3 ms·

NAT was an good solution that the IETF came up with, we wouldn't be able to have the internet at our scale without it

by arcmechanica 2y ago

nrabulinski 2y ago
Unless IPv6 were to be actually adopted as it was introduced
- gamedever 2y ago
  I don't know networking all that well. In my mind, I have 50 devices connected to my router behind NAT. My Mac, My Apple TV, my iPhone, My PC, My Linux Box, My partner's versions of all of those. My video games. Etc From outside there's 1 IP address. With IPv6, every device would get it's own address outside. Why do I want that? That sounds less private to me. Am I mis-understanding something? Lots of traffic on one IP address sounds more obfuscated than all separate.
  - jeroenhd 2y ago
    With IPv6, every device has multiple IP addresses. One or more addresses that are rotated* to prevent you from being tracked easily, and one that's derived from your device's MAC address so you can make your devices easily accessible from WAN by opening ports in your firewall if you want to. You could disable the rotating addresses, or disable MAC-based ones by using DHCP, but there's usually no point. As for why you would want something like that: a whole bunch of software and hardware breaks because of NAT. Consumer NAT has some monkey patching inside of it rewriting some protocols to make them work again (which also allowed random websites to open arbitrary ports to arbitrary addresses in some Linux routers a while back, because NAT overrules firewall settings to work) but there are still limitations. For instance, if you're having issues with your Nintendo Switch, Nintendo will tell you to forward every single port to your Switch (https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console https://en-americas-support.nintendo.com/app/answers/detail/..., hope that IP address doesn't get reassigned to an unpatched device later). Multiple Xbox consoles behind the same NAT requires tricking them into super-restricted-NAT mode to work, or enabling UPnP which allows devices to open ports in your firewall without any authentication. NAT just kind of sucks. IPv6 wasn't ready for deployment when NAT gained popularity, but all of the reasonable problems have been solved over a decade ago. *=default rotation happens daily, but your OS may allow you to pick a shorter duration. I've found out the hard way that setting this to five minutes will fill up Linux' route table real fast after a few days.
    - Hikikomori 2y ago
      Does it matter if they rotate if you use prefix delegation with standard size?
      - fc417fc802 2y ago
        No, it doesn't. At least the last time I checked unless you go out of your way to implement a non-standard configuration IPv6 is a disaster for personal privacy for the typical multi-user household. Then again, the "typical" multi-user household is likely logged in to most things via SSO with Google or Facebook and probably has approximately zero fingerprinting mitigations in use so perhaps it isn't worth worrying about? If you aren't the typical household then given 2^64 addresses and a Linux box serving as a router you've got quite a few options available. Including various creative reinventions of NAT that don't break basic functionality.
        eythian 2y ago
        > IPv6 is a disaster for personal privacy for the typical multi-user household Why? With privacy extensions (which are normally enabled for user devices), then all someone can do is look at the prefix. This is identical to looking at the IPv4 address in a NAT setup, and it hasn't been that much of a privacy disaster. As I see it, nothing is lost on that front.
        fc417fc802 2y ago
        > This is identical to looking at the IPv4 address in a NAT setup It is not identical unless the OS uses a new IP for every new outbound connection. I believe that would qualify as a (very) nonstandard configuration. > it hasn't been that much of a privacy disaster. Indeed, it was tongue in cheek which is why I went on to point out SSO. The reality is most people aren't willing to sacrifice convenience to retain even a shred of privacy. If you are one of the few who care then you can implement one of the many possible non-standard solutions.
        Marsymars 2y ago
  - Marsymars 2y ago
    > From outside there's 1 IP address. With IPv6, every device would get it's own address outside. Why do I want that? That sounds less private to me. Am I mis-understanding something? Lots of traffic on one IP address sounds more obfuscated than all separate. Having recently enabled IPv6 for my home network, the "why" was that a) IPv6 to IPv6 connections are nominally more efficient than those that have to traverse NAT and b) it enables connectivity to/from IPv6-only internet devices. The privacy upsides of a single IPv4 IP for a household are, to me, more marginal than the above benefits.
wmf 2y ago
I'm pretty sure the IETF fought against NAT.
p_l 2y ago
NAT was introduced by private company called Network Translation Inc. and successfully broke efforts to migrate off IPv4 (which was supposed to be EOLd by 1990) and permanently broke the "network of hosts" into asymmetric one of servers and clients. Note that we had a solution for address exhaustion by 1991, but it was just "good" and not "perfect" and worst of all it used the hated OSI protocol stack (TUBA - TCP & UDP on top of OSI CLNS - also known as IPv9). It even had at least two usable implementations at the time it was proposed (for SunOS and Cisco IOS)
- Hikikomori 2y ago
  First product, but does the early RFCs and discussions predate their work?
  - p_l 2y ago
    There's some work predating it, but it was very much undeployed before PIX let out the genie out, because even the early NAT work notes it might be problematic even in short term.
- fc417fc802 2y ago
  > permanently broke the "network of hosts" into asymmetric one of servers and clients. That was inevitable and can't reasonably be blamed on NAT. As but a few examples. ISPs arbitrarily break things unless you pay them extra. Stateful firewalls are a good thing. Even on my local LAN I can't reliably SSH into my laptop because it's on WiFi and does funky power saving stuff with the chipset I guess. My phone is far worse than my laptop in that regard. Setting up a reliable and widely reachable server requires deliberate effort regardless of the existence of NAT.
- wmf 2y ago
  People would have resisted TUBA the same ways they're resisting IPv6 now. It's not a technical problem.
  - p_l 2y ago
    It's partly technical (BSD Sockets being bad API that hard does low level proto ok details in applications) and partially business - vendors didn't want to do the work to upgrade software and hardware - especially with advent of CEF and similar hardware routing options. And by 1990s the government-led standardisation efforts that gave us widespread ethernet and IPv4 got axed, and efforts to make vendors update if only for federal contracts died in waiver hell. The others kinds of problems are from there over time.
PhilipRoman 2y ago
The thing I like about NAT is that it is essentially an ISP side stateful firewall. I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections".
- fc417fc802 2y ago
  It's funny. They'll block things I don't want them to block (email, http server, ...) but not unsolicited inbound IPv6 connections.
- kstrauser 2y ago
  Your router almost certainly has that option.
  - PhilipRoman 2y ago
    Of course, it's probably the default everywhere, but with NAT the traffic never reaches me in the first place.
    - kstrauser 2y ago
      Interesting. My ISP passes both IPv4 and IPv6 inbound, expecting you to block them yourself.
    - ianburrell 2y ago
      NAT is done on your router. There is no difference with IPv6 firewall except doesn't do NAT. Are you thinking about CGNAT which is done by the ISP? That results in double NAT which causes problems.
      - PhilipRoman 2y ago
        You're right, I was thinking of CGNAT. My ISP definitely does it (they have far more users than IP allocations) and my router does NAT as well, so I guess I have a double NAT.
- 2y ago

