Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting a NAT Gateway

awsistoohard.com

Post reply on HN
Print view View original

121–130 of 130 posts

Re: Self-hosting a NAT Gateway

#121

Post by anon291 »

bragh wrote: post #73
api wrote: post #23

As an OG networking person, developer, and Linux user, the state of modern dev culture just makes me sad. Modern devs are helpless in the face of things I taught myself to do in a day or two when I was fourteen, and they’re paralyzed with terror at the thought of running something. It’s “hard” goes the cliche. Networking is “hard.” Sys admin is “hard.” Everything is “hard” so you’d better pay an expert to do it. Wher…

Yes, networking and sysadmin are hard, because the Internet is a much more hostile place than it was 20 years ago and the consequences for getting things wrong are much more severe. Early 2000s, ISPs had ports open by default and getting a static IP-address was a question of just asking. With dyndns, we were hosting websites off home computers. I remember a comment on HN saying that some US university provided public…

I self host everything. Wireguard, locked down ssh configs with private keys, iptables firewall and fail2ban... Not really that hard

Re: Self-hosting a NAT Gateway

#122

Post by notatoad »

eqvinox wrote: post #113
notatoad wrote: post #22

Earlier quoted context omitted.

running a VM where? on an ec2 instance? who's going to keep that updated for me? who's going to reprovision it when aws retires the underlying hardware? who's going to monitor it for PCI compliance for me? i don't want to deal with all that. i could dump it on fargate, but at that point it's barely cheaper than just using the official version. i've had to look at my nat gateway zero times since i set it up a couple y…

> i don't want to deal with all that The market will provide. In this case by increasing prices to the point of maximum value extraction from people who don't want to deal with all that. There's a high initial cost to moving to something else here, with a lot of people dragging along paying more than what the market would otherwise equalize to, out of avoiding that initial hurdle. (And long term commitment of a resou…

the market has provided. they provided me with a managed NAT gateway service for a price that i'm willing to pay.

Re: Self-hosting a NAT Gateway

#124

Post by icedchai »

bragh wrote: post #73
api wrote: post #23

As an OG networking person, developer, and Linux user, the state of modern dev culture just makes me sad. Modern devs are helpless in the face of things I taught myself to do in a day or two when I was fourteen, and they’re paralyzed with terror at the thought of running something. It’s “hard” goes the cliche. Networking is “hard.” Sys admin is “hard.” Everything is “hard” so you’d better pay an expert to do it. Wher…

Yes, networking and sysadmin are hard, because the Internet is a much more hostile place than it was 20 years ago and the consequences for getting things wrong are much more severe. Early 2000s, ISPs had ports open by default and getting a static IP-address was a question of just asking. With dyndns, we were hosting websites off home computers. I remember a comment on HN saying that some US university provided public…

I've hosted stuff at home for almost 30 years, never bothered with a WAF. I have several VMs exposed with public IPs. If you keep your OS updated, it's hardly the end of the world. Sure, if you put up an unpatched OS from 10 years ago, you're going to have problems.

Re: Self-hosting a NAT Gateway

#125

Post by icedchai »

bragh wrote: post #104
api wrote: post #93

Earlier quoted context omitted.

I have 2gbps at home and open ports and IPv6. It’s a dynamic IP but it changes maybe once a year. I could host a site here, sure. It’s infinitely better than it was 20 years ago. OSes are more secure. Isolation is better. Languages are better. Hardware is vastly cheaper and faster and more reliable. Everything is easier and faster and better. In the corp world we have this absurd embarrassment of riches. There are li…

It doesn't matter how easy something is to set up and run from technology side if actually being able to set it up and run it takes half a year or more coordination calendar time, justification to several different departments, their review and approval. It's completely understandable, regulations and audit requirements are what they are: but then it is strange to read that modern developers somehow are paralyzed wit…

The average developer doesn't understand networking at all. DNS is a mystery. TLS certs are scary. Routing is practically beyond comprehension.

Re: Self-hosting a NAT Gateway

#126

Post by zenlot »

icedchai wrote: post #124
bragh wrote: post #73

Earlier quoted context omitted.

