Subject: Re: NATs *ARE* evil!

From: Scott Bradner <[email-masked]>
Date: Fri, 15 Dec 2000 19:59:00 -0500 (EST)

I will admit to some level of confusion
the subject line of this thread is "NATs *ARE* evil!" yet most of the
discussion is about the use of private addresses - something that 
a whole lot of firewalls also do - howcum the subject line is
not "NATs & Firewalls are evil!" or "use of private addresses is evil!"?

this focus on NATs seems to be an incomplete statement of the problem

Scott

---

From: Paul Ferguson <[email-masked]>
Date: Fri, 15 Dec 2000 17:19:44 -0800

I find it amazing (well, probably not so amazing)
that we are re-hashing this every few years.

It looks like NAT's are a fact of life, and we
just need to figure out how to deal with them.

- paul

---

From: Michael Richardson <[email-masked]>
Date: Fri, 15 Dec 2000 21:22:07 -0500

>>>>> "Scott" == Scott Bradner <[email-masked]> writes:
    Scott> the use of private addresses - something that a whole lot of
    Scott> firewalls also do - howcum the subject line is not "NATs &
    Scott> Firewalls are evil!" or "use of private addresses is evil!"?

  Not all firewalls do NAT.
  Firewalls that do NATs are included in the definition of NAT/NAPT.

  Some application firewalls exist that don't change the addresses at all.
They still mess up the end-to-end nature of the internet, but that's their
stated purpose.  

   :!mcr!:            |  Solidum Systems Corporation, http://www.solidum.com
   Michael Richardson |For a better connected world,where data flows faster<tm>
 Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
	mailto:[email-masked]	mailto:[email-masked]

---

From: Keith Moore <[email-masked]>
Date: Sat, 16 Dec 2000 02:00:40 -0500

> this focus on NATs seems to be an incomplete statement of the problem

a complete statement of the problem is quite difficult, especially given
that the problem can be viewed in many different ways (without any of
them being contradictory with the others), each of these views being
illuminating and therefore useful.  RFC 2993 is one view;
http://www.cs.utk.edu/~moore/what-nats-break.html is another, and
there are some other quite illuminating views that haven't been published.

and we're still in the process of discovering the extent of the problem.

private addresses aren't a problem by themselves as long as people don't
want hosts with private addresses to exchange *any* traffic with the
global Internet and as long as people don't expect to run applications
on such hosts that interoperate with other applications on the Internet.

ALGs (which is what I assume you mean by firewalls) cause their own set
of problems, some of which are similar to those caused by NATs.  the 
fact that NATs, ALGs, and firewalls all are in wide use and that their
effects combine with one another makes it difficult to talk about any of
these in isolation regarding their effect on the network or on applications; 
the fact that these functions often appear together in the same box also
adds to the confusion.

but just because ALGs and/or firewalls cause some of the same problems as
NATs does not mean that it's not useful to focus on the problems caused by
NATs.  there is an important difference between deliberate harm to 
interoperability done by firewalls in the name of security (or the illusion 
of security, but I digress) and the accidental/unintentional harm to 
interoperability that is done by NATs.  

Keith

---

From: Keith Moore <[email-masked]>
Date: Sat, 16 Dec 2000 02:08:36 -0500

> just need to figure out how to deal with them.

well, that's the question after all - how best to deal with them?

I claim that NATs are architecturally bankrupt and we should therefore
devote as little energy as possible toward legitimizing NATs and/or
trying to make them any more complex than they already are.  

let's not pretend that they don't exist, or that they don't have some 
valid uses.  but let's not pretend that they are viable in the long 
term either.

Keith