Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NAT Is the Enemy of Low Power Devices

blog.golioth.io

Post reply on HN
Print view View original

91–100 of 180 posts

Re: NAT Is the Enemy of Low Power Devices

#91

Post by wmf »

p_l wrote: post #49
arcmechanica wrote: post #10

NAT was an good solution that the IETF came up with, we wouldn't be able to have the internet at our scale without it

NAT was introduced by private company called Network Translation Inc. and successfully broke efforts to migrate off IPv4 (which was supposed to be EOLd by 1990) and permanently broke the "network of hosts" into asymmetric one of servers and clients. Note that we had a solution for address exhaustion by 1991, but it was just "good" and not "perfect" and worst of all it used the hated OSI protocol stack (TUBA - TCP & U…

People would have resisted TUBA the same ways they're resisting IPv6 now. It's not a technical problem.

Re: NAT Is the Enemy of Low Power Devices

#92

Post by ianburrell »

PhilipRoman wrote: post #76
kstrauser wrote: post #75

Earlier quoted context omitted.

Your router almost certainly has that option.

Of course, it's probably the default everywhere, but with NAT the traffic never reaches me in the first place.

NAT is done on your router. There is no difference with IPv6 firewall except doesn't do NAT.

Are you thinking about CGNAT which is done by the ISP? That results in double NAT which causes problems.

Re: NAT Is the Enemy of Low Power Devices

#93

Post by Dylan16807 »

LegionMammal978 wrote: post #79
jeroenhd wrote: post #41

Earlier quoted context omitted.

Based on your description, you're using NAT as a means to bypass network restrictions. It's a great hack that will do the trick wonderfully, but if that's the officially proposed solution then the network is not set up for what it's actually used for. Contrary to popular belief, IPv6 does have NAT, it's just stupid and unnecessary in most use cases. There are even different kinds of NAT; there's the "swap the public…

> Based on your description, you're using NAT as a means to bypass network restrictions. The threat model on this big enterprise WAN isn't "an authorized user creates a VM on an existing machine", but rather "some rando plugs something in with an Ethernet cable and goes to town on the intranet services". It has a whole web portal where you can log in and register your devices. So it's not like anything's really being…

> The threat model on this big enterprise WAN isn't "an authorized user creates a VM on an existing machine", but rather "some rando plugs something in with an Ethernet cable and goes to town on the intranet services". It has a whole web portal where you can log in and register your devices. So it's not like anything's really being bypassed here.

Isn't that what the MAC filtering is for? I don't see the point of stopping a single registered MAC on a single port from having multiple IPs.

Re: NAT Is the Enemy of Low Power Devices

#94

Post by Marsymars »

gamedever wrote: post #27
nrabulinski wrote: post #14

Earlier quoted context omitted.

Unless IPv6 were to be actually adopted as it was introduced

I don't know networking all that well. In my mind, I have 50 devices connected to my router behind NAT. My Mac, My Apple TV, my iPhone, My PC, My Linux Box, My partner's versions of all of those. My video games. Etc From outside there's 1 IP address. With IPv6, every device would get it's own address outside. Why do I want that? That sounds less private to me. Am I mis-understanding something? Lots of traffic on one…

> From outside there's 1 IP address. With IPv6, every device would get it's own address outside. Why do I want that? That sounds less private to me. Am I mis-understanding something? Lots of traffic on one IP address sounds more obfuscated than all separate.

Having recently enabled IPv6 for my home network, the "why" was that a) IPv6 to IPv6 connections are nominally more efficient than those that have to traverse NAT and b) it enables connectivity to/from IPv6-only internet devices.

The privacy upsides of a single IPv4 IP for a household are, to me, more marginal than the above benefits.

Re: NAT Is the Enemy of Low Power Devices

#95

Post by Marsymars »

fc417fc802 wrote: post #60
Hikikomori wrote: post #55

Earlier quoted context omitted.

Does it matter if they rotate if you use prefix delegation with standard size?

No, it doesn't. At least the last time I checked unless you go out of your way to implement a non-standard configuration IPv6 is a disaster for personal privacy for the typical multi-user household. Then again, the "typical" multi-user household is likely logged in to most things via SSO with Google or Facebook and probably has approximately zero fingerprinting mitigations in use so perhaps it isn't worth worrying ab…

Even disregarding fingerprinting, a single household doesn't have enough traffic from separate devices/users to the same servers to really matter from a privacy standpoint.

