Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS to begin charging for public IPv4 addresses

aws.amazon.com

Post reply on HN
Print view View original

321–330 of 377 posts

Re: AWS to begin charging for public IPv4 addresses

#321

Post by lxgr »

dijit wrote: post #113
blibble wrote: post #89

Earlier quoted context omitted.

it already has stateful firewall so that's: source ip, dest ip, protocol, source port, dest port, connection state (say 16 bytes total) doing NAT too is what, 3 more bytes per connection (8 bits for an offset into an IP table and 16 bits for the translated port)

NAT and Stateful firewalling are commonly bundled together (especially on home systems) but I would not go so far as to say “NAT has a stateful firewall”- I hear such takes all the time and its really frustrating; usually in threads regarding IPv6, incidentally it is usually programmers who think they understand everything about networks because they know how tcp operates.

In almost all NAT implementations, public-side ports are dynamically assigned, which implies that inbound connections aren't possible (unless port forwarding is explicitly configured).

Is that really conceptually so different from a stateful firewall allowing inbound packets only for established connections/flows?

"NATs are good because otherwise people wouldn't have any firewalls" is a tired take, yes, but I don't see the point being needlessly pedantic about the semantics of NAT vs. stateful firewalls when in this case, the effect is the same: No inbound packets without prior outbound packets (or a connection establishment for TCP).

Re: AWS to begin charging for public IPv4 addresses

#322

Post by iamdual »

dheera wrote: post #257
candiddevmike wrote: post #77

Earlier quoted context omitted.

Businesses and organizations are holding IPv6 back, not consumers. No one I talk to is prioritizing IPv6 migrations or spending money to upgrade gear that will support it. Maybe some net new stuff might get it, but for most businesses IPv4 is and will be the default, simply because they can't be bothered to do something different.

IP addresses should never have had letters and double colons in them. What's Google's IPv4 DNS? 8.8.8.8. What SHOULD Google's IPv6 DNS be? 8.8.8.8.8.8. What SHOULD Google's IPv8 DNS be? 8.8.8.8.8.8.8.8. What IS Google's IPv6 DNS? 2001::some::shit::I::::can't::remember//::h0ff::affblah This is why I'm still stuck on IPv4. I'm a walking DNS server for all the instances I own, I can hammer out IPs when DNS fails me and…

For a memorability, I would prefer using domain names which is invented for the humans.

Re: AWS to begin charging for public IPv4 addresses

#323

Post by colmmacc »

wbl wrote: post #226
colmmacc wrote: post #191

Earlier quoted context omitted.

TCP does not use IP fragmentation, and the IP packets are marked "Don't fragment". TCP performs its own fragmentation and every packet gets a TCP header in its leading section. A NAT, Firewall, or end-host can L4 route the TCP packet as-is and does not need to correlate with other packets. Edited to extend: this is why TCP has a "Maximum Segment Size", and why Path MTU Discovery information has to be passed into the…

It could not have copied the UDP header. Otherwise you wouldn't be able to put any new protocol on IP without teaching it to every router.

Several other protocols solve this in a layering agnostic way by simply having a header length field. The header bytes can then be copied without any understanding of the format. This is even how IP's own ICMP protocol knows how much of an IP packet it should (at least) include in an error message so that the sender can know what triggered the error.

TCP, UDP, ICMP and IP were all designed contemporaneously; UDP fragmentation could also easily have just been specified for. It's just an odd regrettable quirk.

Re: AWS to begin charging for public IPv4 addresses

#324

Post by mgaunard »

yuppie_scum wrote: post #214
mgaunard wrote: post #65

Anything in the cloud is 10 times the price it's worth. It's essentially a tax on the people gullible enough to believe in cloud tech or unable to set up real hardware.

Well next time you get that big customer that scales your traffic by 500%, enjoy sitting around waiting for Dell to ship you a bunch of servers or whatever while we just change an integer in a repo and hit terraform apply.

While you could make a case that it is convenient short-term, it is very cost-ineffective.

Re: AWS to begin charging for public IPv4 addresses

#325

Post by jwestbury »

kelnos wrote: post #248
amluto wrote: post #124

Earlier quoted context omitted.

