Can Large Scale NAT Save IPv4?

Julie188 writes "The sales pitch was that IPv6, with its zillions of new IP addresses, would eliminate the need for network address translation altogether. But Jeff Doyle, one of the guys who literally wrote the book on IPv6, suggests that not only will NAT be needed, but it will be needed to save IPv4 at the tipping point of IPv6 adoption. 'I've written previously that as we make the slow — and long overdue — transition from IPv4 to IPv6, we will soon be stuck with an awkward interim period in which the only new globally routable addresses we can get are IPv6, but most public content we want to reach is still IPv4. Large Scale NAT (LSN, also known as Carrier Grade NAT or CGN) is an essential tool for stretching a service provider's public IPv4 address space during this transitional period.'"

Comments

Re: Can Large Scale NAT Save IPv4?

[ls671]

Of course it could fit most people needs who, by the way, don't even know what having a unique IPv4 address means, forget about knowing what a fixed IP address is. My only concerns would be towards people hosting services, even if they only host a gaming server.

Before getting a fixed IP address, I remember using services like dyndns before I setup my own private dyndns server on a fixed IP address server that I had access to. I could always reach my system even if it changed address every 6 hours on the first dialup provider I registered to back then.

So yes, it could, my only concerns is that it may cause prices to have a unique address or a fixed address to rise.

NOOOOOOO

[santax]

Stop the madness. Give us ip6. We (as a society) would gain so many productive hours without NAT and the shit that comes with it. (Portforwarding etc). We have the technology ready to go and give everything it's unique ip. Can we please use that tech? It's not like it's high-tech or to new to be implemented by now.

Re:NOOOOOOO

[skids]

Despite the efforts of ISPs and some institutions (heck even Comcast has an IPv6 pilot program) no significant number of end-users are going to turn on IPv6.

Nothing will happen until someone with enough clout decides to put a new "must have killer app" or free content out there and only allow IPv6 access to it.
Then consumers might demand there equipment, OS and ISP support it. There's no money in that, so I'm not holding my breath.

Re:NOOOOOOO

[lanner]

I don't think non-networking guys really understand the harm that NAT/PAT/masq has done.

I am talking economic damage. NAT has cost you money. It's cost you a LOT of money. It cost your company money. It cost everyone who uses computer an ASS LOAD OF MONEY totally wasted on a cheap hack to get around the fact that we needed a better addressing system.

All the wasted software time which talented people worked for, and NAT is just a work-around.

All the money wasted PAYING for above mentioned software, salaries, time.

All of the needless hardware and software implementations related to NAT.

Anyone who runs a large Cisco PIX/ASA platform can bemoan the number of statics needed between network interfaces.

Think about the apps that had a really hard time working because of NAT. The games that could not peer-to-peer because both sides were behind NAT.

Think about all of the companies that have multiple DNS views -- inside, and then public. That's a ton of extra work.

Best thing of all that I look forward to in IPv6 is... the idiots that it will wring out of the IT/comp-sci sector. Idiot sysadmins that label their servers with IPv4 addresses, idiot programmers who won't learn IPv6 and will get the boot to the curb that they have long deserved.

If you can't handle it, GTFO lamers. You don't need to know your workstation's IP address -- you need to know it's hostname and how to use DNS. I can't tell you the number of places I've worked at where people hard-code IP addresses into config files and the damage that it has caused, along with labeling servers/printers/whatever with their IPv4 address.

Re:NOOOOOOO

[turbidostato]

"Despite the efforts of ISPs and some institutions (heck even Comcast has an IPv6 pilot program) no significant number of end-users are going to turn on IPv6."

Of course not, because that's not what end users do.

End users will go IPv6 en masse as soon as the DSL "thingie" that their ISP installs on their homes and works magically to connect them to the intertubes goes IPv6.

Re:NOOOOOOO

[PsychoSlashDot]

Your rant would be more compelling if your list didn't consist of "software time", "software, salaries, time", "software" (yes, again), "time setting it up (as if setting up a proper firewall ruleset was any less cumbersome)", and "games". Yes, games. Economic damage indeed.

