6 ms·

Running nat on ipv4 is no worse than running a stateful firewall on ipv6 only, I don't get the complaints about it. Modern firewalls do far more with deep packe

by iso1631 16d ago

Running nat on ipv4 is no worse than running a stateful firewall on ipv6 only, I don't get the complaints about it. Modern firewalls do far more with deep packet inspection, SSL unwrapping etc. NAT is a hardware function on enterprise access switches let alone firewall layers, any home router would have to do firewalling at their router anyway.

jcgl 16d ago
Well performance really isn't something I would point to at all. While I believe it can become problematic with great scale (e.g. those expensive CGNAT boxes), it's more the architectural and connectivity aspects that are problems: Architecturally, dealing with two different address spaces is a complication. A flat address space is easier to reason about and more flexible. This is amplified by the fact that IPv4's RFC1918 address space is very small. Have you ever had to merge IPv4 networks from different companies? It's rarely the case that they don't have overlapping ranges. Connectivity-wise, stateful IPv6 firewalling is very different from NAPT in IPv4 because the applications cannot reason about the ports being used (without rendezvous servers).
- iso1631 15d ago
  > Architecturally, dealing with two different address spaces is a complication I completely agree, which is why dual stack is terrible. > Have you ever had to merge IPv4 networks from different companies? It's rarely the case that they don't have overlapping ranges. Dual stack doesn't solve that > stateful IPv6 firewalling is very different from NAPT in IPv4 because the applications cannot reason about the ports being used The source port is ephemeral for almost all applications, and I can't think of a good reason it wouldn't be, just legacy crap I'd love to have an ipv6 only network with NAT66 at the boundary, at home and at work, but while it still requires ipv4 I don't see the point.
  - jcgl 15d ago
    I'm not advocating dual stack either. Like I said in my other reply to you, I am suggesting IPv4-as-a-service using standard translation technologies and architectures.

by iso1631 16d ago

jcgl 16d ago

Well performance really isn't something I would point to at all. While I believe it can become problematic with great scale (e.g. those expensive CGNAT boxes), it's more the architectural and connectivity aspects that are problems: Architecturally, dealing with two different address spaces is a complication. A flat address space is easier to reason about and more flexible. This is amplified by the fact that IPv4's RFC1918 address space is very small. Have you ever had to merge IPv4 networks from different companies? It's rarely the case that they don't have overlapping ranges. Connectivity-wise, stateful IPv6 firewalling is very different from NAPT in IPv4 because the applications cannot reason about the ports being used (without rendezvous servers).

iso1631 15d ago
> Architecturally, dealing with two different address spaces is a complication I completely agree, which is why dual stack is terrible. > Have you ever had to merge IPv4 networks from different companies? It's rarely the case that they don't have overlapping ranges. Dual stack doesn't solve that > stateful IPv6 firewalling is very different from NAPT in IPv4 because the applications cannot reason about the ports being used The source port is ephemeral for almost all applications, and I can't think of a good reason it wouldn't be, just legacy crap I'd love to have an ipv6 only network with NAT66 at the boundary, at home and at work, but while it still requires ipv4 I don't see the point.
- jcgl 15d ago
  I'm not advocating dual stack either. Like I said in my other reply to you, I am suggesting IPv4-as-a-service using standard translation technologies and architectures.