Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NAT Is the Enemy of Low Power Devices

blog.golioth.io

Post reply on HN
Print view View original

51–60 of 180 posts

Re: NAT Is the Enemy of Low Power Devices

#51

Post by nolist_policy »

jeroenhd wrote: post #41
LegionMammal978 wrote: post #9

Earlier quoted context omitted.

Eliminating NAT makes virtual networking much hairier. E.g., my desktop is currently connected to a big enterprise network that keeps track of all devices and will only allocate one IP address per MAC address. That leaves no IPs for any VMs on my desktop to use, so they must go through NAT if they want to communicate with the outside world.

Based on your description, you're using NAT as a means to bypass network restrictions. It's a great hack that will do the trick wonderfully, but if that's the officially proposed solution then the network is not set up for what it's actually used for. Contrary to popular belief, IPv6 does have NAT, it's just stupid and unnecessary in most use cases. There are even different kinds of NAT; there's the "swap the public…

On Virtualbox you can set up ipv6 NAT with a few clicks btw.

Re: NAT Is the Enemy of Low Power Devices

#52

Post by PhilipRoman »

arcmechanica wrote: post #10

NAT was an good solution that the IETF came up with, we wouldn't be able to have the internet at our scale without it

The thing I like about NAT is that it is essentially an ISP side stateful firewall. I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections".

Re: NAT Is the Enemy of Low Power Devices

#53

Post by Hikikomori »

p_l wrote: post #49
arcmechanica wrote: post #10

NAT was an good solution that the IETF came up with, we wouldn't be able to have the internet at our scale without it

NAT was introduced by private company called Network Translation Inc. and successfully broke efforts to migrate off IPv4 (which was supposed to be EOLd by 1990) and permanently broke the "network of hosts" into asymmetric one of servers and clients. Note that we had a solution for address exhaustion by 1991, but it was just "good" and not "perfect" and worst of all it used the hated OSI protocol stack (TUBA - TCP & U…

First product, but does the early RFCs and discussions predate their work?

Re: NAT Is the Enemy of Low Power Devices

#54

Post by p_l »

Hikikomori wrote: post #53
p_l wrote: post #49

Earlier quoted context omitted.

NAT was introduced by private company called Network Translation Inc. and successfully broke efforts to migrate off IPv4 (which was supposed to be EOLd by 1990) and permanently broke the "network of hosts" into asymmetric one of servers and clients. Note that we had a solution for address exhaustion by 1991, but it was just "good" and not "perfect" and worst of all it used the hated OSI protocol stack (TUBA - TCP & U…

First product, but does the early RFCs and discussions predate their work?

There's some work predating it, but it was very much undeployed before PIX let out the genie out, because even the early NAT work notes it might be problematic even in short term.

Re: NAT Is the Enemy of Low Power Devices

#55

Post by Hikikomori »

jeroenhd wrote: post #47
gamedever wrote: post #27

Earlier quoted context omitted.

I don't know networking all that well. In my mind, I have 50 devices connected to my router behind NAT. My Mac, My Apple TV, my iPhone, My PC, My Linux Box, My partner's versions of all of those. My video games. Etc From outside there's 1 IP address. With IPv6, every device would get it's own address outside. Why do I want that? That sounds less private to me. Am I mis-understanding something? Lots of traffic on one…

With IPv6, every device has multiple IP addresses. One or more addresses that are rotated* to prevent you from being tracked easily, and one that's derived from your device's MAC address so you can make your devices easily accessible from WAN by opening ports in your firewall if you want to. You could disable the rotating addresses, or disable MAC-based ones by using DHCP, but there's usually no point. As for why you…

Does it matter if they rotate if you use prefix delegation with standard size?

Re: NAT Is the Enemy of Low Power Devices

#56

Post by immibis »

vollbrecht wrote: post #45
dent9876543 wrote: post #22

That NAT is a problem presumes that we actually want our IoT devices reaching out to the out-of-intranet zone. NAT gets the blame, and the intranet as a concept is generally a big corp term. But I prefer my IoT devices not to need to reach out of my network. For me, NAT is an unwitting ally in the fight against such nonsense.

