Hacker News Reader

Comment by awestroke | Hacker News Reader

Why can you not have NAT when running the network on IPv6? I've never seen anyone explain this

NAT is a workaround for the small amount of address space that was allocated originally. That's not the case on IPv6. I'm sure you can NAT stuff but why the hell would you want to do that and have to maintain all the stateful pain in the ass stuff required such as NAT tables which are going to be much larger.

To prevent the machines in the network from being exposed publicly

If you have machines in the network which you don't trust to handle their own incoming connections securely you can block those connections at the firewall, without port or address translation. Ideally you'd put those on hosts on their own locked-down VLAN. NAT (or NAPT) doesn't add any security (see: NAT traversal) and having different internal vs. external addresses significantly increases the complexity of the system—not just the router but applications as well, which are forced to deal with their public addresses and ports differing from the ones they were assigned.

I'd rather blacklist devices that I believe are somehow secure than blacklist devices that I think are insecure. How would you even keep on top of that in a large company network? Better to just default to hiding all devices behind the NAT

That’s what firewalls are for.

You can, but the point is that you shouldn't have to because there are enough addresses. NAT only makes networking code for applications harder.

NAT complexity is only marginally more than for a stateful firewall, and is probably lower than for an application firewall. And you still want a stateful firewall in IPv6 networks!

Not needing to do address translation is a large amount of code that you don't need to run to keep IP traffic flowing.

Sure, you absolutely need a stateful firewall, but not needing address translation makes it easier to troubleshoot, makes it easier to establish end to end connectivity and no need to port forward or things of that nature so multiple clients can all use the same port.

With NAT you may need STUN, TURN, ICE, and probably a few more acronyms:

* https://en.wikipedia.org/wiki/STUN

* https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_...

* https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab...

Not sure if that's more or less complicated than already knowing your IP address and 'just' using UPnP/PCP:

* http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf

* https://en.wikipedia.org/wiki/Port_Control_Protocol

But NAT can protect your internal addresses. If your ISP changes your IPv6 address/prefix, all devices in your network will change their addresses too. This is pain in the ass that can be alleviated by NAT.

You can use link-local addresses for that. There addresses are only available inside the local network and are never routed. When you use IPv6 your interfaces have multiple addresses, at least one external and one link-local.

You can. I've seen sites use it because they didn't have an allocation of their own, but they didn't want to rely on their ISP's numbering either. So they used 1:1 NAT between their carrier's space and their ULA space. Like renting a /8 and mapping it to 10/8. Except in v6land it's nowhere near as crazy as it sounds.

NAT isn't required in v6, it's not wanted in v6, but it's perfectly possible. If you think about it, PAT/NAT (port-based NAT) doesn't happen at the IP stack, it happens at the port level.

The whole point of a NAT is negated by a switch to IPv6

No it's not -- maybe I'd prefer not to advertise how many devices I have on my network.

Wouldn’t that be the purpose of a router, not NAT? The two are often bundled together but they aren’t necessarily inclusive

IPv6 address randomisation fixes that, and it's enabled by default on most IPv6 stacks.

Reply on news.ycombinator.com