Hacker News Reader

Comment by rr808 | Hacker News Reader

NAT is a very simple idea that works very well. In fact for my private network with 20 odd devices I'd prefer to keep it.

View on HN

The problem is, it is NOT a simple idea, but one that requires a lot of relative heavy lifting with deep packet inspection for a lot of protocols that have to deal with the spaghetti that is NAT.

Yeah but even if it isn't simple it is mostly a solved problem at this point. NAT has been around for, what, 15 years now?

And quite honestly the default configurations for IPv6 on consumer routers is "wide the fuck open"--which is not at all what I want. But if they don't make it "wide the fuck open" suddenly you are asking normal people to learn how to punch holes in their firewall.

I have never seen a consumer IPv6 router without a restrictive firewall enabled by default. Could you give some examples where this is not the case?

Pv6 and NAT were developed in the mid-90s. They've both been around for far longer than just 15 years.

More like almost 30 years.

NAT has fundamental flaws that simply can't be solved, and even when it can be made to work it's still an extra layer of completely unnecessary complexity. It does work surprisingly well despite all that, but it's not something to build the entire future of the internet around.

The default config for most routers is to deny inbound connections, for both v4 and v6. I'm certain you can find routers that don't do that, but it's not common.

Reply on news.ycombinator.com