4 ms·

>And this is what I said in my original comment, ipv6 has extra goals (like removing NAT day 1). Extra goals? Removing NAT? Come on now... Don't act like NAT w

>And this is what I said in my original comment, ipv6 has extra goals (like removing NAT day 1). Extra goals? Removing NAT? Come on now... Don't act like NAT was invented along with the Internet itself, you know it wasn't. And again, never ever conflate NAT with private networks. NAT is a packet-modifying technique that is closely associated with stateful firewalls, but it still ain't firewall. If you want private networks, you would actually use a firewall, not NAT.

hot_gril 3y ago
Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. And even if it wasn't their original purpose, NATs are used as firewalls. Functionally they're similar except NATs also rewrite addresses, which is actually a nice feature too. There's some reassurance in having such a clear default-deny behavior, with local IPs that aren't globally unique to begin with. What's the big problem with NAT existing anyway, especially when you're free to ditch it on your own network? Maybe because the main point of getting rid of NAT in v6 is to allow any device to claim a public IP on default networks, for p2p applications. NAT's default behavior would get in the way of that. So it seems like ipv6 is about pushing default-allow behaviors onto network operators. Again this is pretty separate from the address space crisis.
- orangeboats 3y ago
  >Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. Don't forget the context: we were talking about "removing NAT as an extra goal of IPv6," not "does it matter when was NAT invented". So here I am reiterating my point again: It was never an extra goal, considering that IPv6 was designed in an era when NAT never predominated the internet. >What's the big problem with NAT existing anyway, Oooh no biggie other than breaking all sorts of P2P communication? It's so bad that we have to implement literal hacks like TURN and STUN on top of the hack that is NAT itself. Or maybe we can talk about how it broke all sorts of protocols so badly that we to this day need application-level gateways[1] to help those protocols transverse NAT? Or let's have some time to talk about how inefficient NAT is. You should know it requires computing power to track each connection flow and to maintain a state table for those flows. >So it seems like ipv6 is about pushing default-allow behaviors onto network operators. Again this is pretty separate from the address space crisis. What are you talking about? Default-allow and default-deny are both firewall rules. Even NAT (the "full-cone" or "endpoint-independent" ones) is prone to this, if a port is open everyone can connect to you through the IP:port. I would say removal of NAT and addressing space is closely intertwined, but alas you seem to have pretty amateurish understanding of it. Also, just in case you bring up your IPv4.1 again: all address space enlarging efforts will inevitably face incompatibility issues. [1]: https://en.wikipedia.org/wiki/Application-level_gateway https://en.wikipedia.org/wiki/Application-level_gateway
  - hot_gril 3y ago
    IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening ports. You ok with that? I keep hearing this have your cake and eat it too kind of argument. "It supports P2P" and "just default-deny if you're worried about security" do not mix. We get one or the other as the assumed default. IPv4 + NAT is the default-deny. IPv6 seems to be about default-allow even if that's not inherent to it.
    - orangeboats 3y ago
      >IPv6 with default-deny firewalls in most places would break P2P communication too. That's why you have the PCP protocol to help you setup a hole in your firewall, you default-deny until some host in your network says "I can handle port 12345". If your router doesn't support that, in the worst case scenario you can fallback to manually setting up firewall entries much like NAT. Sure, PCP works in NAT cases too, but not always - especially in double-NAT or CGNAT scenarios. And we already know how prevalent CGNAT is, don't we? I don't know where do you live in, but here all ISPs have deployed CGNAT. By the way that's one of the disadvantages of having NAT, you are forced into a centralized architecture where the central node in the ISP (the CGNAT device) decides what kind of niceties you could get. IPv6, the ISP only carries traffic around and it does not meddle with layer 4 activities.

hot_gril 3y ago

Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. And even if it wasn't their original purpose, NATs are used as firewalls. Functionally they're similar except NATs also rewrite addresses, which is actually a nice feature too. There's some reassurance in having such a clear default-deny behavior, with local IPs that aren't globally unique to begin with. What's the big problem with NAT existing anyway, especially when you're free to ditch it on your own network? Maybe because the main point of getting rid of NAT in v6 is to allow any device to claim a public IP on default networks, for p2p applications. NAT's default behavior would get in the way of that. So it seems like ipv6 is about pushing default-allow behaviors onto network operators. Again this is pretty separate from the address space crisis.

orangeboats 3y ago
>Neither NATs nor firewalls were invented with the Internet, and it doesn't matter. NATs are a thing now. Don't forget the context: we were talking about "removing NAT as an extra goal of IPv6," not "does it matter when was NAT invented". So here I am reiterating my point again: It was never an extra goal, considering that IPv6 was designed in an era when NAT never predominated the internet. >What's the big problem with NAT existing anyway, Oooh no biggie other than breaking all sorts of P2P communication? It's so bad that we have to implement literal hacks like TURN and STUN on top of the hack that is NAT itself. Or maybe we can talk about how it broke all sorts of protocols so badly that we to this day need application-level gateways[1] to help those protocols transverse NAT? Or let's have some time to talk about how inefficient NAT is. You should know it requires computing power to track each connection flow and to maintain a state table for those flows. >So it seems like ipv6 is about pushing default-allow behaviors onto network operators. Again this is pretty separate from the address space crisis. What are you talking about? Default-allow and default-deny are both firewall rules. Even NAT (the "full-cone" or "endpoint-independent" ones) is prone to this, if a port is open everyone can connect to you through the IP:port. I would say removal of NAT and addressing space is closely intertwined, but alas you seem to have pretty amateurish understanding of it. Also, just in case you bring up your IPv4.1 again: all address space enlarging efforts will inevitably face incompatibility issues. [1]: https://en.wikipedia.org/wiki/Application-level_gateway https://en.wikipedia.org/wiki/Application-level_gateway
- hot_gril 3y ago
  IPv6 with default-deny firewalls in most places would break P2P communication too. No application would be able to rely on both users having open listening ports. You ok with that? I keep hearing this have your cake and eat it too kind of argument. "It supports P2P" and "just default-deny if you're worried about security" do not mix. We get one or the other as the assumed default. IPv4 + NAT is the default-deny. IPv6 seems to be about default-allow even if that's not inherent to it.
  - orangeboats 3y ago
    >IPv6 with default-deny firewalls in most places would break P2P communication too. That's why you have the PCP protocol to help you setup a hole in your firewall, you default-deny until some host in your network says "I can handle port 12345". If your router doesn't support that, in the worst case scenario you can fallback to manually setting up firewall entries much like NAT. Sure, PCP works in NAT cases too, but not always - especially in double-NAT or CGNAT scenarios. And we already know how prevalent CGNAT is, don't we? I don't know where do you live in, but here all ISPs have deployed CGNAT. By the way that's one of the disadvantages of having NAT, you are forced into a centralized architecture where the central node in the ISP (the CGNAT device) decides what kind of niceties you could get. IPv6, the ISP only carries traffic around and it does not meddle with layer 4 activities.