Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting a NAT Gateway

awsistoohard.com

Post reply on HN
Print view View original

41–50 of 130 posts

Re: Self-hosting a NAT Gateway

#41

Post by theideaofcoffee »

nwellinghoff wrote: post #35

I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1. I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

I have difficulty remembering ten numbers, why do I have to say 1-212-487-1965 when I can just say Santa Rosita 71965? Maybe we should have just done another exchange name and added another name. Eg Hawthorne Santa Rosita 71965. I know its stupid, but 10 digit phone numbers are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of telephone exchange prefixes.

Yet again, another fundamental misunderstanding (either genuine or not, I'm not sure) about the low-level technologies and their origins that underpin all of this. "Can't we just..."? No.

Re: Self-hosting a NAT Gateway

#42

Post by rmunn »

mystraline wrote: post #31

Yeah, I just use a VPS box I pay $20/year for. Only the most basic config goes on this machine. Basically load is 0.1 , and has no data. Then I run my stuff locally. And then I use ssh tunneling to forward the port to localhost of the remote machine. Its a unit file, and will reconstruct the tunnel every 30s if broken. So at most 30s downtime. Then nginx picks it up.

Brilliant.

I use Tailscale myself, but if you want everything totally under your control (and don't want to go to the trouble of setting up headscale or something similar) then that's one of the absolutely simplest, lowest-effort ways of doing it. EDIT: Well, except for the VPS box I suppose, but if that provider went down or you had any reason to suspect they were doing anything suspicious, it would be quite simple to jump to a different provider, so that's pretty darn close to controlling everything yourself.

Re: Self-hosting a NAT Gateway

#43

Post by theideaofcoffee »

api wrote: post #23

As an OG networking person, developer, and Linux user, the state of modern dev culture just makes me sad. Modern devs are helpless in the face of things I taught myself to do in a day or two when I was fourteen, and they’re paralyzed with terror at the thought of running something. It’s “hard” goes the cliche. Networking is “hard.” Sys admin is “hard.” Everything is “hard” so you’d better pay an expert to do it. Wher…

All of this. I despair with some of the takes on basic technology being hard. And when you try to defend understanding just the most rudimentary things, you're labeled a problem because you should just be paying out the nose for the service and writing even more shit code to cover it up.

Re: Self-hosting a NAT Gateway

#44

Post by waynesonfire »

somanyphotons wrote: post #6
heinternets wrote: post #5

Please can we do away with NAT forever. Why are we still encouraging this? It’s caused the world to do horrible kludges and continues to do so.

Presumably the idea is that if you go ipv6-only you can avoid this cost and just use a firewall?

In theory.. but what happens when you want to change ISPs or your ISP doesnt assign static ipv6 blocks? Its recomnended but ISPs have no incentive to give a shit about you. Now all internal infra is not routable.

Re: Self-hosting a NAT Gateway

#45

Post by BobbyTables2 »

mystraline wrote: post #31

Yeah, I just use a VPS box I pay $20/year for. Only the most basic config goes on this machine. Basically load is 0.1 , and has no data. Then I run my stuff locally. And then I use ssh tunneling to forward the port to localhost of the remote machine. Its a unit file, and will reconstruct the tunnel every 30s if broken. So at most 30s downtime. Then nginx picks it up.

I do something similar using an openvpn tunnel (home->vps). Iptables rules on the VPS redirect services to the VPN client IP.

Client automatically deals with reconnecting, never have to touch it.

SSH tunnel would have been simpler, just didn’t want it open.

SSH tunnel probably needs the keep alive on, otherwise connection loss may not be detected.

Re: Self-hosting a NAT Gateway

#46

Post by trueismywork »

heinternets wrote: post #5

Please can we do away with NAT forever. Why are we still encouraging this? It’s caused the world to do horrible kludges and continues to do so.

Its so much easier to remember`192.168.0.34` than some weird ipv6 numbering.

For someone just getting started with networking and learning things, this seems rhe best way to go forward.

Re: Self-hosting a NAT Gateway

#48

Post by abcdefg12 »

somanyphotons wrote: post #6
heinternets wrote: post #5

Please can we do away with NAT forever. Why are we still encouraging this? It’s caused the world to do horrible kludges and continues to do so.

Presumably the idea is that if you go ipv6-only you can avoid this cost and just use a firewall?

Don’t even need firewall. Aws has egress only ipv6 gateway.

Re: Self-hosting a NAT Gateway

#49

Post by Tractor8626 »

mrsssnake wrote: post #36

> For those unfamiliar, a NAT Gateway acts as a one way door to your private subnet to access the internet without allowing traffic in Repeat after me: NAT is not a firewall. And we need to stop pretending it is.

But NAT acts as a one way door to your private subnet, doesn't it?

Re: Self-hosting a NAT Gateway

#50

Post by moduspol »

notatoad wrote: post #22
stormbeard wrote: post #15

I can't believe people are paying these crazy amounts for what is basically a fleet of firewalls. What is the difficulty in running VMs with nftables rules?

running a VM where? on an ec2 instance? who's going to keep that updated for me? who's going to reprovision it when aws retires the underlying hardware? who's going to monitor it for PCI compliance for me? i don't want to deal with all that. i could dump it on fargate, but at that point it's barely cheaper than just using the official version. i've had to look at my nat gateway zero times since i set it up a couple y…

It costs a lot more than a few bucks when you’re putting a lot of traffic through it. And running your own NAT instance does not incur per-GB traffic costs.

That said, the paid NAT gateways do also publish metrics. That can be nice when debugging a legitimate issue, such as when your gateway actually runs out of NAT ports to use.

Post reply on HN