Hacker News Reader

Comment by diego_sandoval | Hacker News Reader

NAT doesn't get the hate it deserves for stopping people from running their own servers.

I remember being being 18, making my first websites using the LAMP stack and not understanding why my friends were unable to access them from their homes. I knew the basic workings of the IP protocol, but hadn't read about NAT, and the responses online talked about "public and private IP addresses", which made no sense to me -- "Aren't all IP addresses supposed to be public? Isn't that how the protocol works?"

Even after learning about how NAT works, I had no way to work around it, as my ISP blocked the router's web interface and I was unable to do port forwarding.

I would bet that there are at least dozens of millions of people that didn't pursue a career in IT because of NAT. We should ask ourselves if collectively allowing NAT to be what it is was a good decision in the first place.

View on HN

I’m confused, are you complaining about ISP CGNAT or NAT in general? Did your ISP assign you a public IPv4 or not? If the former then you are lucky, that is a relative luxury.

> Even after learning about how NAT works, I had no way to work around it, as my ISP blocked the router's web interface and I was unable to do port forwarding.

Well this is Hacker News, you replace the router with your own.

I have yet to encounter a residential wireline ISP in the US or Europe where using your own router is not a possibility. Even those that implemented 802.1x or similar I have been able to either deal with directly or work around. Not saying there don’t exist counterexamples but I would assume using an alternative router +/- MITM the old one would have been viable.

Of course if the ISP was firewalling (likely) then you have a different problem.

This isn’t really a NAT issue. More of a specific ISP policy issue. (NAT and ipv4 have nothing to do with it, they can just as easily port block inbound 80/443 on ipv6.)

The argument boils down to: My ISP locked down the admin page on my rented router ergo NAT is evil. It’s not terribly sensible.

This is my take as well, we would not have any ip space if every machine had a public ipv4 address - this is kind of a silly argument to make, nat’s provide a ton of usefulness.

As a kid I didn’t get it either but would port forward, run a vpn server, reverse proxy, and so on. It was a good learning experience trying to get my friends to install vpn clients!

> nat’s provide a ton of usefulness

... to companies like IPXO that are trying to acquire, rent, and treat IPv4 addresses like speculative real estate.

> we would not have any ip space if every machine had a public ipv4 address

Right, but then ISPs and hosting providers would have to have supported ipv6 10 years ago (or even earlier) when we ran out. Customers were already demanding multiple devices on their wifi 20 years ago, and without NAT, ipv6 would have been necessary.

With NAT, you can't do p2p or self hosting. Without it, you couldn't use centralized services either.

NAT's usefulness is that it helps with IP address shortage. If there wasn't a shortage, NAT wouldn't be useful anymore.

And for those that say "but security!", firewalls are a thing, and need be no more complicated than NAT.

> Did your ISP assign you a public IPv4 or not? If the former then you are lucky, that is a relative luxury.

At least until the 10G fiber upgrade happens, Sonic has given me a static IPv4 address for a decade.

Do they guarantee it is static?

My current IP hasn't changed in years but I need to pony up if I want them to guarantee it forever.

Are you running any servers? I can't find it now, but I remember reading somewhere once that ISPs force IP changes more often on residential users that they detect are running servers.

I've been running a web server for the last year or so, and I still have the same IP from Comcast that I've had for years. When I was a teenager I also ran servers and had a stable IP for years. Ostensibly they say you're not allowed to run servers, but I'm guessing they'd only care if you're constantly using a significant chunk of your bandwidth.

> Do they guarantee it is static?

Yes, but it's only for grandfathered DSL.

https://help.sonic.com/hc/en-us/articles/360009880293-Static...

Sure. I still remember when I could order additional static IPs on residential cable internet.

That doesn’t mean most getting online today in Asia or Africa basically have a choice other than CGNAT IPv4 and IPv6 from their ISP. Your own dynamically assigned IPv4 is a relative luxury.

As a data point, the ISP I'm personally using here in Australia (Launtel, highly recommended) has static IPs as an option.

It's not the default choice (most people don't need one), but people that do need a static IP can get one.

This is a terribly uninformed take.

ISPs charge for public IP addresses. Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house? Because that's what you get when you don't use NAT. And if it weren't for NAT, the Internet would be running out of IPv4 addresses (it already is, sort of), so you'd either deal with much higher prices for IPv4 addresses, or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT.

Not to mention the premium you'd pay for a router with an actual firewall, and you had better make sure you understand the firewall. Port forwarding on a working router is generally a lot easier than a firewall.

If it was really impossible to set up inbound connections to your server, it was either a problem with the router or a problem with your ISP.

Arguably if people had somehow rejected NAT more violently, IPv6 might’ve been popular much sooner cause you gotta solve the “woops there are now more devices than addresses” problem somehow.

