Re: [v6ops] double nat

[Brian E Carpenter <[e-mail]>]

On 02/10/2012 14:14, Gert Doering wrote:
> Hi,
> 
> On Tue, Oct 02, 2012 at 01:54:52PM +0100, Randy Bush wrote:
>>>> so, is double nat really worse than single nat?  is it formally
>>>> different?  except in the case of overlapping spaces, of course.
>>> One of the problems with "someone else controls your NAT" is that
>>> you can't add port mappings.  This seems to be an inevitable side
>>> effect of NAT444 (but can happen with single NAT44 as well, of
>>> course, depending on where it's placed).
>> i asked *formally*.  i am not concerned with all the ops, social,
>> stuff.  and not about issues not directly connected to the nat.
>> what does double translation do that single does not?
> 
> OK, sorry, I misunderstood.  
> 
> Just focusing on the technical aspects, I'd say a double-NAT doesn't do 
> anything different than a single NAT.

I don't see how to separate the "formal" impact of NAT from environmental
issues such as placement of middleboxes. If the traffic passes through some
kind of upper-layer-aware middlebox in between the two NATs, I am sure the
e2e result will be different than if the middlebox is at one side or the
other of both NATs, assuming the middlebox messes with the IP header or
packet size, or causes fragmentation. I doubt if there is any general
statement to be made beyond that, due the variety of NAT behaviours and
middlebox behaviours.

I think that means that there isn't a guaranteed formal equivalence
between the operation NAT() and the operation NAT(NAT()), because
in the real world we might have NAT(MIDDLEBOX(NAT())).

Another point is that geolocation will find the nearest NAT, and so will
forensic traceback.

Observational data: http://tools.ietf.org/html/draft-donley-nat444-impacts-05

> 
> This is assuming
> 
>  - identical implementations (like FTP ALGs that handle the same subset
>    of PORT/PASV features, not different subsets in both NATs)
>  - no shortage of port space on the second NAT (which is again one of
>    the "real deployment" issues, not a pure theoretical "put two NAT
>    boxes behind each other, without adding extra users" issue)

Right, making a few false assumptions does simplify mathematics ;-)

   Brian