9 ms·

Why do I get the feeling that there will never be a pure IPv6 solution. It does not seem possible to create a pure and complete IPv6 NAT solution. But NAT is w

by drucken 15y ago

Why do I get the feeling that there will never be a pure IPv6 solution. It does not seem possible to create a pure and complete IPv6 NAT solution. But NAT is way too useful and taken for granted to be removed. I honestly cannot believe they did not address this specifically during the standard's process! Why not learn from the past? Are Teredo-like 6-within-4 solutions the only future?

simfoo 15y ago
Maybe this question is stupid, but why do you consider NATs useful? I've always found them pretty obstructive (just look at Skype and other p2p software, they have to try and break through NATs or even use a proxy server). Or do you have other use cases in mind?
- vidarh 15y ago
  Beyond a lack of public IP's, it's the obstructive nature of it that makes it (sort of) useful. It's not really any safer than starting with a firewall where everything is denied by default and opening port by port of inbound traffic. But NAT'ing every internal address forces you into a pattern where the external IP is not tied to where the service is hosted at all - you need to explicitly map that in your firewall -, and where if you were to, say, accidentally turn off all your filtering, you leave yourself isolated instead of exposed. I don't think these are important enough to care about NAT once we switch to IPv6 - you can certainly be just as defensive through other means.
- Duff 15y ago
  Laziness, flexibility and cost. Lazy network admins assume that a private network protects them against poor planning and decision-making. Private networks give you more flexibility to do whatever crazy thing you want to do. For larger enterprise, this may mean building their own private internet. For smaller users in particular, NATing saves time and money. You don't have to wrangle with ISPs who want to bill by IP, or get an IP block assigned.
  - calloc 15y ago
    ULA addresses in IPv6 allow unique local addresses that can be used by a large enterprise to build their own network, so that they have specific IPv6 endpoints always available, and then when their ISP hands them a different /64 or /56 they can continue to function as normal without renumbering.
  - randomdata 15y ago
    For larger enterprise, this may mean building their own private internet. How does IPv6 change this? Either way, you have to use IP addresses assigned to you (public IPv6 addresses, or private IPv4 addresses) if you want to interface it to the public internet. Your physical firewall and router setup isn't going to change much, if at all. If your private network will never be connected to the internet, you can use any old addressees and routing schemes you want. Nobody will care what you do because there is no risk of collision with anyone else.
- drucken 15y ago
  Despite what many assumed from my original question, I was not in the least bit concerned about NAT's replacement as a pseudo access control at the IP layer. My concern was the lack of control and independence from the global network when it is needed. This saves organisations and individuals a small fortune and provides maximum flexibility and convenience in internal networking. However, I have been doing further research and while NAT discovery and traversal is an uncertain area, and (of course) firewalls are the design intention for IPv6 access control, the core ability to have access to private unicast addresses within IPv6 is covered by RFC 4193 (Unique Local IPv6 Unicast Addresses). So, 6-within-4 protocols need only be around as long as 4 is the majority globally routable IP protocol, which may be for a LOT longer than people think, instead of being around because 6 lacks support for existing functions.
guelo 15y ago
NAT as a security requirement can be replaced with a firewall. If you don't trust the firewall for some reason put in a second firewall. People got this notion that NAT is the only way to really secure an internal network. NAT is just an easy way to do default-deny, a firewall can also do it.
lloeki 15y ago
> But NAT is way too useful and taken for granted to be removed NAT is not useful, firewalls are. NAT merely swaps an address for another in the outgoing IP packet, recording the connection, and doing the inverse op on incoming packets matching the record. It's actually called IP masquerading, and it does not protect you of anything. Without a firewall rule that drops incoming packets, outside can readily reach your internal network with the proper route (your router already knows how to route external/internal, since it's its very role), even with NAT. The exact same incoming packet drop rule can readily be used with IPv6. And you can punch holes in the firewall for your internal services the same way you always did, you just don't need address swapping part anymore, nor "port forwarding", since all machines have all ports to them. In fact, the firewall stack actually gets two rules added each time you define a "port forwarding": the firewall rule to not drop the packet, and the NAT rule to forward it. Guess what forwards natively packets to the correct IPs? Routing. And that's precisely the purpose of NAT: being able to route IPs not meant to be routed in the first place, virtually extending the IP address space by having LAN machines sharing one address. The thing is, every IPv6 address is routable†, hence NAT simply has no purpose in IPv6. The only real problem is that people have been framed to think that NAT is how things work. The truth is, having no NAT anymore is a bliss. Everything is easier, from DMZ routing to authorization to abuse handling, mostly because many issues, limitations, and extra work vanish. PS: and don't start me on "NAT is good at using a single IP to connect to your machines". That's what DNS is for. † except local-scoped addresses, but those are constrained to the link, since they are automatically assigned by the machine itself, and made to provide automatic peer-to-peer link-local connectivity only. By design, having only a link-local address means you have no internet connectivity whatsoever.
- Wilya 15y ago
  > Without a firewall rule that drops incoming packets, outside can readily reach your internal network with the proper route (your router already knows how to route external/internal, since it's its very role), even with NAT. That's true if by 'outside' you mean 'directly on the external interface of my home router'. Because if it can indeed route my 10.something/192.168.something internal network, all the routers in between most likely can't. Maybe that's why because think NAT is safer: firewall holes are, in practice, much harder to exploit in IPv4. (Well, that, plus the firewall rules are much simpler. A few fixed ranges to drop, and be done with it. In IPv6, all has to be dynamic, and potentially configurable)
randomdata 15y ago
A major goal of IPv6 was to provide enough addresses for every device. When there is no need for overlapping networks, there is no need for NAT.
revelation 15y ago
NAT is a hack for getting more machines online without having more IPs available. Obviously, IPv6 makes that obsolete.
- agwa 15y ago
  > NAT is a hack for getting more machines online without having more IPs available. Obviously, IPv6 makes that obsolete. The problem is that the addresses might not be where you need them. Let's say you bring an OpenVPN-running Linksys router to a hotel room and plug your devices into them so they can be on their own firewalled subnet with VPN access (this is the ultimate road-warrior setup). Unless the hotel routes a subnet to you (and they won't be), you can't do this. The hotel's subnet might have plenty of public IPv6 addresses available, but you won't have any to make your own subnet. What should you do instead? Bridge the networks and use layer 2 firewalling? The VPN routing would be a nightmare. This question has been plaguing me. To be clear, I do not think NAT should be used in most cases. But for rare or temporary cases it would be very useful to have available if you know what you're doing.
  - BerislavLopac 15y ago
    Or you could carry your own IPv6 addresses around. In this world of mobile devices and networks this might soon become a requirement, actually.
  - lloeki 15y ago
    This is a problem only if you don't default-route everything from the Linksys LAN through the VPN, with the IPv6 LAN subnet being routed through the VPN. In fact the IPv6 LAN subnet might just as well be at the remote endpoint with a tap bridge (which is actually very close to my openvpn ipv4+ipv6 setup)
    - agwa 15y ago
      That's not a bad idea, especially since these days you often can't rely on someone else's network to be secure and free of shenanigans like this: http://news.ycombinator.com/item?id=3804608 http://news.ycombinator.com/item?id=3804608 On the other hand, this leads to suboptimal routing. If I'm in Australia and the VPN server is in the US, connections to Australian hosts would be routed across the Pacific and back.
sp332 15y ago
Pure IPv6 will be used in places that run out of IPv4 addresses first. Probably Africa.
- icebraining 15y ago
  I doubt that; it's not reasonable to be on IPv6 only. ISP-level NAT for IPv4 will probably exist for a long time.
mindcrime 15y ago
But NAT is way too useful and taken for granted to be removed. Eh? NAT is a bloody miserable sodding hack that should be taken out back and shot. Getting rid of NAT and restoring the end-to-end principle is, IMO, one of the best reasons to support ipv6 adoption.

