Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Linux NAT a ping?

devnonsense.com

Post reply on HN
Print view View original

51–60 of 108 posts

Re: How does Linux NAT a ping?

#51

Post by slt2021 »

baq wrote: post #22
Beinglis23 wrote: post #21

When a ping is sent from a device on a local network to a device on the internet, the router performing NAT rewrites the source address of the ping to its public IP address and rewrites the ID field of the ICMP packet to a unique value. When the response is received, the router uses the unique ID value to forward the response to the correct device on the local network.

Taking this thought just a tiny bit further, this is changing a stateless protocol to a stateful one.

NAT stands for Network Address Translation, which means a NAT device maintains a translation table of internal IPs to external, so that it can return response packets coming from Internet to a proper destination on the internal network.

By definition NAT will maintain state which is translation table. Now that table can be dynamic or static, but it doesn't change the fact that there will be some state to maintain.

Re: How does Linux NAT a ping?

#52

Post by 3np »

jandrese wrote: post #39
midasuni wrote: post #11

Earlier quoted context omitted.

I have a few devices on my home internet, on a handful of 192.168 subnets The other week I moved my ISP. The AS my house belonged to obviously changed to the new ISP, and I got a new v4 IP All I had to do was update my Wan router to forward trafffic from the new Ip. Instead with ipv6 I would have to change every node on my network, update my internal DNS. Now in theory I could have my own /48 which I take with me. Th…

With IPv6 you would do stateless autoconfigurarion, so there would be no manually setting of your addresses. The router would advertise the new prefix and everything would just use it. There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. One of the primary goals of IPv6 was to avoid needing manual configuration if anythin…

> There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses.

Assumptions and dragons be here.

Re: How does Linux NAT a ping?

#53

Post by 3np »

mindslight wrote: post #17
jjoonathan wrote: post #2

NAT is such a trashy abstraction. IPv4 needs to die.

Is there a better way to not unnecessarily leak addressing metadata to adversarial remote nodes and middle boxes? IPv6 with assigning end users a whole /64 and end-devices continually churning through privacy addresses is a start. But even then some form of NAT is still required to nimbly use source prefixes from different horizon providers - eg to avoid spilling your geographic location or opening yourself up to low…

> What is the no-NAT equivalent of this?

At least for web-browsing and other HTTP/TCP use-cases: Cut off internet from your hosts and use centralized local proxies for all outgoing connections. Presumably you already have reverse proxies in place for the incoming. There is no need for NAT if all the traffic is taken care of in higher layers. This reduces your consideration to the internet-facing forward- and reverse-proxies only.

Sounds like you already have bittorrent figured out via VPN (Wireguard I guess? Well there we have one more UDP exit-point to consider).

BTW, I largely agree with your sentiment: Benefit of (especially migrating to) IPv6/DS for individual networks is often unclear or questionable and metadata privacy is a valid consideration where I believe correct solutions are not readily available and understood even by your well-intentioned and seasoned senior admins. Maybe globally the number of people who will get this right ranges in the 1000s? 10,000s if we're lucky? How many networks do we need to migrate again for "IPv4 to die"?

I guess the only way forward is for more people to do that migration and share their findings and solutions, though ;)

Re: How does Linux NAT a ping?

#54

Post by yencabulator »

throwawaymaths wrote: post #38
throwawaymaths wrote: post #27

Earlier quoted context omitted.

It's super confusing because you can use udp to read icmp packets (but not send, iirc), and i might be wrong, but i remember seeing tuts that did this!!

Getting downvoted, so: https://stackoverflow.com/questions/13087097/how-to-get-icmp... Using a udp socket is the "classic" way of implementing ping on low privilege syystems

You can kindly ask the kernel networking stack to inform you of errors, but that is not the same as "using udp to read icmp packets".

Re: How does Linux NAT a ping?

#55

Post by kazinator »

growse wrote: post #47
kazinator wrote: post #20

Earlier quoted context omitted.

OP here. Your "ISP" is a sysadmin at work who gives you one address to your cube. You otherwise like the work and the team, and the compensation is fine. Now what?

> Now what? You advocate for change. You make the case. You might not win the battle, but you're by no means forced to accept the status quo. The more who fight the battle, the more win. The more win, the faster progress, which benefits us all.

I set up NAT, I move on.

If you can solve a problem technically, without involving people, that is best.

