Text 10452, 104 rader
Skriven 2013-09-25 15:11:31 av mark lewis (1:3634/12.0)
  Kommentar till text 10445 av Michiel van der Vlist (2:280/5555)
Ärende: IPv4 and IPv6
=====================
 On Wed, 25 Sep 2013, Michiel van der Vlist wrote to mark lewis:

 ml> i still wouldn't give up my perimeter firewall and its NAT...

 MvdV> You don't have to give up the perimeter firewall when the NAT
 MvdV> goes.

NAT will not go from my interface between my LANs and the WAN... it cannot
because of the way the firewall is designed and implemented... besides that, i
will not let it go anyway... as i noted previously, i pay for a connection...
not a connection per device...

 MvdV> My perimeter firewall in my router works just as well on IPv4 as 
 MvdV> on IPv6, despite the fact that for IPv6 there is no NAT.

you are using a router box that has not really need needed... marketing foisted
routers on everyone and got them to believe that they have been required for
their connections when they have not in the huge majority of cases...

 MvdV> NAT is a kludge that breaks end to end connectivity.

i do not agree... especially with it being a kludge... as for breaking end to
end connectivity, the hacker infestation would be much much worse than it
already is without it...

 ml> all that i have to do is to make sure that my internal networks 
 ml> are not using the same IP range as my carrier is using...

 MvdV> When you have NAT behind NAT, some things will not work any
 MvdV> more... 

sure they will... i maintain numerous configurations that are double and even
triple NAT... one only need know, understand and follow basic networking 101...
multiple servers and even multiple VPNs still work thru multiple NAT as long as
you have control over /all/ the NAT... this so-called carrier grade NAT will be
the cause of everything to break that has been in place and working perfectly
well for many many years...

 ml> i pay for a connection to the internet, period... not a connection 
 ml> per device... it is none of their business what or how many 
 ml> deivces i have...

 MvdV> With IPv6 they will have no more or no less information on the
 MvdV> number of devices than with IPv4.

bullshit... with IPv6, every device will be given an IPv6 number... that, in
itself, will give them the information with which to charge for each and every
device connected... yet again, it all comes down to corporate greed... it will
happen if users allow it to happen... like sheep to the slaughter...

 ml> my traffic won't cost them any more to transport and they don't 
 ml> pay for their own connections in any sort of metered basis... if 
 ml> they do, they are stupid as hell...

 MvdV> I think your fears are unfounded. If your ISP wants to charge you
 MvdV> on the number of devices, they can do that now. Why should they
 MvdV> change that policy when you go IPv6?

they can NOT do that now because they have no way of knowing or counting my
devices...

 ml> i know exactly what NAT is ;) this so-called "carrier grade" stuff 
 ml> is no different than what is already used by millions... it does 
 ml> not warrant a different name, either...

 MvdV> CGNAT won't give you access to the port forwarding tables. No
 MvdV> more servers... 

i know this... but it is, again, no different than NAT that is in use now... as
far as servers go, there again is yet another reach into your pockets to
extract more of your $$$...

 PQ>> We would have to surrender our public IPv4 address first, of
 PQ>> course.

 ml> depending on one's service, they may never know they no longer 
 ml> have a WAN IPv4 address...

 MvdV> Every one running a server will soon find out...

it won't stop the servers from running and doing their work... it will only
stop those on the outside of the local carrier from being able to make the
connection... this is true because the traffic won't approach the (carrier) NAT
on the perimeter... LAN traffic goes directly to the remote and not the
perimeter to be bounced back... not unless the network is misconfigured...

 ml> not until their internal LAN stops being able to access the outside
 ml> WAN due to a conflicy with their chosen network IP range...

 MvdV> 100.64.0.0/10 is reserved for CGNAT. If ISPs use that range,
 MvdV> there will not be a conflict with LAN's using RFC1918 addresses.

true... however, i have (and many others as well) been connected to ISPs that
use RFC-1918 for all their client connections... this CGNAT is no different
other than being restricted to another address range... not to mention that
that address range is pretty small when all things are considered (how many
smartphone users are there? how many cars will be connected in the future? how
many household appliances will be connected? how many security systems? and so
on)... 10.0.0.0/8 is 4x as large as that so-called reserved range, which was,
BTW, used for normal traffic not all that long ago ;)

)\/(ark

 * Origin:  (1:3634/12)