Today in our newest take on “older technology is better”: why NAT rules!
I felt dirty! and broke so much shit when i had to implement NAT on networks in the mid 90’s. Nowdays with ipv6 and getting rid of NAT is much more liberating. The difference is staggering!
- you do not need NAT any longer, firewall is the security, just like on ipv4, just less obscurity.
- you do not need dns views, to workaround NAT any more
- you do not need hairpin NAT to workaround NAT any more
- you do not need to renumber to resize a network. they are always /64, and the answer to how many hosts can it fit is: ALL of them!
- many ALG’s will be unnecessary since there is not NAT.
- vpn’s are easier, since it can be the same address both inside and outside the vpn, the firewall (or host even) enforces the encryption.
- vpn’s are MUCH easier since you will have less rfc1918 collisions due to some other network using the rfc1918 of the vpn’s network
- vpn’s are MUCH MUCH easier since you will have less rfc1918 collisions due to you using the rfc1918 of the vpn partner network, to 1:1 nat a previous vpn network you collided with some months ago… ARGH!!!
- vpn are generally less required, heck i swear 95% of the time the VPN are just to workaround the NAT problem and the data is pointlessly double or triple encrypted.
- you can make more granular firewall rules (eg the spesific host, or network of the source address, instead of the whole enterprise’s public ip) this is real tangible improved security, where any random machine in a network you do not control. do not automatically have openings into your own network.
- firewall objects can if it is suited easily use and depend on FQDN DNS objects when allowing traffic. reducing the need of coordinating firewall object ip address changes between 15 companies.
- firewall rules are easier, more readable, and much more predictable how they will work. All the hairpin nat, public to private nat, private to public nat for a thing that need a different public ip, 1:1 nat for a separate zone, NAT to a vpn or 50 (where 10 of them are 1:1 nat due to collisions, making you require 4 dns views of the same ip space!! ) very quickly gets messy and unreadable. this is probably the largest security benefit. just to reduce the complexity.
- much easier to get people to use dns, since nobody wants to remember ipv6 addresses :D
- nibbles in the ipv6 address can have meanings you assign to them, making the networks and structure both easy to remember and logically structured.
- aggregating routes becomes very easy if you design your network that way.
- firewall policies can become easier if you design your network that way.
- your routing tables is leaner and easier, and of a better consistency. We have 1 large public ipv6 prefix, but 25ish ipv4 prefixes of all kinds of various sizes.
- no need to spend $$ to buy even more ipv4 prefixes.
- no need to have spent hundreds of $$ on a new ipv4 prefix only to be unable to use them for over a year because you need to sanitize the addresses from all the reputation filters. and constantly hound geo ip database providers to update the new country of the prefix. (i am bitter, can you tell…)
- did i mention no need to renumber since you need to grow the /24 to /23 due to to many hosts in a network ?
- did i mention no need to renumber 2 /24’s to /25’s to make space for that larger /23.
- you do not even need any ipv4 addresses any more, use a public NAT64 service, for outgoing. and for incoming just use one of the many free public ipv4 to ipv6 proxies for your services online. for a homelab i really like http://v4-frontend.netiter.com/ (go support them) But most large business l networks use cloudflare, or akamai
- since you do not need your ipv4 address space any more, you can ~~sell them for a profit $$$ ~~ return them to the RIR and give some address space to one of the thousands of companies struggling because they do not have any IPv4 : https://www.ripe.net/manage-ips-and-asns/ipv4/ipv4-waiting-list/
- much lower latency on ipv6, since you do not go across a cloud based ipv4 to ipv6 proxy in order to reach the service ;)
Now the greatest and best effect of ipv6 is none of the above. It is that with ipv6 we have a slim hope of reclaiming some of what made the Internet GREAT in the first place. When we all stood on equal footing. Anyone could host their own service. Now we are all vassals of the large companies that have made the common person into a CGNAT4444 using consumer mindlessly lapping up what the large company providers sees fit to provide us. with no way to even try to be a real and true part of the Internet. Fight the companies that want to make you a eyeball in their statistic, Set up your own IPv6 service on the Internet today !
I felt dirty!
“Senpai, route me like one of your French ISPs”
If all that is true, then why do I still hate ipv6 so much.
For me is because it’s so fucking slow. As soon as I disable ipv6 on every device it has better speeds.
IPv6 is trash.
Tell that to your ISP which has fucked their IPv6 deployment up. In my experience IPv6 is actually faster since it bypasses the IPv4 CGNAT.
On busy days my IPv4 connection can get as slow as 15KB/s, now that’s trash.
Fire bad, change scary
Slightly related to the issue of remembering addresses, I think the main issue is with the fact that local nameservers are pretty much non-existent if you’re not running OpenWrt or OpnSense. Which is shameful because the local nameserver is an amazing quality of life tool.
Also the fact that officially there are no local TLDs except for “.arpa” while browsers won’t resolve one word domains without adding http://
And don’t get me started on TLS certificates in local networks… (although dns01 saves the day)
I don’t get why ‘.local’ isn’t a top level domain for LAN hosts.
.local
is already used by mDNS
Ha I can remember the ipv6 of cloudflare DNS just fine! It’s uh… something : something : something :: 1111
2606:4700:4700::1111
Hmm, maybe Google is easier:
2001:4860:4860::8888Quad9 is 2620:fe::fe or 2620:fe::9
I don’t understand why they can’t get better addresses than that. Like surely 1::1 would be valid?
Edit: So IANA only control addresses 2001:: and up and there are quite a few IETF reservations within that. I don’t know why they picked such a high number to start at. Everything else seems IETF reserved with a little space allocated for special purposes (link-local, multicast, etc.).
The problem is we’re projected to run out of unique IPv4 addresses by 2003.
And we are facing the effects of it as we’re speaking. CGNAT and protocols like TURN were not invented without a reason.
Not a big deal. We’re projected to run out of years by 2000 and then the world will end.
IPv6 = second system effect. It’s way too complicated for what was needed and this complexity hinders its adoption. We don’t need 100 ip addresses for every atom on the earth’s surface and we never will.
They should have just added an octet to IPv4 and be done with it.
Bro used <> instead of !=
Honestly we should just use 4 bit ip addresses, it’s too hard for me to remember ipv4 addresses anyways. Carrier grade NAT will take care of the rest.
Ipv6 is not 6 bytes? 8 segments of 2 bytes for a sum of 16 bytes?
Or am I stupid right now?
Yes, you’ve got it right. <> means ≠. 16 is not equal to 6.
You can still NAT IPv6
I haven’t read anything this cursed in a while
Yes, but why would you want to? We have enough addresses for the foreseeable future.
So you don’t need to change your network if your isp changes.
You shouldn’t have to?? Maybe you might need to change the mask in your firewall settings if the ipv6 allocation block size changes but that should be it.
Everything else should just work as normal.