On 10/03/2013 03:42, Walter Dnes wrote: > On Fri, Mar 08, 2013 at 07:41:13PM -0500, Michael Mol wrote > >> The trouble with NAT is that it destroys peer-to-peer protocols. The >> first was FTP in Active mode. > > In its day, it was OK. Nowadays, we use passive mode. What's the > problem? > >> SIP has been heavily damaged as well. Anyone who's used IRC is >> familiar with the problems NAT introduces to DCC. > > Every ADSL router-modem I've run into recently has port-forwarding. > >> Anyone who's ever played video games online,... > > A *CLIENT* that can't operate from behind NAT is totally brain-dead. > >> or who's tried hosting a Teamspeak or Ventrillo server, has had NAT >> get in their way as well. > > Port-forwarding.
All those examples you give are much like a bunch of home machines sitting behind a NAT gateway onto the internet. That's actually OK and I reckon that is the intended use of NAT. Personally, I'd prefer all of my machines to have a public address but there's no chance in hell my NetOps colleagues are giving me that with my DSL connection. We have any years of experience now with consumer connections and the users that use them, these guys mostly can't admin a machine to save their lives, so NAT in their case is a good thing on balance. The true evil of NAT comes about when some clown starts implementing it on the network itself. I'm in city X, we have a large office in city Y, and most of the traffic Y->X goes through a *router* doing NAT. No-one knows anymore why this was originally done but we all know what it will take to undo it. To get our backend systems to work for client in city Y I have to put in the cursed "any any" firewall rules, and that sends our Risk fellows ballistic for good reason. But I have no choice, the network design essentially discarded all information as to who the client is, so now I must allow all of them. Any real-life network that grew organically over several years is always going to be rife with examples of fuck ups like this, always done in the name of expediency. I have lots of such examples, the above is only the first that came to mind. So whereas NAT behind a home router for IPv4 is good, in almost every other usage I've seen it is bad and really just a case of a solution used in places it never ever belonged. -- Alan McKinnon alan.mckin...@gmail.com
