How is NAT a hack?

Question

Forgive me if this sounds a little amateurish, or if this is the wrong stackexchange, but...most of my entirely life I've had ipv4 behind a NAT router. I've been told that this was a hack; simply because the Internet was running out of ipv4 addresses.

I understand the concepts of ip address, routers, subnets, routes (between subnets), ports, and I'm beginning to understand bridges; but I do not understand how the Internet is to work without a being behind a nat router...having not lived before NAT I do not understand why it is a hack...does an IPv6 Internet without NAT just mean that everybody gets an ip and there's no need for a NAT router in between with a single unifying ip address protecting all the machines on the network from being accessed? It sounds to me like instead of a single firewall on a single router, each machine will have to fend for itself with its' own firewall.

So why is NAT a hack and how did things work before that hack was implemented? Also what was so great about it?

I live in the USA, so we don't have alot of choice when it comes to internet and most of the ISPs are ipv4 (or at least they are where I live).

Answer 1

Before NAT every device connected to the internet had its own IP address. That was how the internet was designed. This gives you great flexibility and visibility. If you have a firewall then it can filter traffic for each address, protocol, port etc individually if you want. Because the source address and port (if applicable, not all protocols have ports) and destination address and port do not change between the sender and the receiver it is much much easier to debug. And if you want to let a device look after its own security that is possible too: just tell the firewall not to filter anything on that address, or not use a firewall device at all. Your choice :)

Let's look at the simplest case of NAT: When you ISP only gives you one address you can only connect one device to the internet. This is not what most people want: they need to connect multiple devices. So that single device performs a masquerading trick so that to the outside world it looks like that single device is doing all the internet communication, while behind that device there can be multiple devices that think they have a normal connection to the internet while not really having one. The trick that that single device with a real internet address uses is NAT.

NAT can only do its 'multiplexing' for protocols that use port numbers. For protocols without port numbers a connection is defined by the addresses. As you only have one 'real' address you can only have one connection. For protocols with port numbers like UDP and TCP a connection is usually defined by both addresses and ports. So 37.77.56.75:12345 <-> 94.142.242.216:80 can be one connection and 37.77.56.75:23456 <-> 94.142.242.216:80 another.

If 37.77.56.75 was a NAT device (it's not, it is my own PC's address, I don't use NAT here) it could have an internal state table that remembers that 37.77.56.75:12345 corresponds to internal address 192.168.0.11:32431. Outgoing packets get their original source address and port (192.168.0.11:32431) replaced with the NAT device's own (37.77.56.75:12345), and the reverse is done for incoming packets.

What often causes some confusion with NAT and (stateful) firewalling is that both of those functions need to remember state: who is talking to whom?

A stateful firewall also has to keep track of who is talking to whom. So both a NAT device and a firewall need to remember that there is a session 37.77.56.75:12345 <-> 94.142.242.216:80. A NAT device also has to remember that 37.77.56.75:12345 is really 192.168.0.11:32431. A firewall does some extra filtering and inspections to the traffic.

A NAT device without a firewall function will let unwanted traffic through if it happens to match something in its state table. A firewall will apply inspections to prevent that. But a firewall can also do that if the addresses of incoming and outgoing packets aren't changed: it doesn't need NAT to be able to perform its function.

NAT is considered a hack because it makes the internet more complex. Addresses and ports are being changed, a NAT device has to remember what the original addresses and ports were, it has to actually understand all transport protocols it is applying NAT to so it prevents new transport protocols from being deployed (nobody will use new transport protocols because no NAT device will support them, and NAT devices won't support them because nobody uses them) etc.

Answer 2

I've been told that this was a hack; simply because the Internet was running out of ipv4 addresses.

That's correct. The original concept of IPv4 was to provide end-to-end connectivity so that each device could connect to any other device.

NAT is a crutch for various reasons:

• it is a bottleneck
• diagnosing network problems doesn't get easier
• several protocols at higher levels carry IP addresses for various reasons in their payload. For instance, for VoIP with SIP+RDP the IP address of the caller is transmitted to the callee in the SDP payload of a SIP signalling message. NAT breaks this, so further crutches are needed (e.g. STUN and/or TURN) to remediate this. The complexity is thus further increased.
• When using one-to-many NAT (a.k.a. "Cone NAT") the addresses of the stub network are mapped to the external address of the NAT gateway. More precisely, addr_in/portnum in the stub net are mapped to addr_ex/portnum for a fixed addr_ex. Now there are only 65535 ports for TCP, UDP, or SCTP, so this limits the number of connections that can be NATed concurrently. As a private user in a class C stub net (e.g. 192.168.xx.0/24) you barely notice this limit, but some ISPs use "Carrier Grade NAT" (CGN), which is simply double NAT. At this point, the mentioned limitation becomes a serious problem.
• Another problem with CGN is blacklisting. If you manage to get yourself on an address based blacklist, then so are all your NAT "neighbors".

does an IPv6 Internet without NAT just mean that everybody gets an ip and there's no need for a NAT router in between with a single unifying ip address protecting all the machines on the network from being accessed? It sounds to me like instead of a single firewall on a single router, each machine will have to fend for itself with its' own firewall.

It is a myth ineradicable as weeds that (a) NAT is a security mechanism and (b) that with IPv6 every machine can connect to every other machine. First, yes, NAT acts somehow like a very rudimentary packet filter, but is not a substitute for a real packet filter. Second, you can protect entire IPv6 networks with a packet filter as before with IPv4, thus you don't need to protect each host individually.

Answer 3

Network Address Translation (NAT) and Port Address Translation (PAT) have been widely deployed since the early days of the Web. It may be misleading to characterize NAT/PAT as a hack.

Restoring end-to-end connectivity is a design goal of IPv6 where NAT is not commonly deployed ¹.

The firewall, and current next-generation firewalls, are dedicated network-based devices that perform deep packet inspection which is outside the role of NAT/PAT.