Yes, networking and sysadmin are hard, because the Internet is a much more hostile place than it was 20 years ago and the consequences for getting things wrong are much more severe. Early 2000s, ISPs had ports open by default and getting a static IP-address was a question of just asking. With dyndns, we were hosting websites off home computers. I remember a comment on HN saying that some US university provided public…

I've hosted stuff at home for almost 30 years, never bothered with a WAF. I have several VMs exposed with public IPs. If you keep your OS updated, it's hardly the end of the world. Sure, if you put up an unpatched OS from 10 years ago, you're going to have problems.

[dead]

Re: Self-hosting a NAT Gateway

#127

Post by throw0101a »

thayne wrote: post #114
throw0101a wrote: post #91

Earlier quoted context omitted.

> In a world where people think NAT addresses are safe because […] The vast, vast majority of people do not know what NAT is: ask your mom, aunt, uncle, grandma, cousin(s), etc. They simply have a 'magic box' (often from the ISP) that "connects to Internet". People connect to it (now mostly via Wifi) and they are "on the Internet". They do not know about IPv4 or IPv6 (or ARP, or DHCP, or SLAAC). As long as the magic…

There is one practical difference. IPv6 without a NAT exposes information about different devices inside the private network. A NAT (whether ipv4 or ipv6) will obfuscate how many devices are on the network. Whether that is desirable depends on the circumstances.

> A NAT (whether ipv4 or ipv6) will obfuscate how many devices are on the network. Whether that is desirable depends on the circumstances.

"Revisiting IoT Fingerprinting behind a NAT":

* https://par.nsf.gov/servlets/purl/10332218

"Study on OS Fingerprinting and NAT/Tethering based on DNS Log Analysis":

* https://www.irtf.org/raim-2015-papers/raim-2015-paper21.pdf

Also:

> […] In this paper, we design an efficient and scalable system via spatial-temporal traffic fingerprinting from an ISP’s perspective in consideration of practical issues like learning- testing asymmetry. Our system can accurately identify typical IoT devices in a network, with the additional capability of identifying what devices are hidden behind NAT and the number of each type of device that share the same IP address. […]

* https://www.thucloud.com/zhenhua/papers/TON'22%20Hidden_IoT....

Thinking you're hiding things because you're behind a NAT is security theatre.

Re: Self-hosting a NAT Gateway

#128

Post by zamadatix »

Tractor8626 wrote: post #111
zamadatix wrote: post #87

Earlier quoted context omitted.

The firewall provides the stateful one way door, the router moves packets between the set of subnets it can see, and NAT makes it so things on the public internet think the conversations from one private address+port combo are actually coming from another public address. The last part isn't adding the security, and you can absolutely NAT without preventing the "outside" subnets from being allowed to route to the "ins…

> you can absolutely NAT without preventing the "outside" subnets from being allowed to route to the "inside" subnet Under very specific conditions. Technically if you send packet with destination 192.168.1.10 directly to wan port of router - yes it can route it inside. The problem - how to deliver this packet over internet. You need to be connected to exactly same network segment to pull it off. And you don't need s…

But the NAT is the part making more things reachable, not less.

You need state to block only inbound originated sessions (i.e. the one way door to a private subnet).

Re: Self-hosting a NAT Gateway

#129

Post by switknee »

Am I the only one who read this and thought, "doesn't everyone self host a NAT gateway?"

Mine's in the living room, it says TP Link.

More seriously, NAT is fun and all but it can introduce unexpected behaviors that wouldn't exist in a firewall that doesn't do translation. Less is more.

Re: Self-hosting a NAT Gateway

#130

Post by nwellinghoff »

nwellinghoff wrote: post #35

I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1. I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

Eh. Judging by the large negative response I think the point might still have a point. Can you quickly rattle out ipv6 cidr blocks when you are setting up network configs? Most can grok and crank on ipv4 no problem. But for ipv6…its to the calculator. Not saying its a valid reason. Just saying ppl are lazy sooo if you want something adopted you might have to lean into lazy.
Post reply on HN