Hacker News Reader

Comment by imjustapie | Hacker News Reader

kudos to this well-researched post. As a student with a server in a dorm room, I really hope they don't take away my public IP address.

View on HN

There are advantages to being on a private network behind a firewall ... and they could still offer a DNS name and routing to your computer if it was on a private network. It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world. This is a win for you from a security perspective - having additional layers of security won't hurt you.

NAT is not security at all.

NAT is not an additional layer of security.

I run our servers on public IP addresses, behind a firewall. Troubleshooting and debugging is made much easier, and there's never any conflict with VPNs etc.

> It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world

Port 80, please. With NAT, you can't offer that to more than one computer.

You nailed it! Students love that they can just spin up a whole new web server, no questions asked. I certainly won't be where I am on sysadmin-type skills without the kind of tinkering that the un-NAT'd network affords.

But you can, a simple reverse proxy can let the same port be used for multiple servers and pick based on hostname or query (for http).

reverse proxies like nginx also have plain tcp support so it allows you to easily run several services

You have to scale the reverse proxy, and you've added another point of failure.

Not to mention - who runs it? It needs to be trusted to terminate TLS or do 5-tuple proxying based on the SNI destination (not all clients send SNI). Also if the MIT student is doing something akin to protocol level development it's possible a middle proxy will prevent them from doing their work.

There is also the hassle factor. You may stop people from ever trying something because of the added hoops they must go through.

So, now I have to run a reverse proxy -- another point of failure, another thing to debug when something's not working.

That's a hack to work around a shortage of IP addresses. Why would I use one, when I don't have that shortage?

Well, you can have tons of static IP addresses, or funding to support MIT and future IT upgrades.

That's great and all, but the majority of us have lived in a IPv4 NAT world for most of our lives. A previous poster even mentioned that a student group runs a cloud hosting service on campus, making some of this moot:

"SIPB (MIT's volunteer student computing group) offers free "cloud hosting" to anyone with an Athena account. http://xvm.mit.edu/"

Reply on news.ycombinator.com