ISPs charge for public IP addresses. Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house? Because that's what you get when you don't use NAT. And if it weren't for NAT, the Internet would be running out of IPv4 addresses (it already is, sort of), so you'd either deal with much higher prices for IPv4 addresses, or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT.
Not to mention the premium you'd pay for a router with an actual firewall, and you had better make sure you understand the firewall. Port forwarding on a working router is generally a lot easier than a firewall.
If it was really impossible to set up inbound connections to your server, it was either a problem with the router or a problem with your ISP.
For the sake of running a home server from a network not behind a NAT router, you don’t need to understand much more about IPv6 than how to copy&paste an address.
Because NAT allows them to.
> Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house?
Yes.
> or you'd have to learn IPv6, which is WAY harder than dealing with port forwarding through an IPv4 NAT.
Back in 2005, maybe. Now, it works out of the box, either through SLAAC or DHCPv6.
> Not to mention the premium you'd pay for a router with an actual firewall
In 2005, maybe. Today, $10 routers off AliExpress have a firewall, probably set to "deny incoming" by default.
> Port forwarding on a working router is generally a lot easier than a firewall.
I know for a fact that the routers of at least two ISPs use the exact same page for port forwarding and the firewall. You don't enter iptables commands, you specify a list of ports that you want to be open for a specific address, except now you don't need to differentiate between "source port" and "destination port".
> Because NAT allows them to.
NAT increases the available supply of IPv4 addresses, it makes them cheaper.
>> Do you want to be charged for a large enough block of public IP addresses to cover every networked device in your house?
> Yes.
You can actually just go out and buy a block of IPv4. https://auctions.ipv4.global/
> Even after learning about how NAT works, I had no way to work around it, as my ISP blocked the router's web interface and I was unable to do port forwarding.
Well this is Hacker News, you replace the router with your own.
I have yet to encounter a residential wireline ISP in the US or Europe where using your own router is not a possibility. Even those that implemented 802.1x or similar I have been able to either deal with directly or work around. Not saying there don’t exist counterexamples but I would assume using an alternative router +/- MITM the old one would have been viable.
Of course if the ISP was firewalling (likely) then you have a different problem.
This isn’t really a NAT issue. More of a specific ISP policy issue. (NAT and ipv4 have nothing to do with it, they can just as easily port block inbound 80/443 on ipv6.)
The argument boils down to: My ISP locked down the admin page on my rented router ergo NAT is evil. It’s not terribly sensible.
As a kid I didn’t get it either but would port forward, run a vpn server, reverse proxy, and so on. It was a good learning experience trying to get my friends to install vpn clients!
... to companies like IPXO that are trying to acquire, rent, and treat IPv4 addresses like speculative real estate.
Right, but then ISPs and hosting providers would have to have supported ipv6 10 years ago (or even earlier) when we ran out. Customers were already demanding multiple devices on their wifi 20 years ago, and without NAT, ipv6 would have been necessary.
With NAT, you can't do p2p or self hosting. Without it, you couldn't use centralized services either.
And for those that say "but security!", firewalls are a thing, and need be no more complicated than NAT.
At least until the 10G fiber upgrade happens, Sonic has given me a static IPv4 address for a decade.
It's not the default choice (most people don't need one), but people that do need a static IP can get one.
My current IP hasn't changed in years but I need to pony up if I want them to guarantee it forever.
Yes, but it's only for grandfathered DSL.
https://help.sonic.com/hc/en-us/articles/360009880293-Static...
That doesn’t mean most getting online today in Asia or Africa basically have a choice other than CGNAT IPv4 and IPv6 from their ISP. Your own dynamically assigned IPv4 is a relative luxury.
I ‘member.
There is no doubt that is an extreme advantage. When I started college in the late 90s an upperclassman was in my dorm for a party and saw a trophy i had from a USFirst robotics competition in HS, he invited me to join an organization he was in that built autonomous robots (we called them "vehicles") for a competition. In that lab, we had network drops and static IPs on the schools inet connection. The lab's admin knew the DNS guys and so we could run whatever we wanted on a fast internet connection with access to our own hostnames. At this time Linux, Apache, PHP and MySQL were just starting to take off. That lab and inet opportunity convinced me to change my major to CS and kickstarted my whole career.
edit: that "lab" was really just an unused room in a random building with some desks and hand tools like screwdrivers and stuff to work on our robots. ..but it had rj45 plugs :)
If you showed any interest in computing, other geeks would take you with open arms (mostly) versus now where everyone and their dog wants in on the ground floor.
In the United States my entire life I have always been able to port forward when necessary, though I've only been on two or maybe three providers. I also would help friends in middle and high school port forward so we could connect to their game servers. Many providers seem to try to make it as hard as possible, attempting to lock down the interface behind a web panel. This can typically be bypassed by finding the real panel address locally or by getting a new router that isn't locked down. Growing up it was extremely easy, my provider didn't try to make it difficult, but now there is often a barrier to entry for people who desire to casually tinker with their network setup, which is unfortunate.
We just switched to Metronet last month (5gbps symmetrical!), and while we have to pay $10/month to get a public static IP (CGNAT otherwise), they didn't care what was connected to the ONT, which operates below the IP layer.
