5 ms·

Eliminating NAT makes virtual networking much hairier. E.g., my desktop is currently connected to a big enterprise network that keeps track of all devices and w

Eliminating NAT makes virtual networking much hairier. E.g., my desktop is currently connected to a big enterprise network that keeps track of all devices and will only allocate one IP address per MAC address. That leaves no IPs for any VMs on my desktop to use, so they must go through NAT if they want to communicate with the outside world.

pcpuser 2y ago
That's definitely a limitation of your network. I don't see how ipv6 can shoulder any responsibility here.
Dylan16807 2y ago
Are you talking about eliminating NAT on IPv4? IPv6, set up the normal way, does not allocate IPs. Devices can and will have several at once and their VMs can easily get some too.
- wmf 2y ago
  The enterprise corrupted IPv6 and disabled SLAAC so devices have to use whatever DHCPv6 gives them.
  - somanyphotons 2y ago
    How does that work for android devices? I heard they don't allow dhcp provided addresses?
    - wmf 2y ago
      The Android problem only occurs in an IPv6-only enterprise network which is very rare. Otherwise Android can use IPv4.
pjc50 2y ago
Shouldn't the VMs have their own MACs?
- jeroenhd 2y ago
  If they're not routed directly through the network card but use a virtual switch instead, the network upstream only sees the server MAC. If they're directly hooked into the network card they can have their own MACs, but that approach can make it hard to communicate between host and VM.
  - nolist_policy 2y ago
    Also, multiple MACs does not work with wlan.
    - lxgr 2y ago
      Why would it not? There's even a third MAC address field in the 802.11 headers for just that scenario, as far as I remember (i.e. to distinguish between "802.11 source/destination" and "Ethernet-level actual source/destination").
      - nolist_policy 2y ago
        You actually need to use special 4addr/WDS frames with 4 addresses[1]. However no one accepts these by default so it's unusable for a Laptop that you want to connect to random wlan networks. [1] https://lore.kernel.org/netdev/1258465585.3682.7.camel@johannes.local/ https://lore.kernel.org/netdev/1258465585.3682.7.camel@johan...
        lxgr 2y ago
        Hm, maybe I'm mixing up something here, but all I can say is that it works like this on my machine: I have a VM running in bridged mode, I'm connected to my home router using Wi-Fi, and I can see the virtual MAC address of the VM on the router management interface. Possibly this is just at the DHCP level, though, and what the router sees just comes from my host MAC address? A quick packet trace suggests that.
jeroenhd 2y ago
Based on your description, you're using NAT as a means to bypass network restrictions. It's a great hack that will do the trick wonderfully, but if that's the officially proposed solution then the network is not set up for what it's actually used for. Contrary to popular belief, IPv6 does have NAT, it's just stupid and unnecessary in most use cases. There are even different kinds of NAT; there's the "swap the public prefix with a private one" NAT (useful for shit ISPs that rotate your IPv6 prefix to make you pay extra for a static one, so your addresses don't keep changing), or the IPv4-like "masquerade all traffic when forwarding" one that'll work in your weird enterprise network. With the latter option, you can set up an IPv6 with DHCPv6 on the upstream and whatever combination of SLAAC or DHCP you want on the VM side, and set up NAT using guides like this (possibly outdated iptables-based) one: https://forums.raspberrypi.com/viewtopic.php?t=298878 https://forums.raspberrypi.com/viewtopic.php?t=298878
- nolist_policy 2y ago
  On Virtualbox you can set up ipv6 NAT with a few clicks btw.
- LegionMammal978 2y ago
  > Based on your description, you're using NAT as a means to bypass network restrictions. The threat model on this big enterprise WAN isn't "an authorized user creates a VM on an existing machine", but rather "some rando plugs something in with an Ethernet cable and goes to town on the intranet services". It has a whole web portal where you can log in and register your devices. So it's not like anything's really being bypassed here. Anyway, I still prefer NAT for VMs over most passthrough schemes, which I've found unreliable even on IPv4 networks. What the outside network doesn't know about can't hurt it.
  - Dylan16807 2y ago
    > The threat model on this big enterprise WAN isn't "an authorized user creates a VM on an existing machine", but rather "some rando plugs something in with an Ethernet cable and goes to town on the intranet services". It has a whole web portal where you can log in and register your devices. So it's not like anything's really being bypassed here. Isn't that what the MAC filtering is for? I don't see the point of stopping a single registered MAC on a single port from having multiple IPs.
api 2y ago
You can do local NAT. Most VM hosts will do it. You just don’t need NAT everywhere anymore.
deathanatos 2y ago
"Doctor it hurts when I". Keep track of all devices, and alloc a static /64 per (host) MAC. And even in the face of a supposed malicious network admin like yours, you can still adopt IPv6, and use the IPv6 private network ranges for the VMs, and then do NAT like it's 1983, same as you would have otherwise done with IPv4, except that all other uses cases get easier, while this one use case remains as hard as it was before.

pcpuser 2y ago

That's definitely a limitation of your network. I don't see how ipv6 can shoulder any responsibility here.

