Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting a NAT Gateway

awsistoohard.com

Post reply on HN
Print view View original

111–120 of 130 posts

Re: Self-hosting a NAT Gateway

#111

Post by Tractor8626 »

zamadatix wrote: post #87
Tractor8626 wrote: post #49

Earlier quoted context omitted.

But NAT acts as a one way door to your private subnet, doesn't it?

The firewall provides the stateful one way door, the router moves packets between the set of subnets it can see, and NAT makes it so things on the public internet think the conversations from one private address+port combo are actually coming from another public address. The last part isn't adding the security, and you can absolutely NAT without preventing the "outside" subnets from being allowed to route to the "ins…

> you can absolutely NAT without preventing the "outside" subnets from being allowed to route to the "inside" subnet

Under very specific conditions. Technically if you send packet with destination 192.168.1.10 directly to wan port of router - yes it can route it inside. The problem - how to deliver this packet over internet. You need to be connected to exactly same network segment to pull it off.

And you don't need statefull firewall to deny this kind of packets.

Re: Self-hosting a NAT Gateway

#112

Post by eqvinox »

mzhaase wrote: post #78
Arch-TK wrote: post #61

The article seems to perpetuate one of those age old myths that NAT has something to do with protection. Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding. But implementing NAT on it's own says nothing about the behavior of your router firewall with regards to receiving Martians, or with rega…

If you think about it, NAT offers pretty much the same protection as a default stateful firewall. Only allowing packets from the outside related to a connection initiated from the inside.

> NAT offers pretty much the same protection as a default stateful firewall

Most NAT requires itself to include a stateful firewall; it's the same thing as the NAT flow table. This whole trope is mostly getting into people's heads to not forget about actually configuring that "free" firewall properly, since it'll just be a poor one otherwise.

Re: Self-hosting a NAT Gateway

#113

Post by eqvinox »

notatoad wrote: post #22
stormbeard wrote: post #15

I can't believe people are paying these crazy amounts for what is basically a fleet of firewalls. What is the difficulty in running VMs with nftables rules?

running a VM where? on an ec2 instance? who's going to keep that updated for me? who's going to reprovision it when aws retires the underlying hardware? who's going to monitor it for PCI compliance for me? i don't want to deal with all that. i could dump it on fargate, but at that point it's barely cheaper than just using the official version. i've had to look at my nat gateway zero times since i set it up a couple y…

> i don't want to deal with all that

The market will provide. In this case by increasing prices to the point of maximum value extraction from people who don't want to deal with all that. There's a high initial cost to moving to something else here, with a lot of people dragging along paying more than what the market would otherwise equalize to, out of avoiding that initial hurdle. (And long term commitment of a resource, of course, one with low average but indeterminate excursion cost.)

Re: Self-hosting a NAT Gateway

#114

Post by thayne »

throw0101a wrote: post #91
sshine wrote: post #80

Earlier quoted context omitted.

In a world where people think NAT addresses are safe because you don’t need to know anything else about firewalls, IPv6 _is_ fundamentally less secure.

> In a world where people think NAT addresses are safe because […] The vast, vast majority of people do not know what NAT is: ask your mom, aunt, uncle, grandma, cousin(s), etc. They simply have a 'magic box' (often from the ISP) that "connects to Internet". People connect to it (now mostly via Wifi) and they are "on the Internet". They do not know about IPv4 or IPv6 (or ARP, or DHCP, or SLAAC). As long as the magic…

There is one practical difference. IPv6 without a NAT exposes information about different devices inside the private network. A NAT (whether ipv4 or ipv6) will obfuscate how many devices are on the network. Whether that is desirable depends on the circumstances.

Re: Self-hosting a NAT Gateway

#115

Post by tonymet »

t0mas88 wrote: post #71
tonymet wrote: post #39

In aws you can use IPv6 with either security groups or EIGW to avoid NAT fees altogether (you still pay for transfer fees ) Death , taxes and transfer fees

That's quite recent. There was some time after AWS started charging for ipv4 addresses where you could not realistically go for an ipv6 only setup behind Cloudfront because it would for example not connect to a v6 only origin. This is probably a result of all AWS services being independent teams with their own release schedule. But it would have made sense for AWS to coordinate this better.

