7 ms·

NAT doesn't get the hate it deserves for stopping people from running their own servers. I remember being being 18, making my first websites using the LAMP sta

NAT doesn't get the hate it deserves for stopping people from running their own servers. I remember being being 18, making my first websites using the LAMP stack and not understanding why my friends were unable to access them from their homes. I knew the basic workings of the IP protocol, but hadn't read about NAT, and the responses online talked about "public and private IP addresses", which made no sense to me -- "Aren't all IP addresses supposed to be public? Isn't that how the protocol works?" Even after learning about how NAT works, I had no way to work around it, as my ISP blocked the router's web interface and I was unable to do port forwarding. I would bet that there are at least dozens of millions of people that didn't pursue a career in IT because of NAT. We should ask ourselves if collectively allowing NAT to be what it is was a good decision in the first place.

spogbiper 3y ago
Most ISPs I've encountered (various places in the USA) do allow port forwarding or even replacing the ISPs router with one of your own. I'm not sure NAT has been a massive obstacle for most people interested in networking. And without NAT, we would have had to use IPv6 or something even worse. That would probably have turned off a lot of aspiring network engineers too.
- TheFreim 3y ago
  > Most ISPs I've encountered (various places in the USA) do allow port forwarding or even replacing the ISPs router with one of your own. In the United States my entire life I have always been able to port forward when necessary, though I've only been on two or maybe three providers. I also would help friends in middle and high school port forward so we could connect to their game servers. Many providers seem to try to make it as hard as possible, attempting to lock down the interface behind a web panel. This can typically be bypassed by finding the real panel address locally or by getting a new router that isn't locked down. Growing up it was extremely easy, my provider didn't try to make it difficult, but now there is often a barrier to entry for people who desire to casually tinker with their network setup, which is unfortunate.
- retrac 3y ago
  In some countries, NAT was implemented at the ISP level and you had no public IP at all. I remember it being a consistent practical barrier back in the 90s for stuff like file transfers. I had a public IP but the other person didn't and had no way of getting one or setting up port forwarding. Back when file transfers were often done with direct connection.
- mondomondo 3y ago
  [dead]
- organsnyder 3y ago
  We had Comcast for 17 years, and they always allowed us to bring not only our own router, but our own modem. Even when we rented a combined modem+firewall+AP from them, it was trivial (and documented) to put it into bridge mode. We just switched to Metronet last month (5gbps symmetrical!), and while we have to pay $10/month to get a public static IP (CGNAT otherwise), they didn't care what was connected to the ONT, which operates below the IP layer.
jve 3y ago
NAT was/is a great for blocking incoming connections by default. A lesson I learnt when I found in early Windows XP days that my files are gone and a .txt note was left on my C: disk...
- throwup238 3y ago
  Remember when connecting an unpatched system to the internet would get it infected by the Blaster worm within the day? I ‘member.
- organsnyder 3y ago
  A non-NAT firewall can have the same default rules.
k_bx 3y ago
Tailscale solves this problem as is beginner-friendly, highly recommended.
- Cpoll 3y ago
  How would you set this up? You'd still need a box with a public IP to proxy the traffic, no? (Unless you get all your friends to install Tailscale so that they can access your private network).
  - peoplefromibiza 3y ago
    it/s called exit nodes in Tailscale
    - Cpoll 3y ago
      I don't think that would work? Exit nodes proxy traffic from the Tailscale network to the internet, not the other way around. Kind of like a consumer VPN. The other reply mentions Funnel, which I think fits the use case better.
  - maybe_pablo 3y ago
    If you want to expose a single web service you can do it via tailscale funnel[1] easily. [1] https://tailscale.com/blog/reintroducing-serve-funnel https://tailscale.com/blog/reintroducing-serve-funnel
epcoa 3y ago
I’m confused, are you complaining about ISP CGNAT or NAT in general? Did your ISP assign you a public IPv4 or not? If the former then you are lucky, that is a relative luxury. > Even after learning about how NAT works, I had no way to work around it, as my ISP blocked the router's web interface and I was unable to do port forwarding. Well this is Hacker News, you replace the router with your own. I have yet to encounter a residential wireline ISP in the US or Europe where using your own router is not a possibility. Even those that implemented 802.1x or similar I have been able to either deal with directly or work around. Not saying there don’t exist counterexamples but I would assume using an alternative router +/- MITM the old one would have been viable. Of course if the ISP was firewalling (likely) then you have a different problem. This isn’t really a NAT issue. More of a specific ISP policy issue. (NAT and ipv4 have nothing to do with it, they can just as easily port block inbound 80/443 on ipv6.) The argument boils down to: My ISP locked down the admin page on my rented router ergo NAT is evil. It’s not terribly sensible.
