Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NAT Is the Enemy of Low Power Devices

blog.golioth.io

Post reply on HN
Print view View original

101–110 of 180 posts

Re: NAT Is the Enemy of Low Power Devices

#101

Post by username332211 »

immibis wrote: post #56
vollbrecht wrote: post #45

Earlier quoted context omitted.

The mere existence of Tailscale should give a hint that NAT is only a speedbump and not any protection whatsoever. It protects you against nothing. Every method that Tailscale uses to traverse NAT can be in isolation used by any other piece of software. For more info about that you can read the following article. https://tailscale.com/blog/how-nat-traversal-works

What people really want is a firewall, and since NAT acts as a firewall, they confuse it with that. My university has a public IP for every computer, but you could still only connect to the servers, not random computers, from the outside. Because they had a firewall.

What ordinary people (as opposed to IT departments) really want is firewall that can't be accidentally disabled by pushing an overly permissive firewall rule.

NAT/port forwarding, for all their faults make it rather difficult to write rules allowing traffic to a machine you didn't intend to expose to the world.

Re: NAT Is the Enemy of Low Power Devices

#102

Post by bsder »

vv_ wrote: post #20

The problem(-s) described in the blog post are really acute for IoT in general, especially if you want your device to run on batteries or you have a limited data budget. > Therefore, when you try to continue talking to the server over a previously established session, it will not recognize you. This means you’ll have to re-establish the session, which typically involves expensive cryptographic operations and sending…

> It is often seen as more cost-effective to purchase a cellular modem with an internal MCU rather than a separate cellular modem and a host MCU to run the networking stack.

This one isn't just cost--the compliance restrictions that the cellular carriers place on you are idiotic.

The big one we bumped into is "must allow allow carrier initiated firmware updates with no restrictions on scheduling" which translates to "the carrier will eat your battery often and without warning".

In addition, many IoT devices may not call home more than once every couple of months. And the carrier will happily roll out tower firmware that will kill those being able to call home.

If I use a module with my own firmware, the modem folks will simply point fingers at me. If I use a module with integrated SoC and firmware and it gets updeathed, I get the "joy" of yelling at the cellular module manufacturer.

(I had the wonderful experience of watching a cellular IoT project go gradually dead over 3 days as the carrier rolled out an "upgrade" across its system. We got a front seat as the module manufacturer was screaming bloody murder at the carrier who simply did "We Don't Care. We Don't Have To. We're the Phone Company.")

Re: NAT Is the Enemy of Low Power Devices

#103

Post by PhilipRoman »

ianburrell wrote: post #92
PhilipRoman wrote: post #76

Earlier quoted context omitted.

Of course, it's probably the default everywhere, but with NAT the traffic never reaches me in the first place.

NAT is done on your router. There is no difference with IPv6 firewall except doesn't do NAT. Are you thinking about CGNAT which is done by the ISP? That results in double NAT which causes problems.

You're right, I was thinking of CGNAT. My ISP definitely does it (they have far more users than IP allocations) and my router does NAT as well, so I guess I have a double NAT.

Re: NAT Is the Enemy of Low Power Devices

#104

Post by PhilipRoman »

yjftsjthsd-h wrote: post #78
PhilipRoman wrote: post #52

Earlier quoted context omitted.

The thing I like about NAT is that it is essentially an ISP side stateful firewall. I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections".

> I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections". Does your router not already do that by default?

As another commenter already clarified, I meant CGNAT on the ISP side. I don't believe any ISP currently offers an equivalent firewall on their side.

Re: NAT Is the Enemy of Low Power Devices

#105

Post by Symbiote »

username332211 wrote: post #101
immibis wrote: post #56

Earlier quoted context omitted.

What people really want is a firewall, and since NAT acts as a firewall, they confuse it with that. My university has a public IP for every computer, but you could still only connect to the servers, not random computers, from the outside. Because they had a firewall.

