IPv6 Adoption Grows by 1,900%, Says Internet Census

[gm0n3y]

NAT is a very important part of the internet. Among other things, from a basic consumer standpoint, it allows us to use multiple machine on a single connection transparently. Without NAT your ISP could (and would) charge you for each device, not to mention charging different rates for different types of devices.

From my limit knowledge of IPv6 (and a few college courses in network maintenance/security) I don't see how it could stop NATs from being used.

 

[palladin9479]

[citation][nom]ojas[/nom]Getting hard to know who knows what in the comments section, guess i'll have to read up on it myself...However i do know from a book (Computer Networks, Andrew S. Tanenbaum) that NAT was against the openness of the internet and made it easier for ISPs to control and organize their networks. It also lowered the redundancy of the Internet, since now there were these few main nodes, which, if taken out, would cut of lower hierarchical branches.Having said that, i agree that it makes sense on the security front.[/citation]

Don't know who told you that but they lied.

NAT was created as a mechanism for someone to hide a private network behind a public one, it was designed to obsfucate on purpose. What most people don't realize is that ISP's charge you by connection not IP address, read the fine print in your internet service agreement. One "unlimited" connection to a single device, anything more and you have to pay per-device. Back when NAT software started to become commonly available, the ISP intallers would refuse to connect your DSL / Cable line if they saw you had a NATed setup, I know this because I used to have to hide my gateway whenever I had internet troubles. Because NAT on IPv4 makes it effectivly impossible for them to meter individual connection usage they've mostly given up trying for force you to pay per connection. This will change the moment they can meter individual connections, just look at what the wireless ISP's are doing and what Comcast did with P2P connections and you should get an idea of what they can do.

Now ... when the task group responsible for IPv6 designed it, they went to extraordinary measures to ensure NAT wasn't supported. From their perspective NAT breaks something called the "end to end" model, which is just a saying that means a cell phone in china can directly connect to and communicate with a PC in South America. It's purpose is to make the transportation layer invisible to you as user. NAT breaks this by imposing both a physical and a virtual barrier between your connections. The cell phone in china simply can not address the PC in south america if the south american PC is behind a NAT device. The cell phone must first address the NAT device, and the NAT device must be trusted to relay the communication properly to the PC. This by itself isn't a security measure as IP masquerading (the technical name for NAPT) will just forward everything. But when you combine it with connection tracking and enforce a firewall like ruleset, you get an amazingly powerful, effective and cheap consumer secure gateway device. Break any of those pieces (NAT, SPI, ConnTrack) and the security as a whole starts to fail. Now if you have high paid security experts, they can easily monitor, configure and maintain that firewall such that NAT isn't neccessary. Otherwise, SPI (the kinds found in home routers) + ConnTrack only protects you from limited attacks that are well documented, it doesn't protect you from undocumented attacks nor probing. If anything IPv6 is actually less secure then IPv4, the *mandated* IPSEC suport does nothing as home users don't use IPSEC and setting it up isn't easy. It places the entire security burdon on a *knowledgable user*.

Anyhow, IPv6 was designed with a pure and ideaistic view of the internet. It imaged this big great cloud with every device on the planet able to freely communicate to each other in one big cyberspace world. Of course the idea that many of those devices are untrusted, and some of then are downright dangerous didn't cross their minds until later. The internet is less like Star Trek and more like Babylon 5.

 

[palladin9479]

[citation][nom]Smilla0[/nom]I don't think IPv6 was ever intended to solve China's civil rights problems, improve home user's security holes or facilitate covert use of home internet connections. I think you're putting too much expectation on IPv6 to solve problems that are not within it's mission statement.[/citation]

Except the IPv6 task group, and all it's supporters have gone through extraordinary measures to break NAT in IPv6 and absolutely refused to standardize it. So instead of a standardized IPv6 NAPT protocol that application developers can write their code for, we have a chinese student writing his own code just like it was done with IPv4. We'll get the same problem, NAPT66 will break some communication models and app developers will have to write work-arounds and band-aids for it. It'll slowly develop until it becomes a de facto stanard rather then a written standard.

 

[ojas]

[citation][nom]palladin9479[/nom]Anyhow, IPv6 was designed with a pure and ideaistic view of the internet. It imaged this big great cloud with every device on the planet able to freely communicate to each other in one big cyberspace world. Of course the idea that many of those devices are untrusted, and some of then are downright dangerous didn't cross their minds until later. The internet is less like Star Trek and more like Babylon 5.[/citation]

Alright, i see. Though with respect to the last para, that's exactly what i meant by the openness of the net. Remember, the idealistic view you're talking about is a really old one which kind of was the basis of the net. So they're carrying it forward. Though now since the world has changed quite a bit, i'm surprised they want to terminate NAT.

And i was talking about this guy: http/en.wikipedia.org/wiki/Andrew_S._Tanenbaum
and this book: http/openlibrary.org/books/OL24991169M/Computer_networks

So i think he knows what he's talking about...though admittedly he's from the idealistic generation...

 

[ojas]

@palladin, i'll list what he says:

NAT was used because ISPs had to get around the problem of ip addresses running out, so what you're saying about charging every connection is a bit strange (and not something i've observed personally). Also, all ISP and companies use NAT setups at various levels.

There are more things, but the NAT section is 4 pages long, so will only type the problems he (and/or others in the IP community) find with NAT:

1. NAT violates the architectural model of IP, which states that every IP address should uniquely IDs a single machine world wide....

2. NAT changes the internet from a connectionless network to a connection-oriented network.....in the absence of NAT, router crashes have no effect on TCP....

3. NAT destroys the independence of layered protocols. [not a direct code, just the gist of the para]

4. Process on the internet are not required to use TCP or UDP. If a user on machine A decides to use a new protocol....NAT box will cause he application to fail because the NAT box will not be able to locate the TCP source port correctly.

5. Some applications insert IP addresses in the body of the text...Since NAT knows nothing about these addresses, it cannot replace them, so any attempt to use them on the remote side will fail...

6. Since the TCP source port is 16 bits, at most 61,440 machines can be mapped onto an IP address. [again had to edit this a bit]

"These and other problems with NAT are discussed in RFC 2993. In general, the opponents of NAT say that by fixing the problem of insufficient IP addresses with a temporary and ugly hack, the pressure to implement the real solution, that is, the transition to IPv6, is reduced, and this is a bad thing."

He's listed the pros and cons of both NAT and IPv6, though he doesn't ever mention breaking NAT support. There's also a long para about ipv6 security, but it's mostly about cryptography, so no point quoting anything here because it's not relevant to the point you've raised.

 

[ojas]

^in (3): [not a direct quote ]

 

[ojas]

And ..... means i'm omitting that part of the text, which i've had to, not going to type the whole damn thing.