Look, NAT isn't ideal. I'll grant that. IPv6 is right. But I'd like to point out something. If NAT is seriously as big a deal as you make it out to be, that's man-hours that kept someone employed. Software houses employ people to work in projects that need doing. Working around network realities/idiosyncrasies needs to be done. Remove those realities and the rampaging hordes you envision writing NAT code won't just get a memo saying "hey, we were going to have you work on this uber useful productive project but didn't because you were working on that NAT code but now that it's gone, you're a productive member of society again!"

There's some hyperbole in my post, but the point is clear. At my office we have a phrase, "scripting yourself out of a job". There are a lot of repetitive tasks like new user creation that I'm often tempted to script to save myself (billable) time. Sadly, when everything I do is scripted, I'm not needed. Anyone can punch in values and routine tasks are out of my hands. All that's left is sitting around waiting for something to go wrong. I can't charge for that. That being said, there's an ethical fine line between predatory billing - which we don't ever do - and scripting myself out of a job.

Point is the economic "impact" of NAT isn't something that's worth talking about. If anything it employ[s/ed] people.

Re:NOOOOOOO

[smash]

Remove the BS in dealing with NAT and we can move onto solving other more important problems. keeping broken shit to keep people employed reinventing the wheel is not productive - and essentially productivity is what provides human advancement. if we're wasting time dealing with brain damage just to maintain teh status quo, then why bother? I know this is government strategy for maintaining jobs, but it shouldn't be.

Re:NOOOOOOO

[Ex-MislTech]

IPv6 makes sense, they had RFC's up for a long time ppl could comment on.

Many top level ppl in networking companies, and elsewhere hashed all this out
and it was the best solution they could come up with.

Something better is likely possible, but for now this is it and ppl need to get up to speed.

http://en.wikipedia.org/wiki/IPv6

http://ipv6.com/

Re:NOOOOOOO

[stu72]

Seriously?

With this logic, you would be against any sort of more efficient process ever developed.

Re:NOOOOOOO

[Dagger2]

And NAT is the bomb. It is the best kind of firewall you can have - ie one that doesn't slow down your computer with bloatware. It really is not difficult to forward a router.

No, it's not. The best kind of firewall you can have is a firewall -- which can also be done on your router device, so that it "doesn't slow down your computer with bloatware".

The part I don't like about it though, is the addresses. How easy is it to remember 192.168.2.31 compared to 2001:0db8:ac10:fe01:0000:00000:00000:0000?

If you don't like that address, why did you pick it? For a start, redundant zeros are redundant, so write 2001:db8:ac10:fe01::. Secondly, you are assigned a /48, meaning you can pick the rest of the bits freely. If you didn't want to remember it, why did you pick fe01 instead of, say, 0, letting you write 2001:db8:ac10::?

And in case you hadn't noticed, 2001:db8:ac10:: is shorter than the IPv4 equivalent, where you have to remember both 192.168.2.31 and your external address, 192.0.2.172. What's the problem with IPv6 again?

Re:NOOOOOOO

[antientropic]

If NAT is seriously as big a deal as you make it out to be, that's man-hours that kept someone employed.

Classic example of the broken window fallacy. Are you really saying we should prefer one protocol over another because it employs more sysadmins and developers in activities that would otherwise be unnecessary? Continuing this line of reasoning, we should abolish protocols such as DHCP and require manual configuration of all machines.

Re:NOOOOOOO

[LordAzuzu]

And your ISP must support IPv6.

Hasn't it already?

[MrEricSir]

For years we've heard predictions about how we'll run out of addresses "this year." Yet we haven't.

I assume that's partly because my toaster doesn't have an IP, but it's also got to be because of NAT.

Re:Hasn't it already?

[vanyel]

It has never been "this year", but it *will* be in the next two years, probably next year, at the Registry level. Existing ISPs already have their pools of addresses they can continue using for sometime longer until those are depleted, and yes, NAT has kept this from happening a lot sooner, but lets not make the mistake the US did with the metric system and keep an archaic and broken system in place when life is so much easier (after the transition anyhow) if we switch.