What ordinary people (as opposed to IT departments) really want is firewall that can't be accidentally disabled by pushing an overly permissive firewall rule. NAT/port forwarding, for all their faults make it rather difficult to write rules allowing traffic to a machine you didn't intend to expose to the world.

Consumer routers have very similar UI for managing an IPv6 firewall as IPv4 NAT port forwarding.

This is not in any way a benefit of NAT.

Re: NAT Is the Enemy of Low Power Devices

#106

Post by Symbiote »

lupusreal wrote: post #96
immibis wrote: post #56

Earlier quoted context omitted.

What people really want is a firewall, and since NAT acts as a firewall, they confuse it with that. My university has a public IP for every computer, but you could still only connect to the servers, not random computers, from the outside. Because they had a firewall.

Yeah but the average person wouldn't know to set up a firewall (and can't count on their ISP to have their best interests at heart.) Therefore the general public benefits from the degree of protection that NAT provides.

Almost 50% of internet traffic is IPv6.

Obviously, those average people have a suitable firewall provided by default on their routers.

Re: NAT Is the Enemy of Low Power Devices

#107

Post by mannyv »

People have been complaining about NAT for decades. It's time to STFU. It's a well-known problem with a bunch of well-known solutions.

If you don't like NAT you could go IPv6.

But really, why do you need to talk to your device? If it's just reporting in NAT is irrelevant. If you want to do device management just write something into your protocol to check for updates/commands and deal with it on a periodic basis. You can even do that on startup, so you can tell the customer to power cycle the device. It's unlikely that any IoT device needs instant updates, so long periodic updates are probably fine.

Re: NAT Is the Enemy of Low Power Devices

#108

Post by dave78 »

mannyv wrote: post #107

People have been complaining about NAT for decades. It's time to STFU. It's a well-known problem with a bunch of well-known solutions. If you don't like NAT you could go IPv6. But really, why do you need to talk to your device? If it's just reporting in NAT is irrelevant. If you want to do device management just write something into your protocol to check for updates/commands and deal with it on a periodic basis. You…

There are plenty of IoT devices that people want to execute commands on (anything remotely controlled, basically). Polling for commands on a periodic basis introduces lag into that process which is irritating. Furthermore, polling at a frequent interval can end up using a lot of power as well versus waiting in a receive-only mode for an incoming command.

Re: NAT Is the Enemy of Low Power Devices

#109

Post by altairprime »

vv_ wrote: post #73
justahuman74 wrote: post #2

Interestingly, IPv6 is not listed as the solution

Few cellular modems commonly used in IoT support IPv6, and not all mobile network operators provide an IPv6 address. Since cellular connectivity plays a major role in the industry, IPv6 cannot be used as a blanket solution to this problem.

Either it would or it wouldn’t help in most cases, but the absence of consideration of it at all weakens the article’s arguments from a carrier perspective. IPv6 adoption was at 90% by US mobile carriers a couple years ago, and the US is not known for its telco infrastructure investment; so, while using IPv6 may not be a uniform cure for their issues, the article’s total focus on legacy IPv4 NAT issues is in stark contrast to its availability carrier-side in one of the weakest examples available. China regulates that IPv6 be supported and enabled by default on all hardware sold for use in-country since last year, and telcos have six months left until a first-stage IPv4 new-hardware prohibition goes into effect later this year, so the assumption that most cellular modems don’t support IPv6 seems unlikely as well given their regulatory climate. This deserves more research or at least an explanation of why such was not done for the initial release of the paper.

Re: NAT Is the Enemy of Low Power Devices

#110

Post by lupusreal »

Symbiote wrote: post #106
lupusreal wrote: post #96

Earlier quoted context omitted.

Yeah but the average person wouldn't know to set up a firewall (and can't count on their ISP to have their best interests at heart.) Therefore the general public benefits from the degree of protection that NAT provides.

Almost 50% of internet traffic is IPv6. Obviously, those average people have a suitable firewall provided by default on their routers.

Do they?
Post reply on HN