IP Addresses Through 2025 • Hacker News Board

Re: IP Addresses Through 2025

#101

Post by radlad » Tue, Jan 20, 2026, 9:47 PM UTC

jonathanlydall wrote: post #100

radlad wrote: post #94

Earlier quoted context omitted.

NAT is not a firewall: all it does is rewrite packets, it does not drop them.

The article actually remarks on this kind of argument. While you are technically correct about NAT not being a firewall, it is in practice a widely used front-line defense which even if not “perfect”, it has indisputably proven to be quite effective against a lot of malicious activity. Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep fr…

> Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors.

Maybe, maybe not, but regardless 99% of people are not protected by a NAT. They are protected by a "proper firewall," which happens to support NAT (and typically, is enabled for IPv4 networks.)

That is to say, while most home routers support NATs, they also ship with a default-deny firewall turned on. Typically, enabling NAT mappings also configures the firewall for users. But they are not the same thing and we need to stop conflating them because it causes a lot of confusion when people think that IPv6 is "open by default" and that IPv4 is "protected by NAT." It's not. They are both protected by your router using the same default-deny firewall.

Re: IP Addresses Through 2025

#102

Post by pixl97 » Tue, Jan 20, 2026, 10:03 PM UTC

patmorgan23 wrote: post #80

JulianHart wrote: post #73

Earlier quoted context omitted.

The CGNAT point is underrated. Carriers have zero incentive to move away from it - thousands of users per public IP, no transition cost. The interesting downstream effect is on IP reputation systems. Traditional detection assumed 1 IP = 1 user. CGNAT breaks that entirely - platforms can't aggressively filter mobile carrier IPs without blocking legitimate customers by the thousands. Makes sense the IPv4 price dropped…

Expect CG-NAT boxes are expensive, and introduce another point of failure into the network. Most mobile carriers are running IPv6 first networks these days anyway. Like you said, CG-NAT does have the benefit of making v4 address reputation less reliable, which means it's not as big a deal for the transition to v6.

>CG-NAT does have the benefit of making v4 address reputation less reliable

heh, less reliable is doing a lot of heavy lifting there. You mean "complete and total trash". We need to get to the point where Cloudflare/AWS/some other big sites just block CG-NAT nodes for a day going this IP address is a risk.

Instead if you're a website, instead of doing an easy block by IP, you're left filtering out AI crawlers, spammers, and lots of other crap hiding behind a single IP with thousands of other users behind it, and ISPs that don't really give a shit about doing anything about it.

We need to push the value of IPv4 to nearly zero and finally move away from that crap.

Re: IP Addresses Through 2025

#103

Post by pixl97 » Tue, Jan 20, 2026, 10:04 PM UTC

wcfields wrote: post #79

JulianHart wrote: post #73

Earlier quoted context omitted.

The CGNAT point is underrated. Carriers have zero incentive to move away from it - thousands of users per public IP, no transition cost. The interesting downstream effect is on IP reputation systems. Traditional detection assumed 1 IP = 1 user. CGNAT breaks that entirely - platforms can't aggressively filter mobile carrier IPs without blocking legitimate customers by the thousands. Makes sense the IPv4 price dropped…

Anecdotally on how this affects the day to day user experience: I just deployed T-Mobile 5G Business Internet to a temporary pop-up art space (it's only active for a few months) and I'd say twice daily I get a CAPTCHA challenge on Google search.

And I hope it gets worse for users behind CG-NAT to the point that websites and ISPs move to IPv6.

Re: IP Addresses Through 2025

#104

Post by pixl97 » Tue, Jan 20, 2026, 10:10 PM UTC

huslage wrote: post #90

jdsully wrote: post #52

Earlier quoted context omitted.

They hadn't bothered to add ipv6 support to most of their services and the ones that did have it usually were only dual stack - still requiring an ipv4 address.

They didn't require you to have a public IPv4 address. Just an IPv4 address.

Which requires dual-stack and all the issues that come with it, especially with private addresses.

Re: IP Addresses Through 2025

#105

Post by cyberax » Tue, Jan 20, 2026, 10:12 PM UTC

radlad wrote: post #101

jonathanlydall wrote: post #100

Earlier quoted context omitted.

The article actually remarks on this kind of argument. While you are technically correct about NAT not being a firewall, it is in practice a widely used front-line defense which even if not “perfect”, it has indisputably proven to be quite effective against a lot of malicious activity. Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep fr…

> Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors. Maybe, maybe not, but regardless 99% of people are not protected by a NAT. They are protected by a "proper firewall," which happens to support NAT (and typically, is enabled for IPv4 networks.) That is to say, while most home rout…

This is BS. "Default deny" or "default accept" makes no practical difference with NAT. You can leave the "default accept" rule with NAT and you'll be perfectly fine except in some weird edge cases.

That's because it's exploitable only if you control the next hop from the NAT router, which is typically within the ISP infrastructure. So the attacker will need to either hack your ISP or mess with your NAT router's physical uplink.

Both cases require a very dedicated attacker.

Re: IP Addresses Through 2025

#106

Post by massysett » Tue, Jan 20, 2026, 10:12 PM UTC

1970-01-01 wrote: post #38

I'm interested in any new successful startups going full IPV6 from the beginning. Once we cross that bridge, where your internal IPV4 knowledge is equivalent to token ring knowledge, there's nothing else to watch.

