Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting a NAT Gateway

awsistoohard.com

Post reply on HN
Print view View original

101–110 of 130 posts

Re: Self-hosting a NAT Gateway

#101

Post by api »

schrodinger wrote: post #72
api wrote: post #23

As an OG networking person, developer, and Linux user, the state of modern dev culture just makes me sad. Modern devs are helpless in the face of things I taught myself to do in a day or two when I was fourteen, and they’re paralyzed with terror at the thought of running something. It’s “hard” goes the cliche. Networking is “hard.” Sys admin is “hard.” Everything is “hard” so you’d better pay an expert to do it. Wher…

Bet you never thought you'd have a "when I was a kid" attitude… :)

Always assumed I would, but I thought it was that the youngsters would be running circles around me (in this domain) the way I ran circles around the olds when I was a kid.

What happened is that as an Xennial (young genX / old millennial) I know way more about computers than either generation to the side of me. This includes younger devs. I knew way more than them when I was their age. As a teen I was hacking C to get my 386 with Slackware Linux that I installed from floppies online by modding SLIRP to run on the sun3 I had dial up access to so I could pipe serial SLIP through it. Learned all about everything happening under the hood on a network.

I don’t feel self congratulatory about this. I feel depressed. If the kids were all smarter than me it would give me more hope for the future.

Re: Self-hosting a NAT Gateway

#102

Post by dijit »

grosswait wrote: post #89
lloeki wrote: post #79

Earlier quoted context omitted.

> Only allowing packets from the outside related to a connection initiated from the inside. NAT a.k.a IP masquerading does not do that, it only figures out that some ingress packets whose DST is the gateway actually map to previous packets coming from a LAN endpoint that have been masqueraded before, performs the reverse masquerading, and routes the new packet there. But plop in a route to the network behind and unma…

I have never seen a NAT implementation that forwarded every packet sent to it. As you stated in your first sentence, NAT forwards packets that match previous packets. Assuming it does that job well, that’s filtering right there.

its pretty common to have the NAT gateway also be a stateful firewall (you’re tracking state, after all) but they’re not the same and you can have one without the other.

Its just uncommon in consumer or prosumer devices.

A similar allegory is perhaps industrial washing machines vs consumer ones or that printer/scanner combos are common (even in offices) but print shops and people who actually need a lot of paper would have dedicated equipment that does either scanning or copying better.

It’s also like a leatherman, they all have some commonality (the need to be gripped) so theres a lot of combination; but a tradie would only use one as a last resort- often preferring a proper screwdriver.

Re: Self-hosting a NAT Gateway

#103

Post by globular-toast »

mqus wrote: post #97
throw0101a wrote: post #91

Earlier quoted context omitted.

> In a world where people think NAT addresses are safe because […] The vast, vast majority of people do not know what NAT is: ask your mom, aunt, uncle, grandma, cousin(s), etc. They simply have a 'magic box' (often from the ISP) that "connects to Internet". People connect to it (now mostly via Wifi) and they are "on the Internet". They do not know about IPv4 or IPv6 (or ARP, or DHCP, or SLAAC). As long as the magic…

> which is done for IPv4-NAT, and for IPv6 firewalls Are internet routers that do ipv4 NAT usually also doing an IPv6 firewall (meaning they only let incoming connections in if they are explicitly allowed by some configuration)? Maybe thats the point where the insecurity comes from. A Home NAT cannot work any other way(it fails "safely"), a firewall being absent usually means everything just gets through.

All the ones I've had have had a firewall by default for IPv4 and IPv6, yes. If ISPs are shipping stuff without a firewall by default I'd consider that incompetence given people don't understand this stuff and shitty IoT devices exist.

I do wonder how real the problem is, though. How are people going to discover a random IPv6 device on the internet? Even if you knew some /64 is residential it's still impractical to scan and find anything there (18 quintillion possible addresses). If you scanned an address per millisecond it would take 10^8 years, or about 1/8 the age of the earth, to scan a /64.

Are we just not able to think in such big numbers?

Re: Self-hosting a NAT Gateway

#104

Post by bragh »

api wrote: post #93
bragh wrote: post #73

Earlier quoted context omitted.

