APNIC: Big Tech’s use of carrier-grade NAT is holding back internet innovation

https://www.theregister.com/2022/01/20/ipv4_nats_slow_ipv6_transition/

by aragonite • 2 years ago

121 109 2 years ago

theregister.com

nickburns14• 2 years ago

"let them use IPv6!" -Marie Antoinette a/k/a your ISP that hasn't even rolled it out yet.

IvanAchlaqullah• 2 years ago

Or refuse to implement IPv6. (At least here in Indonesia with only 14% adoption rate)

Why? Because for residential user that want low latency internet & low packet drop (CGNAT increase both), ISP can charge "business price" for dedicated IPv4 that aren't behind CGNAT. With IPv6, CGNAT is not needed.

Considering ISP/Telco in here is very scummy (they even perform MITM to inject ads, use Class 0 message / AMBER Alert for ads, etc.) I won't be surprised if that's the only reason why they didn't rolled out IPv6.

canistel• 2 years ago

I have been averse to IPv6 until recently,and used to disable IPv6 altogether. Couple of weeks back, the ISP silently shifted to CGNAT, and I could no longer forward ports. Out of sheer desperation, I gave IPv6 a try and was shocked to find that the demon which I had feared all along, was in fact the solution to most of the concerns.

A few things to note though:-

1. Default router settings - as configured by the ISP - defaulted to IPv4 only. I had to change it to enable IPv6 too in the WAN settings.

2. Had to lower Firewall security levels (which in fact makes sense).

3. In firewalld, had to enable ipv6-icmp protocol

4. Technologies such as IRC (to take an example), does not support IPv6, but many torrent clients do.

birdiesanders• 2 years ago

Most IRC clients happily accept a properly encoded v6 address.

notpushkin2• 2 years ago

Had to lower Firewall security levels (which in fact makes sense).

Sounds suspicious to be honest. If you get a direct IPv6 address to your computer (as opposed to an IPv4 behind a NAT), shouldn't you raise firewall instead of lowering?

nickburns14• 2 years ago

some components, like RA and SLAAC, require specific ICMP to function properly. a properly configured IPv4 firewall on the other hand would allow no inbound and filter most outbound ICMP by default.

the only actually suspicious part of the original comment is...

  Default router settings - as configured by the ISP

getwiththeprog• 2 years ago

With my ISP, I see CGNAT as a feature as it obfuscates my IPv4 address.

Then I also get millions of IPv6 addresses that are not CGNAT, so it is a real win as far as I am concerned.

GoblinSlayer3• 2 years ago

For this you can just have a socks proxy instead of NAT. Works with ip6 too.

nickburns14• 2 years ago

ISP still has CGNAT logs and can presumably still be lawfully subpoenaed. it's a false cloak.

and in terms of identity tracking—all teh marketeers (who sleep with the CGNAT ISPs mind you) can still exceedingly accurately profile you and keep tabs on what you're up to whether behind your CGNAT ISP or CGNAT telecom alike. it's a false sense of privacy.

WarOnPrivacy3• 2 years ago

With my ISP, I see CGNAT as a feature as it obfuscates my IPv4 address.

It can become an issue when sites like The Economist don't vet their blocklists - and then someone behind the NAT does something that makes the list-author grumpy.

WarOnPrivacy3• 2 years ago

see CGNAT as a feature as it obfuscates my IPv4 address - then get millions of IPv6 addresses that are not CGNAT

It's tough trying to connect to home IPv6 services - when all the locations you visit are served by an ISP that doesn't support IPv6. That's the scenario here.

seba_dos1• 2 years ago

What makes you think that IRC doesn't support IPv6?

lathiat• 2 years ago

Many IRC networks were early to IPv6

LargoLasskhyfv• 2 years ago

4. Hm. Must be a strange network, or bad client. Even (most of what remains of) EFNET supports v6 and TLS. Imagine...

FujiApple• 2 years ago

This Tailscale blog [1] from 2020 has been posted on HN many times before I’m sure but is worth highlighting again as it does a great job outlining the technical complexities that CGNAT (and NAT in general) introduce.

I have my head in this space at the moment as I’m trying to implement NAT detection (as pioneered by Dublin traceroute [2]) into Trippy [3].

