Hacker News new | ask | show | jobs
by Nextgrid 2556 days ago
I’ve never seen NAT being used with IPv6. I don’t see the point, it would be more effort to use it than not.
3 comments

Yes, but it would be worth it. There is no need nor benefit to have a per-device unique address advertised to the world.

If there is a desire for a certain device then absolutely, give it its own IP, but that is the exception.

> There is no need nor benefit to have a per-device unique address advertised to the world.

Yes, there is!

But possibly more importantly: There is no benefit to assigning devices ambiguous addresses. It's as sensible as having all rooms in your business have "1" as their room number because you somehow have convinced yourself that that prevents people from entering your building.

What need or benefit?

I have no idea what you are trying to convey, I do not think you understood the concept.

I'm not talking about security.

The benefit of not having addresses collide. I mean, that's the whole point of assigning globally unique addresses?

When you connect some previously unconnected networks (a merger, or simply access for some sort of cooperation, or for maintenance access, or whatever), it's a nightmare with RFC1918 when address ranges overlap, which they invariably do. If you use globally unique addresses, you can be sure that there will be no problem.

When you debug something, you don't have to figure out what maps to what where in the network. When two machines talk to each other, the packets are labeled with the IP addresses of those two machines and the ports they are using, no matter where in the network you investigate. No matter who writes a log file about some operation happening in the network, all of those log entries are labeled with the same, uniquely identifying addresses.

And on the other side, there is still exactly zero benefit to using ambiguous adresses.

There are plenty of benefits and/or use-cases for having each internet connected device have it's own unique address. If not just for nonrepudiation, the elimination of NAT hardware and complexities is a plus as well.

If you're not talking about security, maybe you should be?

How big of an security issue is the NAT hardware and complexity? And is it not absolutely dwarfed by ipv6 hardware+configure complexity? (not to mention maturity).
The benefit is to eliminate the disadvantages and complexity (however opaque) of running NAT.

I don't think anyone is suggesting that all devices be reachable by default. It's entirely reasonable and prudent to have a firewall between my home network and the world, but NAT is not strictly required for this.

That is a benefit, true. However I don't feel that it is comparable to the drawbacks.

I'm not suggesting that anyone suggest devices being reachable. Them having a unique identifier is bad enough.

Actually it would make P2P communication much simpler.

WebRTC or any other video conferencing software wouldn't need a STUN server if all the clients were able to talk directly to each-other.

First real benefit I guess. Yeah that's nice. Not worth it for me personally though.
For privacy, you can setup your OS to require a different random IP every time it reconnects to the network. You will always be in the same /64, but with a different IP.
That's a hack that doesn't protect anything for ongoing sessions. Slight improvement but hardly enough.
Do you use incognito windows for each website you browse and close them before opening a new one? Do you disable cookies completely?

If not, using NAT doesn't add much privacy for "ongoing session".

Also, how many people share your internet connection? If it's a handful, like most household, your one in a handful, pretty small area. If that's a concern to you, you should use a VPN.

There is more to the internet than the browser.

And there are other techniques than closing all incognito windows for each site ... Surely you recognize the difference between uniquely identifying a machine from that?

Again, at this point, use VPNs, ephemeral ssh hop VMs on AWS, Vultur, etc...

For day to day usage, I'm fine with a given IP on a /64. If the police came to find who ssh'ed through NAT from my ISP provided ipv4, it wouldn't take them very long to figure out my wife and kids can't even spell ssh!

Perhaps they're talking about NAT64?
Well, it's a firewall that behaves like NAT.