Yes, networking and sysadmin are hard, because the Internet is a much more hostile place than it was 20 years ago and the consequences for getting things wrong are much more severe. Early 2000s, ISPs had ports open by default and getting a static IP-address was a question of just asking. With dyndns, we were hosting websites off home computers. I remember a comment on HN saying that some US university provided public…

I have 2gbps at home and open ports and IPv6. It’s a dynamic IP but it changes maybe once a year. I could host a site here, sure. It’s infinitely better than it was 20 years ago. OSes are more secure. Isolation is better. Languages are better. Hardware is vastly cheaper and faster and more reliable. Everything is easier and faster and better. In the corp world we have this absurd embarrassment of riches. There are li…

It doesn't matter how easy something is to set up and run from technology side if actually being able to set it up and run it takes half a year or more coordination calendar time, justification to several different departments, their review and approval. It's completely understandable, regulations and audit requirements are what they are: but then it is strange to read that modern developers somehow are paralyzed with terror. Well, the ones who were willing to try new things got shitcanned long time ago, this is the people who you have.

Isn't it anyway better for admin and security folks to have developers not get any ideas and stick to the bounds of the box?

Re: Self-hosting a NAT Gateway

#105

Post by garettmd »

jimmar wrote: post #94

AWS already documents a solution to self-host a NAT instance: https://docs.aws.amazon.com/vpc/latest/userguide/work-with-n...

I always find these discussions about AWS NAT gateways interesting because I recall way back in the day, before AWS had a manages NAT gateway, the recommendation was to roll your own anyway. Or at least that's what I heard. I took an ACloud Guru course and one of the first ec2 lessons was to create a simple NAT gateway in your VPC so that your other instances could reach the Internet.

Re: Self-hosting a NAT Gateway

#106

Post by throw0101a »

mqus wrote: post #97
throw0101a wrote: post #91

Earlier quoted context omitted.

> In a world where people think NAT addresses are safe because […] The vast, vast majority of people do not know what NAT is: ask your mom, aunt, uncle, grandma, cousin(s), etc. They simply have a 'magic box' (often from the ISP) that "connects to Internet". People connect to it (now mostly via Wifi) and they are "on the Internet". They do not know about IPv4 or IPv6 (or ARP, or DHCP, or SLAAC). As long as the magic…

> which is done for IPv4-NAT, and for IPv6 firewalls Are internet routers that do ipv4 NAT usually also doing an IPv6 firewall (meaning they only let incoming connections in if they are explicitly allowed by some configuration)? Maybe thats the point where the insecurity comes from. A Home NAT cannot work any other way(it fails "safely"), a firewall being absent usually means everything just gets through.

> Are internet routers that do ipv4 NAT usually also doing an IPv6 firewall (meaning they only let incoming connections in if they are explicitly allowed by some configuration)?

Consider the counter-factual: can you list any home routers/CPEs that do not do SPI, regardless of protocol? If someone found such a thing, IMHO there would be a CVE issued quite quickly for it.

And not just residential stuff: $WORK upgraded firewalls earlier in 2025, and in the rules table of the device(s) there is an entry at the bottom that says "Implicit deny all" (for all protocols).

So my question to NAT/IPv6 Truthers is: what are the devices that allow IPv6 connections without SPI?

And even if such a thing exists, a single IPv6 /64 subnet is as large as four billion (2^32) IPv4 Internets (2^32 addresses): good luck trying to find a host to hit in that space (RFC 7721).

Re: Self-hosting a NAT Gateway

#108

Post by throw0101a »

nwellinghoff wrote: post #35

I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1. I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

> I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1.

This was discussed in the early 1990s. Criteria that were to be used for selecting then-IPng (§5.1: 10^12 / 2^40 was the minimum):

* https://datatracker.ietf.org/doc/html/rfc1726

The winning proposal, SIPP, was originally 'only' 64 bits, but it was decided to go to 128:

* https://datatracker.ietf.org/doc/html/rfc1752

> I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

If only there was a system that allowed for easy to remember human labels to be translated to a machine-usable sequence of bits that we call "an address"…

Re: Self-hosting a NAT Gateway

#109

Post by JustExAWS »

api wrote: post #23

As an OG networking person, developer, and Linux user, the state of modern dev culture just makes me sad. Modern devs are helpless in the face of things I taught myself to do in a day or two when I was fourteen, and they’re paralyzed with terror at the thought of running something. It’s “hard” goes the cliche. Networking is “hard.” Sys admin is “hard.” Everything is “hard” so you’d better pay an expert to do it. Wher…

Yes and developers these days don’t know assembly like I learned at 12. Does it matter?

I’m sure the list of things that you don’t know that some other developers do know is long.

No one is an “expert” at everything. I know AWS well (trust me on this) and I’ve used more services than you can imagine in a production capacity. I choose not to know the intricacies of Linux and front end development for instance. That’s either “someone else’s problem” or in the former case, I just give a zip file with my code in it and run it in Lambda or a Docker container and run it using a managed Kubernetes/ECS cluster, use Lambda (yes you can deploy a Docker container to Lambda) or Fargate (AWS manages instances in Docker cluster).

Post reply on HN