Hacker News Reader

Playing Nintendo Switch online doesn't work if you're double NAT'd unless you go through some router hoops. It seems small, but it's quite aggravating if you're not tech oriented like the majority of the people on this forum.

> NAT-upon-NAT(-upon-NAT)

But there is also a fundamental limit of 2^16 = 65536 concurrent connections, right?

Yes, from one NAT IP using the same protocol to a single public IP using a particular port. Change any of those and you can do 2^16 concurrent connections more per change.

In other words, NAT works on the five-tuple of: protocol, source IP, source port, destination IP and destination port.

> The trade-off was the machines behind the NAT mechanism couldn't be reached from the Internet

That can also be pretty awesome given that so many devices now may not work in the interest of their users.

It is a hassle for IOT, but we have long since then solutions for that and maybe those are better anyway.

My provider only supplies IPv6 and you always connect to IPv4 through a transport. That is sometimes down or has too many concurrent users. Makes the net almost unusable still. Perhaps I should learn Hindi.

You need a firewall if your end points are publicly reachable, not NAT.

NAT still provides some layer of protection, especially if you don’t trust the firewall software.

This is going to open up a can of worms once everybody gets global addresses and can’t figure out how to configure their firewall.

It actually doesn't. NAT just changes the apparent source address of outbound connections; it doesn't do anything to inbound ones.

In any case, people manage to do both NAT and firewalls on v4 today so I don't see why they'd suddenly be unable to do firewalls in v6, especially since you don't have the complication of needing to figure out NAT as well.

The large address space also helps a lot, because it makes it much harder to find servers on v6 (including deliberately exposed servers, e.g. cameras or NASs that people want to access from a different network), compared to v4 where you can enumerate all active servers over the entire internet without much trouble.

NAT prevents an external host from making arbitrary connections to a host behind the NAT without further configuration. This is something your average person doesn’t need to know or really care about. But once every device they have is globally routable they will have to care and ensure their machines are secure and behind a firewall. And if that firewall should fail then you’re sitting on the public network with your pants down.

Your other part is security through obscurity, and I can think of at least 2 ways to scan the entire address space in a short amount of time. So nope doesn’t count either.

It doesn't do that. How can rewriting the source address of outbound connections prevent inbound connections?

You're not going to exhaustively scan the entire v6 space in any short amount of time. It is possible to whittle down the space you need to scan, but only moderately. It's still rather unviable compared to v4.

Pick any network doing NAT, attempt to make a connection. It will be denied. NAT devices are both firewalls and translators and if you don’t have a configuration for port forwarding, be it via established connection or manual configuration, the connection won’t get through. And importantly this is a configuration the user doesn’t touch.

And scanning IP spaces is insanely easy to parallelize and uses so few resources an arduino can be used to scan. Given enough nodes it’s instant. And with every windows box on the planet globally routable, bonets will never be stronger.

But let’s pretend this is true and say it takes too much time. What about when it doesn’t? What happens to your security via obscurity then?

I've tested it before, multiple times; NAT won't deny an inbound connection. A router that's NATing outbound connections will allow inbound connections through unless there's also a firewall. Of course it's very common for there to be a firewall as well, but they're still a separate thing to NAT.

> And scanning IP spaces is insanely easy to parallelize and uses so few resources an arduino can be used to scan. Given enough nodes it’s instant.

You're underestimating how big v6 is. Scanning a single /64 takes ~737 million terabytes of traffic. If you used a trillion Arduinos in parallel you could scan 2^40 /64s simultaneously, and it would only take 1870 years for the scan to complete, assuming that every single one of both the Arduinos and the target networks have a 100 Gbit/s internet connection each. Your power consumption would be... about the same as Italy's, which is actually the most reasonable part of all this (except I assumed the 100 GBit/s network connections would take no power).

> And with every windows box on the planet globally routable, bonets will never be stronger.

You're thinking about botnets that spread by brute force scanning, right? But as mentioned, this will be substantially more difficult on v6, to the point that network scanning won't be a very viable technique for spreading a botnet. On top of that, most Windows machines will be behind two separate firewalls, so I don't see how them being globally routable will make botnets stronger. Given that it'll be harder to find targetable hosts, I'd instead expect botnets to be weaker than ever.

Also, remember that a lot of botnets spread by exploiting servers that were deliberately exposed to the internet. Making these hard to find is the only defence they have, and it's not possible on v4. NAT can't help either, however it works.

An insecure, hard-to-find machine is still an insecure machine, but making it difficult to find vulnerable hosts makes it harder to build a botnet, which leads to a very real increase of security on the internet as a whole. Even if a few machines are found, nothing much happens to the overall security so long as it remains hard enough on average.

Think of it as being something like vaccination for the internet.

> I've tested it before, multiple times; NAT won't deny an inbound connection.

Test it with a consumer level router, stock configuration. I'm not concerned with networks that have split NAT / firewall devices. These are setup by people that know what they're doing.

> A router that's NATing outbound connections will allow inbound connections through unless there's also a firewall.

Yes which is my chief complaint. Not getting rid of NAT, pushing the firewall to the client.

> Scanning a single /64 takes

Why are we the entirety of the 64 subnet? You can use some knowledge about networks to cut this down a lot. Just the one knowing a network is there is enough.

Then you're also assuming people won't group together on this. Lists will be sold in short order, making the search space even smaller.

You're still hiding security behind it being hard to scan because of a large number, so that will quickly be invalidated.

And then if someone say hides in the middle of their /64 and changes their address every hour the attack will then change and it will become focused with malware or other means, except there won't be a fronting NAT protecting them to stop inbound requests.

> Think of it as being something like vaccination for the internet.

What does this even mean? How does a computer get a vaccination?

Alright. Most consumer routers do both NAT and firewalling, especially in their stock configurations, but I can drag one out and disable the firewall on it to test with.

I hooked the router up to my network, and then hooked my laptop up behind the router. The router's WAN address is 192.168.4.101, and my laptop got 192.168.1.9. If I try to connect outwards from my laptop, the connection appears to come from the router's WAN address:

  18:47:04.854781 IP 192.168.4.101.45598 > 209.216.230.240.80: Flags [S], seq 3415044640, win 29200, options [...], length 0
  18:47:04.988960 IP 209.216.230.240.80 > 192.168.4.101.45598: Flags [S.], seq 2572527210, ack 3415044641, win 65535, options [...], length 0
  18:47:04.990322 IP 192.168.4.101.45598 > 209.216.230.240.80: Flags [.], ack 1, win 913, options [...], length 0

That confirms that NAT is working. Next, I'll try to connect to a server on my laptop from outside the router:

  18:49:32.400441 IP 192.168.4.2.58084 > 192.168.1.9.9999: Flags [S], seq 2394060892, win 64240, options [...], length 0
  18:49:32.431718 IP 192.168.1.9.9999 > 192.168.4.2.58084: Flags [S.], seq 3958961179, ack 2394060893, win 28960, options [...], length 0
  18:49:32.432013 IP 192.168.4.2.58084 > 192.168.1.9.9999: Flags [.], ack 1, win 2008, options [...], length 0

You can see it works completely fine. The inbound connection successfully completes even while the router is NATing outbound connections, and this is on a regular consumer router.

> Yes which is my chief complaint. Not getting rid of NAT, pushing the firewall to the client.

v6 doesn't necessarily push the firewall to clients. You can and generally do still firewall on your router.

> Why are we the entirety of the 64 subnet? You can use some knowledge about networks to cut this down a lot. Just the one knowing a network is there is enough.

I know you can cut the search space down somewhat, but it's still massively bigger than v4, and therefore it's still going to be harder to find servers via scanning in v6 than in v4. NAT won't help in the slightest with this.

I'm not trying to suggest that anybody's security should (or even could) rely on hiding their hosts in a big sparse network; you should obviously run a firewall, and pretty much every consumer router does in fact do that. I'm just saying that if somebody does run without a firewall -- or deliberately configures it to permit inbound connections -- the large address space reduces exposure simply by making it harder to find any listening servers.

> What does this even mean? How does a computer get a vaccination?

It means that there's some conceptual similarities between the two situations. With vaccines, it's possible to completely stamp out a disease even if a small percentage of vaccinated people still catch the disease in question.

Similarly, even if a small number of servers are found by brute force scanning, so long as it remains hard enough to do so on average brute force scanning will remain an unviable method of spreading malware. This won't eliminate malware in general (because there are plenty of other infection routes to use) but any malware that relies on exploiting random vulnerable servers is going to have a much harder time in v6, not a much easier time as you assumed above.

> Alright. Most consumer routers do both NAT and firewalling, especially in their stock configurations, but I can drag one out and disable the firewall on it to test with.

Nope firewall on. You're still missing the point. Consumers will disable their client firewall once it interferes with something they're trying to do. A physical NAT device with a firewall won't allow this easy circumvention as those who don't know what they're doing won't generally go mucking around their router settings. They will click a button though, and if they have malware on their machine they can disable it via software means. Firewalls are also software, and just like all software they have bugs. There's an old one where sending certain DNS queries through windows firewall would disable it entirely.

> v6 doesn't necessarily push the firewall to clients. You can and generally do still firewall on your router.

Again you're not thinking of the entirety of the changes here. v6 on its own won't, but the entire point of global link addresses is to avoid NAT and other things. Further, the firewall must remain, but it must be easily and programmatically configured. This leaves pushing it to the client, or leaving exactly what we have today.

> I know you can cut the search space down somewhat, but it's still massively bigger than v4, and therefore it's still going to be harder to find servers via scanning in v6 than in v4. NAT won't help in the slightest with this.

NAT won't, but a firewall will.

> the large address space reduces exposure simply by making it harder to find any listening servers.

Reduces exposure, but does not eliminate it. Agreed though, it is harder to scan ip6 space than ip4, but not impossible

I was under the impression that the point was "NAT blocks connections", and I was attempting to point out that it doesn't. Testing with the firewall on will only demonstrate that the router blocks connections when the firewall is enabled (which is expected), it won't demonstrate that the connections aren't being blocked by NAT.

