undefined | Better HN

0 pointsrobertlagrant2y ago0 comments

There's certainly a requirement for them, but it would be good to know what the justification of that requirement was before we know if there's a need. E.g. the justification could be "our SOPs say all network traffic must go through NAT", and if you dig deeper you might find that the SOP was written to save money on IPv4 addresses. That would not indicate a fundamental need.

0 comments

Retric2y ago

NAT works well as an ultra simple firewall. All those ancient IoT devices don’t need to accept traffic from arbitrary addresses, but they may need to communicate with the outside world.

Using a firewall is obviously an option, but why give an IP to something you don’t want accessible by the outside world?

lxgr2y ago

> NAT works well as an ultra simple firewall.

There's something that works even better as an ultra simple firewall: An ultra simple firewall!

> why give an IP to something you don’t want accessible by the outside world?

- You might change your mind about it needing to be accessible by the outside world, and if it already has a global address you don't need to renumber everything.

- Addressing and routing aren't the same thing; it can be useful to have globally unique addressing even without global reachability.

Retric2y ago

Ultra simple firewalls that expose your internal network architecture are less secure than NAT. You simply cannot information about your internal network without risk and there’s zero direct benefit for doing so.

ta12432y ago

> There's certainly a requirement for them

Thus proving that ipv6 failed in it's mission to get rid of nat

robertlagrantOP2y ago

I don't think this is a useful thing to say. If I keep trying to fill up my electric car with petrol, and get so annoyed that it keeps spilling on the floor that I pay someone to install a petrol cap and fuel tank, it would be equally silly to say that electric cars failed in their mission to get rid of petrol use.

j / k navigate · click thread line to collapse

0 comments

Retric2y ago

NAT works well as an ultra simple firewall. All those ancient IoT devices don’t need to accept traffic from arbitrary addresses, but they may need to communicate with the outside world.

Using a firewall is obviously an option, but why give an IP to something you don’t want accessible by the outside world?

lxgr2y ago

> NAT works well as an ultra simple firewall.

There's something that works even better as an ultra simple firewall: An ultra simple firewall!

> why give an IP to something you don’t want accessible by the outside world?

- You might change your mind about it needing to be accessible by the outside world, and if it already has a global address you don't need to renumber everything.

- Addressing and routing aren't the same thing; it can be useful to have globally unique addressing even without global reachability.

Retric2y ago

ta12432y ago

> There's certainly a requirement for them

Thus proving that ipv6 failed in it's mission to get rid of nat

robertlagrantOP2y ago

j / k navigate · click thread line to collapse