Subject: RE: Netmeeting - NAT issue

From: "Peter Ford" <[email-masked]>
Date: Mon, 18 Mar 2002 18:40:13 -0800

Melinda,

I actually agree with most of what you say in the absolute.

I will note that the one thing going for the home network NAT guys is
that they have focused on making things work to the extent that they
even have George Hamilton selling NATs at the poolside on TV commercials
for Circuit City.  They may not take routing transparency seriously
enough, but they seem to have a real market for their products. 

The leading NAT gets the follow review on amazon.com:
Average Customer Review: <4 stars out of 5>  Based on 682 reviews!  

To that extent, they may have found the right engineering and usability
trade-offs for the home LAN scenario and perhaps even the common soho
solution.  I did not see a single comment in the amazon reviews citing
routing issues.

I think we can agree that a single protocol for traversal that works for
all topologies would be ideal.  

cheers, peterf

-----Original Message-----
From: Melinda Shore [mailto:[email-masked]] 
Sent: Monday, March 18, 2002 2:18 PM
To: Peter Ford
Cc: [email-masked]
Subject: Re: Netmeeting - NAT issue

>Ahh, it doesn't have to damage routing transparency.   If we were to
use
>a signaling protocol that is carefully crafted to preserve routing
>transparency (e.g. RSVP) then we can avoid this issue.

That's what I'm working on, but midcom and upnp as they're
currently defined most certainly do have routing-related
problems.

>The upnp guys are not really thinking of damaging routing transparency.

Of course they weren't.  But the assumptions that the network
is single-homed and that there's only one NAT in the path and
that there are no firewall interactions are inherently non-
general, and any assumption that they fix "the" problem is
necessarily incorrect.  Seeing this stuff touted as a general-
purpose fix makes me very uncomfortable.

Melinda

---

From: David Frascone <[email-masked]>
Date: Tue, 19 Mar 2002 08:40:02 -0600

Ok, I have to say something.

I agree that NATs are evil, and *should* not exist.  But, since ISP's
currently charge tons of money for more than one IP address, they always
*will* exist.

Maybe IPv6 will fix all that . . . . we can only pray . . .

--
David Frascone

        Reality is for those who can't handle Star Trek.

---

From: [email-masked]
Date: Tue, 19 Mar 2002 11:00:59 -0500

> currently charge tons of money for more than one IP address, they always

Bad logic.  They won't "always will".  They will as long as ISPs have the
current rate structure. Correlate the number of cell phones with the change in
pricing structure over the last few years....

-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: Keith Moore <[email-masked]>
Date: Tue, 19 Mar 2002 11:26:38 -0500

> for Circuit City.  

well, maybe he can solve the NAT problem, but I can't.

> solution.  I did not see a single comment in the amazon reviews citing

that's because when people do have problems with NATs, they don't see
it as a routing problem - they think there's a problem with the software.

in a just world, the NAT vendors would all be sued out of existence
for the harm they've done to the Internet.  in the real world, if you
can hire a famous personality to advertise your product on TV,
then by definition it must work well.

but at least folks in the IETF (mostly) know where the problems are.

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 19 Mar 2002 11:37:43 -0500

> Maybe IPv6 will fix all that . . . . we can only pray . . .

easily fixed.

get a single IPv4 address, assign it to a 6to4 router that's installed
at your border, and put up to 2**80 hosts (okay, 2**16 hosts if
you use stateless autoconfig) behind it.  you can then get to any of
those hosts from any another machine that speaks IPv6.  if those 
machines don't speak IPv6, they can often be upgraded to do so.
if they don't have IPv6 connectity, they can get it using 6to4.  

and you can use an old PC running NetBSD as a 6to4 router.

the technical solutions exist.  what is needed is for more OS vendors
to support v6 (and 6to4 on the host).

Keith

---

From: Joe Touch <[email-masked]>
Date: Tue, 19 Mar 2002 09:10:26 -0800

> currently charge tons of money for more than one IP address, they always

I wish there were more appreciation for the ephemeral nature of solutions.

Other things that "always *will* exist":

	- freon
	- smoking in bars
	- tobacco/hard liquor ads on TV
	- the dodo

I'm sure we could find a better list off-line; the point is that each of 
the above had reasons why it was inevitible and permanent.

It's OK to reject the status-quo.