by drucken 15y ago

simfoo 15y ago

Maybe this question is stupid, but why do you consider NATs useful? I've always found them pretty obstructive (just look at Skype and other p2p software, they have to try and break through NATs or even use a proxy server). Or do you have other use cases in mind?

vidarh 15y ago
Beyond a lack of public IP's, it's the obstructive nature of it that makes it (sort of) useful. It's not really any safer than starting with a firewall where everything is denied by default and opening port by port of inbound traffic. But NAT'ing every internal address forces you into a pattern where the external IP is not tied to where the service is hosted at all - you need to explicitly map that in your firewall -, and where if you were to, say, accidentally turn off all your filtering, you leave yourself isolated instead of exposed. I don't think these are important enough to care about NAT once we switch to IPv6 - you can certainly be just as defensive through other means.
Duff 15y ago
Laziness, flexibility and cost. Lazy network admins assume that a private network protects them against poor planning and decision-making. Private networks give you more flexibility to do whatever crazy thing you want to do. For larger enterprise, this may mean building their own private internet. For smaller users in particular, NATing saves time and money. You don't have to wrangle with ISPs who want to bill by IP, or get an IP block assigned.
- calloc 15y ago
  ULA addresses in IPv6 allow unique local addresses that can be used by a large enterprise to build their own network, so that they have specific IPv6 endpoints always available, and then when their ISP hands them a different /64 or /56 they can continue to function as normal without renumbering.
- randomdata 15y ago
  For larger enterprise, this may mean building their own private internet. How does IPv6 change this? Either way, you have to use IP addresses assigned to you (public IPv6 addresses, or private IPv4 addresses) if you want to interface it to the public internet. Your physical firewall and router setup isn't going to change much, if at all. If your private network will never be connected to the internet, you can use any old addressees and routing schemes you want. Nobody will care what you do because there is no risk of collision with anyone else.
drucken 15y ago
Despite what many assumed from my original question, I was not in the least bit concerned about NAT's replacement as a pseudo access control at the IP layer. My concern was the lack of control and independence from the global network when it is needed. This saves organisations and individuals a small fortune and provides maximum flexibility and convenience in internal networking. However, I have been doing further research and while NAT discovery and traversal is an uncertain area, and (of course) firewalls are the design intention for IPv6 access control, the core ability to have access to private unicast addresses within IPv6 is covered by RFC 4193 (Unique Local IPv6 Unicast Addresses). So, 6-within-4 protocols need only be around as long as 4 is the majority globally routable IP protocol, which may be for a LOT longer than people think, instead of being around because 6 lacks support for existing functions.

