With Halloween approaching, it seems like an appropriate time to write about NAT. When I first learned about Network Address Translation (NAT), it seemed cool because even though lame ISPs would only give one address per customer, we could still set up a whole network of computers behind a router. It was a great hack.
To my horror, I later learned that some people view NAT as a security feature. These misguided souls fall into two categories: a) friendly but confused people who aren't aware that firewalls can have deny-by-default policies, b) dangerously naive people who believe that NAT is a security panacea even though they recognize that it merely provides security-by-obscurity. The University of Michigan has produced a document, Security Considerations of NAT, that criticizes the use of NAT for security in a much more friendly tone than I would be willing to take. An adequate summary is that NAT doesn't provide nearly as much obscurity as it is usually given credit.
BYU spent tremendous amounts of money a few years ago to roll out NAT across campus, when they should have spent that money to configure firewalls and implement IPv6 (in my opinion, of course). Most people at BYU are nice, so I assume that those responsible fall under group (a), but I'm disappointed in the results.
I hope that as sites eventually start making the move to IPv6, they will consider dropping NAT instead of keeping the "conventional wisdom" of IPv4 and repeating the same mistakes. If we can finally get rid of NAT, I think this would open up a huge amount of innovation for peer-to-peer applications that we can't even imagine yet, in addition to the great applications we already have which are being stunted by the prevalence of NAT. As a user whose home network currently sits behind two layers of NAT, I'm really looking forward to change, although I'm still scared that we might get stuck with the status quo.
Happy Halloween.
No comments:
Post a Comment