3 ms·

NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is curr

by bb88 2y ago

NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)

kstrauser 2y ago
I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it. When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.
- adriancr 2y ago
  That's the thing, you don't have good end-to-end connectivity if you configure the firewall as you should and block everything similar to what NAT does. After which, you have a question, how can you configure end-to-end connectivity securely?, which host(s) do you open up ports towards?
  - bb88 2y ago
    You don't have good end-to-end connectivity with NAT, right? With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet.
    - adriancr 2y ago
      > You don't have good end-to-end connectivity with NAT, right? I do, I have a public IPv4 that I manage as I wish. Open ports on firewall and forward where needed. No issues so far. > With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet. Where are you from and what provider are you using? That is just a crappy provider, you should switch to competition and get a separate IP with no CG-NAT. (never had CG-NAT on home connection, although I avoided providers that did that) If you're a student in a uni campus/dorms you won't really have an option and it is what it is, it used to be CG-NAT 15-20 years ago too. Even with IPv6 they'd likely firewall everything off and the range would have bad reputation.

by bb88 2y ago

kstrauser 2y ago

I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it. When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.

adriancr 2y ago
That's the thing, you don't have good end-to-end connectivity if you configure the firewall as you should and block everything similar to what NAT does. After which, you have a question, how can you configure end-to-end connectivity securely?, which host(s) do you open up ports towards?
- bb88 2y ago
  You don't have good end-to-end connectivity with NAT, right? With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet.
  - adriancr 2y ago
    > You don't have good end-to-end connectivity with NAT, right? I do, I have a public IPv4 that I manage as I wish. Open ports on firewall and forward where needed. No issues so far. > With CG-NAT my IP address is the same one that infected computers are using, so I'm often treated like a second class citizen on the internet. Where are you from and what provider are you using? That is just a crappy provider, you should switch to competition and get a separate IP with no CG-NAT. (never had CG-NAT on home connection, although I avoided providers that did that) If you're a student in a uni campus/dorms you won't really have an option and it is what it is, it used to be CG-NAT 15-20 years ago too. Even with IPv6 they'd likely firewall everything off and the range would have bad reputation.