guelo 15y ago

NAT as a security requirement can be replaced with a firewall. If you don't trust the firewall for some reason put in a second firewall. People got this notion that NAT is the only way to really secure an internal network. NAT is just an easy way to do default-deny, a firewall can also do it.

lloeki 15y ago

> But NAT is way too useful and taken for granted to be removed NAT is not useful, firewalls are. NAT merely swaps an address for another in the outgoing IP packet, recording the connection, and doing the inverse op on incoming packets matching the record. It's actually called IP masquerading, and it does not protect you of anything. Without a firewall rule that drops incoming packets, outside can readily reach your internal network with the proper route (your router already knows how to route external/internal, since it's its very role), even with NAT. The exact same incoming packet drop rule can readily be used with IPv6. And you can punch holes in the firewall for your internal services the same way you always did, you just don't need address swapping part anymore, nor "port forwarding", since all machines have all ports to them. In fact, the firewall stack actually gets two rules added each time you define a "port forwarding": the firewall rule to not drop the packet, and the NAT rule to forward it. Guess what forwards natively packets to the correct IPs? Routing. And that's precisely the purpose of NAT: being able to route IPs not meant to be routed in the first place, virtually extending the IP address space by having LAN machines sharing one address. The thing is, every IPv6 address is routable†, hence NAT simply has no purpose in IPv6. The only real problem is that people have been framed to think that NAT is how things work. The truth is, having no NAT anymore is a bliss. Everything is easier, from DMZ routing to authorization to abuse handling, mostly because many issues, limitations, and extra work vanish. PS: and don't start me on "NAT is good at using a single IP to connect to your machines". That's what DNS is for. † except local-scoped addresses, but those are constrained to the link, since they are automatically assigned by the machine itself, and made to provide automatic peer-to-peer link-local connectivity only. By design, having only a link-local address means you have no internet connectivity whatsoever.

Wilya 15y ago
> Without a firewall rule that drops incoming packets, outside can readily reach your internal network with the proper route (your router already knows how to route external/internal, since it's its very role), even with NAT. That's true if by 'outside' you mean 'directly on the external interface of my home router'. Because if it can indeed route my 10.something/192.168.something internal network, all the routers in between most likely can't. Maybe that's why because think NAT is safer: firewall holes are, in practice, much harder to exploit in IPv4. (Well, that, plus the firewall rules are much simpler. A few fixed ranges to drop, and be done with it. In IPv6, all has to be dynamic, and potentially configurable)

randomdata 15y ago

A major goal of IPv6 was to provide enough addresses for every device. When there is no need for overlapping networks, there is no need for NAT.

revelation 15y ago

NAT is a hack for getting more machines online without having more IPs available. Obviously, IPv6 makes that obsolete.

agwa 15y ago
> NAT is a hack for getting more machines online without having more IPs available. Obviously, IPv6 makes that obsolete. The problem is that the addresses might not be where you need them. Let's say you bring an OpenVPN-running Linksys router to a hotel room and plug your devices into them so they can be on their own firewalled subnet with VPN access (this is the ultimate road-warrior setup). Unless the hotel routes a subnet to you (and they won't be), you can't do this. The hotel's subnet might have plenty of public IPv6 addresses available, but you won't have any to make your own subnet. What should you do instead? Bridge the networks and use layer 2 firewalling? The VPN routing would be a nightmare. This question has been plaguing me. To be clear, I do not think NAT should be used in most cases. But for rare or temporary cases it would be very useful to have available if you know what you're doing.
- BerislavLopac 15y ago
  Or you could carry your own IPv6 addresses around. In this world of mobile devices and networks this might soon become a requirement, actually.
- lloeki 15y ago
  This is a problem only if you don't default-route everything from the Linksys LAN through the VPN, with the IPv6 LAN subnet being routed through the VPN. In fact the IPv6 LAN subnet might just as well be at the remote endpoint with a tap bridge (which is actually very close to my openvpn ipv4+ipv6 setup)
  - agwa 15y ago
    That's not a bad idea, especially since these days you often can't rely on someone else's network to be secure and free of shenanigans like this: http://news.ycombinator.com/item?id=3804608 http://news.ycombinator.com/item?id=3804608 On the other hand, this leads to suboptimal routing. If I'm in Australia and the VPN server is in the US, connections to Australian hosts would be routed across the Pacific and back.

sp332 15y ago

Pure IPv6 will be used in places that run out of IPv4 addresses first. Probably Africa.

icebraining 15y ago
I doubt that; it's not reasonable to be on IPv6 only. ISP-level NAT for IPv4 will probably exist for a long time.

mindcrime 15y ago

But NAT is way too useful and taken for granted to be removed. Eh? NAT is a bloody miserable sodding hack that should be taken out back and shot. Getting rid of NAT and restoring the end-to-end principle is, IMO, one of the best reasons to support ipv6 adoption.