Self-hosting a NAT Gateway

https://www.awsistoohard.com/blog/self-hosting-nat-gateway

by veryrealsid • 8 months ago

169 123 8 months ago

nodesocket4• 8 months ago

I build my own NAT instances from Debian Trixie with Packer on AWS. AWS built-in NAT Gateways use an absurdly outdated and end-of-life version of Amazon Linux and are ridiculously expensive (especially traffic).

The bash configuration is literally a few lines:

    cat <<'EOF' | sudo tee /etc/sysctl.d/99-ip-forwarding.conf > /dev/null
    net.ipv4.ip_forward=1
    EOF

    sudo sysctl --system

    sudo iptables -t nat -A POSTROUTING -o ens5 -j MASQUERADE
    sudo iptables -F FORWARD
    sudo iptables -A FORWARD -i ens5 -m state --state RELATED,ESTABLISHED -j ACCEPT
    sudo iptables -A FORWARD -o ens5 -j ACCEPT
    sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null

Change ens5 with your instance network interface name. Also, VERY IMPORTANT you must set source_dest_check = false on the EC2 NAT instances.

Also, don’t assign a EIP to your EC2 NAT instances (unless you absolutely must persist a given public IP) as that counterintuitively routes through public traffic. Just use a auto-assigned public IP (no EIP).

  NAT instance with EIP
    - AWS routes it through the public AWS network infrastructure (hairpinning).
    - You get charged $0.01/GB regional data transfer, even if in the same AZ.

unquietwiki2• 8 months ago

Assigning an IP is ideal if you're having to whitelist traffic to/from a data center, application, or service.

nodesocket4• 8 months ago

Sure that one’s case, though you might be able to give out a host instead of IP to others to whitelist. Then you just set a low TTL and update the DNS record.

Nextgrid2• 8 months ago

OpenWrt is also a good option.

topspin• 8 months ago

"NAT instances"

That's what you did before AWS had the "NAT Gateway" managed service. It's literally called "NAT Instance" in current AWS documentation, and you can implement it in any way you wish. Of course, you don't have to limit yourself to iptables/nftables etc. OPNsense is a great way to do a NAT instance.

nodesocket4• 8 months ago

I believe the NAT instances also use super old and end-of-life Amazon Linux. I prefer Debian Trixie with Packer and EC2 instances and no EIP. Most secure, performant, and cost effective setup possible.

NAT AMI is built on the last version of the Amazon Linux AMI, 2018.03, which reached the end of standard support on December 31, 2020 and end of maintenance support on December 31, 2023.

vladvasiliu• 8 months ago

Also, don’t assign a EIP to your EC2 NAT instances (unless you absolutely must persist a given public IP) as that counterintuitively routes through public traffic. Just use a auto-assigned public IP (no EIP).

Could you point me to somewhere I can read more about this? I didn't know there was an extra charge for using an EIP (other than for the EIP itself).

m1keil• 8 months ago

I'm highly skeptical of this claim as well. Going through NATGW with EIP or auto-assigned IP is the exact same cost for the actual traffic.

notTooFarGone• 8 months ago

It's honestly ridiculous that people now see that self hosting is stupidly cheaper and still 99.9% reliable.

No your service does not need the extra .099% availability for 100x the price...

Make your own VPN while you are at it, wireguard is basically the same config.

radicaldreamer• 8 months ago

A lot of this is support. If you’re self hosting, when things don’t work the way they should, the team has no one to blame. On AWS, they can always lean on aws not working the way it should as an excuse.

Numerlor2• 8 months ago

For company hosting cloud solutions gets you the various compliance stuff for free which can be worth it if you're not too large, and of course faster turnaround if you need to get a product out.

For personal a cheap vps will end up costing around the same as something you can do on your own, without the risk of messing up your machine/network from a vulnerable endpont

IgorPartola• 8 months ago

This is really it: compliance. The cost is in having to prove that you did the right things. But I do wonder if we will see an easier path forward with that. After all if there was a way to pay someone a once a year fee for an audit and filling out the paperwork and the cost was lower than the cost of using AWS then surely people would do that and it is an opportunity for an audit business that is willing to work with self-hosted setups. Or just have GPT-5 fill out the compliance docs. I suspect it won’t be long until GPT-5 is reading them.

wiredfool• 8 months ago

For free, and 50% or more of your cloud spend.

faizshah• 8 months ago

I think AI coding is another part of why this is seeing a resurgence. It’s a lot quicker to build quick and dirty scripts or debug the random issues that come up self hosting.

dangus• 8 months ago

You’re misunderstanding the value of cloud computing, which should be obvious at this point. But I’ll go ahead and re-explain it for you.