Re:Hasn't it already?

[CRC'99]

Joke aside, my network printers don't support IPv6, my 802.11 access point doesn't support IPv6, my SIP phone doesn't support IPv6, my ADSL modem/router doesn't support IPv6.

Tell me again, how is this transition supposed to work if a good 50% of equipment doesn't support IPv6?

Even if all these devices actually did support IPv6, why would I want them on publicly accessible IP addresses? The truth is, IPv6 hasn't taken off because really there is no huge need for it. Private networks (and there is gobs of IP space for those) are the norm, and in 90% of cases are more than acceptable with a device doing NAT to the rest of the world.

There is nothing stopping people having both public and private IPs (like I have) for things that don't behave behind NAT. That is unless your ISP won't give you addresses....

Re:Hasn't it already?

[sjames]

There is nothing stopping people having both public and private IPs (like I have) for things that don't behave behind NAT. That is unless your ISP won't give you addresses....

And THAT is why you'll be needing IPv6. They won't have any addresses to give.

Re:Hasn't it already?

[asdfghjklqwertyuiop]

why would I want them on publicly accessible IP addresses

Because they're globally unique. You'll never have a conflict of address when you start doing business with other entities with large networks or because the hotel just so happens to be using the same private addresses as a network you're trying to make a VPN connection to from your laptop.

And just because they're public addresses doesn't mean they're publicly accessible.

Re:Fuck you.

[hedwards]

Probably because he doesn't own the infrastructure. The problem is that in the US we heavily subsidized the industry, but didn't require them to really do anything to deserve the money. We didn't require neutrality, we didn't require them to keep building out broad band, or enhance the speeds in urban areas either.

Considering that ultimately they're using public resources to provide a service, I do think they owe us at least something in exchange for making profits using our right of way or airwaves.

Part of the solution

[bbn]

Large scale or ISP wide NAT is part of the solution. It will not "save" IPv4, whatever that means. It will make it possible to transition to IPv6 and still access all the old sites, that have not yet made the transition.

It is not really important that slashdot.org is still IPv4 only. You can access it just fine. And slashdot.org has no need to access you.

You use IPv6 in all the cases where you wanted that nice static IPv4 address before: When running peer to peer software. Setting up your small hobby server. Using direct peer to peer VoIP. And so on.

All the consumer ISPs will transition soon enough during the next few years. We will fairly quickly be able to assume consumers will in fact be able to access IPv6 only sites. For the next 10 years you can also assume consumers will be able to access IPv4 only sites - is anyone really surprised by that?

If all your gaming friends got IPv6, playing on your private IPv6 only game server - what do you care that some backwards dialup only ISP, in a country you never heard of, still is IPv4 only?

Large scale NAT is completely moronic.

[Kaz Kylheku]

There are only 65536 port numbers, so there is only so thin that you can spread a single IP address. Remember that some clients open many ports. There are also questions of reuse; you can't simply cram the 65536 space close to full. When a TCP connection terminates, you don't want to start reusing the port number right away. It's tricky.

People are not going to be happy to be NAT ed. Will large scale NAT also come with large scale port forwarding? Large scale UPnP? What do you do about port number abuses?

Dynamic DNS goes out the window. People can't have a quasi static IP any more with their own port 80, port 22, port 25 mail server or whatever.

If I were to be NATed, I would not want to pay more than 5 dollars a month for such a crippled connection, regardless of bandwidth. So you will automatically have to sell the service to ten subscribers like me instead of just one to make the same revenue.

As long as I can get non-NAT-ted service somewhere, than that is where I will be.

NAT == CRIPPLED_INTERNET. Impose that next door. Next city. Next country. NIMBY: not in my backyard.

And remember that if EVERYONE is NATted, then nobody can talk to anyone. Because you have to connect somewhere to use the Internet. That means resolving DNS to some IP address.

To reach a DNS server you need an IP address. So the DNS server can't be NATed. That DNS server has to hand you the IP address of a host such as a web server. Are all web servers going to be NAT ed? That means they can't be all on port 80 any more. You are looking at redirects! There will have to be a port 80 service sitting on those NAT nodes, which will intercept web traffic, parse the HTTP request and forward to the appropriate node behind the NAT.

