Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting a NAT Gateway

awsistoohard.com

Post reply on HN
Print view View original

31–40 of 130 posts

Re: Self-hosting a NAT Gateway

#31

Post by mystraline »

Yeah, I just use a VPS box I pay $20/year for. Only the most basic config goes on this machine. Basically load is 0.1 , and has no data.

Then I run my stuff locally.

And then I use ssh tunneling to forward the port to localhost of the remote machine. Its a unit file, and will reconstruct the tunnel every 30s if broken. So at most 30s downtime.

Then nginx picks it up.

Re: Self-hosting a NAT Gateway

#33

Post by creatonez »

z7 wrote: post #19

"You only live once." Why state this as absolute fact? Seems a bit lacking in epistemic humility.

Everyone has to address their spiritual beliefs every time they mention something vaguely related to them? Else they lack epistemic humility? ...Did it occur to you that most people have actually thought of this question?

Wait, is "seems lacking in epistemic humility" just coded language for "I disagree, therefore you couldn't possibly be thoughtful"?

Re: Self-hosting a NAT Gateway

#35

Post by nwellinghoff »

I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1. I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

Re: Self-hosting a NAT Gateway

#36

Post by mrsssnake »

> For those unfamiliar, a NAT Gateway acts as a one way door to your private subnet to access the internet without allowing traffic in

Repeat after me: NAT is not a firewall. And we need to stop pretending it is.

Re: Self-hosting a NAT Gateway

#37

Post by ajsnigrutin »

nwellinghoff wrote: post #35

I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1. I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

The problem with "add another block" is, that you have to change everything everywhere to make it work... and if you're changing everything, why not expand it properly.

Only a tiny minority of people have to look at those addresses, the majority just types "facebook", enter, clicks on first google result and gets facebook (because ".com" is too hard to write).

Re: Self-hosting a NAT Gateway

#38

Post by mrsssnake »

bongodongobob wrote: post #20
heinternets wrote: post #5

Please can we do away with NAT forever. Why are we still encouraging this? It’s caused the world to do horrible kludges and continues to do so.

Because it's never once inconvenienced the average network admin, probably. I still don't get what problem it's supposed to solve for me.

There absolutely are annoyences IPv6 get rid of, that are much embedded in IT culture we only see them if we look.

Port forwarding, external/internal address split, split horizon DNS, SNI proxies, NAT, hairpin routing - some of the hacks made mostly because of shortage in IP space.

Re: Self-hosting a NAT Gateway

#40

Post by varenc »

mrsssnake wrote: post #36

> For those unfamiliar, a NAT Gateway acts as a one way door to your private subnet to access the internet without allowing traffic in Repeat after me: NAT is not a firewall. And we need to stop pretending it is.

Agreed. Assuming an AWS "NAT Gateway" is the same as a regular NAT?

Security is not the purpose of a NAT. It's there to give you more IPs than you have. There's all sorts of NAT hole punching techniques. If you want a firewall, you need a firewall.

Post reply on HN