Relatedly: wouldn't there be many applications for which ipv4 isn't needed?

For example, Walmart has electronic eink shelf tags they can update remotely. Each one needs a unique address. I wouldn't think it needs ipv4. It doesn't have to connect to the SpaceJam website.

I would think that as time goes by, the number of these new devices would swamp the number of old ones that need ipv4. v4 would still be around and might even seem important to the fogies using web browsers on laptops...meanwhile the street lamp has five ipv6 addresses and no ipv4 ones.

Re: IP Addresses Through 2025

#107

Post by radlad » Tue, Jan 20, 2026, 10:14 PM UTC

cyberax wrote: post #105

radlad wrote: post #101

Earlier quoted context omitted.

> Against highly determined malicious actors you will of course want a proper firewall, but for 99% of people, NAT is enough to keep from being bothered by run of the mill malicious actors. Maybe, maybe not, but regardless 99% of people are not protected by a NAT. They are protected by a "proper firewall," which happens to support NAT (and typically, is enabled for IPv4 networks.) That is to say, while most home rout…

This is BS. "Default deny" or "default accept" makes no practical difference with NAT. You can leave the "default accept" rule with NAT and you'll be perfectly fine except in some weird edge cases. That's because it's exploitable only if you control the next hop from the NAT router, which is typically within the ISP infrastructure. So the attacker will need to either hack your ISP or mess with your NAT router's physi…

A default deny firewall is a good idea to protect services everywhere in your network, including those which run on the router itself (e.g. many routers run a local DNS server.) Without NAT, packets are not dropped, they simply do not have their destination rewritten to another device on the network. The traffic is still destined for the router and will be processed by it. This is why routers ship with a default-deny firewall rule.

NAT is not a firewall. It is address translation. It will not drop packets.

Re: IP Addresses Through 2025

#108

Post by pixl97 » Tue, Jan 20, 2026, 10:15 PM UTC

huslage wrote: post #93

dlcarrier wrote: post #41

Earlier quoted context omitted.

As someone with a background in electronics who doesn't manage any internet-connected equipment but has multiple embedded devices connected to a WAN, I'm glad that IPv4 still seems to have a bit of life left in it. When IPv6 was developed, over 30 years ago, connecting everything to the internet seemed like a great idea. I know that IPv6 can be made secure, but I don't have the background or research time to learn ho…

NAT is not a security measure at all. It just obscures what's behind a firewall, but that is leaky and not reliable from a security perspective. It might make you feel better, but that is not security.

Yea, people consider NAT a firewall, but at best it stops direct connections from outside. People use this as a rationale to non secure individual devices on the network. Then the moment a single device on your network is compromised (do you really trust that Chinese IOT device?) every host that doesn't have its own firewall is at risk.

With IPv6 you at least say "Holy crap, anyone could connect to this, I better secure it from outside and inside attacks" which is how actual security works.

Re: IP Addresses Through 2025

#109

Post by patmorgan23 » Tue, Jan 20, 2026, 10:20 PM UTC

1970-01-01 wrote: post #88

oasisbob wrote: post #84

Earlier quoted context omitted.

Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with. However, there are network upstarts like Jio (India) which made huge v6 investments from day one which use 464xlat for subscribers to access v4-only resources.

>Exclusively IPv6 without any transitional mechanisms would be difficult to succeed with. That's my point; why is it still difficult? What exactly are the pain points for a fully commercialized native IPV6-only business, and why do we think it will be easier to maintain the status quo?

There are still lots of customers with IPv6, if you go completely and totally v6 only then you limit your potential customer base. Now going v6 internally with a dual stack edge makes sense, Meta has done this.

Re: IP Addresses Through 2025

#110

Post by pixl97 » Tue, Jan 20, 2026, 10:23 PM UTC

rendx wrote: post #4

tokyobreakfast wrote: post #2

The real story here is China and India have been quietly buying up gobs of African IP blocks - most of which are used for botting operations. I see it in my server logs. China already de-facto owns half of Africa so it's natural they would prey on their scarce IP resources as well. When you see AI scraping at a massive scale originating from $AFRICAN_COUNTRY IP space, and that country's GDP is smaller than Rhode Isla…

I see this often that people refer to countries as actors. Are you implying that the government of these countries bought those resources and they're now owned by the government? Or are you saying that citizens/corporations of those countries are buying? I find it weird, I wouldn't use the phrase "The United States is buying XYZ" unless it was the current government doing so?

>Are you implying that the government of these countries bought those resources and they're now owned by the government

You have to take these issues with nuance instead of looking at them black and white.

If the US government gives you a billion dollar subsidy to do some particular action, is the action that is done the will of the corporation or the will of the government?

If the US government is paying private companies to 'gain information on' foreign entities, is that the will of the private companies or of the government itself?

If when a US company acquires a resource the US government can ask nicely for it with the threat of implied violence if you don't give it, is that a private resource or not?

And, note, I'm talking about the US that has relatively strong property rights and not about China where the government has far more leeway with the operation of companies, and absolutely uses them for nation state level information gathering.