Re: NAT debate (Re: [v6ops] A common problem with SLAAC in "renumbering" scenarios)

[Tom Herbert <[e-mail]>]

On Thu, Feb 21, 2019 at 6:13 PM Fernando Gont <[e-mail]> wrote:
>
> On 21/2/19 22:58, JORDI PALET MARTINEZ wrote:
> >
> >     I agreee with that with one exception. I believe that NAT/IPv4 can
> >     offer better privacy in addressing than IPv6 given current addess
> >     allocation methods.
> >
> > I'm for as much privacy as possible, however, not at the cost of things such as:
> > - Unnecessary complexity increase
> > - Moving from peer-to-peer to client-server for everything
> > - Single point of failure
> > - Increasing the attacks chances by reducing the surface to the servers
> > - Increase the complexity of app development
> > - Complexity to host services in "clients"
> > - Complexity to use "freely" and "efficient" DNS
> > - etc
>
> There are two protocols associated with NATs:
> 1) Apps that incorporate IP addresses and ports in the app protocol
> require an ALG
> 2) Because of of the "only allow outgoing connections" side-effect of
> NATs, you need UPnP to open holes in the NAT, or some NAT traversal
> technique.
>
>
> "1)" goes away when you remove the NAT.
>
> "2)" does not if you replace the NAT with a stateful firewall that only
> allows outgoing connections. -- the majority of the IPv6 deployments
> I've seen use this policy/model. And, of course, this is also a single
> point of failure, will also increase application complexity, etc., etc.,
> etc.

So we need to eliminate stateful firewalls as well as NAT...

Tom

>
>
>
> --
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>
>
>
>