from Hacker News

CGNAT frustrates all IP address-based technologies (2019)

by wofo on 3/5/25, 7:52 PM with 61 comments

  • by throw0101d on 3/5/25, 8:42 PM

    (CG)NAT can been a real cost to ISPs, especially smaller ones:

    > Our [American Indian] tribal network started out IPv6, but soon learned we had to somehow support IPv4 only traffic. It took almost 11 months in order to get a small amount of IPv4 addresses allocated for this use. In fact there were only enough addresses to cover maybe 1% of population. So we were forced to create a very expensive proxy/translation server in order to support this traffic.

    > We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices.

    * https://community.roku.com/t5/Features-settings-updates/It-s...

    * Discussion: https://news.ycombinator.com/item?id=35047624

  • by LeoPanthera on 3/5/25, 9:10 PM

    Tailscale's "How NAT traversal works" blog is a fascinating read:

    https://tailscale.com/blog/how-nat-traversal-works

  • by easterncalculus on 3/5/25, 8:23 PM

    Google IPv6 traffic hit an all-time high this week: https://www.google.com/intl/en/ipv6/statistics.html

  • by slt2021 on 3/5/25, 8:21 PM

    The article tries to label something objectively good as something bad:

    >>One practical outcome is that government agencies find it harder to identify criminals behind particular IPv4 addresses.

    lol, lmao even.

    >>As a result, the agency says, investigations often involve examining and tapping the connections of many more people than really necessary.

    just incompetence abound, the police should suffer if they don't know how to do their job more effectively

  • by apitman on 3/5/25, 8:51 PM

    Requiring web services and ISPs to retain detailed logs in perpetuity until IPv6 is universal would be one way to expedite the transition.

    But personally I don't think IPv6 is ever going to happen. There's simply too little monetary incentive for supporting it. For outbound connections NAT/CGNAT works fine. For inbound connections you can use SNI routing with a tunnel[0].

    [0]: https://github.com/anderspitman/awesome-tunneling

  • by nfriedly on 3/5/25, 10:20 PM

    My ISP, Metronet, is mostly CGNAT. That broke some things for me, so I called in and they gave me a "free" static IP to fix it. Except, once per year they start charging me for it and I have to call back, and then they make it free again.

  • by LinAGKar on 3/6/25, 8:42 AM

    Wait, with OpenDNS you can change settings for everyone on an IP address just by connecting from the that same IP address? That seems horribly insecure.

  • by superkuh on 3/5/25, 8:19 PM

    CGNAT providers are not ISPs. They're web service providers, WSP.