4 ms·

You say ipv6 was supposed to get rid of NAT. Can you explain why it doesn't? You then say the problem was built into ipv6 from the start. From looking it up it

You say ipv6 was supposed to get rid of NAT. Can you explain why it doesn't? You then say the problem was built into ipv6 from the start. From looking it up it looks like it's mostly required when IP's change (e.g. when you change ISP), which for me is more of an argument to use DNS if you want fixed addresses.

ta1243 3y ago
The existence of NAT66 and NPTv6 are proof that there is still a need for NAT in an ipv6 environment. Maybe not in your environment, but people wouldn't make these solutions if there wasn't a need.
- robertlagrant 3y ago
  There's certainly a requirement for them, but it would be good to know what the justification of that requirement was before we know if there's a need. E.g. the justification could be "our SOPs say all network traffic must go through NAT", and if you dig deeper you might find that the SOP was written to save money on IPv4 addresses. That would not indicate a fundamental need.
  - ta1243 3y ago
    > There's certainly a requirement for them Thus proving that ipv6 failed in it's mission to get rid of nat
    - robertlagrant 3y ago
      I don't think this is a useful thing to say. If I keep trying to fill up my electric car with petrol, and get so annoyed that it keeps spilling on the floor that I pay someone to install a petrol cap and fuel tank, it would be equally silly to say that electric cars failed in their mission to get rid of petrol use.
  - Retric 3y ago
    NAT works well as an ultra simple firewall. All those ancient IoT devices don’t need to accept traffic from arbitrary addresses, but they may need to communicate with the outside world. Using a firewall is obviously an option, but why give an IP to something you don’t want accessible by the outside world?
    - lxgr 3y ago
      > NAT works well as an ultra simple firewall. There's something that works even better as an ultra simple firewall: An ultra simple firewall! > why give an IP to something you don’t want accessible by the outside world? - You might change your mind about it needing to be accessible by the outside world, and if it already has a global address you don't need to renumber everything. - Addressing and routing aren't the same thing; it can be useful to have globally unique addressing even without global reachability.
      - Retric 3y ago
        Ultra simple firewalls that expose your internal network architecture are less secure than NAT. You simply cannot information about your internal network without risk and there’s zero direct benefit for doing so.
- ClumsyPilot 3y ago
  > The existence of NAT66 and NPTv6 are proof that there is still a need for NAT in an ipv6 environment The existence of fridges with twitter integration proves that there is a need to a Lettice to tweet. There are all kinds of things that exist, steam-powered motorbike among them. Not all of them exist for the right reasons.
- thelastparadise 3y ago
  One such use case: multi wan routing. Would you rather have a bunch of routers sending out advertisements which every client needs to sort out, or have one consistent multi wan load balancing/failover policy that is transparent to clients?
  - ta1243 3y ago
    IPv6 purists think that you can simple have multiple IP addresses on each client, all configured magically, and reconfigured transparently when your ISP changes, with every device somehow knowing via some form of policy deployment (perhaps via dhcpv6) which network to use for a given flow. That's so much simpler than simple src-natting your clients at the edge of your control and routing your outgoing traffic based on a policy at your natting device /s
- elsjaako 3y ago
  There's obviously a need, I didn't deny that. I'm not arguing for ipv6, I just want to learn. The uses that I found while searching weren't very convincing, I was hoping you could give an example.
  - deleted 3y ago
    [deleted]
  - lxgr 3y ago
    Network sharing from a device that has only a single IPv6 /128 address comes to mind.
stock_toaster 3y ago
One reason could be the proliferation of prefix delegation, meaning an ISP now controls the numbering of your internal network, and it keeps constantly changing the net block, so you can never get stable local addressing… so you just keep running dual stack or try to use nat66 with a ULA network as a kludge or something.
- crest 3y ago
  The only in theory clean alternative to the kludges you mentioned is to let DHCPv6 renumber your network automatically which is a major change in how you have to think about your network.
- pantalaimon 3y ago
  You can have multiple IPv6 addresses on your interface, so you can have both the ULA address for internal use as well as the global address - no need for NAT
  - stock_toaster 3y ago
    Source address selection for multiple non-loopback addresses was (maybe still is?) notoriously bad in many OS’s for years.
  - Macha 3y ago
    However, the priority order on your OS for address selection, even when it comes to stuff like choosing which DNS results to use is IPv6 global address > IPv4 > ULAs. So on a dual stack network, ULAs with not be used unless the only address is a ULA. And even if you run your internal services with only an AAAA record pointing to the ULA, the client's source address will likely be the global address of the client device unless you tweak the tables on each client, which then means you'll need to have your global address in all your firewall rules to access the internal services on ULAs, which then means you're not saved from having your ISP-provided global address in your configuration, which is what you were trying to avoid by using ULAs.
    - 3y ago

ta1243 3y ago

The existence of NAT66 and NPTv6 are proof that there is still a need for NAT in an ipv6 environment. Maybe not in your environment, but people wouldn't make these solutions if there wasn't a need.

