Subject: Re: Stupid NAT tricks and how to stop them.

From: John C Klensin <[email-masked]>
Date: Thu, 30 Mar 2006 17:01:47 -0500

--On Thursday, March 30, 2006 11:44 -0500 Keith Moore 
<[email-masked]> wrote:

>> However, we need to keep something else in mind, which
>> Iljitsch's note  hints at.  If I'm an ISP trying to sell a
>> low-end service to low-end  customers at a low  (but still
>> profitable) price, I need to cut customer  support costs to
>> the absolute minimum.  If someone calls up for help  with a
>> configuration problem, that may be six month's of profits
>> from  that customer eaten up in the cost of answering the
>> call.
>
> I find myself wondering, don't they get support calls from
> customers having to deal with the problems caused by the NATs?

Because they don't answer them.  In the process of doing the 
work that led to RFC 4084, I reviewed the terms and conditions 
of service of a large number of ISPs in the US (and a few 
others) who provide low-cost Internet connectivity.  Some 
prohibit connection of more than one machine to the incoming 
line/router/modem.  Others provide a NAT-capable router but 
prohibit the customer from making any changes to its 
configuration and from running any applications that don't work 
in that environment.  And still others indicate that customers 
can supply their own NATs, but must obtain any support 
elsewhere.  All of these prohibitions are "enforced" the same 
way -- if the user calls with a problem, he or she either

(i) is told that there is no support for violations of the rules 
and offered the opportunity to be disconnected (often with a 
large "early termination fee") or

(ii) is instructed to disconnect all equipment between the 
machine in question and the router, and see if the problem still 
occurs.  If it doesn't, then the ISP has no problem and the 
customer's problem is of no interest.

>> For the community, there are elements of "you get what you
>> pay for" in  this.  And, for the ISPs, unless we figure out
>> ways to provide the same  level of support convenience with
>> public addresses, we will certainly  see NATs with IPv6 as
>> well as IPv4.
>
> either that, or IPv6 will be seen as something that is
> "business use only".

That possibility had not occurred to me, but I fear you are 
correct.

     john

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Keith Moore <[email-masked]>
Date: Thu, 30 Mar 2006 17:12:13 -0500

> customer's problem is of no interest.

Well, the reason I asked is that when I got my DSL line, my ISP
supplied me with a modem that does NAT - but only for a single host. 
As best as I can tell this is because the box needs to run PPPoE
on the carrier side and DHCP on the host side, and the only way that
the DHCP server can give the host an address under those conditions is
to do NAT.  So in this case (which I have no reason to believe is
atypical) the ISP is supplying the NAT - and they do so even for
customers who pay them extra to get a static IP address!

And yes it does break things even when there are no other local hosts
involved and no additional boxes between the modem and the customer's
host.  So I have a hard time believing that ISPs don't get support
calls about failures due to NATs, at least when they install the NATs.

Now of course this ISP does have a T&C that prohibits running a server,
but "server" is a pretty vague term, and you don't have to be running
any kind of server to suffer from NAT brain-damage.

Keith

p.s. fwiw the workaround in my case was to tell the modem to work in
"passthrough" mode and configure my local router to run PPPoE.
Under those conditions, I'm happy to report, 6to4 works just fine.

---

From: "Stephen Sprunk" <[email-masked]>
Date: Thu, 30 Mar 2006 21:00:08 -0600

Thus spake "Keith Moore" <[email-masked]>
> any kind of server to suffer from NAT brain-damage.

My ISP has ingeniously defined a "server" as any application that does not 
work through NAT without port forwarding.  Bingo, problem solved (from their 
perspective).

Of course, they don't actually enforce this unless a user's upstream 
bandwidth usage consistently exceeds total POP upstream bandwidth divided by 
the number of users at the POP (in my case, about 300kB/s).  Go above that 
and you get an email asking you to turn down the speed on your P2P client 
;-)

> Under those conditions, I'm happy to report, 6to4 works just fine.

Alas, I've been unable to find a consumer-grade router that will run native 
IPv6, 6to4, or even pass through IPinIP (excluding open-source hacks which 
are not supported by the vendor -- that's not a solution for real 
consumers).  If anyone knows of one, please let me know off-list.

S

Stephen Sprunk        "Stupid people surround themselves with smart
CCIE #3723           people.  Smart people surround themselves with
K5SSS         smart people who disagree with them."  --Aaron Sorkin

---

From: "Stephen Sprunk" <[email-masked]>
Date: Thu, 30 Mar 2006 21:00:08 -0600

S