- dehrmann 3y ago
  > Did your ISP assign you a public IPv4 or not? If the former then you are lucky, that is a relative luxury. At least until the 10G fiber upgrade happens, Sonic has given me a static IPv4 address for a decade.
  - epcoa 3y ago
    Sure. I still remember when I could order additional static IPs on residential cable internet. That doesn’t mean most getting online today in Asia or Africa basically have a choice other than CGNAT IPv4 and IPv6 from their ISP. Your own dynamically assigned IPv4 is a relative luxury.
  - sosborn 3y ago
    Do they guarantee it is static? My current IP hasn't changed in years but I need to pony up if I want them to guarantee it forever.
    - josephcsible 3y ago
libraryatnight 3y ago
I remember joining an IRC FTP share channel when I was a kid, and wanting to share some of my files to get ratio to download some music and anime they had, and it was my first time attempting to setup an FTP and I thought i was all good to go and dropped my info in the channel and about 3 seconds later a bunch of people were lol'ing at my internal IP. They were cool though and everybody was helpful, learned a lot that night. IRC was so awesome in the 90s.
technothrasher 3y ago
I had the advantage of being 18 when the internet was still pretty open and I had all the access I needed through my university. I even remember finding a list of root passwords to various machines at Standford lying in one of the computer labs. No idea how it got there. But I tested one with a quick rlogin and it worked fine. Oops. I emailed them to let them know and got basically a <shrug> in reply. Those days certainly were easier for a kid who was learning networking, but they couldn't last with more and more people getting connected and making it more tempting for bad actors to fool around.
- chasd00 3y ago
  > I had the advantage of being 18 when the internet was still pretty open There is no doubt that is an extreme advantage. When I started college in the late 90s an upperclassman was in my dorm for a party and saw a trophy i had from a USFirst robotics competition in HS, he invited me to join an organization he was in that built autonomous robots (we called them "vehicles") for a competition. In that lab, we had network drops and static IPs on the schools inet connection. The lab's admin knew the DNS guys and so we could run whatever we wanted on a fast internet connection with access to our own hostnames. At this time Linux, Apache, PHP and MySQL were just starting to take off. That lab and inet opportunity convinced me to change my major to CS and kickstarted my whole career. edit: that "lab" was really just an unused room in a random building with some desks and hand tools like screwdrivers and stuff to work on our robots. ..but it had rj45 plugs :)
  - xattt 3y ago
    It wasn’t as hard back then to sift the chaff from the grain. You were either a computer nerd or you were part of the unwashed masses. If you showed any interest in computing, other geeks would take you with open arms (mostly) versus now where everyone and their dog wants in on the ground floor.
deleted 3y ago
[deleted]
j45 3y ago
Nat provides safer networking for the same masses who can’t understand it Depending on the year this was it was a pretty easy Google to learn to traverse nat, and use dynamic dns, or do port forwarding, even out to a Linode
- jrmg 3y ago
  If we didn’t have NAT ISPs would provide a router with a firewall that was just as safe.
  - j45 3y ago
    There was a time the modem was commonly separate from the router. Many ISPs do include a router in their modem with some wifi. It’s often limited in some capacity in real worth use which lets customers over pay and undercover speed and be open to upgrading to a faster plan.
  - jeroenhd 3y ago
    ISPs do provide routers with firewalls, for this very reason of course. You still need to open ports to actually reach the service you're hosting, only now you don't need to figure out what your actual IP is.
granshaw 3y ago
Can’t upvote this enough. It breaks the original spirit of the internet and is lazy “security” with a huge negative externality
- radiojosh 3y ago
  How exactly does it break the spirit of the Internet? The spirit of the Internet is that we run out of IPv4 addresses and everyone who uses the Internet has to learn IPv6 and be an expert on firewalls? I can't tell if you're being elitist because your defacto position is that everyone who uses the Internet has to be a cyber security expert, or if you're just being obtuse because a couple of Google searches will usually set you straight on setting up port forwarding through your router.
  - jeroenhd 3y ago
