Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Thank you. This is the first time that someone admits here that NAT actually adds some security. IPv4 will never go away less that an important share because of it's simplicity and NAT-level security it offers to millions of professionals and amateurs that tinker with their routers.


NAT introduces complexity, not simplicity.

Besides, NAT isn't a security feature.


Secure and reliable IPv6 deployment has _more_ complexity than IPv4.


SLAAC is more complex than IPv4 w/ NAT w/ DHCPv4? Serious?

Assign a /56, firewall in place already dropping anything not explicitly allowed, done.


> SLAAC is more complex than IPv4 w/ NAT w/ DHCPv4? Serious?

Yes? Has this ever been in question?

Stateful DHCP provides a _reliable_ way to configure clients, while SLAAC is anything but. It's also insufficient in itself if you want to configure things like NTP servers.

But that's not the main issue. The main issue is that with SLAAC you are supposed to hand out real routable addresses. That are _not_ controlled by you, so the end devices need to be able to handle prefix withdrawals and deprecations. This can lead to your printer not working if your ISP connection goes down and it has no more active IPv6 prefixes.

So you also need a stable ULA. But even that is not a guarantee because source IP selection rules are, shall we say, not the best.

But wait, there's more! You can trivially load-balance/failover NAT-ed IPv4 network over two WAN connections. Now try to do that with IPv6. Go on. I'll wait.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: