Hacker News Reader

Comment by Symbiote | Hacker News Reader

NAT is not an additional layer of security.

I run our servers on public IP addresses, behind a firewall. Troubleshooting and debugging is made much easier, and there's never any conflict with VPNs etc.

> It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world

Port 80, please. With NAT, you can't offer that to more than one computer.

View on HN

You nailed it! Students love that they can just spin up a whole new web server, no questions asked. I certainly won't be where I am on sysadmin-type skills without the kind of tinkering that the un-NAT'd network affords.

That's great and all, but the majority of us have lived in a IPv4 NAT world for most of our lives. A previous poster even mentioned that a student group runs a cloud hosting service on campus, making some of this moot:

"SIPB (MIT's volunteer student computing group) offers free "cloud hosting" to anyone with an Athena account. http://xvm.mit.edu/"

But you can, a simple reverse proxy can let the same port be used for multiple servers and pick based on hostname or query (for http).

reverse proxies like nginx also have plain tcp support so it allows you to easily run several services

You have to scale the reverse proxy, and you've added another point of failure.

Not to mention - who runs it? It needs to be trusted to terminate TLS or do 5-tuple proxying based on the SNI destination (not all clients send SNI). Also if the MIT student is doing something akin to protocol level development it's possible a middle proxy will prevent them from doing their work.

There is also the hassle factor. You may stop people from ever trying something because of the added hoops they must go through.

So, now I have to run a reverse proxy -- another point of failure, another thing to debug when something's not working.

That's a hack to work around a shortage of IP addresses. Why would I use one, when I don't have that shortage?

Well, you can have tons of static IP addresses, or funding to support MIT and future IT upgrades.

Reply on news.ycombinator.com