Internet centralization and the original sin of NAT • Hacker News Board

Re: Internet centralization and the original sin of NAT

#181

Post by pdonis » Tue, Sep 01, 2026, 8:59 PM UTC

mohaine wrote: post #114

pdonis wrote: post #94

Earlier quoted context omitted.

> most of the time they are unwanted users trying to break in. Exactly. Of all the reasons why the average person doesn't have an Internet-visible server, NAT, I would say, is pretty far down on the list.

1. NAT and a firewall are 2 different things 2. With IPV6 you can have so many IPS that unwanted users can't guess your IP. This isn't true security but see 1 for that.

> NAT and a firewall are 2 different things

Exactly. Which is the issue with saying, as the article does, that NAT is the reason most people don't have an Internet visible server, when the real reason is that their computers need to be behind a firewall and once you're behind a firewall, safely opening up just little pieces of it for an Internet visible server is something most people aren't going to want to deal with.

Re: Internet centralization and the original sin of NAT

#182

Post by pdonis » Tue, Sep 01, 2026, 9:34 PM UTC

throw0101a wrote: post #119

mohaine wrote: post #114

Earlier quoted context omitted.

1. NAT and a firewall are 2 different things 2. With IPV6 you can have so many IPS that unwanted users can't guess your IP. This isn't true security but see 1 for that.

> 2. With IPV6 you can have so many IPS that unwanted users can't guess your IP. In fact you could have an IPv6 address for each user, and if one starts becoming troublesome both revoke account and stop using that address. You could create a new IPv6 address every millisecond, and it'd take 584,868,233 years to exhaust a IPv6 subnet (/64).

Perhaps a server run by a large corporation could do this. Perhaps.

But an ordinary person? I don't see it. If it's tough for an ordinary person to handle safely opening a port in their firewall for forwarding, it's tough squared (or perhaps cubed or an even higher power) for an ordinary person to handle auto-creating a separate IPV6 address for every other person that wants to communicate over the Internet with them.

Not to mention, how does this work with DNS? If Ordinary Person wants to put an article up for others to read, how do the others find it? Surely not by Ordinary Person sending individually crafted IPV6 addresses to anyone who wants to read their article. (And how do they even find those other people if they are also creating new IPV6 addresses for everyone else?)

Re: Internet centralization and the original sin of NAT

#183

Post by throw0101a » Tue, Sep 01, 2026, 10:49 PM UTC

mort96 wrote: post #168

throw0101a wrote: post #129

Earlier quoted context omitted.

"Client-server" thinking may in general be a 'hobbled' way of thinking of things.

It's sadly the only practical way to do things now. For client/server, you only need one party (the server) to not be behind CGNAT. For p2p, you need both parties to not be behind CGNAT. It's typically only possible to guarantee that one party isn't behind CGNAT. All practical solutions for p2p these days require NAT hole punching through STUN and signaling servers anyway, so even p2p has to be bootstrapped via clien…

> For p2p, you need both parties to not be behind CGNAT.

I have been told in many HN discussions that IPv4 is good enough and that IPv6 doesn't solve any problems. ¯\_(ツ)_/¯

Re: Internet centralization and the original sin of NAT

#184

Post by [deleted] » Tue, Sep 01, 2026, 10:52 PM UTC

pdonis wrote: post #182

throw0101a wrote: post #119

Earlier quoted context omitted.

> 2. With IPV6 you can have so many IPS that unwanted users can't guess your IP. In fact you could have an IPv6 address for each user, and if one starts becoming troublesome both revoke account and stop using that address. You could create a new IPv6 address every millisecond, and it'd take 584,868,233 years to exhaust a IPv6 subnet (/64).

Perhaps a server run by a large corporation could do this. Perhaps. But an ordinary person? I don't see it. If it's tough for an ordinary person to handle safely opening a port in their firewall for forwarding, it's tough squared (or perhaps cubed or an even higher power) for an ordinary person to handle auto-creating a separate IPV6 address for every other person that wants to communicate over the Internet with them…

[deleted]

Re: Internet centralization and the original sin of NAT

#185

Post by GoblinSlayer » Tue, Sep 01, 2026, 11:05 PM UTC

mikewarot wrote: post #46

NoMoreNicksLeft wrote: post #25

Earlier quoted context omitted.

>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. This might not be a good thing. Perhaps if there had been no protection for those odious operating systems, they'd have died the horrible deaths they earned decades ago. We should only want to protect things we intend to keep, after all, and none of us…

All of the current OS choices are insecure by design. The all operate programs with the ambient authority of the user. While this was fine for the corporate world of AT&T in the 1970s, and the classroom in the 1980s, it's insane to use it in the era of ubiquitous persistent megabit Internet connectivity, and mobile code. I know of zero systems that can survive exposure to the raw Internet, unpatched and without admin…

> The all operate programs with the ambient authority of the user.

