upvote
I don't think that you can draw the line between NAT and CGNAT. The fact that single NAT works as well as it does is an argument for why it is ok to double NAT with CGNAT.

The conceit behind NAT is that 99% of traffic over the router will be client-server and the last 1% can get away with separately negotiating with the router to get inbound traffic.

For example my ISP Xfinity by default will put your router in CGNAT space (and ipv6) but if you request port forwarding from a mobile app the upstream router will assign you a ipv4 address and it all works. NAT is considered fine because adding roadblocks to server hosting is a acceptable tradeoff.

The reason they i think they can be so flexible is that they likey have a ipv6 backbone to route to all the customers and ipv4 is not used for routing but as a extra service layered on top with packing the 48 bits of ipv4 and port inside a ipv6 address via MAP-T

reply
That can be because UPnP supports only ip4, you need PCP for ip6, but CGNAT supporting port mapping is unheard of.
reply
Yeah NAT is still "every household gets a public IP address". This is a perfectly good foundation for an open Internet. You can still host servers in your home. I did this a lot as a kid and learned a ton from it. It's maybe not super elegant but it works.

Going to a model of "you don't get a public IP address, all traffic must go through servers other people host for you" is what finally kills the open Internet. It's okay enough for cell phones where it's a hack to work around TCP/IP's lack of roaming support, but it should be illegal to deploy as residential Internet.

reply
>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

I don't think NAT being a janky ad hoc firewall does anyone a service. It shields the devices enough to keep the developers oblivious about security, but not enough to stop them from connecting to arbitrary hosts. This perpetuates the humongous botnet ecosystem.

reply
> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

You can have a stateful firewall that blocks non-established-connection packs and all your publicly addressable devices would not be reachable. NAT ≠ firewall (though they often glommed together on CPEs).

And NAT is also giving a false sense of security in some ways: "this device has an RFC 1918 address so is not reachable, and therefore safe". Yeah, except if another device already on the inside is / gets compromised. Perhaps if everything had a public address folks would be more circumspect.

reply
Generally, firewalls aren't going to save you from an internal compromise either. Are you giving each device its own VLAN, subnet, etc?
reply
> Generally, firewalls aren't going to save you from an internal compromise either.

Right, but it's easy to get in the mindset that because devices are on the "inside" network they are safer. This is the risk that NAT brings: RFC 1918 = safe(r).

If every device has a 200::/3 address, then even if there's a SPI firewall which prevents external connections, it may help to reduce this inside/outside thinking.

reply
I think it's hard for us to imagine what we could have if not for NAT.

Just as an example, any device on your home network could have a web interface which you could access from anywhere using a web browser. All the smart light bulbs and things which need some stupid account on some service could be made so they're controlled by the user instead of some company.

I've set up things like this on my home network but it's a pain because I need to deal with port forwarding, and if I have more than one device I need to use a reverse proxy.

reply
> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

I doubt it.

Very few devices do port NAT without also doing firewalling, since firewalling is simpler.

reply
> "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP.

If you try to use those port forwarding hacks, you force every single piece of software to deal with the fact that the IP address it sees for itself is not the IP address its peer sees for it. And you force every single protocol design to allow for that possibility. Add in UPNP, and now you have to implement a whole extra (badly designed) protocol in parallel with the actual application.

It's not trivial to even discover the address your peer is seeing; even now there's a huge diversity of nasty unreliable hacks for doing it.

HTTP isn't the world. In fact, HTTP becoming "the world" was another part of the problem.

reply
NAT didn't save us from insecure networking. It gave insecure networking an excuse that was just good enough to satisfy the masses.

This is worse for everyone in so many ways:

1. Forwarding ports suddenly makes you insecure, because you already were.

2. You have to fuck with your router config to even do that, and risk breaking something else along the way. Nobody should have to bother, because port forwarding shouldn't exist in the first place.

3. Many ISPs make it difficult or impossible to configure your firewall, let alone reserve a static public IP.

4. It's an eternal problem that isolates itself from any true solution. Any actually good UPnP implementation would just be stuck behind your NAT and firewall.

The entire premise "as long as you can control it" is the core issue, and the fundamental reason why NAT is the original sin. Without NAT, there wouldn't be anything to get control of.

reply
NAT only serves as the janky inbound default deny because IPv4 doesn't have the address space. There are very few things NAT solves in a world without address exhaustion; the only one I can think of off hand is a janky method of forcing return routing in enterprise environments where symmetric rooting is needed.

In an alternate universe (or a current one with IPv6) every home router would have a default deny inbound security policy, and home admins could punch holes as needed the way they do today with port forwarding.

reply
> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

Its definitely the opposite. People started ignoring security because its "natted" anyways, even though NAT was never supposed to be security-critical. Thats what firewalls are for.

reply
People (by which I mean average computer users) didn't "start ignoring security", they never bothered to unignore it in the first place. Early Windows editions didn't even ship with a firewall at all, people were rawdogging the internet out of the box without ever stopping to consider the consequences.
reply
I remember in the Windows 95/98 days asking my friend for his IP address and then browsing through my windows explorer to his mum's fully shared windows C drive. She had her computer plugged directly into the modem and was using ICS to share the net to my friends computer.

I sent them a screenshot of her shared drive through ICQ, and not long after she bought a router.

reply
... because people (by which I mean software vendors who should have known better) irresponsibly failed to create secure systems for those average users to use. A whole lot of which came to be justified by "it'll be behind a firewall" thinking.
reply
Did you forget dialup was a thing? No one created anything for home users thinking it would be behind some firewall because as said Windows didn't ship with one, and because the dominant way of customers getting online was dialup, giving a public IP to every user.

Software was created with no security because no one demanded it because no one cared. Technologies that came later did not create that situation.

reply
The typical NAT implementation ("PAT", single public IP, RFC-1918 network) gives you an implicit stateful firewall denying unsoliticed inbound traffic. Most people don't need anything else.
reply
>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

This might not be a good thing. Perhaps if there had been no protection for those odious operating systems, they'd have died the horrible deaths they earned decades ago. We should only want to protect things we intend to keep, after all, and none of us wanted to keep that garbage.

reply
All of the current OS choices are insecure by design. The all operate programs with the ambient authority of the user. While this was fine for the corporate world of AT&T in the 1970s, and the classroom in the 1980s, it's insane to use it in the era of ubiquitous persistent megabit Internet connectivity, and mobile code.

I know of zero systems that can survive exposure to the raw Internet, unpatched and without administrative oversight, with uptimes of years.

reply
>I know of zero systems that can survive exposure to the raw Internet

Sure. And as long as nothing has to survive exposure to the raw Internet, no one will build anything that could survive it. Not sure why that's so difficult to understand. You seem to think that the protection is the reaction to dangerous operating systems, when it's the cause.

reply
[dead]
reply
Regular NAT is not fine at all. It adds needless friction and complexity. Networking is complex and annoying enough without it.

IPv6 just works. DNS gives me the address and that's it, I am now talking to my remote computer.

reply