Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Linux NAT a ping?

devnonsense.com

Post reply on HN
Print view View original

101–108 of 108 posts

Re: How does Linux NAT a ping?

#101

Post by zamadatix »

mike_hock wrote: post #85
littlecranky67 wrote: post #45

Earlier quoted context omitted.

Not sure IPv6 will fix this. Technically, yes it does. But major providers only assigning a /64 to a home user (and charging hefty fees for "buisness use" /48) already leads to IPv6 NAT or segmenting the /64 further - which shoulnt be done.

Why would anyone need /64 if not to segment it further.

So nobody ever again needs to think "what size end user subnet is in use". It's /64, it's always /64. It doesn't matter if you're embedding MAC addresses, using random assignment, using multiple assignments, have 1 device, have 1 trillion devices. It's a /64.

Re: How does Linux NAT a ping?

#102

Post by TheHappyOddish »

jandrese wrote: post #39
midasuni wrote: post #11

Earlier quoted context omitted.

I have a few devices on my home internet, on a handful of 192.168 subnets The other week I moved my ISP. The AS my house belonged to obviously changed to the new ISP, and I got a new v4 IP All I had to do was update my Wan router to forward trafffic from the new Ip. Instead with ipv6 I would have to change every node on my network, update my internal DNS. Now in theory I could have my own /48 which I take with me. Th…

With IPv6 you would do stateless autoconfigurarion, so there would be no manually setting of your addresses. The router would advertise the new prefix and everything would just use it. There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. One of the primary goals of IPv6 was to avoid needing manual configuration if anythin…

> There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses.

Ok, lets say I have a web server - www.example.com running on 192.168.0.100:80/2001:db8::::::100 port 80 - and a game server - game.example.com running on 192.168.0.99:27015/2001:db8::::::99 port 27015. The IPv4 DNS A records point to a CNAME record of server.example.com, which has an A record for an IPv4 addrss which then forwards via NAT to the above. The IPv6 AAAA records point directly to the above addresses and go via a transparent firewall (which likely does router advertisement).

How do I handle an address change when I change ISPs here?

For IPv4 it's very simple - I update the CNAME record and there's no further configuration required - my NAT works and traffic flows. Assumedly I could automate this simply with a DDNS client my router likely already has built in.

For IPv6, I presume I need to look up all the machines (likely via logging into them as DHCPv6 doesn't appear the norm), then go through an update all records? I understand a static suffix may help on inferring the new address, but surely I either have lots of manual updating to do now or need to run a DDNS client per machine?

I have tried running a dual stack, but every time I try it seems to be significantly more steps and complexity than IPv4, but maybe I'm missing something.

Re: How does Linux NAT a ping?

#103

Post by TheHappyOddish »

littlecranky67 wrote: post #45
jjoonathan wrote: post #2

NAT is such a trashy abstraction. IPv4 needs to die.

Not sure IPv6 will fix this. Technically, yes it does. But major providers only assigning a /64 to a home user (and charging hefty fees for "buisness use" /48) already leads to IPv6 NAT or segmenting the /64 further - which shoulnt be done.

That might be a 'your area of the world' issue. Every 'major provider' I've dealt with hands out /48s.

Re: How does Linux NAT a ping?

#104

Post by p1mrx »

TheHappyOddish wrote: post #102
jandrese wrote: post #39

Earlier quoted context omitted.

With IPv6 you would do stateless autoconfigurarion, so there would be no manually setting of your addresses. The router would advertise the new prefix and everything would just use it. There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. One of the primary goals of IPv6 was to avoid needing manual configuration if anythin…

> There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. Ok, lets say I have a web server - www.example.com running on 192.168.0.100:80/2001:db8::::::100 port 80 - and a game server - game.example.com running on 192.168.0.99:27015/2001:db8::::::99 port 27015. The IPv4 DNS A records point to a CNAME record of server.example.…

I think a DDNS client per device is the simplest solution. With https://dns.he.net, this can be an hourly cron job that fetches a URL, so no additional software is needed.

Alternatively, if your devices have a stable suffix, https://dynv6.com/ supports prefix updates across multiple records.

Re: How does Linux NAT a ping?

#105

Post by TheHappyOddish »

p1mrx wrote: post #104
TheHappyOddish wrote: post #102

Earlier quoted context omitted.

> There would be no DNS configuration at all, all local machines would use anycast DNS for the services and a well known server for Internet addresses. Ok, lets say I have a web server - www.example.com running on 192.168.0.100:80/2001:db8::::::100 port 80 - and a game server - game.example.com running on 192.168.0.99:27015/2001:db8::::::99 port 27015. The IPv4 DNS A records point to a CNAME record of server.example.…

I think a DDNS client per device is the simplest solution. With https://dns.he.net , this can be an hourly cron job that fetches a URL, so no additional software is needed. Alternatively, if your devices have a stable suffix, https://dynv6.com/ supports prefix updates across multiple records.

> I think a DDNS client per device is the simplest solution. With https://dns.he.net, this can be an hourly cron job that fetches a URL, so no additional software is needed.

Sure, but depending on what you have set up a lot of maintenance and complexity compared to NAT.

> Alternatively, if your devices have a stable suffix, https://dynv6.com/ supports prefix updates across multiple records.

That is cool and interesting, thanks! Like a lot of people self hosting, the hosted nature of it is unappealing to be, but the concept is workable with a self-hosted solution for sure.

Re: How does Linux NAT a ping?

#106

Post by mike_hock »

zamadatix wrote: post #101
mike_hock wrote: post #85

Earlier quoted context omitted.

Why would anyone need /64 if not to segment it further.

So nobody ever again needs to think "what size end user subnet is in use". It's /64, it's always /64. It doesn't matter if you're embedding MAC addresses, using random assignment, using multiple assignments, have 1 device, have 1 trillion devices. It's a /64.

Ok, then why waste a /64 on that? A /96 should be enough, or even a /112.

Re: How does Linux NAT a ping?

#107

Post by allarm »

backendanon wrote: post #80
jjoonathan wrote: post #2

NAT is such a trashy abstraction. IPv4 needs to die.

IPv6 needs to die. IPv4 using NAT ensures a moderately high level of privacy. IPv6 with privacy extensions does not.

You need to use firewall in BOTH cases. You're blaming the protocol for completely unrelated reasons.

Re: How does Linux NAT a ping?

#108

Post by allarm »

jaimex2 wrote: post #66
jjoonathan wrote: post #2

NAT is such a trashy abstraction. IPv4 needs to die.

IPv6 needs to die also. It had more than enough time to become dominant and has just floundered.

Yeah, right, that's exactly why we need to kill v6 and create the next version of IP - it's obviously going to happen faster this time.
Post reply on HN