Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 5 down vote favorite
3

Possible Duplicate:
Switch to IPv6 and get rid of NAT? Are you kidding?

Is NAT going to disappear with IPv6? What about during the "transition" from IPv4-IPv6?

How are we all going to access the internet then?

share|improve this question
3  
"No more NAT" is definitively one of the goals in IPv6. Though at the moment, it seems (at least here) that interest in actually offering IPv6 is not terribly big, except in datacenters (because bigger packets mean more bandwidth, and more bandwidth means more money for them!). For DSL it's the opposite though, pretty much everyone has flatrate, so IPv6 only means more trouble and more cost for the providers. – dm.skt Mar 23 '11 at 22:23
1  
@dm.skt - that might be true, but CPE vendors and providers will NEED to switch their users to IPv6 simply because all the datacentres are offering it, and if it's offered, people will use it. I wish it weren't so. – Mark Henderson♦ Mar 23 '11 at 23:51
1  
Based on Zoredache's link, it Looks like sysadmin1138 and myself have been reading the same IPv6 material – Mark Henderson♦ Mar 24 '11 at 2:04

migrated from stackoverflow.com Mar 23 '11 at 22:24

marked as duplicate by Michael Hampton, voretaq7♦ Dec 6 '12 at 2:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

9 Answers

up vote 18 down vote accepted

Yes. NAT is dead. There have been some attempts to ratify standards for NAT over IPv6 but none of them ever got off the ground.

This has actually caused issues for providers who are attempting to meet PCI-DSS standards, as the standard actually states that you must be behind a NAT.

For me, this is some of the most wonderful news I've ever heard. I hate NAT, and I hate carrier-grade NAT even more.

NAT was only ever meant to be a bandaid solution to get us through till IPv6 became standard, but it became ingrained into the internet society.

For the transition period, you have to remember that IPv4 and IPv6 are, apart from a similar name, are totally different 1. So devices that are Dual-Stack, your IPv4 will be NATted and your IPv6 will not. It's almost like having two totally seperate devices, just packaged into the one piece of plastic.

So, how does IPv6 internet access work? Well, the way the internet used to work before NAT was invented. Your ISP will assign you an IP range (same as they do now, but they generally assign you a /32, which means that you only get one IP address), but your range will now have millions of available IP addresses in it. You are free to populate these IP addresses as you chose (with auto-configuration or DHCPv6). Each one of these IP addresses will be visible from any other computer on the internet.

Sounds scary, right? Your domain controller, home media PC and your iPhone with your hidden stash of pornography are all going to be accessable from the internet?! Well, no. That's what a firewall is for. Another great feature of IPv6 is that it forces firewalls from an "Allow All" approach (as most home devices are) into a "Deny All" approach, where you open up services for particular IP addresses. 99.999% of home users will happily keep their firewalls default and totally locked down, which means that no un-solicited trafffic will be allowed in.

1Ok there's way more to it than that, but they are in no way compatible with each other, even though they both permit the same protocols running on top

share|improve this answer
What about all the people that claim that having computers behind NAT provides added security? I hear this a lot from some other IT admins. It won't matter if you say that a proper firewall is all you need, because so many of these people believe that NAT adds a layer of security. – user9274 Mar 24 '11 at 0:30
2  
@user9274 - it provides security in two ways: 1) it hides your internal IP address from the world (which is why PCI-DSS demand it), and 2) it's an extra "hop" from the internet to the local machine. But to be honest, the first is just "security through obscurity" which is not security at all, and as for the second a compromised NAT device is just as dangerous as a compromised server, so once the attackers are past the NAT that can likely get into your machine anyway. – Mark Henderson♦ Mar 24 '11 at 0:34
In addition, any security gained through the use of NAT was and is an unintended benefit in the effort to stave off the depletion of IPv4 addresses. It certainly wasn't part and parcel of the design goal, that I'm aware of. – joeqwerty Mar 24 '11 at 0:46
3  
The PCI-DSS standards were amended in late October 2010 and the NAT requirement was removed (section 1.3.8 of v1.2). So even they are catching up with the times. – sysadmin1138♦ Mar 24 '11 at 2:17
@sysadmin - iiiinteresting, that means our datacentre haven't read the latest specs then, because when we requested a PCI-DSS compliant system and then also asked for IPv6 the guy treated me like I was an idiot. Well, maybe I am, but at I'm going to find the updated spec and point him to it. – Mark Henderson♦ Mar 24 '11 at 2:32
show 5 more comments
up vote 7 down vote

If NAT survives in the IPv6 world, it'll most likely be 1:1 NAT. A form a NAT never seen in IPv4 space. What is 1:1 NAT? It's a 1:1 translation of a global address to a local address. The IPv4 equivalent would be translating all connections to 1.1.1.2 only to 10.1.1.2, and so on for the entire 1.0.0.0/8 space. The IPv6 version would be to translate a global address to a Unique Local Address.

Enhanced security could be provided by frequently rotating the mapping for addresses that you don't care about (like internal office users browsing Facebook). Internally, your ULA numbers would stay the same so your split-horizon DNS would continue to work just fine, but externally clients would never be on a predictable port.