Businesses need to maintain focus and allocate resources toward delivering their core product.

Software is highly profitable and even with inflated cloud computing costs, it makes some level of sense to not over-optimize and spread teams thin reinventing the wheel.

If I can deliver my product or feature to the market 20% faster that’s going to make more money than if I optimize my cloud infrastructure costs to save 50%.

As a business owner I don’t want to have to hire high-paid specialists who understand the deep intricacies of data center infrastructure, I want to be able to pay people with highly common skills who can quickly translate my business logic to working software.

heinternets• 8 months ago

Please can we do away with NAT forever. Why are we still encouraging this? It’s caused the world to do horrible kludges and continues to do so.

somanyphotons• 8 months ago

Presumably the idea is that if you go ipv6-only you can avoid this cost and just use a firewall?

waynesonfire• 8 months ago

In theory.. but what happens when you want to change ISPs or your ISP doesnt assign static ipv6 blocks? Its recomnended but ISPs have no incentive to give a shit about you. Now all internal infra is not routable.

abcdefg12• 8 months ago

Don’t even need firewall. Aws has egress only ipv6 gateway.

unquietwiki2• 8 months ago

This shouldn't be mistaken for an anti-IPv6 post. There's also some steps you have to go through to enable IPv6 on your VPS networks, and there's still stuff like GitHub not handling IPv6. So, much as we need to migrate, we still have to support IPv4 connectivity for the foreseeable future.

Shoutout to Hacker News for having IPv6 support!

baby_souffle• 8 months ago

and there's still stuff like GitHub not handling IPv6.

And virtually everything inside of AWS still requires IPv4 so even if you have zero need to reach out to WAN, if you need any number of private AWS endpoints, you're going to be allocating some ipv4 blocks to your VPC :(.

bilegeek• 8 months ago

1.) IPv4 is still heavily favored over IPv6.

2.) Market segmentation: keeps home users from easily hosting their own services without spending $$$ on an upgraded plan.

3.) Adding on to #2, I've seen claims of providers putting IPv6 behind NAT, so don't think full IPv6 acceptance will solve this problem.

ls65536• 8 months ago

I've seen claims of providers putting IPv6 behind NAT, so don't think full IPv6 acceptance will solve this problem.

I get annoyed even when what's offered is a single /64 prefix (rather than something like a /56 or even /60), but putting IPv6 behind NAT is just ridiculous.

bongodongobob2• 8 months ago

Because it's never once inconvenienced the average network admin, probably. I still don't get what problem it's supposed to solve for me.

mrsssnake2• 8 months ago

There absolutely are annoyences IPv6 get rid of, that are much embedded in IT culture we only see them if we look.

Port forwarding, external/internal address split, split horizon DNS, SNI proxies, NAT, hairpin routing - some of the hacks made mostly because of shortage in IP space.

MathMonkeyMan• 8 months ago

I've worked at four tech companies and never saw a hint of IPv6 (except for some tests that verified that third-party networking code accepted that address family).

Instead I played with IPv6 at home to make sure I understood it well enough should it ever come up at work. We'll see!

sidewndr46• 8 months ago

Whenever an ISP offers me IPv6 service that works, I will move to it.

trueismywork• 8 months ago

Its so much easier to remember`192.168.0.34` than some weird ipv6 numbering.

For someone just getting started with networking and learning things, this seems rhe best way to go forward.

Tractor86263• 8 months ago

No. We can't. We encouraging it because it works.

up2isomorphism• 8 months ago

I don't know what is the point of this kind of article. People care the cost and can do it already do it.

It is a damn service, which is defined as "you pay someone to do it".

gerdesj2• 8 months ago

I do both: charge people to do it for them and do it for myself.

(your second sentence is a bit confusing)

stormbeard• 8 months ago

I can't believe people are paying these crazy amounts for what is basically a fleet of firewalls. What is the difficulty in running VMs with nftables rules?

gerdesj2• 8 months ago

Or if nft is too complicated (firewalld) then do ufw.