Or else DNS will have to be re-architected so that it returns not only IP's but port numbers, so when you go to www.somewhere.com, it resolves to x.y.z.w:n, and the host x.y.z.w has port n forwarded to the right server.

Good grief, and good luck with that.

Re:Large scale NAT is completely moronic.

[Anonymous Coward]

While I agree with all of your points, I'm sure the ISPs that would implement this would have no problem completely ignoring all of them.

Re:Large scale NAT is completely moronic.

[mysidia]

but the web server would spawn a process on a higher numbered, unprivileged process for the actual traffic transfer.

No. All traffic is exchanged over the HTTP connection initiated by the client, the server's source port for HTTP traffic is always port 80, or the port the client connected to.

What happens, is (in the case of Apache); the web server initially starts up as root and binds port 80, then "changes user ID" to apache, after the port is already bound, to start its child processes.

Since the superserver is already bound to port 80, it no longer requires root privileges to accept further connections on that port... root permissions are only required to initially open the socket (which was done before it dropped privileges). As each HTTP client connects, the superserver can pass the descriptor to the corresponding child process(es), which will take over the connection, completely transparent to the remote client (port numbers do not change, additional remote connections are not established).

Re:Large scale NAT is completely moronic.

[JSBiff]

"There are only 65536 port numbers, so there is only so thin that you can spread a single IP address."

But who says they have to do a one-to-many NAT? Why not have a pool of public addresses available for NAT. Say, 1 IP per every 50 customers, or even 1 per 25 customers? The point isn't necessarily that an ISP has to drop down to a single IP address for serving every single customer - but that instead of assigning 1 public IP per household/customer, they can get away with spreading it *thinner*.

So, they setup a carrier grade NAT to service a city with 10000 customers, and maybe they provision that NAT with a pool of 400 public IPv4 addresses.

I'm not saying that I think NAT is a great idea - I think it's gonna break a lot of stuff. I'm just saying that I think your argument might rest on a false assumption.

As for the DNS server - your ISP can setup a DNS server with a private address in the same network block as all it's customers. That is, on the 'inside' of the NAT, private addresses are routable. They can setup a DNS Server at address 10.0.0.4, for example, and anyone inside of the NAT'ed network who also has a 10.*.*.* address can communicate with the DNS server no problem.

Web servers, though (or any other server which needs to be reached by anyone on the Internet, will still continue to (for the most part), need public IP addresses, but I think the 'logic' of CGN goes: There are way, way more end-user devices than servers. If we can get enough end-users on CGN, we can free up a few hundred million, or a billion, public IP addresses for use by servers (which ought to be enough for a few years, anyhow).

Again, I still think it's a bad idea, but just addressing your questions.

Re:wrong premise

[hairyfeet]

Because there will literally be mountains of eWaste and headaches galore? How many of the home routers sold in the past 5 years even support IPv6? I don't think any of the consumer grade stuff does. That means we will have to replace just about every router in every home or have some sort of IPv6 to IPv4 bridge built into every modem in the country, again not cheap.

Whether we like it or not, there is a reason why IPv4 has lasted so long. It is a mature tech that everyone knows how to fix. IPv6 is gonna be a nightmare for probably 5 or 6 years and it really ain't gonna be fun trying to fix the mess. So yeah, I can see them stretching out IPv4 for as long as humanly possible, simply because the transition costs are gonna be insane.

Re:Fuck you.

[hedwards]

So, if money talks, and bullshit walks, then what the fuck are you still doing here?

It isn't his responsibility, this is basically the same problem we've seen in the wireless space, the people who actually control access don't bother to upgrade until the last minute, if even then, and without somewhere else to take your business, it's not a realistic option. I've heard that Comcast has IPv6 around here, but going back to them is a non-starter. They're far worse than the other options.

Unless the end user can do to their CO and upgrade the equipment it's a moot point.