    You don't need to be a firewall expert to use a firewall. Stateful firewalls have been around for longer than I can remember. The default for any consumer firewall is "disable by default", as they should be. Now with NAT we need to be disable UPnP, and deal with "NAT types" on gaming consoles. Or Nintendo Switches breaking your LAN because Nintendo tells you to put your switch into the DMZ: https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console https://en-americas-support.nintendo.com/app/answers/detail/... Because of NAT, we now need to deal with firewalls _and_ port forwarding. Plus, because of https://www.armis.com/research/nat-slipstreaming-v2-0/ https://www.armis.com/research/nat-slipstreaming-v2-0/, your IPv4 firewall is practically disabled _because_ of NAT workarounds embedded into your router. You can pick between having a firewall on IPv4 or allowing WebRTC on any of your devices.
    - radiojosh 3y ago
      I don't understand your first point about firewalls, but port forwarding on a consumer router is no more difficult than opening a port on a firewall. Either one can be overcomplicated by a badly designed interface. See Uniquiti Edgerouter for an example. I know gaming consoles can be a pain with NAT, but is that NAT's fault? That link you pasted about the Nintendo Switch is literally just an article about setting up port forwarding. And that NAT slipstreaming issue is just a vulnerability caused by complicated protocols. Saying that a fundamental network technology is bad because its implementation is flawed doesn't make sense. I guess we should throw away x86-64 because Intel Skylake processors had side channel vulnerabilities.
crazygringo 3y ago
I don't understand -- you can purchase your own router instead of renting one from your ISP, which usually works out cheaper in the end too, and port forward. NAT was a necessity when it was being introduced, so I don't understand the complaints. Sure it's annoying, but what was the alternative? I don't think anyone was dissuaded from IT because of NAT. Heck, if anything, learning how to configure it might have been some people's first step into learning about networking and then getting into it as a career! And let's not forget that NAT served as a default firewall that did more than any anti-virus to protect PC's from malware.
- norenh 3y ago
  > NAT was a necessity when it was being introduced, so I don't understand the complaints. Sure it's annoying, but what was the alternative? IPv6
  - crazygringo 3y ago
    Nope. IPv6 still isn't supported everywhere. When you're running out of addresses, you need a workable solution at the moment. Not something that requires all networking equipment worldwide to be replaced with a new standard all at once, with is a practical impossibility.
    - BenjiWiebe 3y ago
      It doesn't have to be replaced all at once. Most of it already has been replaced.
      - crazygringo 3y ago
        But it has to be entirely replaced in order to turn off the last NAT, essentially. Being half-replaced or even mostly-replaced gets you nowhere in terms of NAT removal.
  - fiddlerwoaroof 3y ago
    IPv6 would have been great if it was just bigger addresses but the actual system we got suffers heavily from the second-system effect.
mistercheph 3y ago
Agreed, but does the blame lie in NAT, or the endlessly rainchecked IPv6 transition?
radiojosh 3y ago
This is a terribly uninformed take. ISPs charge for public IP addresses. Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house? Because that's what you get when you don't use NAT. And if it weren't for NAT, the Internet would be running out of IPv4 addresses (it already is, sort of), so you'd either deal with much higher prices for IPv4 addresses, or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT. Not to mention the premium you'd pay for a router with an actual firewall, and you had better make sure you understand the firewall. Port forwarding on a working router is generally a lot easier than a firewall. If it was really impossible to set up inbound connections to your server, it was either a problem with the router or a problem with your ISP.
- skrebbel 3y ago
  Arguably if people had somehow rejected NAT more violently, IPv6 might’ve been popular much sooner cause you gotta solve the “woops there are now more devices than addresses” problem somehow. For the sake of running a home server from a network not behind a NAT router, you don’t need to understand much more about IPv6 than how to copy&paste an address.
  - fragmede 3y ago
    The fact that my laptop right now has 10 different ipv6 addresses assigned to it when my ISP doesn't even support ipv6, (and two ipv4 addresses) says users need to understand more than copy and paste.
- jeroenhd 3y ago
  > ISPs charge for public IP addresses Because NAT allows them to. > Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house? Yes. > or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT. Back in 2005, maybe. Now, it works out of the box, either through SLAAC or DHCPv6. > Not to mention the premium you'd pay for a router with an actual firewall In 2005, maybe. Today, $10 routers off AliExpress have a firewall, probably set to "deny incoming" by default. > Port forwarding on a working router is generally a lot easier than a firewall. I know for a fact that the routers of at least two ISPs use the exact same page for port forwarding and the firewall. You don't enter iptables commands, you specify a list of ports that you want to be open for a specific address, except now you don't need to differentiate between "source port" and "destination port".