People are still running with firewalls on their routers in v6; that's the default basically everywhere.

> Reduces exposure, but does not eliminate it. Agreed though, it is harder to scan ip6 space than ip4, but not impossible

Yup, it's definitely not impossible, but it should be hard enough that the majority of the few unfirewalled Windows machines won't be found, which should weaken botnets rather than strengthen them.

What?! You don’t trust the firewalls software so you are good to trust the NAT software?

Windows firewall? no. iptables? yes. Why? because I know how to configure one and not the other. Also because of things like this:

https://www.enterprisenetworkingplanet.com/security/qa-behin...

Completely true, I wasn't too serious about that, just pointing out that there were unintended benefits.

> But we're at the point in some place where there aren't even enough IPv4 addresses to give to ISP customers even if they're using NAT.

Er, that's a slight exaggeration. It's not uncommon to have 2,000 or more NAT clients behind a single public IP address. 2K * 4B = 8 trillion possible hosts... about 1,000 hosts per living person.

Well, it has limits. You can hide 2000 people behind an address but they might have sporadic connection issues, long held connections such as SSH sessions will be very annoying to support [0] or the users will have to resort to frequent keepalives to make it work regardless, which produces more traffic to destinations you probably don't have in a cache. In some jurisdictions you have to log which customer used what IP (and port) at which point. You can do static assignments but you will have customers (customer homes, e.g. family with perhaps 10 devices or so could be realistic) for which 1000 ports just will not be enough do you will have to dynamically assign spare ports and log those. You might also get more support calls, because the NAT is dropping connections to radically in a peak e.g. a soccer match or whatever. Also the CG-NAT gateway isn't for free and the bigger it needs to be, the pricier it is. Also you might still need to buy some IPv4, perhaps more than you would need to buy if you deployed IPv6 and used it for the connections, where it is possible, taking e.g. almost the full load to Google/ YouTube and Facebook off your gateway.

[0] https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-...

I just found some of my old posts on my old site from 2003, where I complain about NAT and UPNP. It's nearly 20 years, and the problems have stayed the same :(

NAT was the bandaid that became the permanent solution. It was never meant to be permanent, but because of these, so many weird hacks and designs have been made to compensate for it.

Totally silly question, but isn't the NAT-upon-NAT(-upon-NAT) a bit of protection in the sense of additional privacy, and hence a good thing? Doesn't this mean the website cannot directly tie back an incognito user back to a specific IP but instead to just a pool?

For a purely "consumer" internet, yes. But I'd like to think that at some point we move back to a more decentralised model, where addressibility in more contexts than a response to a request become important again. To some degree the NAT issues have even killed a lot of this, making P2P more difficult and unreliable than would be otherwise.

Depends, but really IPv6 and IPv4 seems to be more or less comparable in practice. If you use an app with a login, you are basically screwed anyway. Even on a random website, you can be reliably fingerprinted: https://amiunique.org/

> Doesn't this mean the website cannot directly tie back an incognito user back to a specific IP but instead to just a pool?

Do you have cookies on or off in your web browser settings? If they're enabled then you're being tracking regardless of your IP.

I have my router reboot every night and so I get both a new IPv4 address and a new IPv6 prefix everyday. If I have cookies disabled, then ad folks will have to find other ways to track me beside those two.

Yes, but you could also randomize your IPv6 address constantly too.

Downside of CGNAT and NAT at home is difficulty of getting some services to work, or hosting a server.

It still boils down to everyone gets an identifying number, whether it's an ipv4 address or an ipv6 block.

Any randomized ipv6 address from that block is still as "unique" an identifier as an ipv4 address.

Also, creating/using P2P applications. I needed to look up UDP hole punching and now I wish I hadn't.

out of curiosity, what did you end up going with? I had to host a UDP game server recently and couldn't find a good solution. If only ngrok supported UDP...

It was just research. I'm interested in audio&video over IP, I already had a good grip on HLS, RTP, and a few others, and wanted to dive into WebRTC, RTSP, etc. I don't know but all of this feels like there's a simpler solution (like HLS vs DASH) waiting to be discovered.

DMZ it and firewall up the host.

ISPs log all of the translations and can reverse a (public IP, source port, time stamp) tuple to the user.

> ISPs log all of the translations

On my personal router?

They don't need that much granularity; it is enough to being able to point fingers at someone responsible.

But otherwise, it is possible to enumerate devices behind NAT (obviously, only those that communicate with the world in front of NAT) and assign traffic to them.

No, at their CGNAT layer. They know which customer it came from. They don’t care which device in your house it came from.

"a bit of protection in the sense of additional privacy, and hence a good thing?"

The more dysfunctional is your internet connection, the more prova you youve got

In your first line, I guess you mean to say ipv4 not ipv6.

there's also NAT64, 464XLAT that do ipv6 to ipv4 sorcery

Beyond an ELI5, but correct.

If you are on an IPv4-only or IPv6-only network, you can reach the other through various mechanisms.

A lot of mobile/cell networks are IPv6-only, and so the telcos need a way to allow clients to reach IPv4-only systems.