7 ms·

Sorry. I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as l

Sorry. I implemented the current NAT system in Linux. In particular, avoiding port reservation in favor of squishing more connections into one IP address, as long as the remote address allowed us to differentiate. This, in turn, means incoming traffic from a different address is unroutable. You no longer have a public endpoint. This is "poor man's firewall", but erodes our ability to have a server the way we used to. I was a young engineer solving a specific problem, without considering the larger picture. It wasn't the only thing, but I feel it definitely moved the internet to a client/server infrastructure and a key equality was lost.

gerdesj 17d ago
Mate ... How many people are engineers, technicians, mildly interested, not fussed or call the internet "Facebook"? IPv4 without NAT was fucked at the design stage. To be fair: Who knew? I was asked by my employer a while back to investigate this new www thing that has hit the internet (in around 1994 or 5, it took a while to notice) and I said it was a bit crap and no better than WAIS and GOPHER. I was using telnet on a Windows 3.1 PC and telnetting madly via a VAX and a X.25 PAD and what I now know was close to magic! No one had any idea how things would turn out back then. I'm actually quite impressed how long IPv4 has managed to work and without NAT (which I do mildly despise, given 30 years messing with this stuff), it would be stuffed. Thank you for your work.
- alexpotato 17d ago
  > no better than WAIS and GOPHER. I was using telnet on a Windows 3.1 PC I had a corporate internship in the late 1990s and they blocked external web access. They did, however, allow external Telnet access. This meant that whenever I had free time and/or was waiting for new projects, I would telnet back to my college server and use lynx to go read my favorite websites.
Uptrenda 17d ago
What a comment, lmao. I'm aware of some of the work that you've done. You've had an impressive career, tbh.
an0malous 17d ago
What do you think is the best road to a decentralized net from here? Any specific solutions you like?
- tornado134 17d ago
  [dead]
robinpie 17d ago
Wow! Thanks for the note.
pratyahava 17d ago
Sorry, i am not very much into kernel/netstack development, but a question. So does it mean that even if an alternative NAT system will be available in Linux (kernel module with a switch or whatever) - it will not be adopted by industry because everyone (and every device) is used to how it works now?
- GoblinSlayer 16d ago
  You can work it around with socks5 protocol, it's designed for such cases and it has some merit for server side: https://blog.exe.dev/ssh-host-header https://blog.exe.dev/ssh-host-header
- mort96 17d ago
  NAT itself was a hack to let everything keep working like it already was despite there being more computers than IPv4 addresses. The Internet Protocol only concerns itself with IP addresses. The idea is that each computer has an IP address, so computers can communicate by sending IP packets; each IP packet says, "Message from computer with IP address X to computer with IP address Y". But computers have multiple processes, so there's a need to know which process at the receiving computer is the recipient and which process on the sending computer is the sender. This is why transport protocols (TCP and UDP) add a port field. A port uniquely identifies a particular socket opened by a particular process on a computer. So a TCP or UDP message sent via the Internet Protocol contains the information, "From the socket with port 41590 on the computer with IP address X, to the socket with port 443 on the computer with IP address Y". NAT is a giant hack which is primarily implemented in routers. It makes a whole household (or office building, or university campus) look to the outside world like one big computer with one IP address. Say we have a computer with IP address L, a router with public IP address X, and a public server with IP address Y. The computer will send a message to the router which says, "From port 41590 @ L, to port 443 @ Y". The router will invent a new random port number (say 41200), add an entry to its NAT table which says "port 41200 means port 41590 @ L", then send a message to the public Internet: "From port 41200 @ X to port 443 @ Y". When someone then sends back a message "to port 41200 @ X", the router looks that up in its NAT table and rewrites the packet to say "to port 41590 @ L", then sends it to the computer with that local IP address. The computer doesn't really know that it's speaking through a router. It needs to know that "packets to the public Internet should be sent via the router" but that's it, the packets it sends and receives looks the same as if the router wasn't there. The rest of the world doesn't know that it's speaking to the computer behind the router; from their perspective, it looks like they're just speaking directly to the router. All the special network address translation logic lives only within the router. Already back then, you couldn't easily deploy solutions which required all computers and middle-boxes on the Internet to change. That's why NAT exists in the first place. You could deploy a new NAT implementation, but the problem NAT solves is fundamentally that there aren't enough IPv4 addresses for every computer to have an IPv4 address so you need multiple computers to share. I don't think there's a better solution to that problem other than switching everything over to IPv6 (which has been in progress for the past 30 years and has barely reached 50%). As an aside, you see the term "CGNAT" sometimes as well. This stands for Carrier-Grade NAT and is an evolution of the NAT concept to much bigger contexts; a whole city could share a handful of public IP addresses, making large regions effectively one "local network" behind a "router". Multiple streets could look to the outside world like they're just one gigantic computer. Each household in that area will then probably do its own layer of NAT, making it look to the CGNAT router like the household is one big one computer. This configuration can be called "double NAT". Since each router doing NAT only needs to know about its own NAT, there's really no limit to how deeply you can nest it.
mort96 17d ago
If it's any consolation, I don't think NAT did anything particularly harmful other than making the adoption of IPv6 less urgent. It's CGNAT that's the real problem, not NAT.