Nextgrid2• 8 months ago

1) You can't `npm install` it, which is a huge barrier to entry to the modern breed of "engineers".

2) Companies will happily pay thousands in recurring fees for the built-in NAT gateway, but if an engineer asks for even half that as a one-off sum to motivate them to learn Linux networking/firewalling, they'd get a hard no, so why should they bother?

notatoad2• 8 months ago

running a VM where? on an ec2 instance? who's going to keep that updated for me? who's going to reprovision it when aws retires the underlying hardware? who's going to monitor it for PCI compliance for me? i don't want to deal with all that. i could dump it on fargate, but at that point it's barely cheaper than just using the official version.

i've had to look at my nat gateway zero times since i set it up a couple years ago. i can't say that about any VM host i've got. to me, that's easily worth the few dollars a month that aws charges for it. it's cheaper than hiring somebody, and it's cheaper than me.

moduspol• 8 months ago

It costs a lot more than a few bucks when you’re putting a lot of traffic through it. And running your own NAT instance does not incur per-GB traffic costs.

That said, the paid NAT gateways do also publish metrics. That can be nice when debugging a legitimate issue, such as when your gateway actually runs out of NAT ports to use.

eqvinox2• 8 months ago

i don't want to deal with all that

The market will provide. In this case by increasing prices to the point of maximum value extraction from people who don't want to deal with all that. There's a high initial cost to moving to something else here, with a lot of people dragging along paying more than what the market would otherwise equalize to, out of avoiding that initial hurdle. (And long term commitment of a resource, of course, one with low average but indeterminate excursion cost.)

benmmurphy• 8 months ago

aws has security groups as well. using NAT for a firewall is overkill.

z7• 8 months ago

"You only live once."

Why state this as absolute fact? Seems a bit lacking in epistemic humility.

creatonez• 8 months ago

Everyone has to address their spiritual beliefs every time they mention something vaguely related to them? Else they lack epistemic humility? ...Did it occur to you that most people have actually thought of this question?

Wait, is "seems lacking in epistemic humility" just coded language for "I disagree, therefore you couldn't possibly be thoughtful"?

JustExAWS2• 8 months ago

You only die once - you live everyday…

api3• 8 months ago

As an OG networking person, developer, and Linux user, the state of modern dev culture just makes me sad.

Modern devs are helpless in the face of things I taught myself to do in a day or two when I was fourteen, and they’re paralyzed with terror at the thought of running something.

It’s “hard” goes the cliche. Networking is “hard.” Sys admin is “hard.” Everything is “hard” so you’d better pay an expert to do it.

Where do we get these experts? Ever wonder that?

It’s just depressing. Why even bother.

It really makes me worry about who will keep all this stuff running or build anything new in the future if we are losing not only skills but spine and curiosity. Maybe AI.

theideaofcoffee2• 8 months ago

All of this. I despair with some of the takes on basic technology being hard. And when you try to defend understanding just the most rudimentary things, you're labeled a problem because you should just be paying out the nose for the service and writing even more shit code to cover it up.

amarant• 8 months ago

I actually kinda think ai will help with this, in a roundabout way.

I think of AI as a kind of floor, a minimum required skill to be able to get a job as a professional anything. If you want to find paid work as a developer, you have to at least be better than AI at the job.

Optimistically AI will filter out all the helpless Devs who can't get anything done from the job market. "Code monkeys" won't be a thing.

Juniors will have to enter unpaid trainee programs I guess, but that might not be such a bad thing

schrodinger• 8 months ago

Bet you never thought you'd have a "when I was a kid" attitude… :)

zamadatix4• 8 months ago

For those who DID think "I wonder what my 'when I was a kid' will be about when I'm old" what kind of things did you guess it'd be and what did it actually end up being?

I'm only in my 30s but I was thinking recently "when I'm retired I feel like I'm going to be telling stories about how back in my day we had this thing called the filesystem and you'd just browse it directly..."

tclancy• 8 months ago

Man, just this week I had a moment like this that killed me. I had just woken my tweenager up for school and realized I’d turned into the kind of asshole who comes into your room in a good mood at 6 am. Stood in the shower and came to terms with that, but it took a while.

api3• 8 months ago

Always assumed I would, but I thought it was that the youngsters would be running circles around me (in this domain) the way I ran circles around the olds when I was a kid.

