Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet centralization and the original sin of NAT

dreamstation.systems

Post reply on HN
Print view View original

101–110 of 197 posts

Re: Internet centralization and the original sin of NAT

#101

Post by api »

Reading the comments:

Why do so many people still think NAT equals firewall when they're not directly related?

I guess it's because they're normally packaged together for practical reasons. They're both packet handling functions often performed in the same place. But they are NOT the same and you can have either one without the other. Most IPv6 networks have firewalls, and it's possible to have NAT that liberally passes anything.

I wonder how much this misconception has delayed V6 adoption? "But I'll be wide open without NAT!" No, you can have a firewall. Most IPv6 routers have stateful firewalls on by default.

Re: Internet centralization and the original sin of NAT

#102

Post by kazen44 »

Dylan16807 wrote: post #88
hdgvhicv wrote: post #42

Earlier quoted context omitted.

IPv4 costs are tiny compared to the cost of providing an internet connection.

It's free money to your ISP. A lot of ISPs us CGNAT.

CGNAT is also not cheap and very complex from a architectural point of view.

Vendors have been pushing it though, because implementing IPV6 only somehow is still a very, very scary thing for large ISP's to pull off.

what should happen is it should be very easy to deploy ipv6/4 translation mechanisms in ipv4 only networks, this would allow easy interopability and make it easier for the large networks to push IPV6.

Re: Internet centralization and the original sin of NAT

#103

Post by kazen44 »

9x39 wrote: post #76
sedivy94 wrote: post #19

Earlier quoted context omitted.

IPv6, in a way, takes the concept of a MAC address and puts it on steroids. This became evident to me when I learned about EUI-64 addresses. And then my brain melted when I learned that any interface can be assigned an arbitrary number of unique addresses with varying purposes or contexts because the address space is truly *that big*. When I consider that quality of IPv6’s design, it communicates to me an old and ide…

The 'why' behind all of these protocols and decisions is left out in favor of the cert exams. Being able to implement is usually what gets you paid. >mere fact that Layer 2 and Layer 3 addresses are distinct concepts. The logical separation between the ideas allows for a lot of flexibility, and there were some wrong answers on how scalable vs flexible things should be. Ethernet and IP beat the shit out of everything…

this works nicely in IPV6, where true seperation of layer 2 and layer 3 exist. This does not exist in practice in ethernet, because ARP is required as a mechanism to learn MAC IP bindings and is dependant on IP AND Ethernet.

IPv6 solves this by doing neighbour discovery on link local addresses and multicast addresses.

Re: Internet centralization and the original sin of NAT

#104

Post by Sha1rholder »

TZubiri wrote: post #55
Sha1rholder wrote: post #49

Earlier quoted context omitted.

Not every place is the same.

Do you have any example where leasing an ipv4 block from a NIC directly costs more than 5$ per IPv4 address per year?

China has very few IPv4 addresses per capita. Here in Hangzhou, China, I have to pay China Telecom 850 CNY per year just to get an IPv4 address. That's not a trivial amount of money for us. And among the three major telecom operators, only one even offers this service.

Re: Internet centralization and the original sin of NAT

#105

Post by unethical_ban »

api wrote: post #101

Reading the comments: Why do so many people still think NAT equals firewall when they're not directly related? I guess it's because they're normally packaged together for practical reasons. They're both packet handling functions often performed in the same place. But they are NOT the same and you can have either one without the other. Most IPv6 networks have firewalls, and it's possible to have NAT that liberally pas…

You are correct.

The reason NAT is seen as security on home networks is that, absent a firewall, it acts as a default deny to inbound traffic.

Re: Internet centralization and the original sin of NAT

#106

Post by robinpie »

solatic wrote: post #47

> There’s lots of things you can blame for killing the open Internet, but I think NAT was one of the earliest. Running a server used to be trivial: run an executable, tell people your address, done... It also trained everyone to think client‐server is natural. “My device talks to The Cloud which talks to other devices” feels normal, when that feeling originated as an artifact of address scarcity. A lot of this feels…

> A lot of this feels like a requiem for the days when the only people on the Internet were "high-computer-skill" type folks.