Runways 3y ago
Some might find your take bizarre, but the early architects of the internet were against NAT as well. Although, in their idealistic scenario IPv4 would not have held up as long as it did, and probably would have hastened the introduction of IPv6 - not to mention the security concerns like all devices needing competent firewalls. Some people just didn't like that computers could be locked behind a network veil/wall.
edg5000 3y ago
It is shitty is that your ISP blocked NAT, that is certainly a crime against humanity, as running your own server is such a pure expression of freedom.
gizmo 3y ago
NAT is an accidental consequence of IPv4 address shortage, but it turned out to a blessing in disguise. NAT gives every home a basic hardware firewall for free. Everything, for better and worse (mostly worse) is connected to the internet nowadays. Your watch. Your dishwasher. Your TV. Your light switches. These devices are all comically insecure but because they can't accept outside connections because of NAT it's not such a big deal. IPv4 limitations make outbound connectivity easy but incoming connectivity hard. This is what you want 99% of the time.
- jeroenhd 3y ago
  NAT's firewall effect is purely coincidental. In fact, because people don't run firewalls because of NAT, attacks like NAT slipstreaming can open any port to any internal IP in your network by abusing SIP ALGs and fragmentation. Wherever NAT is enabled now, a statefull firewall is a better solution. Thankfully, this is the default wherever IPv6 is rolled out to consumers.
cm2187 3y ago
NAT, by virtue of also being a firewall, has actually prevented millions of home machines from being powned. The world is better with NAT. And I wouldn't want any modern IoT (including the IoT I am not aware of in all sort of kitchen appliances) to be on the WAN directly.
- jeroenhd 3y ago
  Your router comes with a firewall for this very reason. IPv6 is enabled on over 40% the internet connections to Google, surely you don't think all of those people don't have any kind of firewall on their home network?
  - cm2187 3y ago
    Then if you have a firewall you have the same port forwarding problems than with a NAT.
    - jeroenhd 3y ago
      Not really? No need to mess with destination ports, no need to visit whatismyipaddress.com, no need to risk exposing your entire home network through SIP ALGs, and your Xbox/PlayStation doesn't tell you that you have a bad "NAT type". Plus, when you forward port 1024-65535 to your Nintendo Switch, as Nintendo says you need to do in its documentation, the rest of your devices don't have their P2P network traffic impeded.
      - epcoa 3y ago
        > when you forward port 1024-65535 to your Nintendo Switch, as Nintendo says you need to do in its documentation, Nintendo is a shit company that treats their customer base like bitches yet gets a tremendous steady amount of good will solely due to nostalgia. I'm the last to want to defend the challenges that NAT brings, but blaming it due to some rando corporation's asshattery is silly. Luckily, or not, their documentation is wrong, you almost never have to blanket port forward all UDP ports for the Switch. The GP point still stands as well. If you have a firewall set to block inbound by default (typical) you have the same basic port-forwarding bootstrapping/configuration problem. Also, the reasons you would absolutely need whatismyipaddress.com or similar apply to both v4 and v6. If you're configuring your router anyway you can get the v4 address.
deleted 3y ago
[deleted]
PedroBatista 3y ago
Please see this video: https://www.youtube.com/watch?v=GLrfqtf4txw https://www.youtube.com/watch?v=GLrfqtf4txw In order to get some context and knowledge of History.
- jeroenhd 3y ago
  I've seen this video, and it's an interesting deep dive into the history of NAT, but it brushes aside IPv6 as an "alternative solution" and doesn't pay any more attention to it. Of course, that's not necessarily something to dig into when the topic is NAT and not IPv6, but it's hardly a defence for NAT, merely an explanation on how we got to this point.
feoren 3y ago
> my ISP blocked the router's web interface This is the weirdest thing in your story. Your ISP disallowed you from configuring your router? I've never heard of such a thing, and it certainly sounds ... suspicious. You should be able to get to your own router without even connecting to the internet. Your ISP should never even know when you're connecting to your router. I commonly hit my router's admin page when my internet is down to figure out whether it's my computer or my external connection. Why would your ISP want to hire so many extra people to nanny all their customer's routers for them? Are you sure this wasn't an excuse from your parents who installed parental controls on it or something?