AWS NAT gateway is $0.045 per hour plus $0.045 per GB. The hourly fee seems mostly okay - for largish users, one or two per region is fine. $0.045 per GB is nuts . That’s $20.25/hour or $14580/mo for 1 Gbps. One can buy a cheap gadget using very little power that can NAT 1 Gbps at line rate for maybe $200 (being generous). One can buy a perfectly nice low power server that can NAT 10Gbps line rate for $1k with some c…

Is that $0.045/GB for all data transferred through it, or just egress to the public internet? If it's the latter, that's half the price of normal EC2 instance egress to the public internet. If it's the former... oh sweet jesus, what? Probably way cheaper to just run an a1.large or something with Linux on it, plus a very short shell script to set up NAT. That's assuming well more than half of the traffic going through…

It's quite unfortunate they sunsetted the NAT instance AMI.

Re: AWS to begin charging for public IPv4 addresses

#326

Post by kmbfjr »

dheera wrote: post #272
red_trumpet wrote: post #269

Earlier quoted context omitted.

If it is the use of colons instead of dots that prevents you from learning the adresses, then I'm not sure you can be helped. But that discussion aside, if you adopt the IPv4 naming scheme to the 128-bit IPv6 adresses, Google's DNS would be 8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8. I would never be confident that I put in the right number of 8's in that case. And I have a feeling that you being overwhelmed has more to do with…

> If it is the use of colons instead of dots Colons are inherently more frightening than dots, especially double colons, which seems like some badly written C++ class escaped from gaol. Dots feel friendly and cute, I would pet an IPv4 address. > then I'm not sure you can be helped Sure, and the rest of the planet hasn't adopted IPv6 either. It's a horrible UX.

Lemme introduce you to XML then…

The rest of the world has adopted IPv6 because they never had the vast IPv4 space.

Re: AWS to begin charging for public IPv4 addresses

#327

Post by tecleandor »

dilyevsky wrote: post #86
cj wrote: post #43

Earlier quoted context omitted.

Plus $0.045 per gigabyte of data that passes through it. AWS has notoriously high egress fees.

It's not just egress in case of NAT - they charge you 4.5c per processed GB which means in both directions. This trips a lot of people up.

Wait what... Ingress too? :o

Re: AWS to begin charging for public IPv4 addresses

#328

Post by tedivm »

ttt3ts wrote: post #201
endgame wrote: post #200

Earlier quoted context omitted.

Yes. And AWS do (sorta) offer a NAT AMI (amazon machine image) if you want to do more management yourself and not get extorted for bandwidth. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Ins... I say sorta because it's built on an old version of Amazon Linux and is headed towards EOL with no replacement except "go build your own" as you suggest. https://www.lastweekinaws.com/blog/an-alternat-future-we-now…

Thanks! That is exactly what I wanted to know.

I've also got an open source terraform module for this-

https://github.com/tedivm/terraform-aws-nat

Re: AWS to begin charging for public IPv4 addresses

#329

Post by grumple »

amluto wrote: post #16

> A new blog post shows you how to use Elastic Load Balancers and NAT Gateways for ingress and egress traffic, while avoiding the use of a public IPv4 address for each instance that you launch. It would be nice if this came with reasonably priced NAT gateways. The current pricing is outrageous.

What kind of workloads require a lot of NAT gateway usage?

I think my team's use is kind of high, with 16 TB going through NAT last month. The bill for that came to ~1300, which is higher than I'd like, but that's only about 1.5% of our AWS spend. Tbh I never really looked at the spend for NAT before, but this doesn't alarm me.

Re: AWS to begin charging for public IPv4 addresses

#330

Post by webworker »

toomim wrote: post #171
decasia wrote: post #103

So I have a tiny personal website hosted on ec2. Right now the DNS points to the server's public IPv4 address. But I don't really want to pay $40+/year for an IPv4 for my personal project. Does anyone have experience switching a small personal site to IPv6 only in 2023? I'm guessing the vast majority of my (North American/European-based) friends and visitors can probably connect just fine to an IPv6 address. I wish I…

Switch to linode.

Linode was too slow and had outages in my experience. Used them for years.

Replaced them with lightsail and don’t have any of those problems, plus I can pick FreeBSD.

Post reply on HN