The mere existence of Tailscale should give a hint that NAT is only a speedbump and not any protection whatsoever. It protects you against nothing. Every method that Tailscale uses to traverse NAT can be in isolation used by any other piece of software. For more info about that you can read the following article. https://tailscale.com/blog/how-nat-traversal-works

What people really want is a firewall, and since NAT acts as a firewall, they confuse it with that.

My university has a public IP for every computer, but you could still only connect to the servers, not random computers, from the outside. Because they had a firewall.

Re: NAT Is the Enemy of Low Power Devices

#57

Post by procaryote »

kazinator wrote: post #33

What you can do is port forwarding. You have a bunch of devices behind a 1:N NAT, so they share one IP address. For specific services on those devices, you can pair dedicated ports with this IP address, binding them to internal IP:port pairs. It's not a perfect solution for every scenario, and requires configuration, but there it is. This is how people on residential lines run web servers, mail servers, ... they map…

True in the general sense, but don't do this for IoT devices. Always remember that the S in IoT stands for Security

Re: NAT Is the Enemy of Low Power Devices

#58

Post by fc417fc802 »

p_l wrote: post #49
arcmechanica wrote: post #10

NAT was an good solution that the IETF came up with, we wouldn't be able to have the internet at our scale without it

NAT was introduced by private company called Network Translation Inc. and successfully broke efforts to migrate off IPv4 (which was supposed to be EOLd by 1990) and permanently broke the "network of hosts" into asymmetric one of servers and clients. Note that we had a solution for address exhaustion by 1991, but it was just "good" and not "perfect" and worst of all it used the hated OSI protocol stack (TUBA - TCP & U…

> permanently broke the "network of hosts" into asymmetric one of servers and clients.

That was inevitable and can't reasonably be blamed on NAT. As but a few examples. ISPs arbitrarily break things unless you pay them extra. Stateful firewalls are a good thing. Even on my local LAN I can't reliably SSH into my laptop because it's on WiFi and does funky power saving stuff with the chipset I guess. My phone is far worse than my laptop in that regard.

Setting up a reliable and widely reachable server requires deliberate effort regardless of the existence of NAT.

Re: NAT Is the Enemy of Low Power Devices

#59

Post by fc417fc802 »

PhilipRoman wrote: post #52
arcmechanica wrote: post #10

NAT was an good solution that the IETF came up with, we wouldn't be able to have the internet at our scale without it

The thing I like about NAT is that it is essentially an ISP side stateful firewall. I would migrate to the ipv6 globally addressed mode immediately if my ISP had a checkbox "disallow all incoming connections".

It's funny. They'll block things I don't want them to block (email, http server, ...) but not unsolicited inbound IPv6 connections.

Re: NAT Is the Enemy of Low Power Devices

#60

Post by fc417fc802 »

Hikikomori wrote: post #55
jeroenhd wrote: post #47

Earlier quoted context omitted.

With IPv6, every device has multiple IP addresses. One or more addresses that are rotated* to prevent you from being tracked easily, and one that's derived from your device's MAC address so you can make your devices easily accessible from WAN by opening ports in your firewall if you want to. You could disable the rotating addresses, or disable MAC-based ones by using DHCP, but there's usually no point. As for why you…

Does it matter if they rotate if you use prefix delegation with standard size?

No, it doesn't. At least the last time I checked unless you go out of your way to implement a non-standard configuration IPv6 is a disaster for personal privacy for the typical multi-user household.

Then again, the "typical" multi-user household is likely logged in to most things via SSO with Google or Facebook and probably has approximately zero fingerprinting mitigations in use so perhaps it isn't worth worrying about?

If you aren't the typical household then given 2^64 addresses and a Linux box serving as a router you've got quite a few options available. Including various creative reinventions of NAT that don't break basic functionality.

Post reply on HN