What happened is that as an Xennial (young genX / old millennial) I know way more about computers than either generation to the side of me. This includes younger devs. I knew way more than them when I was their age. As a teen I was hacking C to get my 386 with Slackware Linux that I installed from floppies online by modding SLIRP to run on the sun3 I had dial up access to so I could pipe serial SLIP through it. Learned all about everything happening under the hood on a network.

I don’t feel self congratulatory about this. I feel depressed. If the kids were all smarter than me it would give me more hope for the future.

bragh2• 8 months ago

Yes, networking and sysadmin are hard, because the Internet is a much more hostile place than it was 20 years ago and the consequences for getting things wrong are much more severe. Early 2000s, ISPs had ports open by default and getting a static IP-address was a question of just asking. With dyndns, we were hosting websites off home computers. I remember a comment on HN saying that some US university provided publicly routable static IPs to dorm room port. Not even sure I could get a static IP-address nowadays as a home consumer, never mention the willingness to host something that is not behind a WAF.

And when you got things wrong back in the day, you came home from school, saw a very weirdly behaving computer, grumbled and reinstalled the OS. Nowadays it is a very different story with potentially very severe consequences.

And this is just about getting things wrong at home, in corporate environment it is 100x more annoying. In corporate, anyway you spend 80% of the development time figuring out how to do things and then 20% on actual work, nobody will have the time to teach themselves something out of their domain.

api3• 8 months ago

I have 2gbps at home and open ports and IPv6. It’s a dynamic IP but it changes maybe once a year. I could host a site here, sure. It’s infinitely better than it was 20 years ago.

OSes are more secure. Isolation is better. Languages are better. Hardware is vastly cheaper and faster and more reliable. Everything is easier and faster and better.

In the corp world we have this absurd embarrassment of riches. There are like ten choices in every category. Half of it is free. It’s easier to set up and run than it was back then. Way easier. Hosting is silly cheap if you compare cost / performance.

People are just incurious and brainwashed with this weird sense of helplessness.

This security phobia is so overblown if you take some basic precautions and don’t run crap service software.

If I were hosting something controversial that might draw the ire of one of the insane political cults out there I’d run it through a free CDN maybe. That’s easy.

fsmv• 8 months ago

I'm hosting from my home with a static ipv4 right now. It's been running for years without a single problem. I just put in a basic pf config. Everything is fine. It's not that scary.

anon291• 8 months ago

I self host everything. Wireguard, locked down ssh configs with private keys, iptables firewall and fail2ban... Not really that hard

icedchai2• 8 months ago

I've hosted stuff at home for almost 30 years, never bothered with a WAF. I have several VMs exposed with public IPs. If you keep your OS updated, it's hardly the end of the world. Sure, if you put up an unpatched OS from 10 years ago, you're going to have problems.

JustExAWS2• 8 months ago

Yes and developers these days don’t know assembly like I learned at 12. Does it matter?

I’m sure the list of things that you don’t know that some other developers do know is long.

No one is an “expert” at everything. I know AWS well (trust me on this) and I’ve used more services than you can imagine in a production capacity. I choose not to know the intricacies of Linux and front end development for instance. That’s either “someone else’s problem” or in the former case, I just give a zip file with my code in it and run it in Lambda or a Docker container and run it using a managed Kubernetes/ECS cluster, use Lambda (yes you can deploy a Docker container to Lambda) or Fargate (AWS manages instances in Docker cluster).

ygouzerh2• 8 months ago

I feel the issue is that now, what would be done by entire teams (networking team, storage team, database team), is now perform by only the same DevOps team.

We have way less time unfortunately to dig into each tech, business is pressing us like lemon on the other side to ship quickly.

mystraline2• 8 months ago

Yeah, I just use a VPS box I pay $20/year for. Only the most basic config goes on this machine. Basically load is 0.1 , and has no data.

Then I run my stuff locally.

And then I use ssh tunneling to forward the port to localhost of the remote machine. Its a unit file, and will reconstruct the tunnel every 30s if broken. So at most 30s downtime.