You’re right IPv6 has compatibility issues. But for instances needing NAT gateway (no public ip) , they are often good candidates for IPv6 egress.

Re: Self-hosting a NAT Gateway

#116

Post by labcomputer »

thayne wrote: post #114
throw0101a wrote: post #91

Earlier quoted context omitted.

> In a world where people think NAT addresses are safe because […] The vast, vast majority of people do not know what NAT is: ask your mom, aunt, uncle, grandma, cousin(s), etc. They simply have a 'magic box' (often from the ISP) that "connects to Internet". People connect to it (now mostly via Wifi) and they are "on the Internet". They do not know about IPv4 or IPv6 (or ARP, or DHCP, or SLAAC). As long as the magic…

There is one practical difference. IPv6 without a NAT exposes information about different devices inside the private network. A NAT (whether ipv4 or ipv6) will obfuscate how many devices are on the network. Whether that is desirable depends on the circumstances.

> IPv6 without a NAT exposes information about different devices inside the private network.

In practice this has not been true for over 20 years.

IPv6 devices on SLAAC networks (which is to say, almost all of them) regularly rotate their IPv6 address. The protocol also explicitly encourages (actually, requires) hosts to have more than one IPv6 address active at any given time.

You are also making a wrong assumption that the externally visible address and port ranges chosen by the NAT device do not make the identity of internal devices easily guessable.

Re: Self-hosting a NAT Gateway

#117

Post by sedawkgrep »

gldrk wrote: post #66
Arch-TK wrote: post #61

The article seems to perpetuate one of those age old myths that NAT has something to do with protection. Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding. But implementing NAT on it's own says nothing about the behavior of your router firewall with regards to receiving Martians, or with rega…

>Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding. Don’t forget source routing. That said, depending on your threat model, it’s not entirely unreasonable to just rely on your ISP’s configuration to protect you from stuff like this, specifically behind an IANA private range.

I don't think source routing is a thing anymore. At least if you're talking about the ability of a source to specify a path to its destination.

The last time I heard about source routing actually being a useful feature or a vulnerability used by hackers was the 1990's.

Re: Self-hosting a NAT Gateway

#118

Post by ygouzerh »

drchaim wrote: post #83

I'm not to much into networks, although I've been sysadmin my vps for years. why I would need a NAT Gateway? it's not enough with a good set of rules of ufw or similar software?

It's mostly for AWS context, when you want to host for example your servers in a private subnet, but you want to allow access of small part: you can leverage a NAT Gateway to be the public entrypoint + some security groups as gatekeepers to filter the traffic.

However, the fees from AWS are atrocious on the NAT Gateway.

Re: Self-hosting a NAT Gateway

#119

Post by ygouzerh »

api wrote: post #23

As an OG networking person, developer, and Linux user, the state of modern dev culture just makes me sad. Modern devs are helpless in the face of things I taught myself to do in a day or two when I was fourteen, and they’re paralyzed with terror at the thought of running something. It’s “hard” goes the cliche. Networking is “hard.” Sys admin is “hard.” Everything is “hard” so you’d better pay an expert to do it. Wher…

I feel the issue is that now, what would be done by entire teams (networking team, storage team, database team), is now perform by only the same DevOps team.

We have way less time unfortunately to dig into each tech, business is pressing us like lemon on the other side to ship quickly.

Re: Self-hosting a NAT Gateway

#120

Post by bongodongobob »

mrsssnake wrote: post #38
bongodongobob wrote: post #20

Earlier quoted context omitted.

Because it's never once inconvenienced the average network admin, probably. I still don't get what problem it's supposed to solve for me.

There absolutely are annoyences IPv6 get rid of, that are much embedded in IT culture we only see them if we look. Port forwarding, external/internal address split, split horizon DNS, SNI proxies, NAT, hairpin routing - some of the hacks made mostly because of shortage in IP space.

That's kind of my point. In 20 years of managing networks and infra, none of those things have ever been painful or cost me more than a few minutes a year. That's just not enough to convince me I have any reason to switch over.
Post reply on HN