gerdesj 17d ago

Mate ... How many people are engineers, technicians, mildly interested, not fussed or call the internet "Facebook"? IPv4 without NAT was fucked at the design stage. To be fair: Who knew? I was asked by my employer a while back to investigate this new www thing that has hit the internet (in around 1994 or 5, it took a while to notice) and I said it was a bit crap and no better than WAIS and GOPHER. I was using telnet on a Windows 3.1 PC and telnetting madly via a VAX and a X.25 PAD and what I now know was close to magic! No one had any idea how things would turn out back then. I'm actually quite impressed how long IPv4 has managed to work and without NAT (which I do mildly despise, given 30 years messing with this stuff), it would be stuffed. Thank you for your work.

alexpotato 17d ago
> no better than WAIS and GOPHER. I was using telnet on a Windows 3.1 PC I had a corporate internship in the late 1990s and they blocked external web access. They did, however, allow external Telnet access. This meant that whenever I had free time and/or was waiting for new projects, I would telnet back to my college server and use lynx to go read my favorite websites.

Uptrenda 17d ago

What a comment, lmao. I'm aware of some of the work that you've done. You've had an impressive career, tbh.

an0malous 17d ago

What do you think is the best road to a decentralized net from here? Any specific solutions you like?

tornado134 17d ago
[dead]

robinpie 17d ago

Wow! Thanks for the note.

pratyahava 17d ago

Sorry, i am not very much into kernel/netstack development, but a question. So does it mean that even if an alternative NAT system will be available in Linux (kernel module with a switch or whatever) - it will not be adopted by industry because everyone (and every device) is used to how it works now?

GoblinSlayer 16d ago
You can work it around with socks5 protocol, it's designed for such cases and it has some merit for server side: https://blog.exe.dev/ssh-host-header https://blog.exe.dev/ssh-host-header
mort96 17d ago
NAT itself was a hack to let everything keep working like it already was despite there being more computers than IPv4 addresses. The Internet Protocol only concerns itself with IP addresses. The idea is that each computer has an IP address, so computers can communicate by sending IP packets; each IP packet says, "Message from computer with IP address X to computer with IP address Y". But computers have multiple processes, so there's a need to know which process at the receiving computer is the recipient and which process on the sending computer is the sender. This is why transport protocols (TCP and UDP) add a port field. A port uniquely identifies a particular socket opened by a particular process on a computer. So a TCP or UDP message sent via the Internet Protocol contains the information, "From the socket with port 41590 on the computer with IP address X, to the socket with port 443 on the computer with IP address Y". NAT is a giant hack which is primarily implemented in routers. It makes a whole household (or office building, or university campus) look to the outside world like one big computer with one IP address. Say we have a computer with IP address L, a router with public IP address X, and a public server with IP address Y. The computer will send a message to the router which says, "From port 41590 @ L, to port 443 @ Y". The router will invent a new random port number (say 41200), add an entry to its NAT table which says "port 41200 means port 41590 @ L", then send a message to the public Internet: "From port 41200 @ X to port 443 @ Y". When someone then sends back a message "to port 41200 @ X", the router looks that up in its NAT table and rewrites the packet to say "to port 41590 @ L", then sends it to the computer with that local IP address. The computer doesn't really know that it's speaking through a router. It needs to know that "packets to the public Internet should be sent via the router" but that's it, the packets it sends and receives looks the same as if the router wasn't there. The rest of the world doesn't know that it's speaking to the computer behind the router; from their perspective, it looks like they're just speaking directly to the router. All the special network address translation logic lives only within the router. Already back then, you couldn't easily deploy solutions which required all computers and middle-boxes on the Internet to change. That's why NAT exists in the first place. You could deploy a new NAT implementation, but the problem NAT solves is fundamentally that there aren't enough IPv4 addresses for every computer to have an IPv4 address so you need multiple computers to share. I don't think there's a better solution to that problem other than switching everything over to IPv6 (which has been in progress for the past 30 years and has barely reached 50%). As an aside, you see the term "CGNAT" sometimes as well. This stands for Carrier-Grade NAT and is an evolution of the NAT concept to much bigger contexts; a whole city could share a handful of public IP addresses, making large regions effectively one "local network" behind a "router". Multiple streets could look to the outside world like they're just one gigantic computer. Each household in that area will then probably do its own layer of NAT, making it look to the CGNAT router like the household is one big one computer. This configuration can be called "double NAT". Since each router doing NAT only needs to know about its own NAT, there's really no limit to how deeply you can nest it.

mort96 17d ago

If it's any consolation, I don't think NAT did anything particularly harmful other than making the adoption of IPv6 less urgent. It's CGNAT that's the real problem, not NAT.