Everything, for better and worse (mostly worse) is connected to the internet nowadays. Your watch. Your dishwasher. Your TV. Your light switches. These devices are all comically insecure but because they can't accept outside connections because of NAT it's not such a big deal. IPv4 limitations make outbound connectivity easy but incoming connectivity hard. This is what you want 99% of the time.
Wherever NAT is enabled now, a statefull firewall is a better solution. Thankfully, this is the default wherever IPv6 is rolled out to consumers.
NAT was a necessity when it was being introduced, so I don't understand the complaints. Sure it's annoying, but what was the alternative?
I don't think anyone was dissuaded from IT because of NAT. Heck, if anything, learning how to configure it might have been some people's first step into learning about networking and then getting into it as a career!
And let's not forget that NAT served as a default firewall that did more than any anti-virus to protect PC's from malware.
IPv6
When you're running out of addresses, you need a workable solution at the moment.
Not something that requires all networking equipment worldwide to be replaced with a new standard, with is a practical impossibility.
Being half-replaced or even mostly-replaced gets you nowhere in terms of NAT removal.
I can't tell if you're being elitist because your defacto position is that everyone who uses the Internet has to be a cyber security expert, or if you're just being obtuse because a couple of Google searches will usually set you straight on setting up port forwarding through your router.
Now with NAT we need to be disable UPnP, and deal with "NAT types" on gaming consoles. Or Nintendo Switches breaking your LAN because Nintendo tells you to put your switch into the DMZ: https://en-americas-support.nintendo.com/app/answers/detail/...
Because of NAT, we now need to deal with firewalls _and_ port forwarding. Plus, because of https://www.armis.com/research/nat-slipstreaming-v2-0/, your IPv4 firewall is practically disabled _because_ of NAT workarounds embedded into your router. You can pick between having a firewall on IPv4 or allowing WebRTC on any of your devices.
I know gaming consoles can be a pain with NAT, but is that NAT's fault? That link you pasted about the Nintendo Switch is literally just an article about setting up port forwarding.
And that NAT slipstreaming issue is just a vulnerability caused by complicated protocols. Saying that a fundamental network technology is bad because its implementation is flawed doesn't make sense. I guess we should throw away x86-64 because Intel Skylake processors had side channel vulnerabilities.
The consoles are a common and obvious downside of using NAT. The Nintendo Switch article is an example of the stupid workarounds vendors will require because of NAT. None of these issues existed if we used IPv4 as it was designed.
The issue behind NAT slipstreaming isn't that the protocols are too complex. They work fine on IPv6 and they worked fine on IPv4 without NAT. The issue is that NAT requires hacky workarounds to do normal networking. The ALG vulnerabilities can be fixed, but fixing them wouldn't be necessary if NAT wasn't such a hack.
The other reply mentions Funnel, which I think fits the use case better.
They were cool though and everybody was helpful, learned a lot that night. IRC was so awesome in the 90s.
Depending on the year this was it was a pretty easy Google to learn to traverse nat, and use dynamic dns, or do port forwarding, even out to a Linode
Many ISPs do include a router in their modem with some wifi.
It’s often limited in some capacity in real worth use which lets customers over pay and undercover speed and be open to upgrading to a faster plan.
Also, an application can use upnp to configure your router/firewall to allow traffic. You could do that with NAT too I suppose if ISPs allowed that, but you'd be contending with other users if you wanted a specific port like 80.
Nintendo is a shit company that treats their customer base like bitches yet gets a tremendous steady amount of good will solely due to nostalgia. I'm the last to want to defend the challenges that NAT brings, but blaming it due to some rando corporation's asshattery is silly. Luckily, or not, their documentation is wrong, you almost never have to blanket port forward all UDP ports for the Switch.
The GP point still stands as well. If you have a firewall set to block inbound by default (typical) you have the same basic port-forwarding bootstrapping/configuration problem. Also, the reasons you would absolutely need whatismyipaddress.com or similar apply to both v4 and v6. If you're configuring your router anyway you can get the v4 address.
In order to get some context and knowledge of History.
This is the weirdest thing in your story. Your ISP disallowed you from configuring your router? I've never heard of such a thing, and it certainly sounds ... suspicious. You should be able to get to your own router without even connecting to the internet. Your ISP should never even know when you're connecting to your router. I commonly hit my router's admin page when my internet is down to figure out whether it's my computer or my external connection.
Why would your ISP want to hire so many extra people to nanny all their customer's routers for them? Are you sure this wasn't an excuse from your parents who installed parental controls on it or something?
I remember being being 18, making my first websites using the LAMP stack and not understanding why my friends were unable to access them from their homes. I knew the basic workings of the IP protocol, but hadn't read about NAT, and the responses online talked about "public and private IP addresses", which made no sense to me -- "Aren't all IP addresses supposed to be public? Isn't that how the protocol works?"
Even after learning about how NAT works, I had no way to work around it, as my ISP blocked the router's web interface and I was unable to do port forwarding.
I would bet that there are at least dozens of millions of people that didn't pursue a career in IT because of NAT. We should ask ourselves if collectively allowing NAT to be what it is was a good decision in the first place.