robertlagrant 3y ago
There's certainly a requirement for them, but it would be good to know what the justification of that requirement was before we know if there's a need. E.g. the justification could be "our SOPs say all network traffic must go through NAT", and if you dig deeper you might find that the SOP was written to save money on IPv4 addresses. That would not indicate a fundamental need.
- ta1243 3y ago
  > There's certainly a requirement for them Thus proving that ipv6 failed in it's mission to get rid of nat
  - robertlagrant 3y ago
    I don't think this is a useful thing to say. If I keep trying to fill up my electric car with petrol, and get so annoyed that it keeps spilling on the floor that I pay someone to install a petrol cap and fuel tank, it would be equally silly to say that electric cars failed in their mission to get rid of petrol use.
- Retric 3y ago
  NAT works well as an ultra simple firewall. All those ancient IoT devices don’t need to accept traffic from arbitrary addresses, but they may need to communicate with the outside world. Using a firewall is obviously an option, but why give an IP to something you don’t want accessible by the outside world?
  - lxgr 3y ago
    > NAT works well as an ultra simple firewall. There's something that works even better as an ultra simple firewall: An ultra simple firewall! > why give an IP to something you don’t want accessible by the outside world? - You might change your mind about it needing to be accessible by the outside world, and if it already has a global address you don't need to renumber everything. - Addressing and routing aren't the same thing; it can be useful to have globally unique addressing even without global reachability.
    - Retric 3y ago
      Ultra simple firewalls that expose your internal network architecture are less secure than NAT. You simply cannot information about your internal network without risk and there’s zero direct benefit for doing so.
ClumsyPilot 3y ago
> The existence of NAT66 and NPTv6 are proof that there is still a need for NAT in an ipv6 environment The existence of fridges with twitter integration proves that there is a need to a Lettice to tweet. There are all kinds of things that exist, steam-powered motorbike among them. Not all of them exist for the right reasons.
thelastparadise 3y ago
One such use case: multi wan routing. Would you rather have a bunch of routers sending out advertisements which every client needs to sort out, or have one consistent multi wan load balancing/failover policy that is transparent to clients?
- ta1243 3y ago
  IPv6 purists think that you can simple have multiple IP addresses on each client, all configured magically, and reconfigured transparently when your ISP changes, with every device somehow knowing via some form of policy deployment (perhaps via dhcpv6) which network to use for a given flow. That's so much simpler than simple src-natting your clients at the edge of your control and routing your outgoing traffic based on a policy at your natting device /s
elsjaako 3y ago
There's obviously a need, I didn't deny that. I'm not arguing for ipv6, I just want to learn. The uses that I found while searching weren't very convincing, I was hoping you could give an example.
- deleted 3y ago
  [deleted]
- lxgr 3y ago
  Network sharing from a device that has only a single IPv6 /128 address comes to mind.

stock_toaster 3y ago

One reason could be the proliferation of prefix delegation, meaning an ISP now controls the numbering of your internal network, and it keeps constantly changing the net block, so you can never get stable local addressing… so you just keep running dual stack or try to use nat66 with a ULA network as a kludge or something.

crest 3y ago
The only in theory clean alternative to the kludges you mentioned is to let DHCPv6 renumber your network automatically which is a major change in how you have to think about your network.
pantalaimon 3y ago
You can have multiple IPv6 addresses on your interface, so you can have both the ULA address for internal use as well as the global address - no need for NAT
- stock_toaster 3y ago
  Source address selection for multiple non-loopback addresses was (maybe still is?) notoriously bad in many OS’s for years.
- Macha 3y ago
  However, the priority order on your OS for address selection, even when it comes to stuff like choosing which DNS results to use is IPv6 global address > IPv4 > ULAs. So on a dual stack network, ULAs with not be used unless the only address is a ULA. And even if you run your internal services with only an AAAA record pointing to the ULA, the client's source address will likely be the global address of the client device unless you tweak the tables on each client, which then means you'll need to have your global address in all your firewall rules to access the internal services on ULAs, which then means you're not saved from having your ISP-provided global address in your configuration, which is what you were trying to avoid by using ULAs.
  - 3y ago