[1] https://tailscale.com/blog/how-nat-traversal-works

[2] https://dublin-traceroute.net/

[3] https://github.com/fujiapple852/trippy/issues/1104

mcmcmc• 2 years ago

I already love Trippy but that would be an awesome addition! Big thanks from a satisfied user!

nickburns14• 2 years ago

could you say a little bit more about the design and/or purpose of NAT detection in this context? i'm unfamiliar but see what the service generally does in lay terms. curious more about the technical necessity.

beagle311• 2 years ago

I vastly prefer CGNAT to IPv6, because CGNAT preserves my privacy by default, and IPv6 eliminates it by default. It’s that simple.

While it’s possible for an ISP to unmask me on CGNAT (Verizon and AT&T did in the early smartphone days)- and it’s possible for an ISP to NAT/Wildcard my IPv6 address for privacy - it’s the default in 99% of the cases; and I prefer default privacy to the ability to be directly addressable at home.

seanlinmt• 2 years ago

But how do you host services through CGNAT though?

msk-lywenn2• 2 years ago

You can’t. When my ISP switched me to CGNAT, I spent days upgrading everything to IPv6, only to discover that gmail didn’t even support it! (Mail Server to mail server, not the web app) I gave up, asked my ISP IPv4 back and, fortunately, got back a new IPv4. But I fear the day that option will disappear…

eru• 2 years ago

By and large, you don't. I suspect beagle3 cares more about the privacy aspects than hosting a service from their home.

There are some trick for hosting through CGNAT, if you have a server on the outside.

sambazi9• 2 years ago

either buy paying a few bucks for a vps with static v4 or try techniques like "nat hole punching" to keep the cgnat statemachine happy. but tbf it isn't meant to

miyuru• 2 years ago

What kind of privacy are you getting with CGNAT? ISPs and websites can still track you.

jasode2• 2 years ago

CGNAT? ISPs and websites can still track you.

Yes, ISP's can still track but the other websites-that-are-not-the-ISP that depend on logging unique ip addresses for tracking can't identify you behind a CGNAT. My previous comment about how CGNAT can be another layer of privacy for things like torrents: https://news.ycombinator.com/item?id=38176079

EDIT reply to : >Sure except for the like 800 other metrics they use to track you besides IP lol. Advertisers

Yes, browser fingerprints and "device behavior" heuristics etc demonstrated at https://amiunique.org/ and https://fingerprint.com/blog/browser-fingerprinting-techniqu... ... also exist but that's not what my reply was about.

My comment was specifically talking about those websites that depend on ip addresses and not fingerprinting. Examples are torrent trackers, torrent honeypots, and Wikipedia articles' edits history where their server logs keep track of ip addresses instead of browser fingerprints. CGNAT will make users more anonymous in those situations. Lawsuits and subpoenas from RIAA and movie studios against torrenters for copyright infringements were filed against ip addresses and not browser fingerprints.

As for Google/Facebook sophistication levels of browser fingerprints tracking and surveillance, I'm not so sure how paranoid I should be about it because they still think I'm in Idaho because I happen to open my laptop in a hotel one time there 10 months ago.

0xDEADFED5• 2 years ago

they both suck for me. i can't port forward any IPv4, and Verizon blocks any incoming IPv6 on their side

sambazi9• 2 years ago

rock and a hard place

both seem to be political problems rather than technical ones

justinclift• 2 years ago

Instead of port forwarding for IPv4, couldn't you use that Cloudflare service tunnelling thing?

nirui• 2 years ago

Well, I'm inside a CGNAT. It's like living in an apartment building with 20,000 other families. Maybe it's all fine when everything is normal, but one day, the water pipe on the top floor might go burst while no one is answering the door.

It is true that a NAT could give you some privacy, but the downside is also very obvious. For example, your network neighbor might rub some service in the wrong way, then the service ended up sanction/ban the shared NAT exit.

Then, you might be thinking, "just use a smaller CGNAT then". Well, then a smaller CGNAT will allow the website to track you more easily.

If I really really don't want to be tracked, I'd rather use Tor.

sambazi9• 2 years ago

this is a real downside of ip reputation systems

GoblinSlayer3• 2 years ago

In order to ban an ip6 client one must ban entire /64 network due to address randomization. So you still get banned.

orangeboats7• 2 years ago

It's something I had said before in another thread, but oh well... Here goes again:

The so called privacy-presevation of CGNAT is a double edged sword. Other websites can't track you, simultaneously that also means other internet users can't reach you.

The most obvious consequence is that to host a server, you must purchase a VPS or rent an public IP address from your ISP, and the price for a public IPv4 address is getting higher and higher.