Doesn't mean much when you have a buffer overflow in kernel.

Re: Internet centralization and the original sin of NAT

#186

Post by Arya_xiaofan » Wed, Sep 02, 2026, 3:14 AM UTC

ndiddy wrote: post #122

throw0101a wrote: post #118

Earlier quoted context omitted.

> But we'd still end up with server-client cloud architectures, even if we had started with IPv6 in the beginning. Skype was originally peer-to-peer for comms, but ended up with "super-nodes" because of NAT limitations (not sure if STUN/TURN/ICE had been invented by that point). BitTorrent is still peer-to-peer. A number of folks ran Mincecraft servers at home, but you'd only be able to have one on the default port.…

Yeah I feel like a lot of the people criticizing this are still being client-server brained. There's a lot of use cases that "everyone is a server" would open up without turning everyone into a sysadmin and they'd likely get turned into user-friendly software like BitTorrent or Skype or early Spotify.

[dead]

Re: Internet centralization and the original sin of NAT

#187

Post by Arya_xiaofan » Wed, Sep 02, 2026, 3:26 AM UTC

mort96 wrote: post #168

throw0101a wrote: post #129

Earlier quoted context omitted.

"Client-server" thinking may in general be a 'hobbled' way of thinking of things.

It's sadly the only practical way to do things now. For client/server, you only need one party (the server) to not be behind CGNAT. For p2p, you need both parties to not be behind CGNAT. It's typically only possible to guarantee that one party isn't behind CGNAT. All practical solutions for p2p these days require NAT hole punching through STUN and signaling servers anyway, so even p2p has to be bootstrapped via clien…

[dead]

Re: Internet centralization and the original sin of NAT

#188

Post by GoblinSlayer » Wed, Sep 02, 2026, 9:23 AM UTC

pratyahava wrote: post #156

RustyRussell wrote: post #116

Sorry. I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as long as the remote address allowed us to differentiate. This, in turn, means incoming traffic from a different address is unroutable. You no longer have a public endpoint . This is "poor man's firewall", but erodes our ability to have a server the way we used to…

Sorry, i am not very much into kernel/netstack development, but a question. So does it mean that even if an alternative NAT system will be available in Linux (kernel module with a switch or whatever) - it will not be adopted by industry because everyone (and every device) is used to how it works now?

You can work it around with socks5 protocol, it's designed for such cases and it has some merit for server side: https://blog.exe.dev/ssh-host-header

Re: Internet centralization and the original sin of NAT

#189

Post by GoblinSlayer » Wed, Sep 02, 2026, 9:35 AM UTC

tsimionescu wrote: post #79

Uptrenda wrote: post #27

Author is right about everything. Also: IPv6 doesn't fix this, it just introduces a new problem. IPv6 machines end up with local firewalls + stateful firewalls on the router. That router doesn't let in inbound cons. There is a part of UPnP that lets you add "pin holes" (it works like you expect) -- but the drawbacks are its kind of obscure, poorly implemented, and not guaranteed to be enabled. The idea of router soun…

What consumer routers implement DPI in their default firmware? What type of traffic are you claiming they are dropping? I've never heard of a claim like this, so I'm really curious. Note that I'm not talking about the huge DPI market for corporate/state networks.

Maybe it's about ALG.

Re: Internet centralization and the original sin of NAT

#190

Post by mort96 » Wed, Sep 02, 2026, 10:24 AM UTC

throw0101a wrote: post #183

mort96 wrote: post #168

Earlier quoted context omitted.

It's sadly the only practical way to do things now. For client/server, you only need one party (the server) to not be behind CGNAT. For p2p, you need both parties to not be behind CGNAT. It's typically only possible to guarantee that one party isn't behind CGNAT. All practical solutions for p2p these days require NAT hole punching through STUN and signaling servers anyway, so even p2p has to be bootstrapped via clien…

> For p2p, you need both parties to not be behind CGNAT. I have been told in many HN discussions that IPv4 is good enough and that IPv6 doesn't solve any problems. ¯\_(ツ)_/¯

The problem is that everyone who's championing IPv6 is talking about how it makes NAT unnecessary and about how bad NAT is. See TFA as one example. NAT is perfectly fine, so all the IPv6 boosters who make this huge deal of it get dismissed as IPv6 hype men. "Every household gets an IPv4 address which is shared between their computers using NAT" is a good solution.

The problem is, and has always been, that NAT doesn't solve the IPv4 exhaustion problem. It took a long time before I understood this due to all the noise IPv6 people make, but newer ISPs don't have enough IPv4 addresses to give every household its own address, so they use CGNAT for residential Internet access. This is what people should be focusing on, but it's not. All arguments for IPv6 are irrelevant drivel about how bad NAT is.