Then nginx picks it up.

rmunn• 8 months ago

Brilliant.

I use Tailscale myself, but if you want everything totally under your control (and don't want to go to the trouble of setting up headscale or something similar) then that's one of the absolutely simplest, lowest-effort ways of doing it. EDIT: Well, except for the VPS box I suppose, but if that provider went down or you had any reason to suspect they were doing anything suspicious, it would be quite simple to jump to a different provider, so that's pretty darn close to controlling everything yourself.

mystraline2• 8 months ago

Yep. Ive had the same provider for 3y going on 4.

Particular things: I use letsencrypt wildcard, so my subdomains aren't leaked. If you register per subdomain, LE leaks all your subdomains as part of some transparency report. Learned that and had to burn that domain.

The VPS is from LowEndBox. Like 2 core, 20GB storage 2GB ram. But runs perfectly fine.

I run jellyfin, audiobookshelf, Navidrome, and Romm. Ssh tunnel per application.

It would also be trivial to switch providers as well. But again, not a seed box, not doing torrents, not doing anything that would attract attention. And best of all, no evidence on the VPS. Its all SSL and SSH.

BobbyTables2• 8 months ago

I do something similar using an openvpn tunnel (home->vps). Iptables rules on the VPS redirect services to the VPN client IP.

Client automatically deals with reconnecting, never have to touch it.

SSH tunnel would have been simpler, just didn’t want it open.

SSH tunnel probably needs the keep alive on, otherwise connection loss may not be detected.

hk13372• 8 months ago

I ran a NAT on a floppy back in college, in 2000.

prmoustache• 8 months ago

How do you plug an ethernet cable to the floppy?

hk13372• 8 months ago

Linux boots and runs from a floppy disk. No hard drive, and 2 Ethernet cards

nwellinghoff2• 8 months ago

I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1. I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

ajsnigrutin• 8 months ago

The problem with "add another block" is, that you have to change everything everywhere to make it work... and if you're changing everything, why not expand it properly.

Only a tiny minority of people have to look at those addresses, the majority just types "facebook", enter, clicks on first google result and gets facebook (because ".com" is too hard to write).

theideaofcoffee2• 8 months ago

I have difficulty remembering ten numbers, why do I have to say 1-212-487-1965 when I can just say Santa Rosita 71965? Maybe we should have just done another exchange name and added another name. Eg Hawthorne Santa Rosita 71965. I know its stupid, but 10 digit phone numbers are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of telephone exchange prefixes.

Yet again, another fundamental misunderstanding (either genuine or not, I'm not sure) about the low-level technologies and their origins that underpin all of this. "Can't we just..."? No.

denkmoon• 8 months ago

dead::beef is just as memorable as 1.1.1.1, and my v6 delegated prefix is just as unmemorable as my public v4. The "easier to remember" argument just sucks hard.

dboreham2• 8 months ago

This was all discussed at length in 1993.

miyuru• 8 months ago

How did you access HN? is it by typing its IPv4 address?

globular-toast3• 8 months ago

Who remembers IPv4 addresses? If you have more than a small handful of devices in your network you're probably going to want some kind of name service.

swiftcoder• 8 months ago

I don't think many people are memorising a bunch of wildly different IPv4 addresses either.

At best, I remember the prefix of my private network, and a handful of single-number suffixes of important hosts (i.e. my LAN is 192.168.1.x, and I remember that .100 is my local file server...)

throw0101a5• 8 months ago

I think it might be as simple as ipv4 is just nicer to look at…maybe we should have just done “ipv5” and added another block. Eg 1.1.1.1.1.

This was discussed in the early 1990s. Criteria that were to be used for selecting then-IPng (§5.1: 10^12 / 2^40 was the minimum):

* https://datatracker.ietf.org/doc/html/rfc1726

The winning proposal, SIPP, was originally 'only' 64 bits, but it was decided to go to 128:

* https://datatracker.ietf.org/doc/html/rfc1752

I know its stupid, but ipv6 addresses are just so hard to remember and look at that I think its just human nature to gravitate towards the simplicity of ipv4.

