8 ms·
When Every Network is 192.168.1.x
- 1970-01-01 8mo agoWhy not IPv6? Pretending that it doesn't exist?? https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechanisms https://en.wikipedia.org/wiki/List_of_IPv6_transition_mechan...
- lxgr 8mo agoIPv6 solves the addressing problem, not the reachability problem. Good luck opening ports in the stateful IPv6 firewalls in the scenarios outlined in TFA: > And that assumes a single NAT. Many sites have a security firewall behind the ISP modem, or a cellular modem in front of it. Double or triple NAT means configuring port forwarding on two or three devices in series, any of which can be reset or replaced independently.
- 1970-01-01 8mo agoWith IPv6 you don’t forward ports at all. The device already has a public address.
- jlokier 8mo agoThat's the addressing problem, although I have some bad news on that: NAT is used with IPv6 in some places. The reachability problem is, even with public addresses, sometimes you have to do the same thing to "configure port forwarding" with stateful IPv6 firewalls as with double or triple NAT IPv4.
- lxgr 8mo agoThat's why I said "open ports", not "forward ports". Stateful firewalls are very much a thing on v6. Many mobile ISPs don't allow incoming connections by default, for example. Many CPEs (home routers) also come with a v6 firewall (I'd guess it's probably more common than not?), and not everybody has admin access to theirs.
- bandrami 8mo agoYou don't have to forward ports with IPv6 but you certainly can, and that means some remote sites you have to interact with will.
- bigstrat2003 8mo agoI'm not really seeing a reason why it would be impossible to open firewalls in that scenario. More work, sure, but by no means impossible. In any case TFA says right up front that it is trying to solve the problem of overlapping subnets, which IPv6 solves nicely.
- lxgr 8mo agoIt's completely impossible if you simply don't have the necessary access. Not everybody can administer all firewalls upstream from them. Nor can everyone control whether their connection supports v6, unfortunately.
- digiown 8mo agoHole punching is a thing. Ports are not normally completely blocked. They allow replies, which can be exploited to do make a connection. Obviously this requires an out of band signaling mechanism. Tailscale does this, so does WebRTC, iirc. See: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
- lxgr 8mo agoYes, but I don't believe all firewalls support that, especially for TCP, and as you've mentioned, now you also need to maintain a handshaking mechanism. The complexity makes sense if you need to transport a lot of data peer-to-peer or the lowest possible latency, but if you don't, you might as well use that coordination server (which outbound-only clients are connecting to) for payload communication as well.
- direwolf20 8mo agoFirewalls don't track connections as carefully as you might think. They don't delete the mapping when an RST is received, so you can keep using it and receive a SYN in the other direction and now you have a connection.
- 8mo ago
- zamadatix 8mo agoThe article's proposed solution for IPv4 is a combination of VPN+NAT. The solution in IPv6 can be just VPN, sans NAT.
- bandrami 8mo agoIt can be sans NAT, but there's no guarantee it will be, and if a remote site chooses to NAT their IPV6 you still have to support it
- duskwuff 8mo agoI wouldn't be surprised if a lot of the hardware under management (e.g. IP cameras, NVRs, cable modems) lacks support for IPv6, and/or the customer networks that it's resident on don't have working IPv6 transit.
- reactordev 8mo agoIt’s definitely on the software side… The human side.
- eqvinox 8mo agoThe squishy side. Coincidentally I think that's an overestimation on the number of devices that don't support IPv6. At this point, vendors have to go out of their way to disable IPv6, and they lose out on some government/enterprise tenders that require IPv6 even if they're not running it (yet).
- reactordev 8mo agoRight, IPv6 is baked into the NIC, so it’s up to developers to use it.
- zokier 8mo agoThe solution is to run ipv6 on the overlay and have the customer site gateway thing they have to translate it to target ipv4. Conveniently you can do the translation it more or less statefully and very easily because you can just embed the ipv4 addr in ipv6. For example you could grab a /64 prefix, assign 32 bits to customer/gateway id and other 32 bits to target ipv4 addr.
- pcarroll 8mo agoIPv6 is very badly supported at the low end of the market. Cheap webcams, doorbells, etc. And that not counting already old equipment... If we had a nuclear war, we could start over. But for now, we are stuck. Blame it on Cisco for inventing NAT.
