Hacker News Reader

Comment by bilalq | Hacker News Reader

The NAT tax is real. We got to tens of thousands of registered users of our app with the $30/month NAT gateway being like 90% of our AWS bill. And it didn't even serve customer facing traffic! At the time, it's only use was for a serverless Aurora DB used by background jobs.

It only gets more expensive when you actually serve large amounts of traffic, need multi-AZ setups, and run multiple AWS accounts for different envs for beta/prod and each engineer's sandbox account. The worst part of cloud billing is how each base cost has several dimensions of multipliers.

View on HN

I don't know about your specific network architecture but, if you need to access AWS services from inside your VPC, make sure to configure a VPC endpoint for the services where it is available(RDS is one of them).

Far too many people forget about that and send their AWS traffic through their NAT GWs.

Keep in mind for low traffic sites, it may be cheaper to use NAT, if you already need it for something else. All those "VPC endpoints" can really add up. It's kind of crazy you gotta pay for the privilege of connecting to AWS from within AWS.

I don't pay the NAT tax.

I just use public IP addresses.

It's fine, it works. Worked for EC2-Classic, works today.

You now get charged for ipv4 addresses as well. Less than nat, yes, but now ipv4 addresses are no longer free either.

So upgrade to IPv6.

and if you want to connect to anything ipv4-only like, say GitHub, then what?

How is GitHub still IPv4 only? Ridiculous.

They're not the only ones either. OpenAI also doesn't have ipv6 APIs, and neither does Stripe, many many others....

Or, y'know.... 89% of AWS own services: https://awsipv6.neveragain.de/

See also:

https://ipv6.fail/domain?filter=sinners

Tbh this site is pretty misleading. Fastly and Cloudflare support ipv6 pretty well in their productы, it’s just that their marketing team apparently don’t care

> Tbh this site is pretty misleading

The website is pretty explicit about that it's testing if a domain/website is available over IPv6 vs IPv4. Clicking on a website also sends you to https://ipv6.fail/domain/cloudflare.net/ where it's even more explicit what they're testing against. Wouldn't call it misleading exactly.

Use a nat64 gateway (a list is at https://nat64.xyz).

Just bolting on thing after thing to make it sort of work, maybe, sometimes.

I'll be sticking with ipv4.

IPv6 NAT is "bolting on thing after thing" but IPv4 NAT is good architecture :P

You do realize you also need dns64 for this to work right? So in fact your proposed architecture is strictly worse

It doesn't take much effort to setup DNS64 though.

Source: I have used NAT64 myself before.

Not something i would use in prod and also needs dns64

Except that way many many AWS services can't do ipv6.

And since AWS/Amazon gets more money by not supporting IPv6 everywhere, why would they enable it?

You do realize this is AWS policy, right? I mean you cannot run away from AWS costs ... on AWS. They are targeting dollar amounts of profits for themselves, not charging cost+20% for service X. They will find some other way to charge you the yet more than you're saving here, because MBA culture.

And AWS is like 10x more expensive than dedicated hosting, minimum. Not 10%, 1000%. To the point that for the price of

I mean if cost matters to you you need to move out of the cloud. Plenty of Kubernetes hosting these days, and very easy to set it up yourself.

This. You then work to dig deeper into the vendor lock-in, to move your apps to use apparently cheaper AWS-only services, and if you're wily (or oblivious) you can report this as cost savings.

Reply on news.ycombinator.com