Subject: Re: IPv6 adoption behavior

From: "Christian Strauf (JOIN)" <[email-masked]>
Date: Wed, 22 Oct 2003 08:43:00 +0200

> But if I want a VoIP communication from me (behind a NAT) to some user 
> behind a NAT, not using a 3rd party "location" server, how does v4 deliver, 
> without the receiving user having the pain of port forwarding configuration 
> on their NAT?

Good point. I experienced that end-users in the GnomeMeeting (H.323
client) community that never had anything to do with v6 suddenly started
asking questions about how to get IPv6 connectivity because they heard
that even as a normal end user you can get a /64 from tunnel brokers or
your ISP (in some cases) which solves the end-to-end connectivity
problem that exists with IPv4+NAT because you can get a global v6
address. IPv4+NAT problems are the most common problems in this
community. 80% of all problems that people have with GnomeMeeting can be
traced back to a NAT. What I'm trying to say is that there are
applications that can raise a demand for IPv6 due to easier to achieve
end-to-end connectivity. And Skype is not a good example for end-to-end
communication "over NAT" because it wouldn't work without non-NAT-ed
nodes.

> How do I do the same in v4 where I want end-to-end encryption on the 
> application?
Another good example for a field where end-users will eventually realise
the use of IPv6 w/o NAT vs. IPv4 w/ NAT.

The point is: there are a good number of everyday applications where
end-users are painfully reminded that they live behind a NAT. And those
users would definitely appreciate getting rid of IPv4+NAT if they can
achieve what they want with IPv6. In this case, the adoption of IPv6 is
simply a logical consequence.

Christian

-- 
JOIN - IP Version 6 in the WiN  Christian Strauf
A DFN project                   Westfälische Wilhelms-Universität Münster
http://www.join.uni-muenster.de Zentrum für Informationsverarbeitung
Team: [email-masked]      Röntgenstrasse 9-13
Priv: [email-masked]    D-48149 Münster / Germany
GPG-/PGP-Key-ID: 1DFAAA9A       Fon: +49 251 83 31639, Fax: +49 251 83 31653

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "Jeroen Massar" <[email-masked]>
Date: Tue, 21 Oct 2003 14:35:42 +0200

-----BEGIN PGP SIGNED MESSAGE-----

Dan Lanciani wrote:

> "Jeroen Massar" <[email-masked]> wrote:

<SNIP>

> Again, it is not very interesting for the purposes of 
> determining whether IPv6 can _replace_ IPv4+NAT as suggested.

Even IPv4 can replace IPv4+NAT, anything can replace that
mechanism that is breaking end-to-end connectivity.

> Sure there is if the user has no access to the *local* end which is
> embedded in the tamper-resistant firmware of a smart phone.  My point
> was that this is a context where you can force the user to pay per
> address since he cannot install NAT within the phone.

I think you want to dig more into covert channels.
There is always a way in or out :)

> |> I understand that actual end-user requirements are not a 
> |> major consideration for IPv6 development.
> |
> |The enduser wants one thing: it needs to work(tm)
> 
> The end-user has tasted the power of internetworking.  I don't think
> you will make him forget that easily.  But then I may be wrong.  It
> is said that nobody ever lost money underestimating the intelligence
> of the consumer.  Or something like that.

You are wrong :) They tasted the filth of being behind NAT's
and not being able to do a number of things including VoIP.

> |> an individual networks his own computers and
> |> connects that network to the internet as in the 
> |> pre-commercial model. 
> |
> |Which won't scale as that would require to much routing
> |information and administration in the RIR's.
> 
> This is just another variation of the "PI doesn't scale" 
> argument.  The administration angle is kind of funny, though.  Isn't it 
> amazing how the registries manage to "administer" as many domain names as 
> anybody cares to pay for?  I guess it's much harder to keep a list of numbers 
> than to keep a list of names...

You mean that adminstration of domain names that includes a lot
of inconsistensies is handled by about 250 'registries' and usually
doesn't even contain any real data so that abuse is completely
impossible ?

> |> Your statement is extremely misleading, comparing apples and 
> |> turnips.  It is true that _a_ network connected without NAT
> |> enjoys a slightly larger
> |> set of capabilities (though they are capabilities that are 
> |> not important to the typical NAT user)
> |
> |Let me put it this way: they want their mp3's (-> warez).
> |Thus they need to do P2P as they know no other way.
> |This requires a non-NATted IP.
> 
> Of course, that's not quite true.  People keep trying to 
> project onto NAT the problems caused by the provider's
> limitation of a single IP address.

NAT limits me in the way the internet was designed.
Which was made to communicate between hosts: End To End.
Not Multi To End.

<SNIP>

> |> The correct comparison, then, is between a NAT-connected network
> |> and a network that is not connected to the internet at all.  
> |> Which one enjoys greater capability?
> |
> |The NAT connected network with an IPv6 tunnel :)
> 
> I agree that that is even better:
> 
> (NAT connected network with IPv6 tunnel) >
> 	(NAT connected network) > (unconnected network)
> 
> However, I suspect that you will find that if/when IPv6 access becomes
> valuable to the typical customer, your tunnel broker will 
> start charging you for addresses just as your local ISP would.

Accidentally it is partially 'my' tunnelbroker ;)
I have heared of nobody yet doing this and I don't expect
it become that way for the coming couple of years.
At least not while there is no general IPv6 access.
The company that owns the POP makes up their own
policy and can make it a public or a closed POP.
Charge whatever they want, that is their business.
But in the spirit of good will and the fact that
most other services (ftp servers/public download)
will cost them much more traffic all except two of
the POP's are public, with 2 extra public ones in the pipe.

Actually there have been requests in the past for a service
like a tunnelbroker for which people have to pay to get
a stable set of IPv6 addresses which can move with them
when they swap ISP's. Basically this is also a way of
solving PI, just tunnel the space :)
Though one is not independent of the TB in that case.
But one is always dependent on one instance or another.

Greets,
 Jeroen

---

From: Benny Amorsen <[email-masked]>
Date: Tue, 21 Oct 2003 14:35:12 +0200

On 2003-10-21 at 14:15, Todd T. Fries wrote:

> I'm sorry to reply late to this, but I can't help but realize that
> NAT+IPv4 vs IPv6+firewall can be equivalent in `isolation'.  Simply
> `block in all' and `pass out on $ext_if keep state' (in the pf terms of
> OpenBSD) and in two rules you have the same isolation of a NAT+IPv4 as
> you do with IPv6+firewall.

Imagine that two internal hosts are communicating in your scenario. They
have a TCP connection running for weeks. Then the outside connection to
the Internet breaks and is brought back up, but assigned a different
address. In the IPv4+NAT case hosts that only contact other hosts on the
internal network do not notice the failure at all. In the IPv6+firewall
case the new addresses are provided to the hosts and eventually the old
addresses time out -- and the internal TCP connection breaks. Ouch.

/Benny