[HN Gopher] Beyond the Nat: Cgnat, Bandwidth, and Practical Tunn...
___________________________________________________________________
Beyond the Nat: Cgnat, Bandwidth, and Practical Tunneling
Author : rastrian
Score : 32 points
Date : 2025-12-27 13:59 UTC (5 days ago)
(HTM) web link (blog.rastrian.dev)
(TXT) w3m dump (blog.rastrian.dev)
| teeray wrote:
| > Home internet in the 90s felt simple. You plugged into
| Ethernet, got an IPv4 address, and you could expose a service
| directly.
|
| Maybe the 2000s, yes. This experience in the 90s was reserved for
| businesses and schools that could afford a T-carrier connection.
| The rest of us had dialup.
| kstrauser wrote:
| I had dialup with a static IP and inbound access to listening
| ports.
| reincarnate0x14 wrote:
| Even on dialup it was common to get a public IPv4 address,
| depending on what service. The service I had in like 95-98
| didn't promise static IPs but I effectively got the same
| address for weeks at a time, I'm assuming due to whatever logic
| was mapping accounts to addresses. They also gave you access to
| a FreeBSD shell if you wanted to read email via elm or pine or
| the like, one of the first places I saw SSH!
| kmbfjr wrote:
| New fiber provider across town does CGNAT and no IPv6.
|
| I guess that works for most people except gamers and people who
| get rate limited because of the actions of others.
|
| Article is correct, IPv4 didn't die hard.
| reincarnate0x14 wrote:
| It's bizarre to me that there is still so much effort spent on
| resisting IPv6 implementations, we were converting some
| industrial control networks to it almost 10 years ago and those
| organizations are basically defined by ancient equipment.
| Rather than byzantine v4 NAT coordination we mapped entire
| plants and substations to V6 addresses and put in 6to4 for the
| PLCs that were old enough to vote, so that multiple sites that
| all used the same 10.x.y.z blocks because of course they did
| could be routed together. Had V6 available from my house to
| pretty much anywhere I cared about in 2017.
| esseph wrote:
| As a business, especially a small business, there is no
| financial reason to do so in the United States for the vast
| majority of businesses. This gets talked about on NANOG all
| the time.
|
| It doubles the workload and knowledge required, doubles the
| security attack surface, and because of the 2nd part, doubles
| the security risk.
|
| Right or wrong that's the calculation for most spots.
| immibis wrote:
| You're banned from being a federal contractor if you don't.
| Isn't that pretty important since that's where all the
| money is?
| irusensei wrote:
| It's the same bullshit everywhere it seems. There goes the
| CGNAT with their router where the "advanced" options are
| basically defining DHCP settings - through a shitty phone app.
| There is also the stupid TV that no one asked for but it's part
| of the package.
|
| And when they do give you v6 its a /64.
|
| I wish there might be a category of prosumer friendly ISP of
| sorts. Those exist but they are hard to find.
| idatum wrote:
| If you are already running a VPS, the SSH -J option is useful if
| you don't want to expose your SSH to your home public address.
|
| You create an SSH reverse tunnel (-R option) from a server in
| your home network to your remote VPS. This gives you a localhost
| port on your VPS to your server SSH port. Something like:
| ssh -NT -R 2222:localhost:22 vpsuser@yourvps.com
|
| From your laptop, use your your VPS address and localhost port in
| the -J option. Something like: ssh -J
| vpsuser@yourvps.com:2222 homeuser@yourhome.com
|
| I only allow ssh key auth and only my laptop is trusted by my
| home server. The home server doesn't need to trust the VPS "jump
| server".
| yuvadam wrote:
| Call me a tailscale simp, but since it was launched I honestly
| stopped caring about any of such issues.
|
| They've built such an incredible product I actually feel guilty I
| pay absolutely nothing for it.
| beautyReloaded wrote:
| public ip abundance of the internet should not depend on
| mappings in the tailscale servers owned by tailscale or self
| hosted by other people
| apitman wrote:
| This looks like an excellent overview of the current state of
| things, and some nice practical instructions on getting end to
| end connectivity working.
|
| Personally I don't think IPv6 will ever supplant IPv4. As far as
| big tech is concerned, NAT solves the problem well enough for
| clients and SNI routing solves it well enough for servers.
|
| What incentive do they have to make things better for small orgs
| and p2p use cases? Better from their perspective to retain
| control over IPv4 real estate and extract rent.
| immibis wrote:
| For one, most major governments have told them to do it or
| else. I'm not sure which year it will be but there's already a
| mandate that US federal client systems can't have IPv4, and
| contractors must support IPv6, and a later deadline is for
| servers and websites to not have IPv4, at which point if your
| ISP doesn't provide access to federal government websites then
| all your customers can sue you into oblivion for failure to
| provide contracted services, including damages for any missed
| federal government interactions, which your liability waiver
| will not limit since your lack of IPv6 support by that time is
| intentional gross negligence. Google and Apple both require
| apps to work on IPv6-only networks or they get removed from app
| stores, and the majority of mobile networks are IPv6-native
| (with a slow translation layer for IPv4). Over 50% of internet
| traffic is IPv6 right now.
|
| I'm not sure why you guys keep saying IPv6 won't happen, when
| it's already happened. Just ostriching, or incentivized to keep
| IPv4 address prices high, or what gives?
| unethical_ban wrote:
| Accusation of malice is a little far, I think the ipv6
| transition isn't obvious to people because it has mostly been
| on mobile networks and the big datacenters. There are a lot
| of large organizations yet to implement it internally.
| apitman wrote:
| I wish I had an IPv4 block to hoard.
|
| Far more important than current adoption is rate of adoption,
| which is slowing.
|
| US mandates will certainly help and may be enough, but the US
| can't force other countries to follow. Many countries have
| far lower adoption rates.
___________________________________________________________________
(page generated 2026-01-01 23:01 UTC)