- qhwudbebd 8mo agoYes, I was going to suggest nat64 encapsulating the customer's v4 network on the wireguard overlay, but their embedded device is presumably a little linux board, and mainline linux still lacks any siit/clat/nat64 in netfilter. So I guess they'd end up in a world of pain with out-of-tree modules like jool or inefficient funnelling through taptun tayga-style.
- perakojotgenije 8mo agoShameless plug - this is exactly the same problem that our team had when we had to maintain a bunch of our customer's servers. All of the subnets were same, and we had to jump through hoops just to access those servers - vpns, port forwarding, dynamic dns with vnc - we've tried it all. That is why we developed https://sshreach.me/ https://sshreach.me/ - now it's a click of a button.
- pcarroll 8mo agoThe initial idea started as a bunch of ssh tunnels. Been doing that for years. But WireGuard seemed a better solution at scale, and more efficient. When I first saw WiteGuard, it blew my mind how elegantly simple it was. I always hated VPNs. Now I seem to have made them my life...
- PeterStuer 8mo agoLike Newt (https://github.com/fosrl/newt https://github.com/fosrl/newt)?
- bad_username 8mo agoYour website landing page is great. No stock photo hipsters drinking coffee, no corporate fluff amid whitespace wasteland. Just straight to the point. Rare sight today.
- dgrin91 8mo agoThis is basically what I use tailscale & their magicdns feature for. I manage a few locally hosted jellyfin servers for myself and some family members, and its the same problem. I just added tailscale to them all and now I can basically do ssh parents.jellyfin.ts.net or inlaws.jellyfin.ts.net
- nxobject 8mo agoIn your experience, how often does Tailscale have to resort to an external relay server to traverse? I’ve had that out the kibosh on bandwidth/latency sensitive applications before.
- BrandoElFollito 8mo agoI was about to say that. This is what I do too. The only drawback are routes - they won't work on the same CIDR (I mean the fact that you can say in Tailscale "if you want to reach the 192.168.16.13 device that does not support Tailscale, go through this Tailscale gateway"). For this I had to shift my parents' network to be able to access stuff like the printer, in a network that clashed with another one of mine.
- pcarroll 8mo agoThe way we did it, roting is not a problem. Any Netrinos client (Windows, Mac, or Linux, including the free version) can act as a gateway. It assigns a unique overlay IP to devices on the local network that can't run software themselves, like cameras, NAS units, or printers, and handles the NAT translation. Think of it like a router's DMZ feature, but inverted. Instead of exposing one device to the internet, each device gets a private address that's only reachable inside your mesh network.
- BrandoElFollito 8mo agoThis overlay approach is fantastic, but I do not think it exists in Tailscale.
- venusenvy47 8mo ago
- pixl97 8mo agoOne step beyond this is the multi-subnetted network on each side. You get the DNAT working, but then suddenly the app gets more complex over time and suddenly you're calling 192.168.2.x, which leads to async routes. Some traffic works, some traffic works one way, and other traffic disappears. Then you as the client/app manager pull your hair out as the network team tells you everything is working fine.
- rtkwe 8mo agoI recently just changed my default subnet to 10.X.Y.... rolling two random numbers to make it highly unlikely my home subnet through wireguard would conflict with the subnet where I am connecting from.
- trollbridge 8mo agoI just use /24s in the lower-middle range of 172.16. Very unlikely to have a conflict there.
- EvanAnderson 8mo agoI find a lot of Docker containers using subnets inside 172.16.0.0/16.
- notpushkin 8mo agoProbably for the same reason – 172.16/12 is not as widely used for other networks :-)
- pclmulqdq 8mo agoI often use 172.31/16 for subnets and have never seen a conflict. I have seen 172.24 and 172.16 used before, though.
- dmd 8mo agoMy (very large) corporate network uses 172.16 and 10. heavily, which has lead me to set my docker/daemon.json default-address-pools to 84.54.64.0/18, as it's very unlikely we need to communicate with any IPs in Uzbekistan.