The less obvious consequence is that you're giving up control to the VPS providers (and other centralized services). Does your VPS provider allow you to host Tor services? Run BitTorrrent?

It's rather ironic that people on HN, a website whose name literally includes the term "hacker", would support things like CGNAT which hurt hackers/hobbyists/"privacyists" the most.

beagle311• 2 years ago

To each their own. Want to be reachable? Use IPv6. My privacy is more important to me than being directly reachable.

nickburns14• 2 years ago

if you're a privacy by-default kinda guy—then regrettably you must live in a lonely, lonely world. how do i get there?

at least i have my edge firewall until you let me know.

beagle311• 2 years ago

I live in a very social, active, healthy world.

Indeed, I don't have "friends" on Facebook / Instagram (I don't use those) - I talk to friends on the phone, meet them in person, we have message groups on various services.

Some of my friends do post on Facebook or Instagram; but they let me know personally if there's anything important I should know.

I'm a privacy-by-default kind of guy, yes.

allarm2• 2 years ago

because CGNAT preserves my privacy by default

This comment. Every single time. No it doesn't. NAT doesn't add privacy. NAT doesn't add security. Use firewall with IPv6. This is it.

beagle311• 2 years ago

You are wrong, and I say that as someone who was employed by someone who (likely) invaded and still invades your privacy through a firewall and IPv6.

Modern firewalls do nothing for privacy. IPv6 eliminates your ability to maintain your privacy.

Security is a different matter, and NAT doesn't add much there (although it is another layer). But the comment you quoted was specifically about privacy.

hlandau2• 2 years ago

CGNAT should be illegal.

Or at least it should be illegal to advertise a CGNAT service as an "Internet connection". It's not an Internet connection, you can't use it to send or receive arbitrary IP packets, only TCP/UDP.

patrakov3• 2 years ago

Just as well, it should be illegal to advertise a connection with only a single dynamic /64 of IPv6 as an "Internet connection".

Latty2• 2 years ago

Yeah, I like to compare it to the old "Party Line" phone lines people used to have, where you shared a single phone line with multiple houses and only one person could talk at a time. Sure, it gives you some of the functionality of a phone line, but it is not a phone line, and shouldn't be sold as the same thing.

Honestly, I'm genuinely surprised no ISP has started doing "gamer" marketing as it seems to be so effective elsewhere, "We give you real public IPs so you can connect directly to your opponents for lower latency, get on the internet fast lane!".

Gigachad• 2 years ago

Games have largely moved away from direct connections and user hosted servers though. The players and companies prefer the modern match making system. Its easier to use, more reliable, and gives the company greater control over the experience.

wjholden• 2 years ago

I think I once read that Microsoft's Xbox team once advocated for residential IPv6 for exactly this reason, but I don't have a reference.

everforward5• 2 years ago

This already exists via VPNs that allegedly give you better routing/peering to the game servers.

No idea if they work. I can see conceptually why they might (internet routing is often more of an approximation of a best route than the actual best route), but the problems seem too individualized for a generic VPN to help. Happy to be wrong if someone knows how well/why they work.

sambazi9• 2 years ago

tbf cgnat is fine for the majority of consumers.

a solution to get public v4 on the cpe could be a deeply burried "advanced-expert iknowwhatiamdoing" checkbox in the isp portal

lambdaone• 2 years ago

This article is two years old. I don't think things as as dire as they seem, just a bit more boring than people might like.

I can't see any sign that long-term IPv6 growth has stopped, it's just ceased to accelerate. Looking at Google's IPv6 traffic graph (https://www.google.com/intl/en/ipv6/statistics.html), this is entirely consistent with being the first half of a classic logistic curve, with growth now linear as it approaches the 50% point after 15 years. If this is actually a logistic growth curve, we will presumably see the end of IPv4 sometime around 2040. Even if we take a more optimistic view and assume linear growth continues, it will still take until about 2035.

And that's fine. Old technlogies tend to wither away, not go out with a bang.

CrLf• 2 years ago

The issue with looking at IPv6 adoption from that point of view is that it only shows half of the picture. It shows the percentage of IPv6-enabled clients, which has been growing steadily.

On the other side there are still major services that are IPv4-only, and growth is not uniform.