spogbiper 3y ago

Most ISPs I've encountered (various places in the USA) do allow port forwarding or even replacing the ISPs router with one of your own. I'm not sure NAT has been a massive obstacle for most people interested in networking. And without NAT, we would have had to use IPv6 or something even worse. That would probably have turned off a lot of aspiring network engineers too.

TheFreim 3y ago
> Most ISPs I've encountered (various places in the USA) do allow port forwarding or even replacing the ISPs router with one of your own. In the United States my entire life I have always been able to port forward when necessary, though I've only been on two or maybe three providers. I also would help friends in middle and high school port forward so we could connect to their game servers. Many providers seem to try to make it as hard as possible, attempting to lock down the interface behind a web panel. This can typically be bypassed by finding the real panel address locally or by getting a new router that isn't locked down. Growing up it was extremely easy, my provider didn't try to make it difficult, but now there is often a barrier to entry for people who desire to casually tinker with their network setup, which is unfortunate.
retrac 3y ago
In some countries, NAT was implemented at the ISP level and you had no public IP at all. I remember it being a consistent practical barrier back in the 90s for stuff like file transfers. I had a public IP but the other person didn't and had no way of getting one or setting up port forwarding. Back when file transfers were often done with direct connection.
mondomondo 3y ago
[dead]
organsnyder 3y ago
We had Comcast for 17 years, and they always allowed us to bring not only our own router, but our own modem. Even when we rented a combined modem+firewall+AP from them, it was trivial (and documented) to put it into bridge mode. We just switched to Metronet last month (5gbps symmetrical!), and while we have to pay $10/month to get a public static IP (CGNAT otherwise), they didn't care what was connected to the ONT, which operates below the IP layer.

jve 3y ago

NAT was/is a great for blocking incoming connections by default. A lesson I learnt when I found in early Windows XP days that my files are gone and a .txt note was left on my C: disk...

throwup238 3y ago
Remember when connecting an unpatched system to the internet would get it infected by the Blaster worm within the day? I ‘member.
organsnyder 3y ago
A non-NAT firewall can have the same default rules.

k_bx 3y ago

Tailscale solves this problem as is beginner-friendly, highly recommended.

Cpoll 3y ago
How would you set this up? You'd still need a box with a public IP to proxy the traffic, no? (Unless you get all your friends to install Tailscale so that they can access your private network).
- peoplefromibiza 3y ago
  it/s called exit nodes in Tailscale
  - Cpoll 3y ago
    I don't think that would work? Exit nodes proxy traffic from the Tailscale network to the internet, not the other way around. Kind of like a consumer VPN. The other reply mentions Funnel, which I think fits the use case better.
- maybe_pablo 3y ago
  If you want to expose a single web service you can do it via tailscale funnel[1] easily. [1] https://tailscale.com/blog/reintroducing-serve-funnel https://tailscale.com/blog/reintroducing-serve-funnel

epcoa 3y ago

I’m confused, are you complaining about ISP CGNAT or NAT in general? Did your ISP assign you a public IPv4 or not? If the former then you are lucky, that is a relative luxury. > Even after learning about how NAT works, I had no way to work around it, as my ISP blocked the router's web interface and I was unable to do port forwarding. Well this is Hacker News, you replace the router with your own. I have yet to encounter a residential wireline ISP in the US or Europe where using your own router is not a possibility. Even those that implemented 802.1x or similar I have been able to either deal with directly or work around. Not saying there don’t exist counterexamples but I would assume using an alternative router +/- MITM the old one would have been viable. Of course if the ISP was firewalling (likely) then you have a different problem. This isn’t really a NAT issue. More of a specific ISP policy issue. (NAT and ipv4 have nothing to do with it, they can just as easily port block inbound 80/443 on ipv6.) The argument boils down to: My ISP locked down the admin page on my rented router ergo NAT is evil. It’s not terribly sensible.