NAT was an good solution that the IETF came up with, we wouldn't be able to have the internet at our scale without it

nrabulinski 2y ago

Unless IPv6 were to be actually adopted as it was introduced

gamedever 2y ago
I don't know networking all that well. In my mind, I have 50 devices connected to my router behind NAT. My Mac, My Apple TV, my iPhone, My PC, My Linux Box, My partner's versions of all of those. My video games. Etc From outside there's 1 IP address. With IPv6, every device would get it's own address outside. Why do I want that? That sounds less private to me. Am I mis-understanding something? Lots of traffic on one IP address sounds more obfuscated than all separate.
- jeroenhd 2y ago
  With IPv6, every device has multiple IP addresses. One or more addresses that are rotated* to prevent you from being tracked easily, and one that's derived from your device's MAC address so you can make your devices easily accessible from WAN by opening ports in your firewall if you want to. You could disable the rotating addresses, or disable MAC-based ones by using DHCP, but there's usually no point. As for why you would want something like that: a whole bunch of software and hardware breaks because of NAT. Consumer NAT has some monkey patching inside of it rewriting some protocols to make them work again (which also allowed random websites to open arbitrary ports to arbitrary addresses in some Linux routers a while back, because NAT overrules firewall settings to work) but there are still limitations. For instance, if you're having issues with your Nintendo Switch, Nintendo will tell you to forward every single port to your Switch (https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console https://en-americas-support.nintendo.com/app/answers/detail/..., hope that IP address doesn't get reassigned to an unpatched device later). Multiple Xbox consoles behind the same NAT requires tricking them into super-restricted-NAT mode to work, or enabling UPnP which allows devices to open ports in your firewall without any authentication. NAT just kind of sucks. IPv6 wasn't ready for deployment when NAT gained popularity, but all of the reasonable problems have been solved over a decade ago. *=default rotation happens daily, but your OS may allow you to pick a shorter duration. I've found out the hard way that setting this to five minutes will fill up Linux' route table real fast after a few days.
  - Hikikomori 2y ago
    Does it matter if they rotate if you use prefix delegation with standard size?
    - fc417fc802 2y ago
      No, it doesn't. At least the last time I checked unless you go out of your way to implement a non-standard configuration IPv6 is a disaster for personal privacy for the typical multi-user household. Then again, the "typical" multi-user household is likely logged in to most things via SSO with Google or Facebook and probably has approximately zero fingerprinting mitigations in use so perhaps it isn't worth worrying about? If you aren't the typical household then given 2^64 addresses and a Linux box serving as a router you've got quite a few options available. Including various creative reinventions of NAT that don't break basic functionality.
      - eythian 2y ago
        > IPv6 is a disaster for personal privacy for the typical multi-user household Why? With privacy extensions (which are normally enabled for user devices), then all someone can do is look at the prefix. This is identical to looking at the IPv4 address in a NAT setup, and it hasn't been that much of a privacy disaster. As I see it, nothing is lost on that front.
        fc417fc802 2y ago
        > This is identical to looking at the IPv4 address in a NAT setup It is not identical unless the OS uses a new IP for every new outbound connection. I believe that would qualify as a (very) nonstandard configuration. > it hasn't been that much of a privacy disaster. Indeed, it was tongue in cheek which is why I went on to point out SSO. The reality is most people aren't willing to sacrifice convenience to retain even a shred of privacy. If you are one of the few who care then you can implement one of the many possible non-standard solutions.
      - Marsymars 2y ago
- Marsymars 2y ago
  > From outside there's 1 IP address. With IPv6, every device would get it's own address outside. Why do I want that? That sounds less private to me. Am I mis-understanding something? Lots of traffic on one IP address sounds more obfuscated than all separate. Having recently enabled IPv6 for my home network, the "why" was that a) IPv6 to IPv6 connections are nominally more efficient than those that have to traverse NAT and b) it enables connectivity to/from IPv6-only internet devices. The privacy upsides of a single IPv4 IP for a household are, to me, more marginal than the above benefits.