For the sake of running a home server from a network not behind a NAT router, you don’t need to understand much more about IPv6 than how to copy&paste an address.

The fact that my laptop right now has 10 different ipv6 addresses assigned to it when my ISP doesn't even support ipv6, (and two ipv4 addresses) says users need to understand more than copy and paste.

> ISPs charge for public IP addresses

Because NAT allows them to.

> Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house?

Yes.

> or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT.

Back in 2005, maybe. Now, it works out of the box, either through SLAAC or DHCPv6.

> Not to mention the premium you'd pay for a router with an actual firewall

In 2005, maybe. Today, $10 routers off AliExpress have a firewall, probably set to "deny incoming" by default.

> Port forwarding on a working router is generally a lot easier than a firewall.

I know for a fact that the routers of at least two ISPs use the exact same page for port forwarding and the firewall. You don't enter iptables commands, you specify a list of ports that you want to be open for a specific address, except now you don't need to differentiate between "source port" and "destination port".

>> ISPs charge for public IP addresses

> Because NAT allows them to.

NAT increases the available supply of IPv4 addresses, it makes them cheaper.

>> Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house?

> Yes.

You can actually just go out and buy a block of IPv4. https://auctions.ipv4.global/

NAT was/is a great for blocking incoming connections by default. A lesson I learnt when I found in early Windows XP days that my files are gone and a .txt note was left on my C: disk...

A non-NAT firewall can have the same default rules.

Remember when connecting an unpatched system to the internet would get it infected by the Blaster worm within the day?

I ‘member.

I had the advantage of being 18 when the internet was still pretty open and I had all the access I needed through my university. I even remember finding a list of root passwords to various machines at Standford lying in one of the computer labs. No idea how it got there. But I tested one with a quick rlogin and it worked fine. Oops. I emailed them to let them know and got basically a <shrug> in reply. Those days certainly were easier for a kid who was learning networking, but they couldn't last with more and more people getting connected and making it more tempting for bad actors to fool around.

> I had the advantage of being 18 when the internet was still pretty open

There is no doubt that is an extreme advantage. When I started college in the late 90s an upperclassman was in my dorm for a party and saw a trophy i had from a USFirst robotics competition in HS, he invited me to join an organization he was in that built autonomous robots (we called them "vehicles") for a competition. In that lab, we had network drops and static IPs on the schools inet connection. The lab's admin knew the DNS guys and so we could run whatever we wanted on a fast internet connection with access to our own hostnames. At this time Linux, Apache, PHP and MySQL were just starting to take off. That lab and inet opportunity convinced me to change my major to CS and kickstarted my whole career.

edit: that "lab" was really just an unused room in a random building with some desks and hand tools like screwdrivers and stuff to work on our robots. ..but it had rj45 plugs :)

It wasn’t as hard back then to sift the chaff from the grain. You were either a computer nerd or you were part of the unwashed masses.

If you showed any interest in computing, other geeks would take you with open arms (mostly) versus now where everyone and their dog wants in on the ground floor.

Most ISPs I've encountered (various places in the USA) do allow port forwarding or even replacing the ISPs router with one of your own. I'm not sure NAT has been a massive obstacle for most people interested in networking. And without NAT, we would have had to use IPv6 or something even worse. That would probably have turned off a lot of aspiring network engineers too.

In some countries, NAT was implemented at the ISP level and you had no public IP at all. I remember it being a consistent practical barrier back in the 90s for stuff like file transfers. I had a public IP but the other person didn't and had no way of getting one or setting up port forwarding. Back when file transfers were often done with direct connection.

> Most ISPs I've encountered (various places in the USA) do allow port forwarding or even replacing the ISPs router with one of your own.

In the United States my entire life I have always been able to port forward when necessary, though I've only been on two or maybe three providers. I also would help friends in middle and high school port forward so we could connect to their game servers. Many providers seem to try to make it as hard as possible, attempting to lock down the interface behind a web panel. This can typically be bypassed by finding the real panel address locally or by getting a new router that isn't locked down. Growing up it was extremely easy, my provider didn't try to make it difficult, but now there is often a barrier to entry for people who desire to casually tinker with their network setup, which is unfortunate.

We had Comcast for 17 years, and they always allowed us to bring not only our own router, but our own modem. Even when we rented a combined modem+firewall+AP from them, it was trivial (and documented) to put it into bridge mode.

We just switched to Metronet last month (5gbps symmetrical!), and while we have to pay $10/month to get a public static IP (CGNAT otherwise), they didn't care what was connected to the ONT, which operates below the IP layer.

NAT, by virtue of also being a firewall, has actually prevented millions of home machines from being powned. The world is better with NAT. And I wouldn't want any modern IoT (including the IoT I am not aware of in all sort of kitchen appliances) to be on the WAN directly.

Your router comes with a firewall for this very reason. IPv6 is enabled on over 40% the internet connections to Google, surely you don't think all of those people don't have any kind of firewall on their home network?