Joe

---

From: Hans Kruse <[email-masked]>
Date: Tue, 19 Mar 2002 15:10:41 -0500

OK, but that does not solve the problem where the NATs are mostly deployed 
-- home and SOHO --  until all internet servers of interest to those users 
speak IPv6.  "Can be upgraded to do so" is great if you control the server, 
but these users don't.  So Yahoo, Google, etc can be pursuaded to upgrade, 
maybe...  and the home/SOHO user using the setup below does a search.  Many 
of the hits will be IPv4 only sites, and we are back to NAT.

Don't get me wrong, this is a good migration path and should be pushed as 
much as possible, but it is not as fast as your message implies.

> if they don't have IPv6 connectity, they can get it using 6to4.

Hans Kruse, Associate Professor
J. Warren McClure School of Communication Systems Management
Ohio University, Athens, OH, 45701
740-593-4891 voice, 740-593-4889 fax

---

From: Keith Moore <[email-masked]>
Date: Tue, 19 Mar 2002 15:34:08 -0500

> but these users don't.

true enough.  fortunately, NAT doesn't interfere much with www and email,
and a few other common services, so NATted v4 works okay to access these.
IMHO v6 will mostly be used to talk between things that don't work with
NAT. for those things, it's worth it to upgrade the hosts. and 6to4 
relives some of the immediate requirement to upgrade the net.

Keith

---

From: james woodyatt <[email-masked]>
Date: Tue, 19 Mar 2002 12:47:19 -0800

everyone--

I know this is a frequent source of heated discussion, and that much has 
already been said that doesn't need to be repeated here, but I *just* 
*can't* *let* *this* *go* unchallenged.

-----

On Tuesday, March 19, 2002, at 08:26 AM, Keith Moore wrote:
> [...]
> [...]

The harm done to the growth potential of the Internet by the widespread 
deployment of NAT routers is not the fault of the people who make them.

That there is a profitable business to be made in selling NAT appliances 
to non-technical Internet users is *not* the root cause of the problem.  
It's a symptom, and I think the IETF would do very well to think long 
and hard about how to solve the real problem illustrated by the ubiquity 
of NAT routers in residential settings: strategic opposition to the 
end-to-end architecture among large retail Internet service providers.

The first thing I would suggest is to sit back and contemplate whether 
the situation bears any resemblance to other problems in which the user 
population engages in behavior that results in short-term personal 
benefit in exchange for long-term harm to the welfare of society.

In fairness, I should disclose that I am currently employed by a company 
that sells-- among other fine products-- a home gateway appliance with a 
NAT routing function; also, my responsibilities include integrating the 
library of ALG implementations it offers.  So, yes-- I've been having 
this debate with myself for years.

I very much wish there were a profitable business to be made selling 
home gateway appliances with IPv6 and 6to4 support, but I also very much 
wish that Afghan farmers could make a living growing wheat instead of 
opium.  Sadly-- there is not much business to be made that way today, 
and whether there will be a thriving business there in the near future 
remains a very open question.

--
j h woodyatt <[email-masked]>

---

From: Keith Moore <[email-masked]>
Date: Tue, 19 Mar 2002 16:10:41 -0500

> benefit in exchange for long-term harm to the welfare of society.

granted there are numerous instances of this.  but it seems disingenuous 
to blame the NAT problem on users when the NAT vendors are doing their 
best to mislead users about the harm that NAT does.

---

From: Harald Koch <[email-masked]>
Date: Tue, 19 Mar 2002 17:31:49 -0500

Of all the gin joints in all the towns in all the world, Keith Moore
> best to mislead users about the harm that NAT does.

I think you missed the important point. It's not the NAT vendors, it's
the ISPs.

I have 6 computers at home. I'd be perfectly happy to have a /28 or so
of address space routed for me by my ISP, but I would have to upgrade
from the residential $40/month connection to the business $500/month to
do so.  I'll think I'll buy a $130 Linksys box and pocket the savings,
thank you very much.

I understand the limitations of NAT environments, having built two
commercial ALG firewalls and maintained several linux based ones for my
friends. I just don't really have any choice. My ISP doesn't offer IPv6
(and won't for the foreseeable future). I do have an IPv6 tunnel from a
tunnelbroker, and I do run 6to4, but that doesn't connect me to very
much.