FWIW I (writer of blog post) am 21 years old and just a bitch lol

Re: Internet centralization and the original sin of NAT

#107

Post by tom_alexander »

miki123211 wrote: post #45

The designers of the internet made one fundamental mistake, namely applying meatspace norms to cyberspace. In the "real world", you don't really need that much security. Your actual security comes from the fact that all the worst criminals are already locked up, most of the would-be criminals are afraid of being locked up, and if somebody does actually commit a crime, they will get locked up and won't be able to do i…

> If not for NAT, we'd all need a firewall

You still need a firewall regardless of NAT. Otherwise, every time you take your computer outside of your home, you're no longer protected. Any attacker or compromised device on your hotel, airport, or coffee shop wifi network would have direct access to your machine.

Re: Internet centralization and the original sin of NAT

#108

Post by __MatrixMan__ »

kazen44 wrote: post #100
thomastjeffery wrote: post #90

The consequences are so much more significant than people seem to realize. Because of NAT, hierarchy (centralized servers) is the foundational design pattern of the internet, and anyone who wants any semblance of anarchy (decentralized networks) must use a workaround that is itself hierarchical and costly. We are all interconnected, but only a wealthy few can truly speak fist.

while i agree with your sentiment, i personally think that the foundational design pattern of the internet as a network is highly decentralized. once you get public IP space and the infrastructure required to talk BGP, making decentralized designs is actually quite easy. The issue that ipv4 exhausting and "solutions" around it like NAT are making it very hard for actual users (bussiness, people etc) to get access to…

I agree that assumptions on the application side are the bigger issue, but it's less about encouraging client/server architecture in general. It's often very helpful, even among peers, to drop into a mode where somebody is wearing the client hat and somebody else is wearing the server hat.

The sin here is the hierarchy imposed by SSL and its infatuation with server names. Its says: these people are lords, they can wear the server hat. As for the peasants, your client hats are over there. If we catch a peasant wearing a server hat, the browsers will make them look like a criminal.

Our applications have evolved accordingly.

Re: Internet centralization and the original sin of NAT

#109

Post by DanHulton »

robinpie wrote: post #106
solatic wrote: post #47

> There’s lots of things you can blame for killing the open Internet, but I think NAT was one of the earliest. Running a server used to be trivial: run an executable, tell people your address, done... It also trained everyone to think client‐server is natural. “My device talks to The Cloud which talks to other devices” feels normal, when that feeling originated as an artifact of address scarcity. A lot of this feels…

> A lot of this feels like a requiem for the days when the only people on the Internet were "high-computer-skill" type folks. FWIW I (writer of blog post) am 21 years old and just a bitch lol

Not saying this is what’s going on, but you can ABSOLUTELY have nostalgia for a time that wasn’t your own, too.

Re: Internet centralization and the original sin of NAT

#110

Post by icedchai »

talideon wrote: post #91
cm2187 wrote: post #85

NATs are also firewalls. I think people forget that before NATs, when you would install Windows, the minute you connected it to the internet, you had to rush to update it before a virus would infect it. The OS of the 90s weren't secure enough to be exposed to the WAN.

NATs are not firewalls. Any firewall-like functionality provided by NAT is entirely accidental and better provides by an actual NAT.

There are really two things here:

1) The typical "NAT" is a "PAT", which requires state for mapping traffic flow. An implementation is going to look very similar to a stateful firewall, by necessity, not accident.

2) The use of RFC-1918 addresses behind the router / NAT box provides some protection. If your address is not globally reachable, it's much harder to reach any hosts behind it. Yes, a poor implementation might allow direct routing from adjacent networks, like your ISP or neighbor. But that still isolates you from 99.99% of the internet.

Post reply on HN