- dijit 8mo agoSo, uh. I kinda don't want to share this because: A) it's a bad idea B) it means it will be less unique and C) I got teased for it a long time ago by my other nerd friends. But the US DOD has huge blocks of prefixes that it doesn't do anything with, presumably they use it for internal routing so every device they have could publicly route without NAT.. One of those prefixes is 7.0.0.0/8. My home network uses that. I have never had an issue with S2S VPNs. However, there have been a few bits of software (pfsense for example) which have RFC1918 hardcoded in some areas and treat it like a public network and overwriting it means doing the entire network setup manually without the helping hand of the system to build-out a working boilerplate.
- solaris2007 8mo ago> But the moment two sites share the same address range, you have an ambiguity that IP routing cannot resolve. Writing PF or nft rules to NAT these hyper-legacy subnets on the local side of the layer3 tunnel is actually super trivial, like 20 seconds of effort to reason about and write in a config manifest. Like written the article, a device on the customer site is required. At that point you might as well deploy a router that has a supportable software stack and where possible sober IP instead of legacy IP. . I have been running IPv6-only networks since 2005 and have been deploying IPv6-only networks since 2009. When I encountered a small implementation gap in my favorite BSD, I wrote and submitted a patch. Anyone who complained about their favorite open source OS having an IPv6 implementation gap or was using proprietary software (and then also dumb enough to complain about it), should be ashamed of themselves for doing so on any forum with "hacker" in the name. But we all know they aren't ashamed of themselves because the competency crisis is very real and the coddle culture let's such disease fester. There is no excuse to not deploy at minimum a dual-stack network if not an IPv6-only network. If you deploy an IPv4-only network you are incompetent, you are shitting up the internet for everyone else, and it would be better for all of humanity if you kept any and all enthusiasm you have for computers entirely to yourself (not a single utterance).
- organsnyder 8mo agoI don't have enough time for that.
- solaris2007 8mo ago[flagged]
- pcarroll 8mo agoSupport for IPv6 is notoriously bad in residential modems. They can barely run IPv4. In an enterprise, you can do it properly. But here we are stuck with the junk the ISP gave out. Customers don't care. You have to work with what you've got.
- solaris2007 8mo ago
- eqvinox 8mo agoThey clearly haven't talked to a telco or network device vendor, they would've sold them a VRF/EVPN/L3VPN based solution… for a whole bunch of money :) You can DIY that these days though, plain Linux software stack, with optional hardware offload on some specific things and devices. Basically, you have a traffic distinguisher (VXLAN tunnel, MPLS label, SRv6, heck even GRE tunnel), keep a whole bunch of VRFs (man ip-vrf) around, and have your end services (server side) bind into appropriate VRFs as needed. Also, yeah, with IPv6 you wouldn't have this problem. Regardless of whether it's GUAs or ULAs. Also-also, you can do IPv6 on the server side until the NAT (which is in the same place as in the article), and have that NAT be a NAT64 with distinct IPv6 prefixes for each customer.
- yardstick 8mo agoThe problem with talking to a telco, is you have to talk with not just one but any your customer may use. And if at the customer location there’s multiple routers in between the cameras and that telco router, it’s a shitshow trying to configure anything. Much easier to drop some router on site that is telco neutral and connect back to your telco neutral dc/hq.
- eqvinox 8mo agoThat's all true, but you can also, you know, like, talk to people without buying your whole solution from them :) (btw, have you actually read past the first 7 words? I'm much more interested what people think about the latter parts.)
- yardstick 8mo agoOn the later parts, VRF in my scenarios won’t scale. Need to provide support access to 10k-50k locations all with the same subnet (industry standard equipment where the vendor mandates specific IP addressing, for better or worse). They are always feeding in data into the core too. Much easier to just VPN+NAT.
- 8mo ago
- rpcope1 8mo agoThe suggested solution involves using the CGNAT /10 in conjunction with a VPN, but I've actually seen someone do this, and still have problems with certain end users where their next hop for routing also involves a router with an IPv4 address in the same space, so it's not really bulletproof either. We may as well consider doing other naughty things like co-opting DoD non-routable /8s or the test net in the RFCs you're not supposed to use, because basically anything you pick is going to have problems.
- pcarroll 8mo agoThat does not happen here. The CGNAT addresses are in the VPN tunnel. And the tunnel connects private devices end-to-end. The LAN packets never see the Internet. They are inside the WireGuard packets.
