5 ms·

Maybe this question is stupid, but why do you consider NATs useful? I've always found them pretty obstructive (just look at Skype and other p2p software, they h

by simfoo 14y ago

Maybe this question is stupid, but why do you consider NATs useful? I've always found them pretty obstructive (just look at Skype and other p2p software, they have to try and break through NATs or even use a proxy server). Or do you have other use cases in mind?

vidarh 14y ago
Beyond a lack of public IP's, it's the obstructive nature of it that makes it (sort of) useful. It's not really any safer than starting with a firewall where everything is denied by default and opening port by port of inbound traffic. But NAT'ing every internal address forces you into a pattern where the external IP is not tied to where the service is hosted at all - you need to explicitly map that in your firewall -, and where if you were to, say, accidentally turn off all your filtering, you leave yourself isolated instead of exposed. I don't think these are important enough to care about NAT once we switch to IPv6 - you can certainly be just as defensive through other means.
Duff 14y ago
Laziness, flexibility and cost. Lazy network admins assume that a private network protects them against poor planning and decision-making. Private networks give you more flexibility to do whatever crazy thing you want to do. For larger enterprise, this may mean building their own private internet. For smaller users in particular, NATing saves time and money. You don't have to wrangle with ISPs who want to bill by IP, or get an IP block assigned.
- calloc 14y ago
  ULA addresses in IPv6 allow unique local addresses that can be used by a large enterprise to build their own network, so that they have specific IPv6 endpoints always available, and then when their ISP hands them a different /64 or /56 they can continue to function as normal without renumbering.
- randomdata 14y ago
  For larger enterprise, this may mean building their own private internet. How does IPv6 change this? Either way, you have to use IP addresses assigned to you (public IPv6 addresses, or private IPv4 addresses) if you want to interface it to the public internet. Your physical firewall and router setup isn't going to change much, if at all. If your private network will never be connected to the internet, you can use any old addressees and routing schemes you want. Nobody will care what you do because there is no risk of collision with anyone else.
drucken 14y ago
Despite what many assumed from my original question, I was not in the least bit concerned about NAT's replacement as a pseudo access control at the IP layer. My concern was the lack of control and independence from the global network when it is needed. This saves organisations and individuals a small fortune and provides maximum flexibility and convenience in internal networking. However, I have been doing further research and while NAT discovery and traversal is an uncertain area, and (of course) firewalls are the design intention for IPv6 access control, the core ability to have access to private unicast addresses within IPv6 is covered by RFC 4193 (Unique Local IPv6 Unicast Addresses). So, 6-within-4 protocols need only be around as long as 4 is the majority globally routable IP protocol, which may be for a LOT longer than people think, instead of being around because 6 lacks support for existing functions.

by simfoo 14y ago

vidarh 14y ago

Beyond a lack of public IP's, it's the obstructive nature of it that makes it (sort of) useful. It's not really any safer than starting with a firewall where everything is denied by default and opening port by port of inbound traffic. But NAT'ing every internal address forces you into a pattern where the external IP is not tied to where the service is hosted at all - you need to explicitly map that in your firewall -, and where if you were to, say, accidentally turn off all your filtering, you leave yourself isolated instead of exposed. I don't think these are important enough to care about NAT once we switch to IPv6 - you can certainly be just as defensive through other means.

Duff 14y ago

Laziness, flexibility and cost. Lazy network admins assume that a private network protects them against poor planning and decision-making. Private networks give you more flexibility to do whatever crazy thing you want to do. For larger enterprise, this may mean building their own private internet. For smaller users in particular, NATing saves time and money. You don't have to wrangle with ISPs who want to bill by IP, or get an IP block assigned.

calloc 14y ago
ULA addresses in IPv6 allow unique local addresses that can be used by a large enterprise to build their own network, so that they have specific IPv6 endpoints always available, and then when their ISP hands them a different /64 or /56 they can continue to function as normal without renumbering.
randomdata 14y ago
For larger enterprise, this may mean building their own private internet. How does IPv6 change this? Either way, you have to use IP addresses assigned to you (public IPv6 addresses, or private IPv4 addresses) if you want to interface it to the public internet. Your physical firewall and router setup isn't going to change much, if at all. If your private network will never be connected to the internet, you can use any old addressees and routing schemes you want. Nobody will care what you do because there is no risk of collision with anyone else.

drucken 14y ago

Despite what many assumed from my original question, I was not in the least bit concerned about NAT's replacement as a pseudo access control at the IP layer. My concern was the lack of control and independence from the global network when it is needed. This saves organisations and individuals a small fortune and provides maximum flexibility and convenience in internal networking. However, I have been doing further research and while NAT discovery and traversal is an uncertain area, and (of course) firewalls are the design intention for IPv6 access control, the core ability to have access to private unicast addresses within IPv6 is covered by RFC 4193 (Unique Local IPv6 Unicast Addresses). So, 6-within-4 protocols need only be around as long as 4 is the majority globally routable IP protocol, which may be for a LOT longer than people think, instead of being around because 6 lacks support for existing functions.