Fck-nat: The (f)easible (C)ost (k)onfigurable NAT

https://fck-nat.dev/v1.3.0/

by alexzeitler • 2 years ago

149 80 2 years ago

fck-nat.dev

pyvpx• 2 years ago

fuck tail latency, as well.

paulvnickerson2• 2 years ago

I've used this in the past. Was very pleased.

andrewguenther5• 2 years ago

Happy to hear it! I've been looking to add some testimonials to the site. Is it okay if I reach out to you via email?

paulvnickerson2• 2 years ago

Sure.

TheRealPomax4• 2 years ago

If you did it right, your tool or service will exist for decades to come, if you have the option to not call it something fsck, fwkc, fck, etc. it's worth exercising that option.

ianlevesque• 2 years ago

On the other hand, this is your chance to name it fsck, fwkc, fck. It'll be harder to rename later.

OkayPhysicist• 2 years ago

If you're too stuck up to appreciate a funny pun, don't use the software. No one's holding a gun to your head. Or you could relax, not everything needs to be "serious business".

isityouyesitsme3• 2 years ago

While not really being one who cares personally about the example here, I would not give a tool a name that I full well know will offend the sensibilities of some who will use it. That would make me a jerk, no matter how funny or whimsical I may find it.

Even when poking fun at myself, I choose names of projects carefully. It's pretty easy to not be a jerk, at least in this way.

wruza3• 2 years ago

No one's holding a gun to your head

Good luck explaining a less-techy client at your job that fck-nat, fsck (which was originally just "fuck", afaik) and so on are fine puns and no one's holding a gun to their head either. I feel similar about recursive acronyms. These are funny-ish when you're in your mom jokes phase, but then someone asks you what that means and sometimes you can see their "what a bunch of creeps" reaction when you try to explain. Not surprising that people try to avoid that "we can use FCK for our SHT instances in CRP network" nonsense.

Retr0id• 2 years ago

Sometimes keeping "serious" people away from your project is a feature, not a bug.

TheRealPomax4• 2 years ago

Thanks, I'll let fsck know.

834573• 2 years ago

It will probably be changed to "ck-nat" eventually.

SkyMarshal• 2 years ago

Technically it should be cc-nat. This fck acronym seems like someone is trying a little too hard to twist it into something edgy.

Symbiote• 2 years ago

It worked out OK for Git, which means slightly malicious idiot in Britain and Ireland.

(Linus was supposedly well aware of the meaning when he chose it.)

diggan4• 2 years ago

Supposedly, Linus named Git after himself, just like with Linux. According to the legends at least.

suprjami• 2 years ago

There's a bit of a difference between "cranky old person" and one letter away from "fuck".

sonicanatidae2• 2 years ago

https://i.kym-cdn.com/entries/icons/original/000/028/596/dsm...

TehCorwiz• 2 years ago

The name of 'Git' (the source control system) is literally a derogatory term. I think you overestimate the value or prevalence of decorum. you should also google the relationship between the number of uses of the word "fuck" in code comments with code quality. There's been several papers on it.

EDIT: Here: https://cme.h-its.org/exelixis/pubs/JanThesis.pdf

TheRealPomax4• 2 years ago

The actual fsck command predates git by a lot of years. And they're both still incredibly stupid names.

shzhdbi09gv8ioi3• 2 years ago

fsck

= filesystem check

please stop being this thin skinned

wruza3• 2 years ago

https://hachyderm.io/@robpike/111593487329402102

TheRealPomax4• 2 years ago

Oh hi Linus.

Here's the thing: there is no reason not to keep pointing out that these are just bad names. And by pointing that out every time, someone might just pay attention and give their tool a better name in the future, because they took heed and decided against calling their tool "cwnt" in favour of calling it "check-wnat". And you will never know it could have been called the "oh stop being so thin skinned" cwnt.

And as a bonus, folks don't have to guess at what it does, the name tells you. Imagine if fsck had just been called checkfs... it would have been both a better name and would have saved a lot of askubuntu/superuser/etc posts.

hasty_pudding• 2 years ago

I would advertise how understandable it is as well.

maybe something like: ufck?

overstay8930• 2 years ago

If you care about price this badly just use v6, it's free

dns_snek2• 2 years ago

That's not an option if you need to support IPv4-only clients, which the vast majority of services do.

andrewaylett• 2 years ago

IPv4 clients are a different problem, with a different solution -- NAT is for outbound connections. Of course, plenty of services you want to connect to could only support IPv4.

IPv6 internally doesn't stop you running public IPv4-accessible services.

ikiris• 2 years ago

Start charging those clients an ipv4 fee then.

andrepew• 2 years ago

Unless you’re dependent on one of the many many AWS services that don’t support IPv6-only access.

https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su...

sonicanatidae2• 2 years ago

He's probably being paid by Big v6 to push it.

p1mrx• 2 years ago

There is an ongoing discussion about adding NAT64 support: https://github.com/AndrewGuenther/fck-nat/issues/41

oopsthrowpass• 2 years ago

Ahh this almost fits our use case, but we already went with Feasible Cost Konfigurable AWS setup

bilalq• 2 years ago

The NAT tax is real. We got to tens of thousands of registered users of our app with the $30/month NAT gateway being like 90% of our AWS bill. And it didn't even serve customer facing traffic! At the time, it's only use was for a serverless Aurora DB used by background jobs.

