4 ms·

> IP networks are stateless Until you have stateful firewall, which any modern end network is going to have > NAT gateways don't actually route/translate by (

by iso1631 7mo ago

> IP networks are stateless Until you have stateful firewall, which any modern end network is going to have > NAT gateways don't actually route/translate by (IP, port) as you imply, but rather by (source IP, source port, destination IP, destination port), as otherwise there simply would not be enough ports in many cases. If 192.168.0.1 and 0.2 both hide behind 2.2.2.2 and talk to 1.1.1.1:80 then they'll get private source IPs and source ports hidden behind different public source ports. Unless your application requires the source port to not be changed, or indeed embeds the IP address in higher layers (active mode ftp, sip, generally things that have terrible security implications), it's not really a problem until you get to 50k concurrent connections per public ipv4 address. In practice NAT isn't a problem. Most people complaining about NAT are actually complaining about stateful firewalls.

lxgr 7mo ago
> Until you have stateful firewall, which any modern end network is going to have Yes, but it's importantly still a choice. Also, a firewall I administer, I can control. One imposed onto me by my ISP I can’t. > not really a problem until you get to 50k concurrent connections per public ipv4 address. So it is in fact a big problem for CG-NATs. > In practice NAT isn't a problem. Most people complaining about NAT are actually complaining about stateful firewalls. No, I know what I'm complaining about. Stateful firewall traversal via hole punching is trivial on v6 without port translation, but completely implementation dependent on v4 with NAT in the mix, to just name one thing. (Explicit "TCP hole punching" would also be trivial to specify; it's a real shame we haven't already, since it would take about a decade or two for mediocre CPE firewalls to get the memo anyway.) Having global addressing is also just useful in and of itself, even without global reachability.
- iso1631 7mo ago
  > So it is in fact a big problem for CG-NATs. Only if they're under provisioned. If my home really needed tens of thousands I'd provision another ipv4 address, but it doesn't -- at the moment I have a mere 121 active connections in my firewall. The cost of a firewall is far more than the cost of an ipv4 address, which are available for about $20 each. > Having global addressing is also just useful in and of itself, even without global reachability. Except that doesn't happen, as most locations will not be BGP peering and advertising their own /48 (routing tables would melt) Instead if you change your ISP, you change your IP address. Unless you use private ips in the fc00:: range, which is no different to using rfc1918 addresses for the vast majority of users

by iso1631 7mo ago

lxgr 7mo ago

> Until you have stateful firewall, which any modern end network is going to have Yes, but it's importantly still a choice. Also, a firewall I administer, I can control. One imposed onto me by my ISP I can’t. > not really a problem until you get to 50k concurrent connections per public ipv4 address. So it is in fact a big problem for CG-NATs. > In practice NAT isn't a problem. Most people complaining about NAT are actually complaining about stateful firewalls. No, I know what I'm complaining about. Stateful firewall traversal via hole punching is trivial on v6 without port translation, but completely implementation dependent on v4 with NAT in the mix, to just name one thing. (Explicit "TCP hole punching" would also be trivial to specify; it's a real shame we haven't already, since it would take about a decade or two for mediocre CPE firewalls to get the memo anyway.) Having global addressing is also just useful in and of itself, even without global reachability.

iso1631 7mo ago
> So it is in fact a big problem for CG-NATs. Only if they're under provisioned. If my home really needed tens of thousands I'd provision another ipv4 address, but it doesn't -- at the moment I have a mere 121 active connections in my firewall. The cost of a firewall is far more than the cost of an ipv4 address, which are available for about $20 each. > Having global addressing is also just useful in and of itself, even without global reachability. Except that doesn't happen, as most locations will not be BGP peering and advertising their own /48 (routing tables would melt) Instead if you change your ISP, you change your IP address. Unless you use private ips in the fc00:: range, which is no different to using rfc1918 addresses for the vast majority of users