5 ms·

The mere existence of Tailscale should give a hint that NAT is only a speedbump and not any protection whatsoever. It protects you against nothing. Every method

The mere existence of Tailscale should give a hint that NAT is only a speedbump and not any protection whatsoever. It protects you against nothing. Every method that Tailscale uses to traverse NAT can be in isolation used by any other piece of software. For more info about that you can read the following article. https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works

immibis 2y ago
What people really want is a firewall, and since NAT acts as a firewall, they confuse it with that. My university has a public IP for every computer, but you could still only connect to the servers, not random computers, from the outside. Because they had a firewall.
- lupusreal 2y ago
  Yeah but the average person wouldn't know to set up a firewall (and can't count on their ISP to have their best interests at heart.) Therefore the general public benefits from the degree of protection that NAT provides.
  - Symbiote 2y ago
    Almost 50% of internet traffic is IPv6. Obviously, those average people have a suitable firewall provided by default on their routers.
    - lupusreal 2y ago
      Do they?
    - smw 2y ago
      I think the vast majority of that is from phones?
      - Symbiote 2y ago
        It will vary by country, but for example all but one of the large broadband ISPs in the UK use IPv6.
  - lxgr 2y ago
    Then just enable the firewall by default, or don't even provide a way to disable it unless the user enters "developer/advanced/Pro (tm)" mode. None of these are valid excuses for NAT.
- username332211 2y ago
  What ordinary people (as opposed to IT departments) really want is firewall that can't be accidentally disabled by pushing an overly permissive firewall rule. NAT/port forwarding, for all their faults make it rather difficult to write rules allowing traffic to a machine you didn't intend to expose to the world.
  - Symbiote 2y ago
    Consumer routers have very similar UI for managing an IPv6 firewall as IPv4 NAT port forwarding. This is not in any way a benefit of NAT.
  - lxgr 2y ago
    Then... make the firewall UI so that you can't accidentally push an overly permissive firewall rule? Just because NAT accidentally achieves some good outcomes doesn't in any way imply that said good outcomes are somehow exclusive to NAT.
phendrenad2 2y ago
"not any protection whatsoever" is way too strong a statement. NAT does raise the bar to exploiting a random smart lightbulb in your house significantly higher.
kccqzy 2y ago
The big distinction is that for Tailscale both endpoints know they want to talk to each other, and that both have Internet access. That's not the usual case firewalls are designed for. Tailscale doesn't strictly need NAT traversal. They can run only their DERP servers and still continue to work. If your firewall tries to block two devices from communicating and yet allows both devices internet access, you have already lost.

immibis 2y ago

What people really want is a firewall, and since NAT acts as a firewall, they confuse it with that. My university has a public IP for every computer, but you could still only connect to the servers, not random computers, from the outside. Because they had a firewall.

lupusreal 2y ago
Yeah but the average person wouldn't know to set up a firewall (and can't count on their ISP to have their best interests at heart.) Therefore the general public benefits from the degree of protection that NAT provides.
- Symbiote 2y ago
  Almost 50% of internet traffic is IPv6. Obviously, those average people have a suitable firewall provided by default on their routers.
  - lupusreal 2y ago
    Do they?
  - smw 2y ago
    I think the vast majority of that is from phones?
    - Symbiote 2y ago
      It will vary by country, but for example all but one of the large broadband ISPs in the UK use IPv6.
- lxgr 2y ago
  Then just enable the firewall by default, or don't even provide a way to disable it unless the user enters "developer/advanced/Pro (tm)" mode. None of these are valid excuses for NAT.
username332211 2y ago
What ordinary people (as opposed to IT departments) really want is firewall that can't be accidentally disabled by pushing an overly permissive firewall rule. NAT/port forwarding, for all their faults make it rather difficult to write rules allowing traffic to a machine you didn't intend to expose to the world.
- Symbiote 2y ago
  Consumer routers have very similar UI for managing an IPv6 firewall as IPv4 NAT port forwarding. This is not in any way a benefit of NAT.
- lxgr 2y ago
  Then... make the firewall UI so that you can't accidentally push an overly permissive firewall rule? Just because NAT accidentally achieves some good outcomes doesn't in any way imply that said good outcomes are somehow exclusive to NAT.

phendrenad2 2y ago

"not any protection whatsoever" is way too strong a statement. NAT does raise the bar to exploiting a random smart lightbulb in your house significantly higher.

kccqzy 2y ago

The big distinction is that for Tailscale both endpoints know they want to talk to each other, and that both have Internet access. That's not the usual case firewalls are designed for. Tailscale doesn't strictly need NAT traversal. They can run only their DERP servers and still continue to work. If your firewall tries to block two devices from communicating and yet allows both devices internet access, you have already lost.