But really, it's a small amount of improved security for the hassle it creates. Scanning IPv6 subnets is a really large task and is infeasible without some recon on how IP addresses are assigned on those subnets (MAC-generation method? Random method? Static assignment of human-readable addresses?).

In most cases, what'll happen is that clients behind the corporate firewall will get a global address, maybe a ULA, and the perimeter firewall will be set to deny all incoming connections of any kind to those addresses. For all intents and purposes, those addresses are unreachable from the outside. Once the internal client initiates a connection, packets will be allowed through along that connection. The need to change the IP address to something completely different is handled by forcing an attacker to thumb through 2^64 possible addresses on that subnet.

share|improve this answer
@sysadmin1138: I like this solution. As I currently understand IPv6, if my ISP gives me a /64, I'm supposed to use that /64 on my entire network if I want my machines to be IPv6 internet-accessible. But if I get fed up with that ISP and move to another, now I have to completely renumber everything. – Kumba Apr 6 '11 at 4:41
@sysadmin1138: That said, however, I have noticed that I can assign multiple IPs to a single interface a lot easier than with IPv4, so I can forsee using the ISP-given /64 for external access and my own private internal ULA scheme for comms between hosts, and use a firewall to make the ULA addresses unreachable from the outside. More setup work involved, but it seems like it'll avoid NAT altogether. – Kumba Apr 6 '11 at 4:42
@sysadmin1138: I STILL scratch my head on why ULA are, for all intents and purposes, private, yet they are expected to still be globally unique. It's like saying that I can have a car of any make and model currently available, but not any make/model/year already used by someone else, even though it's my car and I'll be the only driver it'll ever have. – Kumba Apr 6 '11 at 4:46
@sysadmin1138: Last comment-spam, I just wanted to say that while TODAY port scanning 65,535 ports on 18 quintillion IPv6 addresses (a /64) is entirely unfeasible, what about 10-15 years from now? This is the most common counter-argument to IPv6 NAT that I see. Computing power will increase, and we might see the introduction of things like optronics which would change the playing field a LOT. Scanning IPv6 /64 blocks, I imagine, will be far easier in 2021 than in 2011. So I think this counter-argument is a recipe for disaster by giving people a false sense of security in the long-term. – Kumba Apr 6 '11 at 4:50
@Kumba Yeah, you'll have to renumber everything if you change ISP. Which is why you should probably be using RA / DHCPv6. If you have a complex network, then get a PI /48. – Richard Gadsden Apr 12 '11 at 13:08
show 4 more comments
up vote 5 down vote

Kind of. There's actually different "types" of IPv6 addresses. The closest to RFC 1918 (10/8, 172.16/12, 192.168/16) is called "Unique local address" and is defined in RFC 4193:

http://en.wikipedia.org/wiki/Unique_local_address

So you begin with fd00::/8, then add a 40-bit string (using a pre-defined algorithm in the RFC!), and you end up with a pseudo-random /48 prefix that should be globally unique. You have the rest of the address space to assign however you want.

You should also block fd00::/7 (fc00::/8 and fd00::/8) at your (IPv6) router to outside of your organization—hence the "local" in the address name. These addresses, while in the global address space, should not be reachable to the world at large, just with-in your "organization".

If your PCI-DSS servers need an IPv6 for connectivity to other internal IPv6 hosts, you should generate an ULA prefix for your company and use it for this purpose. You can use IPv6's auto-config just like any other prefix if you wish.

Given that IPv6 was designed so that hosts can have multiple addresses, a machine can have—in addition to a ULA—a globally routable address as well. So a web server that needs to talk to both the outside world, and to internally machines, can have both an ISP-assigned prefex address and your ULA prefix.

If you want NAT-like functionality you can look at NAT66 as well, but in general I'd architect around ULA. If you have further questions you may want to check out the "ipv6-ops" mailing list.

share|improve this answer
Hah. I write all those comments to sysadmin1138, and didn't even think to look at your answer about using dual addresses for global and local comms. However, I vehemently disagree with the precepts of ULA needing to be globally unique. I don't like randomized, 40-bit numbers at all, especially for my internal LAN, of which I am the only user. They probably do need a world database of ULAs to be registered (SixXS runs such), but drop the random number mess and let people be creative. Like personalized license plates. You apply for one and if it's taken, you try for another. – Kumba Apr 6 '11 at 4:57
@Kumba they're trying to stop every single network using the same addresses - random means you don't need a public database and each network is independent; if you wanted to issue IP addresses centrally, then just use global ones! – Richard Gadsden Apr 14 '11 at 9:58
@Richard: That's a...How do I put it, silly concept, IMHO. Why should it matter if small Joe Company in a town in Montana uses the same IPv6 addressing as another small company in Perth, Australia? The odds of the two ever crossing, while not impossible, are pretty improbable. If the intention of the IPv6 designers was to try and do away entirely with the concept of "private networks", then they need to have their coffee checked, because that's not realistically feasible. – Kumba Apr 23 '11 at 6:43
1  
@Kumba I think it's the scars from when you try to merge two large IPv4 private networks in 10/8 and you have to renumber one (or even both) of them that they're trying to avoid. – Richard Gadsden Apr 26 '11 at 10:59
@Richard: Exactly, there's nothing more painful than using VPN to connect to another network with the same private subnet, some implementation will just stop working. – Hubert Kario Aug 12 '11 at 10:37
up vote 3 down vote

Hopefully, NAT will go away forever. It's useful only when you have an IP address scarcity and has no security features that aren't provided better, cheaper and more easily managed by a stateful firewall.

