A standard DMZ still does NAT. You get a private IP and the router "nat"s you, just that it forwards all incoming traffic to that device by default. I think technically, that gets you disqualified for no nat november. Though, you’d end up exposing the ports of the machine to incoming traffic, that’s correct.
I admittedly did not read the original Mastodon post from nixCraft about the purpose of No NAT November, but surely it’s not just about moving to IPv6? You can (and usually would) still do NATing with IPv6. You don’t want every device to be internet-exposed, but still want them to be able to access the internet (and who wants to configure internet-defensive firewall rules on all their internal home hosts)?
I don’t agree that you usually would still use NAT with IPv6. I’ve never seen NAT in combination with IPv6 and I’ve seen plenty of deployments at our customers. NAT is not the same as a firewall, so just using public IPv6 addresses does not mean that you are exposing every port by default. I think you should read up on IPv6 and firewalling before making statements like this :)
Edit: you don’t even have to set up firewalling on each internal device… the router/firewall blocks inbound traffic by default.
So first off, I think it’s safe to assume that the article is not about going and removing IPv4 on your company’s corporate networks for a month, so I’ve been speaking in regards to home internet service.
NAT is not a firewall, but in normal use by the average home internet user it is a means to prevent computers outside of their network from reaching computers inside the network without ports being forwarded on the router, or the internal machine initiating the connection. If you do not have a firewall on the devices, and they are not behind a NAT gateway/router, then they are by default exposing ports. There’s no inherent guarantee that a router has a firewall configured properly, or has it enabled.
I’ve never seen NAT in combination with IPv6 and I’ve seen plenty of deployments at our customers.
I’m interested in how this works. In a normal IPv4 scenario for home internet users, you are assigned a single IP for your router by your ISP, and internal addressing is usually handled by router-resident DHCP automatically. In the deployments you’re seeing, are ISPs handing out /120 blocks to each router? Does that require the ISP to have access to alter your home router, or do customers configure the DHCP themselves (which seems unlikely to scale)?
That’s right. People want a firewall. Maybe on the devices and/or on the router. But NAT isn’t that. It’s address translation. Predominantly because there aren’t enough addresses available. It’s a workaround. And it kills things like VOIP, videoconferences, direct communication etc. And then you need a workaround for the workaround to work around that… If you just want to drop incoming traffic and not expose clients, that’s what the firewall is for.
A standard DMZ still does NAT. You get a private IP and the router "nat"s you, just that it forwards all incoming traffic to that device by default. I think technically, that gets you disqualified for no nat november. Though, you’d end up exposing the ports of the machine to incoming traffic, that’s correct.
I admittedly did not read the original Mastodon post from nixCraft about the purpose of No NAT November, but surely it’s not just about moving to IPv6? You can (and usually would) still do NATing with IPv6. You don’t want every device to be internet-exposed, but still want them to be able to access the internet (and who wants to configure internet-defensive firewall rules on all their internal home hosts)?
There’s a reason that FD00::/7 exists.
I don’t agree that you usually would still use NAT with IPv6. I’ve never seen NAT in combination with IPv6 and I’ve seen plenty of deployments at our customers. NAT is not the same as a firewall, so just using public IPv6 addresses does not mean that you are exposing every port by default. I think you should read up on IPv6 and firewalling before making statements like this :)
Edit: you don’t even have to set up firewalling on each internal device… the router/firewall blocks inbound traffic by default.
So first off, I think it’s safe to assume that the article is not about going and removing IPv4 on your company’s corporate networks for a month, so I’ve been speaking in regards to home internet service.
NAT is not a firewall, but in normal use by the average home internet user it is a means to prevent computers outside of their network from reaching computers inside the network without ports being forwarded on the router, or the internal machine initiating the connection. If you do not have a firewall on the devices, and they are not behind a NAT gateway/router, then they are by default exposing ports. There’s no inherent guarantee that a router has a firewall configured properly, or has it enabled.
I’m interested in how this works. In a normal IPv4 scenario for home internet users, you are assigned a single IP for your router by your ISP, and internal addressing is usually handled by router-resident DHCP automatically. In the deployments you’re seeing, are ISPs handing out /120 blocks to each router? Does that require the ISP to have access to alter your home router, or do customers configure the DHCP themselves (which seems unlikely to scale)?
That’s right. People want a firewall. Maybe on the devices and/or on the router. But NAT isn’t that. It’s address translation. Predominantly because there aren’t enough addresses available. It’s a workaround. And it kills things like VOIP, videoconferences, direct communication etc. And then you need a workaround for the workaround to work around that… If you just want to drop incoming traffic and not expose clients, that’s what the firewall is for.