(All $ are Canadian. :-)

-- 
Harald Koch     <[email-masked]>

"It takes a child to raze a village."
		-Michael T. Fry

---

From: james woodyatt <[email-masked]>
Date: Tue, 19 Mar 2002 14:47:08 -0800

On Tuesday, March 19, 2002, at 01:10 PM, Keith Moore wrote:
> [I wrote:]

I did not mean to imply that my employer's customers are to blame for 
"the NAT problem," or to excuse the NAT vendors (including my employer) 
who mislead their customers about the harm caused by NAT routers.

In the sentence immediately before the one you quoted, I expressed the 
following opinion (admittedly, as if it were fact):
>
> [...] the real problem illustrated by the ubiquity of NAT routers in 
> residential settings: strategic opposition to the end-to-end 
> architecture among large retail Internet service providers.

I could be wrong about this, but I really believe this is the root cause 
of the NAT problem, not ignorant users or self-interested appliance 
vendors.

---

From: Keith Moore <[email-masked]>
Date: Tue, 19 Mar 2002 21:10:42 -0500

> I think you missed the important point. It's not the NAT vendors, it's

I'll grant that ISPs have something to do with it.  But there is a
shortage of IPv4 addresses, so it's not as if anybody can have as
many as they want.  And it's not the fact that people are selling
NAT that I find objectionable, it's the fact that they are marketing
them as a general purpose solution - misleading people about their
applicability - rather than a stopgap measure.

Keith

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 20 Mar 2002 12:29:07 +0859 ()

Keith;

> many as they want.

Wrong.

There actually is no shortage of IPv4 addresses.

The primary reason of why NAT is so popular is that NICs do not offer
IPv4 addresses promptly, because NICs feared shortage of IPv4 addresses.

The wrong policy on IPv4 address assignment made NAT profittable.

						Masataka Ohta1

---

From: "Meritt James" <[email-masked]>
Date: Wed, 20 Mar 2002 09:11:33 -0500

See the problem?  Lots of "That is not the problem, THIS is the REAL
problem" and all too few doable solutions.

Throwing rocks is easy.  Catching them is harder.
-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---

From: "Melinda Shore" <[email-masked]>
Date: Wed, 20 Mar 2002 12:50:59 -0500

>From: "james woodyatt" <[email-masked]>

I don't believe that there's a NAT problem.  There are many
NAT problems, and the opportunity to use more addresses than
are available to you is only one of them.  It's increasingly
the case that NATs are being used to enforce policy domain
separation, including security, and to the extent that that
function is established and spreading it's very much the fault
of vendors.  There's a challenge here, and that challenge is
to support site-local policy in a way that's consistent with
the design of the underlying technology.  Right now the 
mechanisms that vendors are selling and users are buying are
too willy-nilly not to break.

Melinda

---

From: "Vivek Gupta" <[email-masked]>
Date: Wed, 20 Mar 2002 14:13:59 -0500

But what do U say about people using it at home ....SOHO
One is not going to buy 3 IP's if someone tries to use it at home.
The objective is to make Internet accessible to everybody at the least $ out
of pocket.
We should not forget that.

Vivek

---

From: "Vivek Gupta" <[email-masked]>
Date: Wed, 20 Mar 2002 14:20:05 -0500

I agree

---

From: Keith Moore <[email-masked]>
Date: Wed, 20 Mar 2002 14:36:38 -0500

> But what do U say about people using it at home ....SOHO

if people understand that NATs allow them to run web and mail 
clients from multiple machines but prevent them from running
most other apps, then I don't have any problem with it.
again, the problem isn't that NATs exist, but that people
are misled about the harm that they do - to the point that
if an application won't work over NAT, folks blame the application.

> IPV6 is running away from current problem .... not the solution ......

no, I don't think so.

the only way to solve the NAT problems is to provide better ways
of doing things that NATs purport to do, while at the same time
not causing the damage that NATs cause.  in particular,   

1 provide an end-to-end global address space 
2 provide better mechanisms for security/policy enforcement than those 
  based on patterns of address bits
3 make it as easy to plug a network into the Internet as it is to 
  plug in a host
4 minimize the burden of renumbering 

IPv6 is attempting to do all of these except #2.  

Keith

---

From: Peter Deutsch <[email-masked]>
Date: Wed, 20 Mar 2002 12:31:20 -0800

g'day,

> most other apps, then I don't have any problem with it.

And if your objection to NATs ended there, I wouldn't have a problem
with it. But instead of then working to change the protocols that break
with NATs, you continue to insist, Canute-like, that you can turn back
the tides and move the world back to a pre-NAT world. This is probably
even more irritating to me than your continual use of "ITEF" without the
article.

