Hacker News Reader

Comment by digitalPhonix | Hacker News Reader

It’s still conflating things. You can have a stateless NAT: device x.x.x.y will get outbound source ports rewritten to (orignal port) << 8 + y.

This is a (dumb) NAT but has no state so it cannot possibly implement a default deny or any firewall adjacent features.

View on HN

And that kind of NAT effectively doesn't exist in practice, so that's quite beside the point. Such a NAT doesn't scale to more than 24 devices behind it.

No, it very much does. If you want to join two network segments such that on one side all devices are on 10.1.X.X and the other all devices are 10.2.X.X, you'd use a mapping between 10.1.a.b and 10.2.a.b

See https://en.wikipedia.org/wiki/Network_address_translation#Me...

The general context here is about NATting to the public internet at large, not between particular segments. And the parent of my comment was talking specifically about NAPT, which is different from the non-port-based NAT that you're talking about.

>> You can have a stateless NAT: device x.x.x.y will get outbound source ports rewritten to (orignal port) << 8 + y.

> And that kind of NAT effectively doesn't exist in practice […]

Anyone using IPv6 ULA and NPT would disagree.

* https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr...

See my reply to your sibling commenter. My comment was not about NAT in general, i.e. I was not denying the very real existence of stateless NAT. Rather, I was disputing the usefulness of the NAPT solution proposed above as a solution to public IPv4 address exhaustion.

> proposed above as a solution to public IPv4 address exhaustion.

It was not proposed as a solution (although, it would work). I'm pointing out that in networking many names are conflated/used generally against their specific definition. NAT/Firewall; Router/Access Point/Gateway; etc.

Reply on news.ycombinator.com