Internet centralization and the original sin of NAT • Hacker News Board

Re: Internet centralization and the original sin of NAT

#141

Post by an0malous » Tue, Sep 01, 2026, 1:03 AM UTC

RustyRussell wrote: post #116

Sorry. I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as long as the remote address allowed us to differentiate. This, in turn, means incoming traffic from a different address is unroutable. You no longer have a public endpoint . This is "poor man's firewall", but erodes our ability to have a server the way we used to…

What do you think is the best road to a decentralized net from here? Any specific solutions you like?

Re: Internet centralization and the original sin of NAT

#142

Post by jamiek88 » Tue, Sep 01, 2026, 1:06 AM UTC

CrimsonCape wrote: post #84

TZubiri wrote: post #40

Earlier quoted context omitted.

You are describing the product technically, but I find how it is used more important. Do you use it? What do you use it for? If empirically most users use it to host a server on a machine with firewalled IP, then that's more descriptive than its technical featureset as listed on the tin.

I've been running a home server and Tailscale is magic. My firewalls have no open ports. The tailnet is a virtual network that assigns IP addresses to approved devices that you authenticate to join. I use it in 3 ways: 1. My phone connects to my home network by joining the tailnet. I can play music and movies from my home server when I am away. No struggles with configuration. 2. A dedicated mini pc at home is on a s…

This sounds great! Deffo gonna investigate this!

Re: Internet centralization and the original sin of NAT

#143

Post by TZubiri » Tue, Sep 01, 2026, 1:09 AM UTC

CrimsonCape wrote: post #84

TZubiri wrote: post #40

Earlier quoted context omitted.

You are describing the product technically, but I find how it is used more important. Do you use it? What do you use it for? If empirically most users use it to host a server on a machine with firewalled IP, then that's more descriptive than its technical featureset as listed on the tin.

I've been running a home server and Tailscale is magic. My firewalls have no open ports. The tailnet is a virtual network that assigns IP addresses to approved devices that you authenticate to join. I use it in 3 ways: 1. My phone connects to my home network by joining the tailnet. I can play music and movies from my home server when I am away. No struggles with configuration. 2. A dedicated mini pc at home is on a s…

An interesting use case, a kind of personal server, presumably FTP.

Still not my cup of tea, but I think that the threshold of acceptable hacks is much higher for personal usage, there's no right or wrong, because it's as much a useful project as it is one of exploration and expression.

Thanks for sharing.

Re: Internet centralization and the original sin of NAT

#144

Post by sundancegh » Tue, Sep 01, 2026, 1:13 AM UTC

The distinction between NTP as a protocol and the assumptions imposed by NAT is useful, especially when considering how much modern networking depends on intermediaries rather than direct connectivity.

Re: Internet centralization and the original sin of NAT

#145

Post by robinpie » Tue, Sep 01, 2026, 1:15 AM UTC

RustyRussell wrote: post #116

Sorry. I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as long as the remote address allowed us to differentiate. This, in turn, means incoming traffic from a different address is unroutable. You no longer have a public endpoint . This is "poor man's firewall", but erodes our ability to have a server the way we used to…

Wow! Thanks for the note.

Re: Internet centralization and the original sin of NAT

#146

Post by GoblinSlayer » Tue, Sep 01, 2026, 1:15 AM UTC

ironhaven wrote: post #77

elric wrote: post #23

Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But regular NAT is fine as long as you can control it. "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If anything, NAT has saved millions of wildly…

I don't think that you can draw the line between NAT and CGNAT. The fact that single NAT works as well as it does is an argument for why it is ok to double NAT with CGNAT. The conceit behind NAT is that 99% of traffic over the router will be client-server and the last 1% can get away with separately negotiating with the router to get inbound traffic. For example my ISP Xfinity by default will put your router in CGNAT…

That can be because UPnP supports only ip4, you need PCP for ip6, but CGNAT supporting port mapping is unheard of.

Re: Internet centralization and the original sin of NAT

#147

Post by trevithick » Tue, Sep 01, 2026, 1:40 AM UTC

robinpie wrote: post #106

solatic wrote: post #47

> There’s lots of things you can blame for killing the open Internet, but I think NAT was one of the earliest. Running a server used to be trivial: run an executable, tell people your address, done... It also trained everyone to think client‐server is natural. “My device talks to The Cloud which talks to other devices” feels normal, when that feeling originated as an artifact of address scarcity. A lot of this feels…

> A lot of this feels like a requiem for the days when the only people on the Internet were "high-computer-skill" type folks. FWIW I (writer of blog post) am 21 years old and just a bitch lol

But you are a "high-computer-skill" person.

Also, the lazy sysadmin forgot to set a quote for today.

Re: Internet centralization and the original sin of NAT

#148

Post by xvilka » Tue, Sep 01, 2026, 1:45 AM UTC

One option to resolve current worrying trends is to invest in development of alternative network protocols/structure, Yggdrasil[1][2], for example.

[1] https://yggdrasil-network.github.io/

[2] https://github.com/yggdrasil-network/yggdrasil-go

Re: Internet centralization and the original sin of NAT

#149

Post by mintflow » Tue, Sep 01, 2026, 1:47 AM UTC

As a engineering all my career life focused on networking, I am so depressed that IPv6 still not fully replaced IPv4

We have dozen of RFCs and vendors gears support IPv6 as well, but it just not finished

Re: Internet centralization and the original sin of NAT

#150

Post by tsimionescu » Tue, Sep 01, 2026, 2:07 AM UTC

TZubiri wrote: post #137

tsimionescu wrote: post #81

Earlier quoted context omitted.

> But if I see a user that exposes a server without a dedicated IP address, and they use tailscale for this, the way I would describe it is that they are adding a third party node that routes traffic for them (just to provide multiplexing), so in terms of security, it's an additional unnecessary man in the middle. If you are listening on a public IP, you can trivially be attacked by anyone on the Internet. If you lis…

Yeah, but to the extent that the server is useful, it needs to be exposed to the internet. If you make your tailscale available to the internet through tailscale, you are still weak to external attackers, putting a VPN in the middle doesn't fundamentally change that dynamic, maybe it shifts it around and it confuses you enough to feel less shifty about it. But it doesn't decrease your risk, if your HTTP server is wea…

> Yeah, but to the extent that the server is useful, it needs to be exposed to the internet.

Not if it's a private server, like the poster above was describing. For example, if I want to maintain a NAS to store my photos and view them anytime, I am better off running it on a Tailscale network that only I (and some friends/family) can acces, no reason to expose it publicly and then try to secure it.