wmf 2y ago

I'm pretty sure the IETF fought against NAT.

p_l 2y ago

NAT was introduced by private company called Network Translation Inc. and successfully broke efforts to migrate off IPv4 (which was supposed to be EOLd by 1990) and permanently broke the "network of hosts" into asymmetric one of servers and clients. Note that we had a solution for address exhaustion by 1991, but it was just "good" and not "perfect" and worst of all it used the hated OSI protocol stack (TUBA - TCP & UDP on top of OSI CLNS - also known as IPv9). It even had at least two usable implementations at the time it was proposed (for SunOS and Cisco IOS)

Hikikomori 2y ago
First product, but does the early RFCs and discussions predate their work?
- p_l 2y ago
  There's some work predating it, but it was very much undeployed before PIX let out the genie out, because even the early NAT work notes it might be problematic even in short term.
fc417fc802 2y ago
> permanently broke the "network of hosts" into asymmetric one of servers and clients. That was inevitable and can't reasonably be blamed on NAT. As but a few examples. ISPs arbitrarily break things unless you pay them extra. Stateful firewalls are a good thing. Even on my local LAN I can't reliably SSH into my laptop because it's on WiFi and does funky power saving stuff with the chipset I guess. My phone is far worse than my laptop in that regard. Setting up a reliable and widely reachable server requires deliberate effort regardless of the existence of NAT.
wmf 2y ago
People would have resisted TUBA the same ways they're resisting IPv6 now. It's not a technical problem.
- p_l 2y ago
  It's partly technical (BSD Sockets being bad API that hard does low level proto ok details in applications) and partially business - vendors didn't want to do the work to upgrade software and hardware - especially with advent of CEF and similar hardware routing options. And by 1990s the government-led standardisation efforts that gave us widespread ethernet and IPv4 got axed, and efforts to make vendors update if only for federal contracts died in waiver hell. The others kinds of problems are from there over time.

PhilipRoman 2y ago

The thing I like about NAT is that it is essentially an ISP side stateful firewall. I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections".

fc417fc802 2y ago
It's funny. They'll block things I don't want them to block (email, http server, ...) but not unsolicited inbound IPv6 connections.
kstrauser 2y ago
Your router almost certainly has that option.
- PhilipRoman 2y ago
  Of course, it's probably the default everywhere, but with NAT the traffic never reaches me in the first place.
  - kstrauser 2y ago
    Interesting. My ISP passes both IPv4 and IPv6 inbound, expecting you to block them yourself.
  - ianburrell 2y ago
    NAT is done on your router. There is no difference with IPv6 firewall except doesn't do NAT. Are you thinking about CGNAT which is done by the ISP? That results in double NAT which causes problems.
    - PhilipRoman 2y ago
      You're right, I was thinking of CGNAT. My ISP definitely does it (they have far more users than IP allocations) and my router does NAT as well, so I guess I have a double NAT.
2y ago