3 ms·

There are many things wrong with this analogy, but the most important ones seem to be: - NAT gateways are inherently stateful (per connection) and IP networks

by lxgr 8mo ago

There are many things wrong with this analogy, but the most important ones seem to be: - NAT gateways are inherently stateful (per connection) and IP networks are stateless (per host, disregarding routing information). So even if you only look at the individual connection level, disregarding the host/connection layering violation, the analogy breaks. - NAT gateways don't actually route/translate by (IP, port) as you imply, but rather by (source IP, source port, destination IP, destination port), as otherwise there simply would not be enough ports in many cases.

iso1631 8mo ago
> IP networks are stateless Until you have stateful firewall, which any modern end network is going to have > NAT gateways don't actually route/translate by (IP, port) as you imply, but rather by (source IP, source port, destination IP, destination port), as otherwise there simply would not be enough ports in many cases. If 192.168.0.1 and 0.2 both hide behind 2.2.2.2 and talk to 1.1.1.1:80 then they'll get private source IPs and source ports hidden behind different public source ports. Unless your application requires the source port to not be changed, or indeed embeds the IP address in higher layers (active mode ftp, sip, generally things that have terrible security implications), it's not really a problem until you get to 50k concurrent connections per public ipv4 address. In practice NAT isn't a problem. Most people complaining about NAT are actually complaining about stateful firewalls.
- lxgr 8mo ago
  > Until you have stateful firewall, which any modern end network is going to have Yes, but it's importantly still a choice. Also, a firewall I administer, I can control. One imposed onto me by my ISP I can’t. > not really a problem until you get to 50k concurrent connections per public ipv4 address. So it is in fact a big problem for CG-NATs. > In practice NAT isn't a problem. Most people complaining about NAT are actually complaining about stateful firewalls. No, I know what I'm complaining about. Stateful firewall traversal via hole punching is trivial on v6 without port translation, but completely implementation dependent on v4 with NAT in the mix, to just name one thing. (Explicit "TCP hole punching" would also be trivial to specify; it's a real shame we haven't already, since it would take about a decade or two for mediocre CPE firewalls to get the memo anyway.) Having global addressing is also just useful in and of itself, even without global reachability.
  - iso1631 8mo ago
    > So it is in fact a big problem for CG-NATs. Only if they're under provisioned. If my home really needed tens of thousands I'd provision another ipv4 address, but it doesn't -- at the moment I have a mere 121 active connections in my firewall. The cost of a firewall is far more than the cost of an ipv4 address, which are available for about $20 each. > Having global addressing is also just useful in and of itself, even without global reachability. Except that doesn't happen, as most locations will not be BGP peering and advertising their own /48 (routing tables would melt) Instead if you change your ISP, you change your IP address. Unless you use private ips in the fc00:: range, which is no different to using rfc1918 addresses for the vast majority of users
pocksuppet 8mo ago
There's actually a kind of stateless NAT where each host gets a source port range. I believe it was involved in one of the IPv6 transition ideas.

by lxgr 8mo ago

iso1631 8mo ago

> IP networks are stateless Until you have stateful firewall, which any modern end network is going to have > NAT gateways don't actually route/translate by (IP, port) as you imply, but rather by (source IP, source port, destination IP, destination port), as otherwise there simply would not be enough ports in many cases. If 192.168.0.1 and 0.2 both hide behind 2.2.2.2 and talk to 1.1.1.1:80 then they'll get private source IPs and source ports hidden behind different public source ports. Unless your application requires the source port to not be changed, or indeed embeds the IP address in higher layers (active mode ftp, sip, generally things that have terrible security implications), it's not really a problem until you get to 50k concurrent connections per public ipv4 address. In practice NAT isn't a problem. Most people complaining about NAT are actually complaining about stateful firewalls.

lxgr 8mo ago
> Until you have stateful firewall, which any modern end network is going to have Yes, but it's importantly still a choice. Also, a firewall I administer, I can control. One imposed onto me by my ISP I can’t. > not really a problem until you get to 50k concurrent connections per public ipv4 address. So it is in fact a big problem for CG-NATs. > In practice NAT isn't a problem. Most people complaining about NAT are actually complaining about stateful firewalls. No, I know what I'm complaining about. Stateful firewall traversal via hole punching is trivial on v6 without port translation, but completely implementation dependent on v4 with NAT in the mix, to just name one thing. (Explicit "TCP hole punching" would also be trivial to specify; it's a real shame we haven't already, since it would take about a decade or two for mediocre CPE firewalls to get the memo anyway.) Having global addressing is also just useful in and of itself, even without global reachability.
- iso1631 8mo ago
  > So it is in fact a big problem for CG-NATs. Only if they're under provisioned. If my home really needed tens of thousands I'd provision another ipv4 address, but it doesn't -- at the moment I have a mere 121 active connections in my firewall. The cost of a firewall is far more than the cost of an ipv4 address, which are available for about $20 each. > Having global addressing is also just useful in and of itself, even without global reachability. Except that doesn't happen, as most locations will not be BGP peering and advertising their own /48 (routing tables would melt) Instead if you change your ISP, you change your IP address. Unless you use private ips in the fc00:: range, which is no different to using rfc1918 addresses for the vast majority of users

pocksuppet 8mo ago

There's actually a kind of stateless NAT where each host gets a source port range. I believe it was involved in one of the IPv6 transition ideas.