Yup, just crazy

[Midnight Thunder]

Add to this how many more NAT workarounds we will need to have in software. We already have to deal with NAT busting solutions, now we will have to deal with double NAT busting solutions. Believe me, NAT was a workaround to a limitation and we shouldn't be using this workaround at any more levels than necessary.

There is only so much duct tape you can use before it is time to just accept you will have to install the new solution.

If IPv6 appears so hard, its because people keep on waiting for someone else to take the plunge. If you are an IT professional, then is should be your business to understand and embrace IPv6, whether that is in your network or in your software. If your issue is with your router not supporting IPv6, then make some noise to your router's manufacturer, install a third-party firmware or go with a company already offering an IPv6 capable router.

Re:A few quick points...

[Midnight Thunder]

p2. The transition to IPv6 is probably going to need some NAT64 and DNS64 magick at some point. Not everybody is going to be well-served by running dual-stack hosts and networks. I've heard that some mobile broadband providers are looking at various kinds of NAT tricks to keep IPv4 marginally functional for legacy applications on IPv6-only networks without resorting to expensive tunnel encapsulation mechanisms.

Have you actually done a count of the number of addressable devices IPv6 provides. There may well be a time when IPv6 needs to be NATed, but that is well into the future when systems will be ready for a 256bit network address. At this point IPv6 provides just what we need for the next century, and possibly more. Trying to get any more mileage out of IPv4 is like taking a dying horse and expecting it to walk 1000 miles. It may make it, but there are good chances it won't.

If companies are having to deal with legacy applications, then there is nothing stopping them from having IPv4 in the internal network and having an IPv6 proxy or bridge in front of it. For everything else it will be IPv6. If companies are making new software today that is not IPv6 capable, that intended to accessible on the internet, then they deserve to be out of business tomorrow.

Re:wrong premise

[bertok]

Because there will literally be mountains of eWaste and headaches galore? How many of the home routers sold in the past 5 years even support IPv6? I don't think any of the consumer grade stuff does. That means we will have to replace just about every router in every home or have some sort of IPv6 to IPv4 bridge built into every modem in the country, again not cheap.

Whether we like it or not, there is a reason why IPv4 has lasted so long. It is a mature tech that everyone knows how to fix. IPv6 is gonna be a nightmare for probably 5 or 6 years and it really ain't gonna be fun trying to fix the mess. So yeah, I can see them stretching out IPv4 for as long as humanly possible, simply because the transition costs are gonna be insane.

You can't get better evidence of the incompetence of government than this. There's a dwindling resource that will run out in just a couple of years, impacts practically every person in every OECD country, yet have you heard of even one government agency, in any country, that is mandating IPv6 for consumer grade gear to force the vendors to solve the problem before it becomes critical? Of course not! That would require foresight and competence. About the only IPv6 push I'm hearing is that for government tenders in the US, IPv6 support is required, but that does nothing to solve the problem of hundreds of millions of home routers that are IPv4 only.

No government on Earth has even bothered to lift a finger to solve a well known, easily predicted problem with a ready and tested solution that would cost the government no money whatsoever (it's just legislation!). Given that, now picture the level of competence you'd get from the same bunch of idiots when tasked with solving much bigger issues like global warming, peak oil, or overpopulation. Issues like that won't be critical for decades, have no obvious solution, and all possible solutions are expected to cost trillions. I can only imagine the level of incompetence that will no doubt ensue...

Offering a half-Internet package

[tepples]

Why should I have to pay *EXTRA* for the full internet, and competent support?

Because the majority of people don't see the point of paying for the full Internet, and what little competition there is between cable and DSL forces the two to cut their rates to the point where they have to offer a half-Internet package.

NAT is good

[Balthisar]

Okay, let's assume that IPv4 no longer exists...

1. Is Comcast going to give me unlimited IPv6 addresses? How will that work through my router? Do I now need to announce every device to Comcast? I REALLY like the fact that I get a single IP address, and I can port forward and use NAT as I like.

2. NAT makes for a pretty good firewall. I have Linux and Mac machines, and consumer devices, behind my current NAT router. With NAT and SPI, I have it pretty good. I really only ever use an outbound firewall to detect phone-home stuff and malware (and with Linux and Mac, surprise, surprise, there's not a lot of the latter).