- DontBreakAlex 8mo agoCan we please just use ipv6? PLEASE
- direwolf20 8mo agono because it wastes 24 bytes per packet!!!11111
- Frotag 8mo ago> The gateway device performs 1:1 NAT. Traffic arriving for 100.97.14.3 is destination-translated to 192.168.1.100, and the source is masqueraded to the gateway's own LAN address. Couldn't you tell the WG devices that 192.168.2.0/24 refers to the 192.168.1.0/24 network at customer A, such that 192.168.2.55 is routed to 192.168.1.55. Same for 192.168.3.0/24 referring to customer B. I think this is what the article is getting at but I don't see the value in manually assigning an alias to each non-wg device, versus assigning an alias to the entire LAN.
- direwolf20 8mo agoIt's not enough to set fake routes. You have to edit the addresses in the packets, so the end devices will receive them.
- Frotag 8mo agoYeah so instead DNAT, use NETMAP on the gateway device to that LAN. (Sorry if I'm abusing the terminology, I only do this stuff like once a year for homelab.) eg this is what I'm currently using to alias my home network # Rewrite 192.168.150.?? as 192.168.50.?? PreUp = iptables -t nat -A PREROUTING -d 192.168.150.0/24 -j NETMAP --to 192.168.50.0/24 PostDown = iptables -t nat -D PREROUTING -d 192.168.150.0/24 -j NETMAP --to 192.168.50.0/24 With other wg peers getting a 192.168.150.0/24 entry in the AllowedIPs for this gateway (if needed).
- pcarroll 8mo agoThe problem there is you still need to keep track of the subnets. It works for a while, but it's quite complex. NAT is actually easier when you get into hundreds of sites.
- waynesonfire 8mo agoI decided to learn IPv6 recently and I'm pleasantly surprised how simple and elegant it is. Truly a joy. Highly recommend, if you've never worked with IPv6 to try it. It's like discovering a bidet.
- fukawi2 8mo agoThis is what the NETMAP target in iptables is for - map an entire subnet to another subnet, including the reverse. We were doing this 20 years ago for clients trying to on-board other companies that they'd bought. It's horrible, but it does solve the problem in a pinch.
- bob1029 8mo agoI feel like this is really only an issue with true site to site VPNs. Client to site shouldn't have this issue because the VPN concentrator is like a virtual NAT. The best strategy might be to maintain the ability to easily reassign the network for a site. If every site is non-overlapping the problem does become trivial. I'd much rather fight a one time "reboot your machines tonight" battle than the ongoing misery of mapping things that do not want to be.
- hacker_homie 8mo agoAt the risk of ruining my solution I moved my lan sub net into the 172.16.0.0/12 block This is used on virtual private clouds and is not publicly addressable. since switching to this I have not had any collisions.
- divbzero 8mo agoWhat we could do is increase the number of IP addresses available. Just imagine if we enlarged the IP address space from 32 bits to 128 bits: Every device on the Internet could have a unique IP address!
- JohnClark1337 8mo ago[dead]
- Yaggo 8mo agoInteresting idea! But I think such upgrade would take years, if not decades, to get widely adopted.
- showmexyz 8mo agoOr maybe a century.
- nottorp 8mo agoThe thing is, this upgrade you two are praising is designed to satisfy the original article's needs and no one else's. Why do all those devices need to talk to each other btw? It's never specified. Is it a user need or a data collection/spyware need? In a world where security articles make the news saying that you could obtain access to something IF the attacker already has local root and IF the moon is in a quarter phase and IF the attacker is physically present in the same room as the machine and this means the sky is falling... ... we should be questioning why disparate devices on unrelated home networks need to talk to each other.
- preisschild 8mo agoThere are completely legitimate usecases that are not "spyware" related for true end-to-end connectivity For security there is still the firewall
- watermelon0 8mo ago
- petiepooo 8mo agoWe implemented a very similar solution more than five years ago. The NanoPi R3S was not available then, so we used the GL.iNet GL-MT300N-v2 (aka Mango) running OpenWRT as our edge gateways. It's slow and only has two 100Mb ports, but that was never the bottleneck. At that time, I was able to assemble a batch of 10 including cables and power supplies for only $300, which was ridiculously cheap for such a flexible solution. If you need a polished, turnkey solution, by all means check netrinos out. If you have a strong Linux/nftables/wireguard background, this solution is easy to roll on your own.