The challenge didn’t ask to disable ipv4 but it was (jokingly) daring people to expose all ports to public to see how long the system would last before being exploited by bots. It wasn’t meant to be taken seriously 😆
You can essentially achieve this with some routers with a “DMZ” network segment/ device, so all incoming requests to your external IP get forwarded to it automatically. You don’t even need to disable NAT if you set it up well.
A standard DMZ still does NAT. You get a private IP and the router "nat"s you, just that it forwards all incoming traffic to that device by default. I think technically, that gets you disqualified for no nat november. Though, you’d end up exposing the ports of the machine to incoming traffic, that’s correct.
I admittedly did not read the original Mastodon post from nixCraft about the purpose of No NAT November, but surely it’s not just about moving to IPv6? You can (and usually would) still do NATing with IPv6. You don’t want every device to be internet-exposed, but still want them to be able to access the internet (and who wants to configure internet-defensive firewall rules on all their internal home hosts)?
I don’t agree that you usually would still use NAT with IPv6. I’ve never seen NAT in combination with IPv6 and I’ve seen plenty of deployments at our customers. NAT is not the same as a firewall, so just using public IPv6 addresses does not mean that you are exposing every port by default. I think you should read up on IPv6 and firewalling before making statements like this :)
Edit: you don’t even have to set up firewalling on each internal device… the router/firewall blocks inbound traffic by default.
So first off, I think it’s safe to assume that the article is not about going and removing IPv4 on your company’s corporate networks for a month, so I’ve been speaking in regards to home internet service.
NAT is not a firewall, but in normal use by the average home internet user it is a means to prevent computers outside of their network from reaching computers inside the network without ports being forwarded on the router, or the internal machine initiating the connection. If you do not have a firewall on the devices, and they are not behind a NAT gateway/router, then they are by default exposing ports. There’s no inherent guarantee that a router has a firewall configured properly, or has it enabled.
I’ve never seen NAT in combination with IPv6 and I’ve seen plenty of deployments at our customers.
I’m interested in how this works. In a normal IPv4 scenario for home internet users, you are assigned a single IP for your router by your ISP, and internal addressing is usually handled by router-resident DHCP automatically. In the deployments you’re seeing, are ISPs handing out /120 blocks to each router? Does that require the ISP to have access to alter your home router, or do customers configure the DHCP themselves (which seems unlikely to scale)?
That’s right. People want a firewall. Maybe on the devices and/or on the router. But NAT isn’t that. It’s address translation. Predominantly because there aren’t enough addresses available. It’s a workaround. And it kills things like VOIP, videoconferences, direct communication etc. And then you need a workaround for the workaround to work around that… If you just want to drop incoming traffic and not expose clients, that’s what the firewall is for.
The challenge didn’t ask to disable ipv4 but it was (jokingly) daring people to expose all ports to public to see how long the system would last before being exploited by bots. It wasn’t meant to be taken seriously 😆
NAT != closing ports
How would you disable NAT and still use ipv4 unless you are able to assign a public IPv4 to your PC (and have nothing else in the network)?
You got it on the nose, only one device.
You can essentially achieve this with some routers with a “DMZ” network segment/ device, so all incoming requests to your external IP get forwarded to it automatically. You don’t even need to disable NAT if you set it up well.
A standard DMZ still does NAT. You get a private IP and the router "nat"s you, just that it forwards all incoming traffic to that device by default. I think technically, that gets you disqualified for no nat november. Though, you’d end up exposing the ports of the machine to incoming traffic, that’s correct.
I admittedly did not read the original Mastodon post from nixCraft about the purpose of No NAT November, but surely it’s not just about moving to IPv6? You can (and usually would) still do NATing with IPv6. You don’t want every device to be internet-exposed, but still want them to be able to access the internet (and who wants to configure internet-defensive firewall rules on all their internal home hosts)?
There’s a reason that FD00::/7 exists.
I don’t agree that you usually would still use NAT with IPv6. I’ve never seen NAT in combination with IPv6 and I’ve seen plenty of deployments at our customers. NAT is not the same as a firewall, so just using public IPv6 addresses does not mean that you are exposing every port by default. I think you should read up on IPv6 and firewalling before making statements like this :)
Edit: you don’t even have to set up firewalling on each internal device… the router/firewall blocks inbound traffic by default.
So first off, I think it’s safe to assume that the article is not about going and removing IPv4 on your company’s corporate networks for a month, so I’ve been speaking in regards to home internet service.
NAT is not a firewall, but in normal use by the average home internet user it is a means to prevent computers outside of their network from reaching computers inside the network without ports being forwarded on the router, or the internal machine initiating the connection. If you do not have a firewall on the devices, and they are not behind a NAT gateway/router, then they are by default exposing ports. There’s no inherent guarantee that a router has a firewall configured properly, or has it enabled.
I’m interested in how this works. In a normal IPv4 scenario for home internet users, you are assigned a single IP for your router by your ISP, and internal addressing is usually handled by router-resident DHCP automatically. In the deployments you’re seeing, are ISPs handing out /120 blocks to each router? Does that require the ISP to have access to alter your home router, or do customers configure the DHCP themselves (which seems unlikely to scale)?
That’s right. People want a firewall. Maybe on the devices and/or on the router. But NAT isn’t that. It’s address translation. Predominantly because there aren’t enough addresses available. It’s a workaround. And it kills things like VOIP, videoconferences, direct communication etc. And then you need a workaround for the workaround to work around that… If you just want to drop incoming traffic and not expose clients, that’s what the firewall is for.
you connect your PC directly out of the link that the ISP is giving you (if allowed), for example via PPPoE