Then if you have a firewall you have the same port forwarding problems than with a NAT.

Not really? No need to mess with destination ports, no need to visit whatismyipaddress.com, no need to risk exposing your entire home network through SIP ALGs, and your Xbox/PlayStation doesn't tell you that you have a bad "NAT type". Plus, when you forward port 1024-65535 to your Nintendo Switch, as Nintendo says you need to do in its documentation, the rest of your devices don't have their P2P network traffic impeded.

> when you forward port 1024-65535 to your Nintendo Switch, as Nintendo says you need to do in its documentation,

Nintendo is a shit company that treats their customer base like bitches yet gets a tremendous steady amount of good will solely due to nostalgia. I'm the last to want to defend the challenges that NAT brings, but blaming it due to some rando corporation's asshattery is silly. Luckily, or not, their documentation is wrong, you almost never have to blanket port forward all UDP ports for the Switch.

The GP point still stands as well. If you have a firewall set to block inbound by default (typical) you have the same basic port-forwarding bootstrapping/configuration problem. Also, the reasons you would absolutely need whatismyipaddress.com or similar apply to both v4 and v6. If you're configuring your router anyway you can get the v4 address.

Without NAT, you can do hole punching. A third server can coordinate two peers sending packets to each other to make their firewalls each see the connection as outgoing and allow traffic. With NAT, the peers don't know which port they're sending on, so they can't relay that info through the third party (though maybe you could have one port scan the other).

Also, an application can use upnp to configure your router/firewall to allow traffic. You could do that with NAT too I suppose if ISPs allowed that, but you'd be contending with other users if you wanted a specific port like 80.

Firewalls on home routers are often of the "shit" level of quality / capability though. :(

Don't worry, the NAT is no better than those firewalls.

Some might find your take bizarre, but the early architects of the internet were against NAT as well. Although, in their idealistic scenario IPv4 would not have held up as long as it did, and probably would have hastened the introduction of IPv6 - not to mention the security concerns like all devices needing competent firewalls. Some people just didn't like that computers could be locked behind a network veil/wall.

NAT is an accidental consequence of IPv4 address shortage, but it turned out to a blessing in disguise. NAT gives every home a basic hardware firewall for free.

Everything, for better and worse (mostly worse) is connected to the internet nowadays. Your watch. Your dishwasher. Your TV. Your light switches. These devices are all comically insecure but because they can't accept outside connections because of NAT it's not such a big deal. IPv4 limitations make outbound connectivity easy but incoming connectivity hard. This is what you want 99% of the time.

NAT's firewall effect is purely coincidental. In fact, because people don't run firewalls because of NAT, attacks like NAT slipstreaming can open any port to any internal IP in your network by abusing SIP ALGs and fragmentation.

Wherever NAT is enabled now, a statefull firewall is a better solution. Thankfully, this is the default wherever IPv6 is rolled out to consumers.

I remember joining an IRC FTP share channel when I was a kid, and wanting to share some of my files to get ratio to download some music and anime they had, and it was my first time attempting to setup an FTP and I thought i was all good to go and dropped my info in the channel and about 3 seconds later a bunch of people were lol'ing at my internal IP.

They were cool though and everybody was helpful, learned a lot that night. IRC was so awesome in the 90s.

> my ISP blocked the router's web interface

This is the weirdest thing in your story. Your ISP disallowed you from configuring your router? I've never heard of such a thing, and it certainly sounds ... suspicious. You should be able to get to your own router without even connecting to the internet. Your ISP should never even know when you're connecting to your router. I commonly hit my router's admin page when my internet is down to figure out whether it's my computer or my external connection.

Why would your ISP want to hire so many extra people to nanny all their customer's routers for them? Are you sure this wasn't an excuse from your parents who installed parental controls on it or something?

I don't understand -- you can purchase your own router instead of renting one from your ISP, which usually works out cheaper in the end too, and port forward.

NAT was a necessity when it was being introduced, so I don't understand the complaints. Sure it's annoying, but what was the alternative?

I don't think anyone was dissuaded from IT because of NAT. Heck, if anything, learning how to configure it might have been some people's first step into learning about networking and then getting into it as a career!

And let's not forget that NAT served as a default firewall that did more than any anti-virus to protect PC's from malware.

> NAT was a necessity when it was being introduced, so I don't understand the complaints. Sure it's annoying, but what was the alternative?

IPv6

Nope. IPv6 still isn't supported everywhere.

When you're running out of addresses, you need a workable solution at the moment.

Not something that requires all networking equipment worldwide to be replaced with a new standard all at once, with is a practical impossibility.

It doesn't have to be replaced all at once. Most of it already has been replaced.

But it has to be entirely replaced in order to turn off the last NAT, essentially.