Who was the Roman Senator who ended every speech with "Carthage must be
destroyed"? You might take solace from the fact that eventually Carthage
was destroyed, but the power struggles and cost of that conflict hurt
Rome hugely in the process. Better to light a candle than to curse the
darkness, and all...

> if an application won't work over NAT, folks blame the application.

I might ask why you aren't more actively seeking ways to accomodate
things, rather than hoping that you're going to turn back the NAT tide
this late in the day. The water's gone beyond your ankles and is lapping
your ears on this one. It's time to accept that you lost a technical
argument and move on...

			- peterd
-- 
-----------------------------------------------------------------------
   Peter Deutsch                   [email-masked]
   Gydig Software

      "This, my friend, is a pint."
      "It comes in pints?!? I'm getting one!!"

                         - Lord of the Rings

----------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Wed, 20 Mar 2002 15:47:09 -0500

> the tides and move the world back to a pre-NAT world. 

A Canute-like approach would be trying to fix protocols that break with 
NATs.  It's easier to turn back the tides than to recover the 
functionality lost due to NATs.  To the extent that you can recover it, 
you lose scalability, efficency, reliability, and increase deployment 
barriers.

I'm not trying to do that, because it's clearly futile.  Nor do I 
pretend that NATs will go away without a better solution in place
to problems that caused people to buy NATs.  Rather, I'm concentrating 
my efforts in areas that might actually produce useful results.  Part 
of that effort is to improve IPv6.  Part of that effort is to try to 
dispel some of the widespread disinformation/delusion/fantasy about NATs.

As for a genuine effort to understand how to build applications that 
can operate (to some degree) in the presence of NATs, see 
draft-moore-nat-tolerance-recommendations-00

Keith

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 20 Mar 2002 14:13:57 -0700 (MST)

> From: Peter Deutsch <[email-masked]>

> Rome hugely in the process. Better to light a candle than to curse the

I thought it was agreed among histgorians that the destruction of
Carthage was not only worth the cost but probably necessary for
the development of the Roman Empire.

> ...

I've not noticed any technical arguments any that have been lost
in the real world or anywhere else.
I think Keith goes a little overboard in his efforts arguments, but
when talking about NAT itself, let's please keep to the facts.  One
fact is that NAT boxes are widely and grossly misrepresented by vendors
and trade rag consultants.

Vernon Schryver    [email-masked]

---

From: "Melinda Shore" <[email-masked]>
Date: Wed, 20 Mar 2002 16:39:24 -0500

>From: "Peter Deutsch" <[email-masked]>

The protocols that break in the presence of NATs are not 
illegitimate, badly-designed protocols.  Simplicity is good, 
but sometimes complex problems really do call for complex 
solutions.  Aside from that, consider the problem of running 
a server.  

I'm very comfortable with identifying NAT as a problem.  I'm 
far less comfortable with the "STOP BREAKING MY INTERNET" thing.

Melinda

---

From: [email-masked]
Date: 22 Mar 2002 01:50:29 -0000

> benefit in exchange for long-term harm to the welfare of society.

IMHO, most people who buy Internet access and/or services are not anywhere
near as savvy about what the Internet does as most people who contribute
to this list.  On the other hand, they are particularly savvy about how
they want to spend their money.  If it costs them less to give several
devices (what they believe to be) Internet access by buying a NAT device
than purchasing a block from their provider, that's what they're going to
do.

--gregbo

---

From: [email-masked] (Claus Färber)
Date: 27 Mar 2002 14:17:00 +0200

> to support v6 (and 6to4 on the host).

What we do need are "killer applications". Just imagine what would
happen if Quake IV required IPv6[1]. ;-)

Claus

[1] and came with everything you need to make your host IPv6-
    capable, of course.
-- 
------------------------ http://www.faerber.muc.de/ ------------------------
OpenPGP: DSS 1024/639680F0 E7A8 AADB 6C8A 2450 67EA AF68 48A5 0E63 6396 80F0

---

From: Harald Koch <[email-masked]>
Date: Wed, 27 Mar 2002 14:08:23 -0500

> happen if Quake IV required IPv6[1]. ;-)

Well, since you mentioned it:

<http://www.viagenie.qc.ca/en/ipv6-quake.shtml>