Subject: RE: arguments against NAT?

From: "Michel Py" <[email-masked]>
Date: Tue, 2 Dec 2003 20:55:38 -0800

> Joe Touch wrote:
> Since we've been lacking a similar non-NAT solution,
> we (ISI) built one called TetherNet, as posted earlier:
> http://www.isi.edu/tethernet

What is this beside a box that setups a tunnel? What's the difference
with:
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_e
xample09186a00801982ae.shtml

> FWIW, the "seriousness of the impediments" (Michael Py)
> are felt wherever NATs are deployed.

Yeah right. That's why there are millions of NAT sites and they all have
serious impediments.

Michel.

---

From: "Jeff Johnson" <[email-masked]>
Date: Wed, 3 Dec 2003 09:13:41 -0800

> I'm not arguing about that, it is delaying things indeed. However I
> wonder which kind of instant messaging you are referring to, as all
the
> ones I've seen work fine through NAT.

Peer-to-peer CUSeeMe stopped working for me when I installed a NAT box
at home.  Now I can only do peer-to-peer CUSeeMe on a single computer
for which I've installed the appropriate port redirects in the NAT box.
Sure, server-based CUSeeMe still works on all the computers, but
peer-to-peer now only works on the one.

Any protocol where you have to receive an incoming connection on a fixed
port, and want to do so on multiple machines, just doesn't work when a
NAT is in place.

/jeff

---

From: Joe Touch <[email-masked]>
Date: Wed, 03 Dec 2003 09:56:37 -0800

> xample09186a00801982ae.shtml

The same difference, in principle, between DHCP and setting the IP
address yourself. The details of which are in the ISI web page above.

> Yeah right. That's why there are millions of NAT sites and they all have

There are millions of Compaq computers sold; all that run Windows (the
vast majority) rely on a local web server to manage Compaq software
updates.

But the people behind NATs don't know that. They just don't get the
updates. There are other cases where things just silently fail, and
people go out and buy alternatives that work, or live without. You deem 
this, in other mail, a 'security feature'; I deem it a bug.

Ignorance is bliss, but only when it's not expensive and/or frustrating.

Your other post to Melinda was closer to the primary issue, IMO - 
whether we can create an alternative which is as easy to use. The whole 
point of my post is that this can be done. Our solution may not be the 
best or the only one, but it proves (by example) that NATs aren't the 
only way to automated subnets, and that there is a way to undo the 
effects of NATs if - or when - those effects are finally noticed.

Joe