It only gets more expensive when you actually serve large amounts of traffic, need multi-AZ setups, and run multiple AWS accounts for different envs for beta/prod and each engineer's sandbox account. The worst part of cloud billing is how each base cost has several dimensions of multipliers.

paulddraper3• 2 years ago

I don't pay the NAT tax.

I just use public IP addresses.

It's fine, it works. Worked for EC2-Classic, works today.

ipython• 2 years ago

You now get charged for ipv4 addresses as well. Less than nat, yes, but now ipv4 addresses are no longer free either.

outworlder• 2 years ago

I don't know about your specific network architecture but, if you need to access AWS services from inside your VPC, make sure to configure a VPC endpoint for the services where it is available(RDS is one of them).

Far too many people forget about that and send their AWS traffic through their NAT GWs.

icedchai• 2 years ago

Keep in mind for low traffic sites, it may be cheaper to use NAT, if you already need it for something else. All those "VPC endpoints" can really add up. It's kind of crazy you gotta pay for the privilege of connecting to AWS from within AWS.

candiodari• 2 years ago

You do realize this is AWS policy, right? I mean you cannot run away from AWS costs ... on AWS. They are targeting dollar amounts of profits for themselves, not charging cost+20% for service X. They will find some other way to charge you the yet more than you're saving here, because MBA culture.

And AWS is like 10x more expensive than dedicated hosting, minimum. Not 10%, 1000%. To the point that for the price of

I mean if cost matters to you you need to move out of the cloud. Plenty of Kubernetes hosting these days, and very easy to set it up yourself.

fulafel• 2 years ago

This. You then work to dig deeper into the vendor lock-in, to move your apps to use apparently cheaper AWS-only services, and if you're wily (or oblivious) you can report this as cost savings.

mannyv• 2 years ago

One use case for NAT is lambdas calling out of their VPC to the internet. Not everything is v6 friendly yet.

I'll try and deploy this. Our NAT costs aren't that high, but reducing spend is worth an hour or two. I might leave this as something for the new guy, just so we can see if he can do it without taking down the environment.

sakopov2• 2 years ago

This is perfect for preprod environments. I'd probably not deploy in production. There is a better nat instance setup available called alternat [1] which is a little more durable and better for production cases.

[1] https://github.com/1debit/alternat

tootie• 2 years ago

This is what we run. Modest but not trivial scale. Transition was really easy.

andrewguenther5• 2 years ago

Author of fck-nat here. My big issue with Alternat is that it actively updates the route table which can still cause availability problems. It's a shorter outage than the current fck-nat replacement methodology, but it is still dropping connections.

The longer term vision for fck-nat is a two node approach using conntrackd and keepalived to actively failover existing connections to the secondary with no loss of availability. This has the added benefit of not requiring all of the auxiliary infrastructure that Alternat sets up.

sakopov2• 2 years ago

That's an awesome update! I currently run fck-nat in pre-prod environments (and love it so far) but still use NAT gateway in production. I was actively looking into switching over to AlterNat for prod because of the failover to NAT gateway during NAT instance updates and outages, but definitely not a fan of the complexity you're eluding to. The future plans you've outlined definitely make me want to wait it out and just use fck-nat across the board. Thanks for sharing these plans!

andrewguenther5• 2 years ago

Author of fck-nat here. Happy to answer any questions! Thanks for the post!

renlo• 2 years ago

Thank you for creating the project! Oddly enough I came across fck-nat last week and have been looking into incorporating it into my project app to avoid paying the $30+ per month for the managed solution.

As someone who is new to setting up VPCs and networking, how does this work? I was so curious I even tried to query ChatGPT about it a couple of days ago but I got a less than satisfactory answer.

Is the secret to making it work disabling the "source destination check"? Say a host in the private subnet wants to connect to a host on the internet, it tries to connect to <PublicIP>, and sends some IP packets over the subnet via the ENI, does the VPC subnet act like an old-school ethernet connection where fck-nat gets the IP packets for <PublicIP> (source/dest is disabled so it receives the packets) and then it forwards it to the internet gateway and does the network address translations when it receives a response packet?

mjlee• 2 years ago

https://github.com/AndrewGuenther/fck-nat/blob/main/service/... this is the bit you need to understand.

You've got the gist of it, but you probably want to read about NAT and iptables.

The source destination check is important - but implementation specific here. Google Cloud does it like this - https://cloud.google.com/vpc/docs/using-routes#canipforward

From the VPC perspective, the key here is understanding that subnets within VPCs have route tables that determine where traffic from your subnet goes next. In this case traffic to the internet is sent to an interface on the NAT instance.

Uptrenda• 2 years ago

What type of NAT algorithm are you using for your NAT here? E.g. full cone, symmetric, etc. Such details can be useful for testing. Currently I'm having to code a small script to simulate different NAT behaviours so I can test trying to traverse them easily. I looked for a way to do this kind of thing with cloud networking ages back but they were no where near as configurable as needed. Normally the details were hidden. IDK what they would be using in that case.

The other thing is the port allocation algorithm. Many home routers try to preserve the source port (assuming its available.) But there's other algorithms that could be used here like independent delta +1 (increment each new mapping by +1) and others. IDK if there's a target market for something this specific or niche. But thought I'd put it out there.

ragesh• 2 years ago

Any chance you're willing to share your scripts? I'm interested in trying out NAT traversal, too, and was starting to research ways to simulate all the different types.

Fck-nat: The (f)easible (C)ost (k)onfigurable NAT

Related Stories