If my PC uses the same IP as my partner's to talk to Google, it hardly matters for our privacy if they mix up the attribution of traffic between the two of us.

Re: NAT Is the Enemy of Low Power Devices

#96

Post by lupusreal »

immibis wrote: post #56
vollbrecht wrote: post #45

Earlier quoted context omitted.

The mere existence of Tailscale should give a hint that NAT is only a speedbump and not any protection whatsoever. It protects you against nothing. Every method that Tailscale uses to traverse NAT can be in isolation used by any other piece of software. For more info about that you can read the following article. https://tailscale.com/blog/how-nat-traversal-works

What people really want is a firewall, and since NAT acts as a firewall, they confuse it with that. My university has a public IP for every computer, but you could still only connect to the servers, not random computers, from the outside. Because they had a firewall.

Yeah but the average person wouldn't know to set up a firewall (and can't count on their ISP to have their best interests at heart.) Therefore the general public benefits from the degree of protection that NAT provides.

Re: NAT Is the Enemy of Low Power Devices

#97

Post by bb88 »

kazinator wrote: post #33

What you can do is port forwarding. You have a bunch of devices behind a 1:N NAT, so they share one IP address. For specific services on those devices, you can pair dedicated ports with this IP address, binding them to internal IP:port pairs. It's not a perfect solution for every scenario, and requires configuration, but there it is. This is how people on residential lines run web servers, mail servers, ... they map…

With CG-NAT this doesn't work. Multiple customers are sharing the same IP address, all of which are sitting behind a NAT. Further the internet gateway is a NAT sitting behind the CG-NAT. And if you prefer to use a nice Mesh WiFi router, well that's a third NAT layer.

Common suggestions I've heard:

"Use a VPN"

I tried to buy a computer from Apple directly. They detected the VPN and wouldn't let me purchase it. I turned off the VPN and the purchase worked. I then got a call from Apple asking me if I really did intend to buy the computer.

"Use Tailscale"

On my setup, tailscale can't really navigate the NAT setup correctly. I have a 200Mb downlink and I will often only get a 10th of that through tailscale. Also the routing table no longer works as routing is handled by a myriad of netfilter rules -- which may or may not conflict with docker on the same box.

"Use Ubiquiti (or other networking gear) to get rid of the last NAT"

Gah. I didn't need to perform a huge cash outlay 10 years ago and rewiring the house to do the same thing I'm trying to do today.

Re: NAT Is the Enemy of Low Power Devices

#99

Post by londons_explore »

> This doesn’t solve the issue of cloud to device traffic being dropped after NAT timeout (check back for another post on that topic),

This is the key problem. I think it would be best solved by NAT devices having some way of probing their timeout policy, and then notifying the endpoints when they expire a mapping.

One way to do that might be for a client to deliberately send a packet to the server with an insufficient TTL.

The reply (via ICMP) could then contain fields specifying the timeout in minutes of the mapping, together with some generation number specifying if the mapping table has been cleared due to reboot or overflowed since last queried.

There might even be a way to request a specific mapping become long lived - perhaps for months or years.

The benefit of all this is that client devices can do push notifications from servers or P2P notifications, all with no polling - allowing for example coin cell devices to last for months or years (with appropriate WiFi protocol improvements too)

Re: NAT Is the Enemy of Low Power Devices

#100

Post by lxgr »

dent9876543 wrote: post #22

That NAT is a problem presumes that we actually want our IoT devices reaching out to the out-of-intranet zone. NAT gets the blame, and the intranet as a concept is generally a big corp term. But I prefer my IoT devices not to need to reach out of my network. For me, NAT is an unwitting ally in the fight against such nonsense.

Sounds like you like the idea of a stateful firewall, and good news: There are stateful firewalls for IPv6!

They have all the upsides of NATs (i.e. an option to block inbound connections by default), with none of the downsides (they preserve port numbers, can be implemented statelessly, they greatly simplify cooperative firewall traversal, you can allow inbound connections for some hosts).

Post reply on HN