Hacker News Reader

Comment by makeworld | Hacker News Reader

You can, but the point is that you shouldn't have to because there are enough addresses. NAT only makes networking code for applications harder.

View on HN

But NAT can protect your internal addresses. If your ISP changes your IPv6 address/prefix, all devices in your network will change their addresses too. This is pain in the ass that can be alleviated by NAT.

You can use link-local addresses for that. There addresses are only available inside the local network and are never routed. When you use IPv6 your interfaces have multiple addresses, at least one external and one link-local.

NAT complexity is only marginally more than for a stateful firewall, and is probably lower than for an application firewall. And you still want a stateful firewall in IPv6 networks!

Not needing to do address translation is a large amount of code that you don't need to run to keep IP traffic flowing.

Sure, you absolutely need a stateful firewall, but not needing address translation makes it easier to troubleshoot, makes it easier to establish end to end connectivity and no need to port forward or things of that nature so multiple clients can all use the same port.

With NAT you may need STUN, TURN, ICE, and probably a few more acronyms:

* https://en.wikipedia.org/wiki/STUN

* https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_...

* https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab...

Not sure if that's more or less complicated than already knowing your IP address and 'just' using UPnP/PCP:

* http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf

* https://en.wikipedia.org/wiki/Port_Control_Protocol

Reply on news.ycombinator.com