I run into NAT almost every single day. It wastes time, breaks things, consumes router resources, rules out certain technologies/products/services and duplicates so much work it's just unreal.

IPv6 != No NATing.

Example: Verizon Wireless.

You mean IPv6 != No Firewall. Firewall are going to cause pretty much the same problems as NAT.

Quite. But there's no need, nor excuse for NAT on IPv6.

True, but that's just kind of dumb.

As a sysadmin, if I had limitless IPv4 addresses, I'd still use NAT on servers and clients because it's a useful security layer. There's little reason that individual devices need globally routable IP addresses.

> it's a useful security layer

No, it's not. As a sysadmin, you should know the difference between NAT and a stateful firewall, and that NAT alone doesn't prevent packets from being routed to local addresses.

> There's little reason that individual devices need globally routable IP addresses.

NAT has been more damaging to the development of network software than any other factor. NAT breaks the development of true network software, such that entire categories of software haven't even been considered.

NAT forces extremely complicated hacks[1] and centralized management of true peer to peer connections. The benefit of the internet has been that any peer has the capability to publish. NAT breaks that benefit, turning the internet back into cable TV, where most people need an imprimatur[2] to publish.

[1] http://www.brynosaurus.com/pub/net/p2pnat/

[2] https://www.fourmilab.ch/documents/digital-imprimatur/

This needs to be repeated everywhere. There are too many system admins with dangerously bad ideas about IPv6 and NAT. NAT needs to die in a fire and if you're rolling out NAT for IPv6 you're wasting your time and your company's money for a bag of nothing.

But with an extra layer to configure and for a vendor to properly implement, surely that also means it's an extra security liability?

>consumes router resources

Thats a weird claim to make against IPv4. Grab a calculator and see how much memory is required by a IPv6 /64 address space.

Not much! Just a few bytes for each packet. Running a NAT service requires a big table of all the active connections, ie. it's stateful - IPv6 with no NAT needs no per-connection state in the router so that's a big space-saving.

As I understand it, there have been a few nation-scale Internet outages that have been a result of IPv4 address tables reaching their resource ceiling (not relating to NAT) - another example of how IPv4 is no longer fit for purpose regarding hardware resources.

Those were caused because Cisco by default (optimistically) partitioned a big chunk of the routing table memory for v6 routes. The fix was to reduce the memory usage for v6 and give that memory back for v4 routes. So really it was allocating so much space for v6 before there was any need that caused those outages.

If 32 bit address tables are reaching capacity, increasing the size of the address space is unlikely to resolve the problem.

Doesn't ipv6 include efficiencies for this, like hierarchical prefixes?

In practical reality, doesn't that just mitigate the strain caused by an explosion in the size of the address tables?

A sometimes large but solvable part of the problem in ipv4 routing table sizes is numerically adjacent routes that could be aggregated into fewer announcements but aren't; ipv6 doesn't help with that. Another part of the problem is that many networks have lots of allocations that aren't adjacent, so they can't aggregate them; ipv6 should help with that as there's room for big allocations.

I guess it depends on how big the efficiency gain is, but afaik it's pretty big.

So you don't want stateful inspection on your private LAN router? Its ok for every hacker to portscan the 100's of IoT devices in your house? You're a very trusting fellow.

How many IoT devices need to allow incoming connections at all? And how many connections do they need to make?

IoT devices, if I had any use for them, would go on my private LAN. My private-public router can do complex stateful tracking, because it only has to handle a few connections at a time. Meanwhile my grown-up internet devices go on the public side and get actual internet access, meaning that e.g. two people inside my house can play an online game with a person outside my house, and aren't slowed down by a complex connection-tracking router. Also means my guests don't get access to my IoT devices.

> How many IoT devices need to allow incoming connections at all? And how many connections do they need to make?

If they need outgoing connections, they likely also need incoming when we are speaking about stateless filtering. Without incoming connections only UDP would be allowed and it would be usually impossible to determine if the packet should be send again (it would only be possible if there was out of band method to detect it).

Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.

> Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.

I have more faith in that than I have faith in a router that does complex state-tracking logic to not contain RCE vulnerabilities itself.

Are you recommending NAT as some sort security-by-accident measure?

The claim isn't about memory needed to flesh out an entire address range, but resources allocated to things like nat in ipv4.

Why am I trying to fill out in memory an entire /64? More importantly what purpose will doing that for a home network that will at best have 100 nodes even with ipv6? The memory needed to route and track 100 ipv6 nodes vs 100 ipv4 is a rounding error. Even if I enabled privacy extensions the amount of addresses is miniscule.

Nat sucks, end of story, and yes ipv6 requires more memory. It is a bigger address range after all. We also gain a lot of what we lost with ipv4 years ago.

I don't need to grab a calculator to figure out what I have already witnessed.

I've come across several routers that stop working (partially or completely) or spontaneously reboot when there are too many active NAT sessions. At a few customers I've had to set session limits to prevent some devices from being unable to talk to the WAN.

I get better peering though the HE tunnel broker than I get on IPv4. :)

Especially to exotic destinations and to services which my ISP feels like choking a little (such as Youtube)...

IPSec is one. You would burn two IPv4 to enable IPSec between two machines you control. That's a no brainer with IPv6. It is cumbersome and expensive with IPv4.

And given that most datacentres (outside of cloud services) are IPv6 enabled, this makes sense to secure server to server communications.