<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">A comment about NAT when learning IPv6.<br>
<br>
Long soggy saga about how I tried for years to get V6
connectivity. Russ turned me on to SixXS (tunnel broker). I also
use HE (another tunnel broker). Have "native" V6 now for one
server, but most are still tunneled. Works.<br>
<br>
When I finally got connected, the first tunnel was flying.
Awesome! I was then trying to figure out how to get the other
boxes on my LAN safely into the IPv6 game. I was looking for a V6
equivalent of the N-to-1 NAT which my firewall/router provided.<br>
<br>
Stop looking. I did. Life got easier.<br>
<br>
It took a couple weeks for the light to dawn on me. I went from
N-to-1 NAT as a fact of life (even desirable) to "Rick hates NAT".
You don't have to be a hater like me, but I hope you'll come to
value the absense of gNATs in IPv6 world.<br>
<br>
The original design of the internet was for unique addressability
and for one-to-one connectivity. The addresses reserved for N-to-1
NAT (first in RFC 1597, then in RFC 1918) were culled before they
got allocated. It was the early 90s and we were running out of
room even then. The proliferation of N-to-1 NAT destroyed the
unique addressability. We have to play tricks because we no longer
have one-to-one connectivity.<br>
<br>
IPv6 restores the one-to-one function.<br>
<br>
Most people mistake N-to-1 NAT as a security feature. It's not.
This was presented playfully in a YouTube video that I share when
I pitch IPv6.<br>
<br>
<blockquote><a class="moz-txt-link-freetext" href="http://www.youtube.com/watch?v=v26BAlfWBm8">http://www.youtube.com/watch?v=v26BAlfWBm8</a><br>
</blockquote>
<br>
We've been doing N-to-1 NAT so long that we're blind to the
ridiculous machinations we go through to support it. (eg: port
mapping, but numerous other things)<br>
<br>
You <i>can</i> still do NAT in IPv6, but you no longer <i>have
to</i>. And it's usually N-to-N. But I have yet to encounter
even doing N-to-N yet for V6.<br>
<br>
Security is offered by your firewall. You don't need NAT for
security, just a stateful firewall with half a brain. If your
firewall and/or router is brainless, you can at least control the
routing so that at-risk systems on your LAN simply do not connect
with the outside world.<br>
<br>
Long rant, but I hope it helps.<br>
<br>
-- R; <><<br>
<br>
<br>
</div>
<br>
</body>
</html>