dehrmann 3y ago
> Did your ISP assign you a public IPv4 or not? If the former then you are lucky, that is a relative luxury. At least until the 10G fiber upgrade happens, Sonic has given me a static IPv4 address for a decade.
- epcoa 3y ago
  Sure. I still remember when I could order additional static IPs on residential cable internet. That doesn’t mean most getting online today in Asia or Africa basically have a choice other than CGNAT IPv4 and IPv6 from their ISP. Your own dynamically assigned IPv4 is a relative luxury.
- sosborn 3y ago
  Do they guarantee it is static? My current IP hasn't changed in years but I need to pony up if I want them to guarantee it forever.
  - josephcsible 3y ago

libraryatnight 3y ago

I remember joining an IRC FTP share channel when I was a kid, and wanting to share some of my files to get ratio to download some music and anime they had, and it was my first time attempting to setup an FTP and I thought i was all good to go and dropped my info in the channel and about 3 seconds later a bunch of people were lol'ing at my internal IP. They were cool though and everybody was helpful, learned a lot that night. IRC was so awesome in the 90s.

technothrasher 3y ago

I had the advantage of being 18 when the internet was still pretty open and I had all the access I needed through my university. I even remember finding a list of root passwords to various machines at Standford lying in one of the computer labs. No idea how it got there. But I tested one with a quick rlogin and it worked fine. Oops. I emailed them to let them know and got basically a <shrug> in reply. Those days certainly were easier for a kid who was learning networking, but they couldn't last with more and more people getting connected and making it more tempting for bad actors to fool around.

chasd00 3y ago
> I had the advantage of being 18 when the internet was still pretty open There is no doubt that is an extreme advantage. When I started college in the late 90s an upperclassman was in my dorm for a party and saw a trophy i had from a USFirst robotics competition in HS, he invited me to join an organization he was in that built autonomous robots (we called them "vehicles") for a competition. In that lab, we had network drops and static IPs on the schools inet connection. The lab's admin knew the DNS guys and so we could run whatever we wanted on a fast internet connection with access to our own hostnames. At this time Linux, Apache, PHP and MySQL were just starting to take off. That lab and inet opportunity convinced me to change my major to CS and kickstarted my whole career. edit: that "lab" was really just an unused room in a random building with some desks and hand tools like screwdrivers and stuff to work on our robots. ..but it had rj45 plugs :)
- xattt 3y ago
  It wasn’t as hard back then to sift the chaff from the grain. You were either a computer nerd or you were part of the unwashed masses. If you showed any interest in computing, other geeks would take you with open arms (mostly) versus now where everyone and their dog wants in on the ground floor.

deleted 3y ago

[deleted]

j45 3y ago

Nat provides safer networking for the same masses who can’t understand it Depending on the year this was it was a pretty easy Google to learn to traverse nat, and use dynamic dns, or do port forwarding, even out to a Linode

jrmg 3y ago
If we didn’t have NAT ISPs would provide a router with a firewall that was just as safe.
- j45 3y ago
  There was a time the modem was commonly separate from the router. Many ISPs do include a router in their modem with some wifi. It’s often limited in some capacity in real worth use which lets customers over pay and undercover speed and be open to upgrading to a faster plan.
- jeroenhd 3y ago
  ISPs do provide routers with firewalls, for this very reason of course. You still need to open ports to actually reach the service you're hosting, only now you don't need to figure out what your actual IP is.

granshaw 3y ago

Can’t upvote this enough. It breaks the original spirit of the internet and is lazy “security” with a huge negative externality

