Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

By installing NAT, MIT stifles innovation

blog.achernya.com

Post reply on HN
Print view View original

71–80 of 188 posts

Re: By installing NAT, MIT stifles innovation

#71

Post by ghshephard »

throwaway2048 wrote: post #60
ghshephard wrote: post #45

Wow - 2603:4000::/24. That's the largest block of IPv6 addresses I'm aware of being handed out to a single entity. Normally, ISPs get a /32, from which, they hand out /48s to their customer. And, with pretty much zero paper work, and ISP can get a second /32 (usually adjacent with their first /32 so they can summarize as a /31). So - an ISP might get 2001:1868::/32 and then hand off 2001:1868:0209::/48 to a customer.…

It has nothing to do with amounts of addresses, and everything to do with making dividing stuff up for routing easier. A large ISP entity like comcast or AT&T can now have say a single /16 or /24 allocation and pretty much no matter how much they subdivide up their regional routing, routing to AT&T can easily be coalesced and summarized , and every end customer can still get a /64 till pretty much the end of time.

I totally understand why Comcast, AT&T, Verizon and other service providers would want /16s. They are continent wide providers with millions of customs (millions of sites).

I'm trying to grok why MIT went for a /24 instead of a /32. Because they could?

Re: By installing NAT, MIT stifles innovation

#73

Post by srcmap »

hawkling wrote: post #30
cma wrote: post #25

Earlier quoted context omitted.

On the other hand, selling its IP4 blocks may do more to slow down the move to IPv6.

Indeed! If anyone needs to feel the squeeze for IPv4 to make a move to IPv6, it is AWS... which MIT is conveniently selling the IPv4 addresses to!

Sometime, I felt force all IOTs devices, typical laptops, Phones, behind NAT is actually safer for internet as whole.

Security via network segmentation. IMO, NAT gateway is good place to lock down and put in network security appliance to track/block all the unwanted connections.

Re: By installing NAT, MIT stifles innovation

#74

Post by rocqua »

astrodust wrote: post #22
achernya wrote: post #6

Earlier quoted context omitted.

Author here -- MIT does not currently have IPv6. Although MIT did receive a /24 IPv6 allocation, https://whois.arin.net/rest/net/NET6-2603-4000-1 , it's not routable everywhere on campus yet. Unfortunately, IPv6 deployment is still below 20% (as measured by Google, https://www.google.com/intl/en/ipv6/statistics.html ) so a publically-accessible IPv6 address is not yet sufficient.

20% is starting to reach critical mass.

I'm not switching my private network. This has nothing to do with wider adoption, nor do I have issues with IPv6 as a protocol.

What's blocking me is router firmware. It can do IPv6, but only as an afterthought. Sadly, no level of adoption is going to fix that, until I buy a new router.

Re: By installing NAT, MIT stifles innovation

#76

Post by merb »

hawkling wrote: post #30
cma wrote: post #25

Earlier quoted context omitted.

On the other hand, selling its IP4 blocks may do more to slow down the move to IPv6.

Indeed! If anyone needs to feel the squeeze for IPv4 to make a move to IPv6, it is AWS... which MIT is conveniently selling the IPv4 addresses to!

well lately aws (even ec2) supports IPv6. would be cool if they would enforce it. I.E. only IPv6 internally and only via some kind of edge router to IPv6.

Re: By installing NAT, MIT stifles innovation

#77

Post by dastbe »

hawkling wrote: post #30
cma wrote: post #25

Earlier quoted context omitted.

On the other hand, selling its IP4 blocks may do more to slow down the move to IPv6.

Indeed! If anyone needs to feel the squeeze for IPv4 to make a move to IPv6, it is AWS... which MIT is conveniently selling the IPv4 addresses to!

AWS does support ipv6 everywhere; the problem is that many consumers do not (I can't access ipv6 on my current provider w/o doing work on my side, for example) and so the need for public ipv4 is going to continue for years.

I would be really happy to have only ipv6 addresses in my VPC, as that would make connecting up multiple VPCs much easier since I know their ip space won't overlap.

Re: By installing NAT, MIT stifles innovation

#78

Post by merb »

throwaway2048 wrote: post #60
ghshephard wrote: post #45

Wow - 2603:4000::/24. That's the largest block of IPv6 addresses I'm aware of being handed out to a single entity. Normally, ISPs get a /32, from which, they hand out /48s to their customer. And, with pretty much zero paper work, and ISP can get a second /32 (usually adjacent with their first /32 so they can summarize as a /31). So - an ISP might get 2001:1868::/32 and then hand off 2001:1868:0209::/48 to a customer.…

It has nothing to do with amounts of addresses, and everything to do with making dividing stuff up for routing easier. A large ISP entity like comcast or AT&T can now have say a single /16 or /24 allocation and pretty much no matter how much they subdivide up their regional routing, routing to AT&T can easily be coalesced and summarized , and every end customer can still get a /64 till pretty much the end of time.

> and every end customer can still get a /64 till pretty much the end of time.

on Telekom Germany every customer get's a /56 Fun fact their router's (Speedport) can't do prefix delegation to other routers. you need to buy one from another vendor

Re: By installing NAT, MIT stifles innovation

#79

Post by shif »

Symbiote wrote: post #34
smoyer wrote: post #17

Earlier quoted context omitted.

There are advantages to being on a private network behind a firewall ... and they could still offer a DNS name and routing to your computer if it was on a private network. It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world. This is a win for you from a security perspective - having additional layers of security won't hurt you.

NAT is not an additional layer of security. I run our servers on public IP addresses, behind a firewall. Troubleshooting and debugging is made much easier, and there's never any conflict with VPNs etc. > It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world Port 80, please. With NAT, you can't offer that to more than one computer.

But you can, a simple reverse proxy can let the same port be used for multiple servers and pick based on hostname or query (for http).

reverse proxies like nginx also have plain tcp support so it allows you to easily run several services

Re: By installing NAT, MIT stifles innovation

#80

Post by kalleboo »

I moved to student housing in Sweden in 2004 when they had aging network infrastructure (all 100 MBit but that also applied to the shared links to the housing areas[0]), and by the next year they just ditched the school-sponsored network and moved to making students pay for third party internet (distribution to rooms was still Ethernet-based but now with a citywide fiber backhaul run by the municipal power company shared by regular apartment buildings).

We got faster service with fewer restrictions (no P2P service filters) for like $10/mo with student pricing, and still with fixed IPs.

I'm not sure why what innovative service a university can provide in this space in 2017?

[0]which meant about 1000 rooms sharing 100MBit internet access. This was somewhat mitigated by local DC++ networks in each housing area to keep piracy downloads off the shared link.

Post reply on HN