If only there was a system that allowed for easy to remember human labels to be translated to a machine-usable sequence of bits that we call "an address"…

nwellinghoff2• 8 months ago

Eh. Judging by the large negative response I think the point might still have a point. Can you quickly rattle out ipv6 cidr blocks when you are setting up network configs? Most can grok and crank on ipv4 no problem. But for ipv6…its to the calculator. Not saying its a valid reason. Just saying ppl are lazy sooo if you want something adopted you might have to lean into lazy.

mrsssnake2• 8 months ago

For those unfamiliar, a NAT Gateway acts as a one way door to your private subnet to access the internet without allowing traffic in

Repeat after me: NAT is not a firewall. And we need to stop pretending it is.

varenc• 8 months ago

Agreed. Assuming an AWS "NAT Gateway" is the same as a regular NAT?

Security is not the purpose of a NAT. It's there to give you more IPs than you have. There's all sorts of NAT hole punching techniques. If you want a firewall, you need a firewall.

Tractor86263• 8 months ago

But NAT acts as a one way door to your private subnet, doesn't it?

zamadatix4• 8 months ago

The firewall provides the stateful one way door, the router moves packets between the set of subnets it can see, and NAT makes it so things on the public internet think the conversations from one private address+port combo are actually coming from another public address.

The last part isn't adding the security, and you can absolutely NAT without preventing the "outside" subnets from being allowed to route to the "inside" subnet, it's just that NAT is almost always done on the box providing the stateful firewall too so people tend to think of the 3 functions as combined in concept as well.

tonymet2• 8 months ago

In aws you can use IPv6 with either security groups or EIGW to avoid NAT fees altogether (you still pay for transfer fees )

Death , taxes and transfer fees

mannyv• 8 months ago

Moving to IPv6 works until it doesn't.

t0mas88• 8 months ago

That's quite recent. There was some time after AWS started charging for ipv4 addresses where you could not realistically go for an ipv6 only setup behind Cloudfront because it would for example not connect to a v6 only origin.

This is probably a result of all AWS services being independent teams with their own release schedule. But it would have made sense for AWS to coordinate this better.

tonymet2• 8 months ago

You’re right IPv6 has compatibility issues. But for instances needing NAT gateway (no public ip) , they are often good candidates for IPv6 egress.

kenrose• 8 months ago

We did this at OpsLevel a few years back. Went from AWS managed NAT gateway to fck-nat (Option 1 in the article).

It’s a (small) moving part we now have to maintain. But it’s very much worth the massive cost savings in NATGateway-Bytes.

A big part of OpsLevel is we receive all kinds of event and payload data from prod systems, so as we grew, so did our network costs. fck-nat turned that growing variable cost into an adorably small fixed one.

nodesocket4• 8 months ago

I looked at using fck-nat, but decided it was honestly easier to build my own Debian Trixie packer images. See my comment below[1]. How has your experience been with fck-nat?

[1] https://news.ycombinator.com/item?id=46010302

dboreham2• 8 months ago

For anyone else who is super confused as to wtf this is about: 1) it's not "NAT Gateway " but rather "The AWS service called NAT Gateway" and 2) it's not "self-hosting" but "hosting in EC2", in the same sense that "running postgresql on an EC2 instance" wouldn't be "self hosting aurora".

Arch-TK• 8 months ago

The article seems to perpetuate one of those age old myths that NAT has something to do with protection.

Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding. But implementing NAT on it's own says nothing about the behavior of your router firewall with regards to receiving Martians, or with regards to whether the router firewall itself accepts connections and if the router firewall itself isn't running some service which causes exposure.

To actually protect things behind NAT you still need firewall rules and you can keep those rules even when you are not using NAT. Thus those rules, and by extension the protection, are separable from the concept of NAT.

This is the kind of weird argument that has caused a lot of people who hadn't ever used IPv6 to avoid trying it.

gldrk• 8 months ago

Yes, in a very superficial sense, you can't literally route a packet over the internet backwards to a host behind NAT without matching a state entry or explicit port forwarding.

Don’t forget source routing. That said, depending on your threat model, it’s not entirely unreasonable to just rely on your ISP’s configuration to protect you from stuff like this, specifically behind an IANA private range.

sedawkgrep• 8 months ago

I don't think source routing is a thing anymore. At least if you're talking about the ability of a source to specify a path to its destination.