This means the combined situation is not as cheerful. It's hard to arrive at definitive conclusions, but IPv6 traffic(1) may be as low as 15% when considering this mismatch.

https://blog.cloudflare.com/ipv6-from-dns-pov/

Without stronger incentives, IPv6 may be an eternal runner up. At least it looks like it will take quite a few decades more to make IPv4 obsolete.

(1) By connections or requests. By bytes transferred, IPv6 might have already overtaken IPv4 for all we know (I'm not aware of a broad enough study on this, so I'm open to this possibility). The largest streaming providers are IPv6 enabled.

jofla_net• 2 years ago

Another good reason for slow adoption is that the pushers of V6 herald it as the death of all nat, and i wager there are certain types of net admins who really like at least SOME nat. I have a longer writeup here http://www.jofla.net/?p=00000113#00000113

granted i would love for more v6, if it yielded a 1 for 1 repacement, with all features .

anonym292• 2 years ago

Every service I run for all time will be exclusively ipv4. Ipv6 gets a heckler's veto from me for trying to do too much.

Give me an addressing scheme and absolutely NOTHING ELSE - just like IPv4 - and I'll consider it. IPv6 does an order of magnitude more than just this one thing, and therefore is too complex to be a replacement as it adds a bunch of anti-features that I don't want anywhere near any of my networks for any reason ever.

I am a permanent rejecter of all ipv6, both as a client and a server.

For every downvote this post gets, I'm going to increase the number of sockpuppet acconts I automate in my crusade against ipv6 in all public forums by 1 order of magnitude. Each downvote will multiply the number of voices standing in opposition to your own desired outcome coming from my system by ten.

Don't like it? Propose a better standard that fixes the address space problem without adding layers of shit on top of it next time.

Democracy is two wolves and a sheep voting on what to each for lunch, and for this particular subject, I can (and will) make more virtual anti-ipv6 wolves than there are pro-ipv6 sheep that are real humans.

Don't like that? Demand a better governance system than democracy.

nickburns14• 2 years ago

very well said about legacy technologies, plus estimated projections based on actual current adoption at least to me informative. thanks for sharing your thoughts.

can16358p• 2 years ago

I could easily access my computer from the internet when I'm not home back in the days... all the ISPs in my country have moved to CGNAT and there is no v6 support, probably because of lack of demand and ridiculous "static IP" pricing.

Result: I'm constantly checked by Cloudflare etc. and sometimes blocked altogether by some hosts as I'm probably in the same public facing IP with many non-savvy people whose devices are infected with botnets.

James_K• 2 years ago

GCNAT is truly one of the ugliest pieces of technology ever created. It is incompetence and bad planning made manifest into software.

magicalhippo• 2 years ago

Maybe it's more like IPv6 is the solution we got, rather than the solution we want. Not unlike Wayland vs X11. Both over-corrections to the problems they set out to fix.

Then again, my code doesn't get good until the third time I rewrite it...

As someone with a small home lab, IPv6 feels much more complex compared to IPv4. And it's still in significant flux despite decades old, while IPv4 hasn't changed significantly since I deployed my own m0n0wall box back before y2k.

It also requires more infra. DNS for everything is non-optional due to long addresses and dynamic prefixes. DHCPv6 is needed for all configuration settings to be set on clients. And there's still software that doesn't play well with IPv6.

It's just too much hassle for my home lab for now. Maybe in another decade.

nickburns14• 2 years ago

  over-corrections to the problems they set out to fix.

IPv4 space will—not a matter of if, it will eventually be exhausted. given that i don't know if IPv6 could reasonably be considered an 'over-correction' in the context of needing a larger address space, unless you strictly refer to complexity of the successor analogies (i.e. IPv6 and Wayland).

a comment elsewhere in this post makes some informed projections about when the transition will go from being gradual to necessarily fully (at least for IPv4) co-operational.

sp3322• 2 years ago

IPv6 has changed a lot over the years, mostly to simplify it. IPsec used to be mandatory, for example.

jcarrano• 2 years ago

Every time I used IPv6 I found it solved more problems than it created. E.g. with v6 you can make sure a VPN addresses will not collide with the user's actual address. No more nats or port forwadings, etc.

The main problem is that v4 has not yet been retired and that means many times you have to support both.

patrakov3• 2 years ago

No more nats

Hehehe... writing this from behind NPTv6 (a form of a prefix-to-prefix NAT). I have to use it because this is currently the only working method for a fail-over configuration with two ISPs.

APNIC: Big Tech’s use of carrier-grade NAT is holding back internet innovation

Related Stories