Since IPv6 = no more scarcity, it means we can rid the world of the ugly hack that is NAT.

share|improve this answer
up vote 3 down vote

IMHO: not.

There are still some places where SNAT/DNAT can be usefull. For expample some servers were moved to another network, but we don't want/we can't change IP of application.

share|improve this answer
You need to be using DNS names instead of IP addressess in your application configurations. – rmalayter Apr 6 '12 at 15:10
DNS doesn't resovle your problem, if you need create network path without modifying your whole routing topology and firewalling rules. – sumar May 15 '12 at 13:43
up vote 2 down vote

There are many schemes to support NAT in a V4 to V6 transition scenario. However, if you have an all IPV6 network and connect to an upstream IPV6 provider, NAT is not part of the new world order, except that you may tunnel between V4 networks over V6 networks.

Cisco has plenty of general information on 4to6 scenarios, migration, and tunneling.

http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-nat_trnsln_ps6350_TSD_Products_Configuration_Guide_Chapter.html

http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-tunnel.html

Also at Wikipedia:

https://secure.wikimedia.org/wikipedia/en/wiki/IPv6_transition_mechanisms

share|improve this answer
up vote 2 down vote

Politics and basic business practice will most likely further the existence of NAT. The plethora of IPv6 addresses means ISPs will be tempted to charge per device or limit connections only to a restricted number of devices. See this recent article on /. for example:

http://news.slashdot.org/story/11/03/17/0157239/British-ISPs-Could-Charge-Per-Device

share|improve this answer
I'm not so sure. I think there will be a huge technical revolt against any ISP that attempts to charge per device. Although I can see why ISP's would jump at this idea, because now they can actually tell how many devices are on the other end of a connection. – Mark Henderson♦ Mar 24 '11 at 3:04
Given the move to provide some level of anonymity by using temporary addresses for outgoing connections, enforcing per device rules would be complex, if not impossible. A device could have 2 or more active global addresses under this scheme, in addition to any other assigned. – BillThor Mar 24 '11 at 4:41
1  
@Mark Henderson - There already are ISPs who charge per device. AT&T, for example, charge extra for "tethering". – Richard Gadsden Apr 14 '11 at 13:15
@Richard - if that was the case, if I were with AT&T I would drop them like it's hot – Mark Henderson♦ Apr 14 '11 at 23:03
@Mark - That's AT&T wireless (look at the iPhone contracts, for instance). – Richard Gadsden Apr 15 '11 at 9:30
up vote 2 down vote

I have not seen a definitive answer on how the loss of NAT (if it truly does go away) with IPv6 will affect user privacy.

With individual device IP addresses publicly exposed, it will be much easier for web services to surveille (collect, store, aggregate over time and space and sites, and facilitate a multitude of secondary uses) your travels around the internet from your various devices. Unless... ISPs, routers, and other equipment make it possible and easy to have dynamic IPv6 addresses that can be frequently changed for each device.

Of course no matter what we will still have the issue of static wi-fi MAC addresses being public, but that's another story...

share|improve this answer
up vote -5 down vote

Well, it looks like that the answers are pretty much opinions -so here is mine- and that most of them are against NAT -I have some doubts about it-.

Agreed, NAT adds complexity when dealing with things like FTP (*1) or P2P protocols, but I see a few advantages with it.

First and least important, it is an extra level of security. Yes you can have a well configured firewall to do that, but NAT adds an extra layer of protection in case there is some mistake in the firewall or its configuration.

Second, it allows to use only one domain to access multiple services. You do SMTP to example.com and end in server1, HTTP and go to server2, FTP and go to server3.

I know you can do that all with FW but, if you end by configuring a FW to work as a NAT then you'll have a NAT implemented through FW.

Of course, it will be good that those who want/need it can reach the internet without NAT, but I think that some NAT functionality will remain.

share|improve this answer
3  
For me, you've just outlined why NAT does more harm than good. Assuming that NAT is going to block incoming connections as a default policy can be harmful; with things like zeroconf and UPnP floating around, this is an assumption that may not be true. That port may be open to the world. Assuming you're safe as more dangerous than knowing you're not. For port forwarding to different hosts, this is routing, not NAT. Let routers route. Let firewalls, firewall. Don't trust NAT to properly handle what are essentially side-effects. – Shaun Mar 24 '11 at 0:39
2  
That's not NAT, that's a load-balancer. The LB is under no obligation to send connections to the back-end devices with the source address unchanged (though some do). – sysadmin1138♦ Mar 24 '11 at 2:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.