observation on the future longevity of non-perishable things like technology or an idea being proportional to their current age, ipv4 due to its age will likely be around for quite some time to come. https://en.wikipedia.org/wiki/Lindy_effect https://en.wikipedia.org/wiki/Lindy_effect
- littlecranky67 3y agoNot sure IPv6 will fix this. Technically, yes it does. But major providers only assigning a /64 to a home user (and charging hefty fees for "buisness use" /48) already leads to IPv6 NAT or segmenting the /64 further - which shoulnt be done.
- lazide 3y agoMost seem to have stopped and are handing out /48’s in my experience. Do you know any not doing that still?
- littlecranky67 3y agoI'm with one of the biggest german internet providers (o2 Telefonia) and they are not even providing any IPv6 at all (at least not in all regions, and without calling support to enable this feature individually).
- lazide 3y agoThanks for the correction! Hopefully they get their act together soon.
- mike_hock 3y agoWhy would anyone need /64 if not to segment it further.
- littlecranky67 3y agoWell ask the IETF, the RFCs say that sub-segmenting a /64 shouldn't be done. Yet people do, and the result is - well - here be dragons depending on the implementations.
- zamadatix 3y agoSo nobody ever again needs to think "what size end user subnet is in use". It's /64, it's always /64. It doesn't matter if you're embedding MAC addresses, using random assignment, using multiple assignments, have 1 device, have 1 trillion devices. It's a /64.
- jaimex2 3y agoIPv6 needs to die also. It had more than enough time to become dominant and has just floundered.
- sgjohnson 3y agohttps://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html 45% (and growing) of all traffic to Google is IPv6. Hardly "floundered". It's just that most major ISPs in the developed world have so many IPv4 addresses they don't care that much about IPv6 yet. Now, try starting a new ISP without CGNAT (which will lead to a garbage experience for everyone) or IPv6. You'll have to spend literal tens (if not hundreds) of millions just on IP addresses alone.
- commandersaki 3y ago25 years and we've only got 45% We should've been at 95% decades earlier if they came up with an actual transition plan.
- sgjohnson 3y ago"25 years" is not fair. There was no immediate need for IPv6 for anyone 10 years ago, so it should be no surprise that it's not at 95% currently. Now there is.
- commandersaki 3y ago20 years ago DJB called it [0]. The same problems exist. The only place IPv6 has gained any success is in the mobile market since handsets tend to be homogeneous and therefore configurable, which does allow a decrease in load of CGNAT for carriers. However, this success is not replicated in the broadband realm and probably never will be for all same reasons outlined by DJB. IPv6 is a second class network. [0]: https://cr.yp.to/djbdns/ipv6mess.html https://cr.yp.to/djbdns/ipv6mess.html
- 3y ago
- backendanon 3y agoIPv6 needs to die. IPv4 using NAT ensures a moderately high level of privacy. IPv6 with privacy extensions does not.
- commandersaki 3y agoYou mean the unsung hero of the Internet.