Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Linux NAT a ping?

devnonsense.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: How does Linux NAT a ping?

#81

Post by tambourine_man »

voxic11 wrote: post #34

You might be interested in https://samy.pl/pwnat/ Specifically, when the server starts up, it begins sending fixed ICMP echo request packets to the fixed address 3.3.3.3. We expect that these packets won't be returned. Now, 3.3.3.3 is *not* a host we have any access to, nor will we end up spoofing it. Instead, when a client wants to connect, the client (which knows the server IP address) sends an ICMP Time Exceeded p…

pwnat seems really interesting and potentially easier than my SSH tunnels. Thanks for the link

Re: How does Linux NAT a ping?

#83

Post by commandersaki »

sgjohnson wrote: post #77
jaimex2 wrote: post #66

Earlier quoted context omitted.

IPv6 needs to die also. It had more than enough time to become dominant and has just floundered.

https://www.google.com/intl/en/ipv6/statistics.html 45% (and growing) of all traffic to Google is IPv6. Hardly "floundered". It's just that most major ISPs in the developed world have so many IPv4 addresses they don't care that much about IPv6 yet. Now, try starting a new ISP without CGNAT (which will lead to a garbage experience for everyone) or IPv6. You'll have to spend literal tens (if not hundreds) of millions j…

25 years and we've only got 45% We should've been at 95% decades earlier if they came up with an actual transition plan.

Re: How does Linux NAT a ping?

#84

Post by sgt »

i80and wrote: post #10
trustingtrust wrote: post #3

Earlier quoted context omitted.

You'll hate CG-NAT even more then.

The first time I encountered CGNAT was such a rude shock. I don't think it should be legal to market it as "internet" to consumers

If your ISP gives you CGNAT, then the best thing you can do is to request a static public IP address. Will probably cost a little bit more but well worth it.

Re: How does Linux NAT a ping?

#85

Post by mike_hock »

littlecranky67 wrote: post #45
jjoonathan wrote: post #2

NAT is such a trashy abstraction. IPv4 needs to die.

Not sure IPv6 will fix this. Technically, yes it does. But major providers only assigning a /64 to a home user (and charging hefty fees for "buisness use" /48) already leads to IPv6 NAT or segmenting the /64 further - which shoulnt be done.

Why would anyone need /64 if not to segment it further.

Re: How does Linux NAT a ping?

#86

Post by littlecranky67 »

mike_hock wrote: post #85
littlecranky67 wrote: post #45

Earlier quoted context omitted.

Not sure IPv6 will fix this. Technically, yes it does. But major providers only assigning a /64 to a home user (and charging hefty fees for "buisness use" /48) already leads to IPv6 NAT or segmenting the /64 further - which shoulnt be done.

Why would anyone need /64 if not to segment it further.

Well ask the IETF, the RFCs say that sub-segmenting a /64 shouldn't be done. Yet people do, and the result is - well - here be dragons depending on the implementations.

Re: How does Linux NAT a ping?

#87

Post by littlecranky67 »

lazide wrote: post #68
littlecranky67 wrote: post #45

Earlier quoted context omitted.

Not sure IPv6 will fix this. Technically, yes it does. But major providers only assigning a /64 to a home user (and charging hefty fees for "buisness use" /48) already leads to IPv6 NAT or segmenting the /64 further - which shoulnt be done.

Most seem to have stopped and are handing out /48’s in my experience. Do you know any not doing that still?

I'm with one of the biggest german internet providers (o2 Telefonia) and they are not even providing any IPv6 at all (at least not in all regions, and without calling support to enable this feature individually).

Re: How does Linux NAT a ping?

#88

Post by hddqsb »

voxic11 wrote: post #34

You might be interested in https://samy.pl/pwnat/ Specifically, when the server starts up, it begins sending fixed ICMP echo request packets to the fixed address 3.3.3.3. We expect that these packets won't be returned. Now, 3.3.3.3 is *not* a host we have any access to, nor will we end up spoofing it. Instead, when a client wants to connect, the client (which knows the server IP address) sends an ICMP Time Exceeded p…

To save others some reading:

This trick (ping 3.3.3.3) is used to let a server behind NAT learn the IP address of a client that is also behind NAT, without requiring any non-NAT server (such as https://ifconfig.co).

The main action of this tool is to then create a UDP tunnel between the client and server.

But based on quick reading, the tool appears to assume that the NAT does not rewrite the UDP source port, so it won't work on all routers. STUN (which is used in e.g. WebRTC) implements more sophisticated techniques, and even then there are some cases where it cannot work and the only option is to use a relay (TURN).

I'm pretty sure that the same issue applies to the ping 3.3.3.3 trick -- if the NAT rewrites the ping identifier (as described in the article), the trick would break.

Re: How does Linux NAT a ping?

#89

Post by qhwudbebd »

dgl wrote: post #75
qhwudbebd wrote: post #43

Earlier quoted context omitted.

> In the future you can probably go "IPv6-mostly" with a CLAT engine ...although there still isn't any kernel support for the necessary SIIT v4 v6 translation, so to implement CLAT you end up using unmaintained (and unmergeably bad) out-of-tree kernel modules or unmaintained (and slow) userspace daemons hanging off a tuntap interface.

pf on OpenBSD does it fine.

It does yes. I should have written 'no Linux kernel support' rather than 'no kernel support', sorry. The BSDs are better off than Linux here.

Re: How does Linux NAT a ping?

#90

Post by sgjohnson »

commandersaki wrote: post #83
sgjohnson wrote: post #77

Earlier quoted context omitted.

https://www.google.com/intl/en/ipv6/statistics.html 45% (and growing) of all traffic to Google is IPv6. Hardly "floundered". It's just that most major ISPs in the developed world have so many IPv4 addresses they don't care that much about IPv6 yet. Now, try starting a new ISP without CGNAT (which will lead to a garbage experience for everyone) or IPv6. You'll have to spend literal tens (if not hundreds) of millions j…

25 years and we've only got 45% We should've been at 95% decades earlier if they came up with an actual transition plan.

"25 years" is not fair. There was no immediate need for IPv6 for anyone 10 years ago, so it should be no surprise that it's not at 95% currently.

Now there is.

Post reply on HN