The last time I heard about source routing actually being a useful feature or a vulnerability used by hackers was the 1990's.

globular-toast3• 8 months ago

Yeah, I keep meaning to write something about this. I've definitely noticed people wary of IPv6 because their machines get "real" IP addresses rather than the "safe" RFC1918 ones. Of course, having a real IP address is precisely the point of IPv6.

It's like we've been collectively trained to think of RFC1918 as "safe" and forgotten what a firewall is. It's one of those "a little knowledge is a dangerous thing" things.

sshine• 8 months ago

In a world where people think NAT addresses are safe because you don’t need to know anything else about firewalls, IPv6 _is_ fundamentally less secure.

mzhaase• 8 months ago

If you think about it, NAT offers pretty much the same protection as a default stateful firewall. Only allowing packets from the outside related to a connection initiated from the inside.

lloeki• 8 months ago

Only allowing packets from the outside related to a connection initiated from the inside.

NAT a.k.a IP masquerading does not do that, it only figures out that some ingress packets whose DST is the gateway actually map to previous packets coming from a LAN endpoint that have been masqueraded before, performs the reverse masquerading, and routes the new packet there.

But plop in a route to the network behind and unmatched ingress packets definitely get routed to the internal side. To have that not happen you need to drop those unmatched ingress packets, and that's the firewall doing that.

Fun fact: some decade ago an ISP where I lived screwed that up. A neighbour and I figured out the network was something like that:

    192.168.1.x --- 192.168.1.1 --
                                  \
                                   10.0.0.x ----> WAN
                                  /
    192.168.2.x --- 192.168.2.1 --

192.168.1 and 192.168.2 would be two ISP subscribers and 10.0.0.x some internal local haul. 192.168.x.1 would perform NAT but not firewall.

You'd never see that 10.0.0.x usually as things towards WAN would get NAT'd (twice). But 10.0.0.x would know about both of the 192, so you just had to add respective routes to each other in the 192.168.x.1 and bam you'd be able to have packets fly through both ways, NAT be damned.

Network Address Translation is not a firewall and provides no magically imbued protection.

eqvinox2• 8 months ago

NAT offers pretty much the same protection as a default stateful firewall

Most NAT requires itself to include a stateful firewall; it's the same thing as the NAT flow table. This whole trope is mostly getting into people's heads to not forget about actually configuring that "free" firewall properly, since it'll just be a poor one otherwise.

0xbadcafebee• 8 months ago

Fwiw, the solutions mentioned here don't seem to properly secure the kernel's network stack against common attacks (rp_filter, accept_redirects, accept_source_route, syncookies, netfilter rules, etc). Ask your local security guru to harden the instance before deploying.

drchaim• 8 months ago

I'm not to much into networks, although I've been sysadmin my vps for years. why I would need a NAT Gateway? it's not enough with a good set of rules of ufw or similar software?

snowfield• 8 months ago

This article is ment for companies who want to save a buck on aws costs.

ygouzerh2• 8 months ago

It's mostly for AWS context, when you want to host for example your servers in a private subnet, but you want to allow access of small part: you can leverage a NAT Gateway to be the public entrypoint + some security groups as gatekeepers to filter the traffic.

However, the fees from AWS are atrocious on the NAT Gateway.

jimmar• 8 months ago

AWS already documents a solution to self-host a NAT instance: https://docs.aws.amazon.com/vpc/latest/userguide/work-with-n...

garettmd• 8 months ago

I always find these discussions about AWS NAT gateways interesting because I recall way back in the day, before AWS had a manages NAT gateway, the recommendation was to roll your own anyway. Or at least that's what I heard. I took an ACloud Guru course and one of the first ec2 lessons was to create a simple NAT gateway in your VPC so that your other instances could reach the Internet.

7bit• 8 months ago

Society would have you believe that self hosting a NAT Gateway is “crazy”, “irresponsible” and potentially even “dangerous”.

I just can't take articles seriously when they lead with these kind of claims and then don't back them up. Typically to give their articles some sort of justification and/or weight. Did not bother to read the rest.

switknee• 8 months ago

Am I the only one who read this and thought, "doesn't everyone self host a NAT gateway?"

Mine's in the living room, it says TP Link.

More seriously, NAT is fun and all but it can introduce unexpected behaviors that wouldn't exist in a firewall that doesn't do translation. Less is more.

Self-hosting a NAT Gateway

Related Stories