Subject: RE: Why people by NATs

From: "Michel Py" <[email-masked]>
Date: Fri, 26 Nov 2004 14:47:20 -0800

>> Peter Ford wrote:
>> I do vehemently agree with your last paragraph.  In some
>> sense, you are saying that NAT is an intrinsic part of the
>> nominal "residential gateway" (could be expanded for soho
>> and small/medium business).

> Eric S. Raymond wrote
> Indeed. I think this is true.

There is nothing more truely than this. Before all this
half-true-half-false discussion about the relation between NAT and
security, the primary reason early users bought Linksys and precursors
was for the NAT feature. NAT is an intrinsic part not only of the
nominal "residential gateway" but also of many larger networks.

> Several people on this list have tried to tell me that I
> don't really want the IP address space on my local net to
> be decoupled from the server address. They are wrong. I want
> to be able to change ISPs by fixing *one* IP address in
> *one* place, and I want to control the mapping from global
> IP addresses to local ones.  This desire has nothing to do
> with IPv4 vs. IPv6 and everything to do with wanting to be
> able to make only small, conservative changes in my network
> configuration rather than having to completely disrupt it.
> Once again, I don't think my situation is unique.

Of course it's not, you are among the millions that do the same.

> For somebody administering a network of 100 machines, the
> hassle cost of IP renumbering would be twenty times larger.

It's actually a lot worse than many think. Anyone here that has actually
done it cares to comment on how easy and fast it is to renumber a
Windows Domain Controller that is a global catalog server and an
operations master? :-D

Michel.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Michel Py" <[email-masked]>
Date: Mon, 29 Nov 2004 17:24:23 -0800

>>> Jeroen Massar wrote:
>>> What if you want to do VoIP from _multiple_
>>> computers or even real VoIP phones.
 
>> Michel Py wrote:
>> This has never been an issue in the enterprise.

> Indeed not if they are keeping the traffic local or using
> a proxy. Then you don't have to circumvent NAT anyhow.

Jeroen, this is the usual way. What I am trying to tell you is that you keep arguing about problems that don't exist.

Back to the home/SIP issue: Have you seen the latest Linksys with voice? It's a regular Linksys "router" with the guts of a Sipura SPA-2000 ATA grafted to it. I have not seen the code for it, but it seems logical that the SIP part would not even have to cross NAT, as it is in the same box that does NAT and therefore has a straight shot at the outside IP address. What was your problem again?

> [Game Server]
> And please don't say you have to do manual
> port forwarding on the NAT box.

You don't have to. There are several NAT traversal mechanisms that don't require manual port forwarding nor uPNP. Skype and Morpheus being examples: zero configuration, and you can place _and_ receive calls (or download _and_ share files). With Skype you can have multiple phone clients behind the NAT that can each receive calls specific to them and even call each other.

> And please don't say you have to do manual
> port forwarding on the NAT box.

And let me add this: I use port forwarding preferably to uPNP. I like being the one in charge of what's happening on my network. But this is me; for Joe Six-Pack uPNP or Skype-type mechanisms are acceptable.

> End to end is not possible

Users don't give a rip; they don't even know what it is.

> +-------------+  +-------+   .--,--,--.   +-------+  +-------------+
> | Game Server |--| NAT_A |--{ Internet }--| NAT_B |--| Game Client |
> +-------------+  +-------+   `-,---,--'   +-------+  +-------------+
> Or are you depending on a public server on the internet?

Then what? You're depending on it anyway as most games will check the serial number to see if it's not pirated. Adding the NAT traversal mechanism to it, who cares? Again, don't say "it does not work" because it actually does. You might not like the way it is done, your problem.

>> I'm not defending NAT, but the course of action that says people
>> will have to use IPv6 because NAT is not working is flawed.

> Quoting yourself from above:
>> This where NAT sucks: game developers have to
>> write NAT-compatible code.
> I rest my case ;)

That's where you are missing the point: I'm a user; I don't care if the job of game developers is harder. Economics 101: I will buy the games that work on my system which includes NAT like everyone else. I vote with my wallet, write games that cross NAT and get my money or don't and die. Though luck, but that's the way it is.

Don't confuse "working" and "sucks". The user has no idea whatsoever what it takes to cross NAT, does not care, and does not care either if you and/or the IETF consider the practice impure or heretic.

>> - What would it buy the cybercafé owner to have IPv6?
>> Nothing. First, if I needed IPv6 while traveling I would
>> not rely on availability so I have my own. Second, his
>> tunneling might be worse than my own (the cybercafé does
>> not run BGP; I do).

> You run BGP where? On your laptop, tunneling IPv4/IPv6
> over the cafe's IPv4/IPv6 connectivity? This does not
> make sense.

I run BGP in California with multiple peers. In many situations, I would be better off tunneling IPv6 from Mexico to California then let the California router decide which one of the peers is the best, opposed to relying on the IPv6 provided by the cybercafé if it's a Freenet6 client that hauls the traffic back to Montreal.

Not trying to point any fingers as I do not know the specifics, possibly I could even be better off tunneling IPv6 from DC/IETF back to California instead of relying on the IPv6 provided there which was quite scenic routing. 

>> Would the cybercafé owner be able to charge me $2 for 30
>> minutes instead of $2 per hour? No. Would I choose his
>> cybercafé instead of the one next door if the sign said
>> "IPv6"? No.

> The question is more: would you pay $2 for 30 minutes of
> non-NATted connectivity against $2 for 60 minutes of
> NATted and crippled connectivity ?

NO! and the reason is it's not crippled: it would _not_ work smoother; it would _not_ work faster and I would have _no_ extra features. All I care is that I get a DHCP address with the default gateway a DNS server configured right. In this and many other situations being behind NAT or not does not change _anything_ in terms of usability.

> Easy choice for me, I rather pay a bit more for real connectivity, 

Geek syndrome. Lots of people on this list have a bad case of it (starting with me). For a long time, I though that the smallest acceptable home router needed redundant CPU and redundant power. My wife eventually got tired of the space, noise, heat and electric bill associated with the c7507; I just downgraded from this 12U monster to a 3U c7204 with single power and NPE-150. Guess what: it's not a "real" router (who would run a network on a non-redundant box, heaven forbid) and still it runs my home network just fine.

Geeks don't make the market. Joe User does, and he doesn't even know what "real" is.

> and what is $2 on your daily spending when
> you are on holiday?

You are missing the point here too. These cybercafés are not there to entertain tourists; lots of Mexicans get their Internet access in a cybercafé. To you and me, $2 is nothing. To lots of other people, it is a lot. Mexicans that go in a  cybercafé to read their email don't care if they get "real" connectivity.

Michel.