Comment on No NAT November: My Month Without IPv4
t3rmit3@beehaw.org 2 weeks agoYou can essentially achieve this with some routers with a “DMZ” network segment/ device, so all incoming requests to your external IP get forwarded to it automatically if not part of an outbound NAT’ed session. You don’t even need to disable NAT.
hendrik@palaver.p3x.de 2 weeks ago
A standard DMZ still does NAT. You get a private IP and the router "nat"s you, just that it forwards all incoming traffic to that device by default. I think that disqualifies for no nat november.
t3rmit3@beehaw.org 2 weeks ago
I admittedly did not read the original Mastodon post from nixCraft about the purpose of No NAT November, but surely it’s not just about moving to IPv6? You can (and usually would) still do NATing with IPv6. You don’t want every device to be internet-exposed, but still want them to be able to access the internet (and who wants to configure internet-defensive firewall rules on all their internal home hosts)?
targetx@programming.dev 2 weeks ago
I don’t agree that you usually would still use NAT with IPv6. I’ve never seen NAT in combination with IPv6 and I’ve seen plenty of deployments at our customers. NAT is not the same as a firewall, so just using public IPv6 addresses does not mean that you are exposing every port by default. I think you should read up on IPv6 and firewalling before making statements like this :)
hendrik@palaver.p3x.de 2 weeks ago
That's right. People want a firewall. Maybe on the devices and/or on the router. But NAT isn't that. It's address translation. Predominantly because there aren't enough addresses available. It's a workaround. And it kills things like VOIP, videoconferences, direct communication etc. And then you need a workaround for the workaround to work around that... If you just want to drop incoming traffic and not expose clients, that's what the firewall is for.
t3rmit3@beehaw.org 2 weeks ago
So first off, I think it’s safe to assume that the article is not about going and removing IPv4 on your company’s corporate networks for a month, so I’ve been speaking in regards to home internet service.
NAT is not a firewall, but in normal use by the average home internet user it is a means to prevent computers outside of their network from reaching computers inside the network without ports being forwarded on the router, or the internal machine initiating the connection. If you do not have a firewall on the devices, and they are not behind a NAT gateway/router, then they are by default exposing ports. There’s no inherent guarantee that a router has a firewall, or has it enabled.
I’m interested in how this works. In a normal IPv4 scenario for home internet users, you are assigned a single IP for your router by your ISP, and internal addressing is usually handled by router-resident DHCP automatically. In the deployments you’re seeing, are ISPs handing out /120 blocks to each router? Does that require the ISP to have access to alter your home router, or do customers configure the DHCP themselves (which seems unlikely to scale)?