Hacker News Reader

Comment by emmelaich | Hacker News Reader

When I speak to our network guys to get a firewall entry they don't want to hear about names. Their network diagrams don't have names. Using names to them is unnecessary cognitive load.

View on HN

What would happen if your current ISP got problems and you had to switch to a different ISP with a new range of addresses (assuming you don't have operator independent addresses and not using BGP)?

They'd NAT. And they're probably already NATed, so it would just be a few changes on the outside of the firewall.

Good luck NATing v6

There's nothing about NAT that makes it IPv4 specific. In fact, it implemented in netfilter (Linux)/PF (OpenBSD). For IPv6, there's also NPT (Network Prefix Translation), though I'm not sure how widespread it is.

Now, the fact that you can NAT IPv6, doesn't mean that you should. Specifically, if you NAT your IPv6 prefix because that's what you do with your IPv4 block, then you're doing something wrong.

That's already done. If you're big enough that renumbering is a concern, but small enough that you don't have your own assigned prefix, you use unique local addresses (fc00::/7) and NAT them to your providers space. (Which works better than it sounds - because you have enough space to nat one-to-one, the translation mechanism doesn't need to keep state. Simply replace one prefix with another, whack a new checksum in and send it along)

I would hope that the firewall guys are using a layer of abstraction in their rules rather than just putting the IPs in each rule individually. Network and protocol objects are fantastic, because you can assign names to network resources and then write rules that refer to hosts and networks by human names.

As an added bonus, if a resource changes addresses you just update the object and all of your rules are updated.

Reply on news.ycombinator.com