radiojosh 3y ago
How exactly does it break the spirit of the Internet? The spirit of the Internet is that we run out of IPv4 addresses and everyone who uses the Internet has to learn IPv6 and be an expert on firewalls? I can't tell if you're being elitist because your defacto position is that everyone who uses the Internet has to be a cyber security expert, or if you're just being obtuse because a couple of Google searches will usually set you straight on setting up port forwarding through your router.
- jeroenhd 3y ago
  You don't need to be a firewall expert to use a firewall. Stateful firewalls have been around for longer than I can remember. The default for any consumer firewall is "disable by default", as they should be. Now with NAT we need to be disable UPnP, and deal with "NAT types" on gaming consoles. Or Nintendo Switches breaking your LAN because Nintendo tells you to put your switch into the DMZ: https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console https://en-americas-support.nintendo.com/app/answers/detail/... Because of NAT, we now need to deal with firewalls _and_ port forwarding. Plus, because of https://www.armis.com/research/nat-slipstreaming-v2-0/ https://www.armis.com/research/nat-slipstreaming-v2-0/, your IPv4 firewall is practically disabled _because_ of NAT workarounds embedded into your router. You can pick between having a firewall on IPv4 or allowing WebRTC on any of your devices.
  - radiojosh 3y ago
    I don't understand your first point about firewalls, but port forwarding on a consumer router is no more difficult than opening a port on a firewall. Either one can be overcomplicated by a badly designed interface. See Uniquiti Edgerouter for an example. I know gaming consoles can be a pain with NAT, but is that NAT's fault? That link you pasted about the Nintendo Switch is literally just an article about setting up port forwarding. And that NAT slipstreaming issue is just a vulnerability caused by complicated protocols. Saying that a fundamental network technology is bad because its implementation is flawed doesn't make sense. I guess we should throw away x86-64 because Intel Skylake processors had side channel vulnerabilities.

crazygringo 3y ago

I don't understand -- you can purchase your own router instead of renting one from your ISP, which usually works out cheaper in the end too, and port forward. NAT was a necessity when it was being introduced, so I don't understand the complaints. Sure it's annoying, but what was the alternative? I don't think anyone was dissuaded from IT because of NAT. Heck, if anything, learning how to configure it might have been some people's first step into learning about networking and then getting into it as a career! And let's not forget that NAT served as a default firewall that did more than any anti-virus to protect PC's from malware.

norenh 3y ago
> NAT was a necessity when it was being introduced, so I don't understand the complaints. Sure it's annoying, but what was the alternative? IPv6
- crazygringo 3y ago
  Nope. IPv6 still isn't supported everywhere. When you're running out of addresses, you need a workable solution at the moment. Not something that requires all networking equipment worldwide to be replaced with a new standard all at once, with is a practical impossibility.
  - BenjiWiebe 3y ago
    It doesn't have to be replaced all at once. Most of it already has been replaced.
    - crazygringo 3y ago
      But it has to be entirely replaced in order to turn off the last NAT, essentially. Being half-replaced or even mostly-replaced gets you nowhere in terms of NAT removal.
- fiddlerwoaroof 3y ago
  IPv6 would have been great if it was just bigger addresses but the actual system we got suffers heavily from the second-system effect.

mistercheph 3y ago

Agreed, but does the blame lie in NAT, or the endlessly rainchecked IPv6 transition?

radiojosh 3y ago

This is a terribly uninformed take. ISPs charge for public IP addresses. Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house? Because that's what you get when you don't use NAT. And if it weren't for NAT, the Internet would be running out of IPv4 addresses (it already is, sort of), so you'd either deal with much higher prices for IPv4 addresses, or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT. Not to mention the premium you'd pay for a router with an actual firewall, and you had better make sure you understand the firewall. Port forwarding on a working router is generally a lot easier than a firewall. If it was really impossible to set up inbound connections to your server, it was either a problem with the router or a problem with your ISP.

skrebbel 3y ago
Arguably if people had somehow rejected NAT more violently, IPv6 might’ve been popular much sooner cause you gotta solve the “woops there are now more devices than addresses” problem somehow. For the sake of running a home server from a network not behind a NAT router, you don’t need to understand much more about IPv6 than how to copy&paste an address.
- fragmede 3y ago
  The fact that my laptop right now has 10 different ipv6 addresses assigned to it when my ISP doesn't even support ipv6, (and two ipv4 addresses) says users need to understand more than copy and paste.
jeroenhd 3y ago
> ISPs charge for public IP addresses Because NAT allows them to. > Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house? Yes. > or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT. Back in 2005, maybe. Now, it works out of the box, either through SLAAC or DHCPv6. > Not to mention the premium you'd pay for a router with an actual firewall In 2005, maybe. Today, $10 routers off AliExpress have a firewall, probably set to "deny incoming" by default. > Port forwarding on a working router is generally a lot easier than a firewall. I know for a fact that the routers of at least two ISPs use the exact same page for port forwarding and the firewall. You don't enter iptables commands, you specify a list of ports that you want to be open for a specific address, except now you don't need to differentiate between "source port" and "destination port".

Runways 3y ago

Some might find your take bizarre, but the early architects of the internet were against NAT as well. Although, in their idealistic scenario IPv4 would not have held up as long as it did, and probably would have hastened the introduction of IPv6 - not to mention the security concerns like all devices needing competent firewalls. Some people just didn't like that computers could be locked behind a network veil/wall.

edg5000 3y ago

It is shitty is that your ISP blocked NAT, that is certainly a crime against humanity, as running your own server is such a pure expression of freedom.

gizmo 3y ago

NAT is an accidental consequence of IPv4 address shortage, but it turned out to a blessing in disguise. NAT gives every home a basic hardware firewall for free. Everything, for better and worse (mostly worse) is connected to the internet nowadays. Your watch. Your dishwasher. Your TV. Your light switches. These devices are all comically insecure but because they can't accept outside connections because of NAT it's not such a big deal. IPv4 limitations make outbound connectivity easy but incoming connectivity hard. This is what you want 99% of the time.

jeroenhd 3y ago
NAT's firewall effect is purely coincidental. In fact, because people don't run firewalls because of NAT, attacks like NAT slipstreaming can open any port to any internal IP in your network by abusing SIP ALGs and fragmentation. Wherever NAT is enabled now, a statefull firewall is a better solution. Thankfully, this is the default wherever IPv6 is rolled out to consumers.

cm2187 3y ago

NAT, by virtue of also being a firewall, has actually prevented millions of home machines from being powned. The world is better with NAT. And I wouldn't want any modern IoT (including the IoT I am not aware of in all sort of kitchen appliances) to be on the WAN directly.

jeroenhd 3y ago
Your router comes with a firewall for this very reason. IPv6 is enabled on over 40% the internet connections to Google, surely you don't think all of those people don't have any kind of firewall on their home network?
- cm2187 3y ago
  Then if you have a firewall you have the same port forwarding problems than with a NAT.
  - jeroenhd 3y ago
    Not really? No need to mess with destination ports, no need to visit whatismyipaddress.com, no need to risk exposing your entire home network through SIP ALGs, and your Xbox/PlayStation doesn't tell you that you have a bad "NAT type". Plus, when you forward port 1024-65535 to your Nintendo Switch, as Nintendo says you need to do in its documentation, the rest of your devices don't have their P2P network traffic impeded.
    - epcoa 3y ago
      > when you forward port 1024-65535 to your Nintendo Switch, as Nintendo says you need to do in its documentation, Nintendo is a shit company that treats their customer base like bitches yet gets a tremendous steady amount of good will solely due to nostalgia. I'm the last to want to defend the challenges that NAT brings, but blaming it due to some rando corporation's asshattery is silly. Luckily, or not, their documentation is wrong, you almost never have to blanket port forward all UDP ports for the Switch. The GP point still stands as well. If you have a firewall set to block inbound by default (typical) you have the same basic port-forwarding bootstrapping/configuration problem. Also, the reasons you would absolutely need whatismyipaddress.com or similar apply to both v4 and v6. If you're configuring your router anyway you can get the v4 address.

deleted 3y ago

[deleted]

PedroBatista 3y ago

Please see this video: https://www.youtube.com/watch?v=GLrfqtf4txw https://www.youtube.com/watch?v=GLrfqtf4txw In order to get some context and knowledge of History.

jeroenhd 3y ago
I've seen this video, and it's an interesting deep dive into the history of NAT, but it brushes aside IPv6 as an "alternative solution" and doesn't pay any more attention to it. Of course, that's not necessarily something to dig into when the topic is NAT and not IPv6, but it's hardly a defence for NAT, merely an explanation on how we got to this point.

feoren 3y ago

> my ISP blocked the router's web interface This is the weirdest thing in your story. Your ISP disallowed you from configuring your router? I've never heard of such a thing, and it certainly sounds ... suspicious. You should be able to get to your own router without even connecting to the internet. Your ISP should never even know when you're connecting to your router. I commonly hit my router's admin page when my internet is down to figure out whether it's my computer or my external connection. Why would your ISP want to hire so many extra people to nanny all their customer's routers for them? Are you sure this wasn't an excuse from your parents who installed parental controls on it or something?