Being half-replaced or even mostly-replaced gets you nowhere in terms of NAT removal.

IPv6 would have been great if it was just bigger addresses but the actual system we got suffers heavily from the second-system effect.

Can’t upvote this enough. It breaks the original spirit of the internet and is lazy “security” with a huge negative externality

How exactly does it break the spirit of the Internet? The spirit of the Internet is that we run out of IPv4 addresses and everyone who uses the Internet has to learn IPv6 and be an expert on firewalls?

I can't tell if you're being elitist because your defacto position is that everyone who uses the Internet has to be a cyber security expert, or if you're just being obtuse because a couple of Google searches will usually set you straight on setting up port forwarding through your router.

Port forwarding doesn’t help when your public facing ip could change at anytime

That isn't NATs fault. That's a dynamically assigned IP address. You can pay for a static, or you can use Dynamic DNS to work around it. If you didn't have NAT, you'd have a static IP by default, but again, you'd be paying for all those extra IP addresses you need.

You don't need to be a firewall expert to use a firewall. Stateful firewalls have been around for longer than I can remember. The default for any consumer firewall is "disable by default", as they should be.

Now with NAT we need to be disable UPnP, and deal with "NAT types" on gaming consoles. Or Nintendo Switches breaking your LAN because Nintendo tells you to put your switch into the DMZ: https://en-americas-support.nintendo.com/app/answers/detail/...

Because of NAT, we now need to deal with firewalls _and_ port forwarding. Plus, because of https://www.armis.com/research/nat-slipstreaming-v2-0/, your IPv4 firewall is practically disabled _because_ of NAT workarounds embedded into your router. You can pick between having a firewall on IPv4 or allowing WebRTC on any of your devices.

I don't understand your first point about firewalls, but port forwarding on a consumer router is no more difficult than opening a port on a firewall. Either one can be overcomplicated by a badly designed interface. See Uniquiti Edgerouter for an example.

I know gaming consoles can be a pain with NAT, but is that NAT's fault? That link you pasted about the Nintendo Switch is literally just an article about setting up port forwarding.

And that NAT slipstreaming issue is just a vulnerability caused by complicated protocols. Saying that a fundamental network technology is bad because its implementation is flawed doesn't make sense. I guess we should throw away x86-64 because Intel Skylake processors had side channel vulnerabilities.

Yes, firewalls are easy, that's my point. Any consumer router will cone with apps strong a firewall as NAT us able to provide, and an even stronger one if ALGs are enabled.

The consoles are a common and obvious downside of using NAT. The Nintendo Switch article is an example of the stupid workarounds vendors will require because of NAT. None of these issues existed if we used IPv4 as it was designed.

The issue behind NAT slipstreaming isn't that the protocols are too complex. They work fine on IPv6 and they worked fine on IPv4 without NAT. The issue is that NAT requires hacky workarounds to do normal networking. The ALG vulnerabilities can be fixed, but fixing them wouldn't be necessary if NAT wasn't such a hack.

Please see this video: https://www.youtube.com/watch?v=GLrfqtf4txw

In order to get some context and knowledge of History.

I've seen this video, and it's an interesting deep dive into the history of NAT, but it brushes aside IPv6 as an "alternative solution" and doesn't pay any more attention to it. Of course, that's not necessarily something to dig into when the topic is NAT and not IPv6, but it's hardly a defence for NAT, merely an explanation on how we got to this point.

Nat provides safer networking for the same masses who can’t understand it

Depending on the year this was it was a pretty easy Google to learn to traverse nat, and use dynamic dns, or do port forwarding, even out to a Linode

If we didn’t have NAT ISPs would provide a router with a firewall that was just as safe.

There was a time the modem was commonly separate from the router.

Many ISPs do include a router in their modem with some wifi.

It’s often limited in some capacity in real worth use which lets customers over pay and undercover speed and be open to upgrading to a faster plan.

ISPs do provide routers with firewalls, for this very reason of course. You still need to open ports to actually reach the service you're hosting, only now you don't need to figure out what your actual IP is.

It is shitty is that your ISP blocked NAT, that is certainly a crime against humanity, as running your own server is such a pure expression of freedom.

Agreed, but does the blame lie in NAT, or the endlessly rainchecked IPv6 transition?

Tailscale solves this problem as is beginner-friendly, highly recommended.

How would you set this up? You'd still need a box with a public IP to proxy the traffic, no? (Unless you get all your friends to install Tailscale so that they can access your private network).

If you want to expose a single web service you can do it via tailscale funnel[1] easily.

[1] https://tailscale.com/blog/reintroducing-serve-funnel

it/s called exit nodes in Tailscale

I don't think that would work? Exit nodes proxy traffic from the Tailscale network to the internet, not the other way around. Kind of like a consumer VPN.

The other reply mentions Funnel, which I think fits the use case better.

Reply on news.ycombinator.com