Re: How does Linux NAT a ping?

#56

Post by starfallg »

devman0 wrote: post #44
starfallg wrote: post #35

Earlier quoted context omitted.

Any NAT that is not statically mapping IP addresses or ports 1-to-1 will require connections to be tracked and hence makes it stateful on the side after the translation (usually outside). Hence you do need state syncing between firewalls in order for NAT connections to failover correctly, unless it's a statically mapped, one-on-one, one range onto another range, for example.

This isn't really specific to NAT either, connection tracking is required for most firewalls as well even if NAT isn't in play just to implement the most basic ALLOW related,estabalished rule even, and especially, what would normally be connectionless protocols.

Yes, tracking the state of connections (e.g. TCP) is needed enforce rules on OSI layers 4 - 7. That's kinda the typically scenario when we think of connection tracking and stateful enforcement of rules.

I was just pointing out when NAT also requires connection tracking (i.e. when the NAT table needs to be built dynamically, as opposed to statically mapped).

Re: How does Linux NAT a ping?

#57

Post by justsomehnguy »

Beinglis23 wrote: post #21

When a ping is sent from a device on a local network to a device on the internet, the router performing NAT rewrites the source address of the ping to its public IP address and rewrites the ID field of the ICMP packet to a unique value. When the response is received, the router uses the unique ID value to forward the response to the correct device on the local network.

Or thinking about the proper way: how an operating system distinguish between two different ICMP 'talks' to the same destination.

Bam, you only need one computer and wireshark/tcpdump.

Sure, the article is nice and probably is enlightening for someone who never even thought about and doesn't have any networking understanding... honestly it's more about how to make a proper network lab and dig the sources but without thinking.

Re: How does Linux NAT a ping?

#58

Post by p1esk »

Beinglis23 wrote: post #21

When a ping is sent from a device on a local network to a device on the internet, the router performing NAT rewrites the source address of the ping to its public IP address and rewrites the ID field of the ICMP packet to a unique value. When the response is received, the router uses the unique ID value to forward the response to the correct device on the local network.

Why not use the source private IP instead of the “unique value”?

Re: How does Linux NAT a ping?

#59

Post by mindslight »

3np wrote: post #53
mindslight wrote: post #17

Earlier quoted context omitted.

Is there a better way to not unnecessarily leak addressing metadata to adversarial remote nodes and middle boxes? IPv6 with assigning end users a whole /64 and end-devices continually churning through privacy addresses is a start. But even then some form of NAT is still required to nimbly use source prefixes from different horizon providers - eg to avoid spilling your geographic location or opening yourself up to low…

> What is the no-NAT equivalent of this? At least for web-browsing and other HTTP/TCP use-cases: Cut off internet from your hosts and use centralized local proxies for all outgoing connections. Presumably you already have reverse proxies in place for the incoming. There is no need for NAT if all the traffic is taken care of in higher layers. This reduces your consideration to the internet-facing forward- and reverse-…

The general ignorance of the privacy benefits of NAT are what I'm reacting against too. It's certainly regrettable that end users are forced into NAT [0], but since then a shameless surveillance industry has cropped up, looking to exploit every bit of identifying information that it can. And it seems that calls for native IPv6 with everything having its own distinct address generally just ignore the practical privacy implications.

It certainly seems possible to get a NAT-equivalent privacy from properly set up SLAAC. Although a sibling comment says that the proposal for variable length prefixes was just submitted this year?!? Equivalent privacy would also require things like consumer VPN providers allowing you to request a few new addresses every few minutes, whereas NAT makes a shared uniform distribution the default.

Using a proxy instead of NAT is a good point, although there are certainly reasons I moved towards managing egress flows at the packet level with VMs rather than configuring software to play nice with proxies. And spiritually I would say that a proxy is an even more heavyweight version of NAT one layer up.

[0] Although I don't personally think the web would have developed any less centralized without NAT as many people like to imagine

Re: How does Linux NAT a ping?

#60

Post by rfmoz »

Beinglis23 wrote: post #21

When a ping is sent from a device on a local network to a device on the internet, the router performing NAT rewrites the source address of the ping to its public IP address and rewrites the ID field of the ICMP packet to a unique value. When the response is received, the router uses the unique ID value to forward the response to the correct device on the local network.

But the ID is on the ICMP header or it belongs to the IP part?
Post reply on HN