Hey, I understand the need for IPv6. I guess I just don't want to lose what NAT offers.

Re:NAT is good

[Lord Ender]

You're right. NAT makes a pretty good firewall. But you know what makes an even better firewall? A FIREWALL.

NAT is a money maker!!!

[DigiShaman]

ISPs are licking their chops for this. They want to roll out NAT for all default consumer grade ISP connections. It solves problems with scarcity, they profit from scarcity (want public IP? You pay extra for it), and it will jack with routing of P2P data and thus cut down on the leeches. It's a WIN-WIN-WIN for the Telco and cable companies.

If you guys think IP6 will be adopted, just wait till they find huge money in artificial scarcity of IP4 blocks. There will be no where to run and escape it! Unless you pay that premium...

Problems with geolocation and DOS protection

[rlh100]

I am working on an IPv6 migration project for our group. Our solution will include:
        IPv6 to IPv4 proxy servers to a Private internal IPv4 address space
        Some native IPv6 support where it is easy
        White listing of some IPv4 services where the above two solutions do not work

I suspect our solution is fairly typical for most Internet portals considering IPv6.

Two big issues with Carrier Grade NAT (CGN) or Large Scale NAT (LSN) that will have to be resolved are geolocation and denial of service protection.

Geo-location is the mapping of a browser's IP address to a physical location. Most of the large portals are fairly accurate about this. Although I move around from Hayward to Pleasanton and sometimes they get it right with Palo Alto. The problem with CGN is that many browsers for many different users will be NATed behind a single IP address. So if you are on the left coast you might be mapped to the Silicon Valley, if you are on the right coast it might be DC or New York, and people in the middle might be Omaha, Nebraska. As long as the ISPs hide big regions behind a single set of IP addresses, geolocation is going to have problems.

HTML 5 has a separate geolocation protocol built in, but that is going to have to wait for browser upgrades. A logical solution might be to have the ISPs map their old POPs to a single fixed IPv6 address so all traffic from Palo Alto has one IPv6 address and all the traffic from Redwood City has another IPv6 address. But this is entirely to logical and would require effort on the part of the ISPs

The other big problem is Denial Of Service protection. My company has tools to block traffic from IP addresses that are determined to be abusers of the site: to many account creation requests, to many emails sent, to many login failures, etc. With CGN this becomes a real problem. First how do you determine how many is to many. With thousands of hosts NATed behind a single address a thousand emails an hour is entirely reasonable and ten thousand an hour is not outrageous. The other problem is that when you block the IP address you block all of the customers, not just the one causing the problem. A logical solution for this would be to give each customer their own IPv6 address that they are NATed behind. This could also work well with geolocation. But again it entirely to logical and it requires work on the part of the ISPs. Without the unique per browser IP addresses DOS protection becomes a really hard problem.

RLH

"IPv6, too much, too soon" -- Someone

Re: Can Large Scale NAT Save IPv4?

[PybusJ]

Absolutely. I don't understand why do dual-stack and NAT44 instead of giving customers IPv6 and NAT64.

I assume this is because the problem isn't just all those web servers on IPv4 addresses, but a significant number of end user applications that are not IPv6 aware. Unfortunately, if we allow them to avoid upgrading with NAT44 then we can confidently predict that apps won't get updated and you'll never be able to switch it off. It's human nature not to fix the problem until forced to.

Re:Useless investement

[AbbeyRoad]

YOU would not put up with it.

But others would if it were cheeper.

So the Internet will just be divided into the 0.01% of users
who have real IP address, and the 99.99% average Joe.

-paul

Re:You mean like ipv6porn ?

[Anonymous Coward]

Some have proposed that IPv6 adoption could be driven by Google etc stating a policy of a SLIGHT search engine ranking benefit for sites available via both IPv6 and IPv4. You just have to look at the thousands people will spend on SEO voodoo to see how much of an impact this would have. Overnight, content providers would be the ones driving uptake.

http://www.computing.co.uk/computing/analysis/2269512/ipv6-might-cause-problems