NAT wasn't so much normalized as a security feature as it was introduced as one. The flagship NAT product of the 1990s was the Cisco PIX, a firewall. It resulted from Cisco's acquisition of the company that originated NAT.
Internet centralization and the original sin of NAT
151–160 of 197 posts
Re: Internet centralization and the original sin of NAT
#152Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But regular NAT is fine as long as you can control it. "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If anything, NAT has saved millions of wildly…
I think it's hard for us to imagine what we could have if not for NAT.
Just as an example, any device on your home network could have a web interface which you could access from anywhere using a web browser. All the smart light bulbs and things which need some stupid account on some service could be made so they're controlled by the user instead of some company.
I've set up things like this on my home network but it's a pain because I need to deal with port forwarding, and if I have more than one device I need to use a reverse proxy.
Re: Internet centralization and the original sin of NAT
#153The designers of the internet made one fundamental mistake, namely applying meatspace norms to cyberspace. In the "real world", you don't really need that much security. Your actual security comes from the fact that all the worst criminals are already locked up, most of the would-be criminals are afraid of being locked up, and if somebody does actually commit a crime, they will get locked up and won't be able to do i…
Uhh... you can have a firewall without NAT, including one at the perimeter. This is a very common misunderstanding. NAT and firewalls are separate concepts. You can also have NAT with no meaningful firewall -- a port remapping NAT that allows anything through. Most IPv6 networks are firewalled but there's no NAT.
I think this is not really a good way to divide up the space. It's obviously true that there are non-NAT firewalls. But NAT was introduced as a firewalling technique. In the first decade of firewalls, there was a whole taxonomy of different kinds of firewalls: application layer gateways, packet filters, "stateful" packet filters, and, yes, NAT.
Re: Internet centralization and the original sin of NAT
#154Reading the comments: Why do so many people still think NAT equals firewall when they're not directly related? I guess it's because they're normally packaged together for practical reasons. They're both packet handling functions often performed in the same place. But they are NOT the same and you can have either one without the other. Most IPv6 networks have firewalls, and it's possible to have NAT that liberally pas…
You are correct. The reason NAT is seen as security on home networks is that, absent a firewall, it acts as a default deny to inbound traffic.
In other words, the reason NAT is seen as security is that it provides security (imperfectly, like almost everything else).
Re: Internet centralization and the original sin of NAT
#155As a engineering all my career life focused on networking, I am so depressed that IPv6 still not fully replaced IPv4 We have dozen of RFCs and vendors gears support IPv6 as well, but it just not finished
It's fine. IPv4 addresses might get too expensive at some point, encouraging their deprecation. Or it's entirely possible having the option of IPv6 prevents IPv4 addresses from getting prohibitvely costly. Either way, IPv6 has its role.
Re: Internet centralization and the original sin of NAT
#156Sorry. I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as long as the remote address allowed us to differentiate. This, in turn, means incoming traffic from a different address is unroutable. You no longer have a public endpoint . This is "poor man's firewall", but erodes our ability to have a server the way we used to…
Sorry, i am not very much into kernel/netstack development, but a question. So does it mean that even if an alternative NAT system will be available in Linux (kernel module with a switch or whatever) - it will not be adopted by industry because everyone (and every device) is used to how it works now?
Re: Internet centralization and the original sin of NAT
#157Earlier quoted context omitted.
> Anyway, we'll get the whole non-nat with IPv6, let's see what that brings I'll believe it when I see it. So far it doesn't look like IPv6 will win anytime soon.
It's already won. Over 50% of Internet users are on ipv6.
Source: https://www.google.com/intl/en/ipv6/statistics.html>
In the US, it’s currently over 60%: https://stats.labs.apnic.net/ipv6/US>
Re: Internet centralization and the original sin of NAT
#158[deleted]
Re: Internet centralization and the original sin of NAT
#159I think its funny everyone thinks that ISPs, Device Manufacturers, and Cloud Providers are going to let your connect back directly to your "home" with IOT devices. Absolutely not. They can charge your $9.99/mo so you can connect their craptastic app to their craptastic cloud so you can "use their app from anywhere".
... and NAT was a big part of giving them the market power they now use to enforce that.
I would say the lack of deploying service locator records in DNS was also a major contributor. We have trillions of ports/ip combinations available and we use waste bits by always using 443.
Re: Internet centralization and the original sin of NAT
#160Earlier quoted context omitted.
I absolutely plan to NAT my home, I don't see a good reason to do otherwise. I don't see a reason why my machine addresses should change over time... then again, most shouldn't have direct internet access anyway, a http proxy on firewall should be enough.
> I don't see a reason why my machine addresses should change over time You can still use fixed addresses locally if you want, its not like IPv6 is forcing you to use the prefix assigned if you just want to communicate locally over never-changing addresses. You can have your computers be fd01::1, fd01::2, fd01::3, etc, and talk to everything on their local addresses when wanting to stay local. And then when they want…
Source address selection still favors GUA over ULA by default in every major operating system… If you run both you’re almost certainly going to see a lot of GUA addresses in logs where you only allow LAN traffic. Especially if you’re using mDNS/.local for your hostnames. The only way to be sure your internal stuff only ever uses ULA’s is to not give them GUA’s, and now you’re doing NAT.
(I don’t personally run my network as ULA-only, I do ULA+GUA as you describe, but I had to basically give up on being able to reliably tie traffic logs to a known source… hosts in my LAN always seem to use a GUA to talk to each other when discovering over mDNS, which of course means they use privacy addresses by default. My ULA uses DHCP so that I can get stable addresses and know who is who, but it’s useless when things just decide to use the GUA anyway.)