7 ms·
Fck-nat: The (f)easible (C)ost (k)onfigurable NAT
- pyvpx 3y agofuck tail latency, as well.
- paulvnickerson 3y agoI've used this in the past. Was very pleased.
- andrewguenther 3y agoHappy to hear it! I've been looking to add some testimonials to the site. Is it okay if I reach out to you via email?
- paulvnickerson 3y agoSure.
- TheRealPomax 3y agoIf you did it right, your tool or service will exist for decades to come, if you have the option to not call it something fsck, fwkc, fck, etc. it's worth exercising that option.
- ianlevesque 3y agoOn the other hand, this is your chance to name it fsck, fwkc, fck. It'll be harder to rename later.
- OkayPhysicist 3y agoIf you're too stuck up to appreciate a funny pun, don't use the software. No one's holding a gun to your head. Or you could relax, not everything needs to be "serious business".
- wruza 3y agoNo one's holding a gun to your head Good luck explaining a less-techy client at your job that fck-nat, fsck (which was originally just "fuck", afaik) and so on are fine puns and no one's holding a gun to their head either. I feel similar about recursive acronyms. These are funny-ish when you're in your mom jokes phase, but then someone asks you what that means and sometimes you can see their "what a bunch of creeps" reaction when you try to explain. Not surprising that people try to avoid that "we can use FCK for our SHT instances in CRP network" nonsense.
- isityouyesitsme 3y agoWhile not really being one who cares personally about the example here, I would not give a tool a name that I full well know will offend the sensibilities of some who will use it. That would make me a jerk, no matter how funny or whimsical I may find it. Even when poking fun at myself, I choose names of projects carefully. It's pretty easy to not be a jerk, at least in this way.
- gosub100 3y agoWould you be ok if this tool was named sensibly, but was developed in brainfuck?
- isityouyesitsme 3y agoWell, what I'm not ok doing is arguing silly points steeped in what-about-isms. There are far more entertaining ways to waste time.
- diggan 3y ago> I full well know will offend the sensibilities of some who will use it How could you possibly know this, where do you draw the line? For something people, "Hacker News" is surely offensive because "hacker" is generally thought of as a negative term (Yes, I know our meaning, others generally don't). GitHub could also be offensive to some, "git" after all is as much of a swear-word as "fck".
- Retr0id 3y agoSometimes keeping "serious" people away from your project is a feature, not a bug.
- TheRealPomax 3y agoThanks, I'll let fsck know.
- 83457 3y agoIt will probably be changed to "ck-nat" eventually.
- SkyMarshal 3y agoTechnically it should be cc-nat. This fck acronym seems like someone is trying a little too hard to twist it into something edgy.
- 83457 3y agoWas looking for someone to get the fckeditor > ckeditor reference.
- Symbiote 3y agoIt worked out OK for Git, which means slightly malicious idiot in Britain and Ireland. (Linus was supposedly well aware of the meaning when he chose it.)
- diggan 3y agoSupposedly, Linus named Git after himself, just like with Linux. According to the legends at least.
- suprjami 3y agoThere's a bit of a difference between "cranky old person" and one letter away from "fuck".
- pwagland 3y agoIt really depends on what country you are in. In many countries c*nt is one of the more terrible swearwords could imagine. In Ireland it's friendly banter. d*ckhead can be either a term of endearment amongst (close) friends, or an insult in Australia, and worse in other countries. In many, if not most, non American countries, f*ck just doesn't cut the mustard when swearing. Heck, in the UK, they have a major high street brand called FCUK.
- sonicanatidae 3y agohttps://i.kym-cdn.com/entries/icons/original/000/028/596/dsmGaKWMeHXe9QuJtq_ys30PNfTGnMsRuHuo_MUzGCg.jpg https://i.kym-cdn.com/entries/icons/original/000/028/596/dsm...