Dylan16807 2y ago

Are you talking about eliminating NAT on IPv4? IPv6, set up the normal way, does not allocate IPs. Devices can and will have several at once and their VMs can easily get some too.

wmf 2y ago
The enterprise corrupted IPv6 and disabled SLAAC so devices have to use whatever DHCPv6 gives them.
- somanyphotons 2y ago
  How does that work for android devices? I heard they don't allow dhcp provided addresses?
  - wmf 2y ago
    The Android problem only occurs in an IPv6-only enterprise network which is very rare. Otherwise Android can use IPv4.

pjc50 2y ago

Shouldn't the VMs have their own MACs?

jeroenhd 2y ago
If they're not routed directly through the network card but use a virtual switch instead, the network upstream only sees the server MAC. If they're directly hooked into the network card they can have their own MACs, but that approach can make it hard to communicate between host and VM.
- nolist_policy 2y ago
  Also, multiple MACs does not work with wlan.
  - lxgr 2y ago
    Why would it not? There's even a third MAC address field in the 802.11 headers for just that scenario, as far as I remember (i.e. to distinguish between "802.11 source/destination" and "Ethernet-level actual source/destination").
    - nolist_policy 2y ago
      You actually need to use special 4addr/WDS frames with 4 addresses[1]. However no one accepts these by default so it's unusable for a Laptop that you want to connect to random wlan networks. [1] https://lore.kernel.org/netdev/1258465585.3682.7.camel@johannes.local/ https://lore.kernel.org/netdev/1258465585.3682.7.camel@johan...
      - lxgr 2y ago
        Hm, maybe I'm mixing up something here, but all I can say is that it works like this on my machine: I have a VM running in bridged mode, I'm connected to my home router using Wi-Fi, and I can see the virtual MAC address of the VM on the router management interface. Possibly this is just at the DHCP level, though, and what the router sees just comes from my host MAC address? A quick packet trace suggests that.

jeroenhd 2y ago

Based on your description, you're using NAT as a means to bypass network restrictions. It's a great hack that will do the trick wonderfully, but if that's the officially proposed solution then the network is not set up for what it's actually used for. Contrary to popular belief, IPv6 does have NAT, it's just stupid and unnecessary in most use cases. There are even different kinds of NAT; there's the "swap the public prefix with a private one" NAT (useful for shit ISPs that rotate your IPv6 prefix to make you pay extra for a static one, so your addresses don't keep changing), or the IPv4-like "masquerade all traffic when forwarding" one that'll work in your weird enterprise network. With the latter option, you can set up an IPv6 with DHCPv6 on the upstream and whatever combination of SLAAC or DHCP you want on the VM side, and set up NAT using guides like this (possibly outdated iptables-based) one: https://forums.raspberrypi.com/viewtopic.php?t=298878 https://forums.raspberrypi.com/viewtopic.php?t=298878

nolist_policy 2y ago
On Virtualbox you can set up ipv6 NAT with a few clicks btw.
LegionMammal978 2y ago
> Based on your description, you're using NAT as a means to bypass network restrictions. The threat model on this big enterprise WAN isn't "an authorized user creates a VM on an existing machine", but rather "some rando plugs something in with an Ethernet cable and goes to town on the intranet services". It has a whole web portal where you can log in and register your devices. So it's not like anything's really being bypassed here. Anyway, I still prefer NAT for VMs over most passthrough schemes, which I've found unreliable even on IPv4 networks. What the outside network doesn't know about can't hurt it.
- Dylan16807 2y ago
  > The threat model on this big enterprise WAN isn't "an authorized user creates a VM on an existing machine", but rather "some rando plugs something in with an Ethernet cable and goes to town on the intranet services". It has a whole web portal where you can log in and register your devices. So it's not like anything's really being bypassed here. Isn't that what the MAC filtering is for? I don't see the point of stopping a single registered MAC on a single port from having multiple IPs.

api 2y ago

You can do local NAT. Most VM hosts will do it. You just don’t need NAT everywhere anymore.

deathanatos 2y ago

"Doctor it hurts when I". Keep track of all devices, and alloc a static /64 per (host) MAC. And even in the face of a supposed malicious network admin like yours, you can still adopt IPv6, and use the IPv6 private network ranges for the VMs, and then do NAT like it's 1983, same as you would have otherwise done with IPv4, except that all other uses cases get easier, while this one use case remains as hard as it was before.