- TehCorwiz 3y agoThe name of 'Git' (the source control system) is literally a derogatory term. I think you overestimate the value or prevalence of decorum. you should also google the relationship between the number of uses of the word "fuck" in code comments with code quality. There's been several papers on it. EDIT: Here: https://cme.h-its.org/exelixis/pubs/JanThesis.pdf https://cme.h-its.org/exelixis/pubs/JanThesis.pdf
- TheRealPomax 3y agoThe actual fsck command predates git by a lot of years. And they're both still incredibly stupid names.
- shzhdbi09gv8ioi 3y ago> fsck = filesystem check please stop being this thin skinned
- wruza 3y agohttps://hachyderm.io/@robpike/111593487329402102 https://hachyderm.io/@robpike/111593487329402102
- shzhdbi09gv8ioi 3y agoSo, the link that was shared by robpike, from 2006 lays it out like this: > First, let's review what fsck, or the File System ChecK program, actually does. Again, stop being this amount of thin skinned, it is rather ridiculous.
- wruza 3y agoI am not, I just don’t get why some people are so profanity oriented in naming things. Personally, it doesn’t offend me, but it ridicules them in my eyes, and stops me from talking about it around people. If that’s what they want, okay. If that’s not what they want, they can use this subthread as a feedback. How would they know if no one spoke? Also, I find your reaction thin skinned-ish as well. Why throw stop commands if you ought to not care? Cause it’s ridiculous? Well, we have more in common than you think then.
- shzhdbi09gv8ioi 3y ago> Also, I find your reaction thin skinned-ish as well. Why throw stop commands if you ought to not care? Oh really. You're the one who can't shut up about some app that used to be named f*ck but was renamed some 30+ years ago still grinds your gears. It's an (ancient) light hearted joke, please just drop it. I care about the state of the world, and I find it deeply depressing people run around being prude like we're some kind of Christian middle ages society.
- TheRealPomax 3y ago
- hasty_pudding 3y agoI would advertise how understandable it is as well. maybe something like: ufck?
- overstay8930 3y agoIf you care about price this badly just use v6, it's free
- dns_snek 3y agoThat's not an option if you need to support IPv4-only clients, which the vast majority of services do.
- andrewaylett 3y agoIPv4 clients are a different problem, with a different solution -- NAT is for outbound connections. Of course, plenty of services you want to connect to could only support IPv4. IPv6 internally doesn't stop you running public IPv4-accessible services.
- ikiris 3y agoStart charging those clients an ipv4 fee then.
- andrepew 3y agoUnless you’re dependent on one of the many many AWS services that don’t support IPv6-only access. https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-support.html https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su...
- sonicanatidae 3y agoHe's probably being paid by Big v6 to push it.
- oopsthrowpass 3y agoAhh this almost fits our use case, but we already went with Feasible Cost Konfigurable AWS setup
- bilalq 3y agoThe NAT tax is real. We got to tens of thousands of registered users of our app with the $30/month NAT gateway being like 90% of our AWS bill. And it didn't even serve customer facing traffic! At the time, it's only use was for a serverless Aurora DB used by background jobs. It only gets more expensive when you actually serve large amounts of traffic, need multi-AZ setups, and run multiple AWS accounts for different envs for beta/prod and each engineer's sandbox account. The worst part of cloud billing is how each base cost has several dimensions of multipliers.
- candiodari 3y agoYou do realize this is AWS policy, right? I mean you cannot run away from AWS costs ... on AWS. They are targeting dollar amounts of profits for themselves, not charging cost+20% for service X. They will find some other way to charge you the yet more than you're saving here, because MBA culture. And AWS is like 10x more expensive than dedicated hosting, minimum. Not 10%, 1000%. To the point that for the price of I mean if cost matters to you you need to move out of the cloud. Plenty of Kubernetes hosting these days, and very easy to set it up yourself.
- fulafel 3y agoThis. You then work to dig deeper into the vendor lock-in, to move your apps to use apparently cheaper AWS-only services, and if you're wily (or oblivious) you can report this as cost savings.
- deleted 3y ago[deleted]
- paulddraper 3y agoI don't pay the NAT tax. I just use public IP addresses. It's fine, it works. Worked for EC2-Classic, works today.
- ipython 3y agoYou now get charged for ipv4 addresses as well. Less than nat, yes, but now ipv4 addresses are no longer free either.
- mannyv 3y agoOne use case for NAT is lambdas calling out of their VPC to the internet. Not everything is v6 friendly yet. I'll try and deploy this. Our NAT costs aren't that high, but reducing spend is worth an hour or two. I might leave this as something for the new guy, just so we can see if he can do it without taking down the environment.
- sakopov 3y agoThis is perfect for preprod environments. I'd probably not deploy in production. There is a better nat instance setup available called alternat [1] which is a little more durable and better for production cases. [1] https://github.com/1debit/alternat https://github.com/1debit/alternat
- tootie 3y agoThis is what we run. Modest but not trivial scale. Transition was really easy.
- andrewguenther 3y agoAuthor of fck-nat here. My big issue with Alternat is that it actively updates the route table which can still cause availability problems. It's a shorter outage than the current fck-nat replacement methodology, but it is still dropping connections. The longer term vision for fck-nat is a two node approach using conntrackd and keepalived to actively failover existing connections to the secondary with no loss of availability. This has the added benefit of not requiring all of the auxiliary infrastructure that Alternat sets up.
- sakopov 3y agoThat's an awesome update! I currently run fck-nat in pre-prod environments (and love it so far) but still use NAT gateway in production. I was actively looking into switching over to AlterNat for prod because of the failover to NAT gateway during NAT instance updates and outages, but definitely not a fan of the complexity you're eluding to. The future plans you've outlined definitely make me want to wait it out and just use fck-nat across the board. Thanks for sharing these plans!
- andrewguenther 3y agoI don't want to get anyone too hyped on it just yet because there's still a lot of testing to be done, but hopefully will start giving some more concrete updates on "fck-nat 2.0" soon-ish!
- 3y ago
- andrewguenther 3y agoAuthor of fck-nat here. Happy to answer any questions! Thanks for the post!
- renlo 3y agoThank you for creating the project! Oddly enough I came across fck-nat last week and have been looking into incorporating it into my project app to avoid paying the $30+ per month for the managed solution. As someone who is new to setting up VPCs and networking, how does this work? I was so curious I even tried to query ChatGPT about it a couple of days ago but I got a less than satisfactory answer. Is the secret to making it work disabling the "source destination check"? Say a host in the private subnet wants to connect to a host on the internet, it tries to connect to <PublicIP>, and sends some IP packets over the subnet via the ENI, does the VPC subnet act like an old-school ethernet connection where fck-nat gets the IP packets for <PublicIP> (source/dest is disabled so it receives the packets) and then it forwards it to the internet gateway and does the network address translations when it receives a response packet?
- mjlee 3y agohttps://github.com/AndrewGuenther/fck-nat/blob/main/service/fck-nat.sh https://github.com/AndrewGuenther/fck-nat/blob/main/service/... this is the bit you need to understand. You've got the gist of it, but you probably want to read about NAT and iptables. The source destination check is important - but implementation specific here. Google Cloud does it like this - https://cloud.google.com/vpc/docs/using-routes#canipforward https://cloud.google.com/vpc/docs/using-routes#canipforward From the VPC perspective, the key here is understanding that subnets within VPCs have route tables that determine where traffic from your subnet goes next. In this case traffic to the internet is sent to an interface on the NAT instance.
- Uptrenda 3y agoWhat type of NAT algorithm are you using for your NAT here? E.g. full cone, symmetric, etc. Such details can be useful for testing. Currently I'm having to code a small script to simulate different NAT behaviours so I can test trying to traverse them easily. I looked for a way to do this kind of thing with cloud networking ages back but they were no where near as configurable as needed. Normally the details were hidden. IDK what they would be using in that case. The other thing is the port allocation algorithm. Many home routers try to preserve the source port (assuming its available.) But there's other algorithms that could be used here like independent delta +1 (increment each new mapping by +1) and others. IDK if there's a target market for something this specific or niche. But thought I'd put it out there.
- ragesh 3y agoAny chance you're willing to share your scripts? I'm interested in trying out NAT traversal, too, and was starting to research ways to simulate all the different types.