Subject: Re: RE: Stupid NAT tricks and how to stop them.

From: John Loughney <[email-masked]>
Date: Tue, 11 Apr 2006 10:33:12 +0300

Lars-Erik,

> > From: Michel Py [mailto:[email-masked]]
> > Unfortunately some protocol purity zealots still have to realize
> > that Linksys, Netgear, Belkin and consorts don't sell NAT boxes
> > because they think NAT is good, they sell NAT boxes because
> > consumers want to buy them. 
> 
> I do not think consumers in general want to buy NAT boxes, but
> they are forced to do so by ISP's who do not give them a choice.

We're over-analyzing things. The last 3 WLAN APs I bought had NAT on by default; 2 of them it was impossible to turn this off.  I got into long discussions with tech support who were telling me it is impossible to design a WLAN AP-router combo that didn't NAT.  

My DSL provier offers me 5 DHCP address for free (consumer grade connection) and my mobile carrier is now using real IP address for GPRS (they had too many problems caused by NATed IP addresses).  

In practice, I've needed to power-cycle these NAT boxes every few weeks, to clear out the garbage.  The most common things most ISP tech support lines are "unplug your router/AP/box", count to 60 and plug it back in.  

However, if I am just a normal user, go to Best Buy and pickup a home WLAN Access Point, I'll have a NAT by default.  There is no "NAT inside" logo on the box, nor are there clear instructions on how to turn this off.  Vendors have turned NAT on by default because it is easier for them; not because the market has asked them to.

As for reference, my local paper started, computer stores started advertising "NAT firewalls" around 1998-99.  When NATs first came to a the market, the marketing message was that NATs provided a security feature.  Still, I have far too many tech support discussions where there is common confusion between NAT & firewall features.  I don't think it is really intellectually honest to say the market has chosen NATs because it is what they wanted - it is a band-aid fix for a couple of different problems, which it kind of solved, but creates some ugly side effects.  

To get around these side effects, people are deploying ALRs, B2BUA and SBCs to help fix the side-effects (and to do other things).  Human nature being what it is, we'll probably keep applying these quick fixes, until it gets far to messy and someone comes in and wipes these away with a new solution.  Circuit switching, ATM, ISDN, etc. all have been useful for some solutions - but when you try to go beyond what they have been designed for, you tend to have to apply patches and hacks to get things working.

John

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Peter Dambier <[email-masked]>
Date: Tue, 11 Apr 2006 13:57:14 +0200

> We're over-analyzing things. The last 3 WLAN APs I bought had NAT on by default; 2 of them it was impossible to turn this off.  I got into long discussions with tech support who were telling me it…

Just for curiousity: The TI chipset AR7 is the core of a couple of boxes.
The all run linux and you can telnet them. They can route. No need for NAT

My box is an Eumex 300 IP from t-online.de
It is the same as the Fritzbox from AVM.

Netgear, Siemens, Linksys and D-link produce similar boxes.

I remember some people at RIPE loudly thinking about writing their own
software for the Netgear or the Linksys.

> My DSL provier offers me 5 DHCP address for free (consumer grade connection) and my mobile carrier is now using real IP address for GPRS (they had too many problems caused by NATed IP addresses).  

DHCP is almost as bad as NAT is. Best get an aDSL-modem, if you are connected by aDSL
then distribute the line via a switch and let your five coputers to the PPPoE stuff.
So your computers are the DHCP clients and can dyndns or whatever.

> In practice, I've needed to power-cycle these NAT boxes every few weeks, to clear out the garbage.  The most common things most ISP tech support lines are "unplug your router/AP/box", count to 60 a…

I have had that same power-cycle problems with a GrandStrem ATA for my VoIP.
My ISP dtag.de or t-online.de forces a disconnect every 24 hours. Sometimes
they dont disconnect very cleanly and the Grandstream breaks.

Best forget GrandStream. It breaks ICMP and it has problems with ssh and
telnet passing through. Problably it does not get MTU correctly from
people living behind tunnels. Their support never cared to answer.

A Siemens router is now connected for half a yaer without any power-cycles.
I guess the box is one of those AR7 linux boxes.

My eumex too did not show any problems except for nagging about undisciplined
disconnects form my ISP.

> However, if I am just a normal user, go to Best Buy and pickup a home WLAN Access Point, I'll have a NAT by default.  There is no "NAT inside" logo on the box, nor are there clear instructions on h…

I guess if you are a normal user then you are a loser anyhow.
Those people normally have open windows and they dont know
how to close them :)

Putting those people behind triple NAT would not only save their
harddisk some viruses but it would save our bandwidth too -
keeping them from p2p each other :)

> To get around these side effects, people are deploying ALRs, B2BUA and SBCs to help fix the side-effects (and to do other things).  Human nature being what it is, we'll probably keep applying these…

Cheers
Peter and Karin

-- 
Peter and Karin Dambier
The Public-Root Consortium
Graeffstrasse 14
D-64646 Heppenheim
+49(6252)671-788 (Telekom)
+49(179)108-3978 (O2 Genion)
+49(6252)750-308 (VoIP: sipgate.de)
mail: [email-masked]
mail: [email-masked]
http://iason.site.voila.fr/
https://sourceforge.net/projects/iason/

---

From: Jari Arkko <[email-masked]>
Date: Tue, 11 Apr 2006 15:12:14 +0300

> software for the Netgear or the Linksys. 

People ARE writing software for these devices. And
using their software. See,  for instance,
http://en.wikipedia.org/wiki/Wrt54g
Among the publicly available enhancements you
can get a tunneled v6 service if your provider
doesn't support it natively.

--Jari

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 11 Apr 2006 16:41:24 -0600

On 4/11/06 12:33 AM, "John Loughney" <[email-masked]> wrote:

> In practice, I've needed to power-cycle these NAT boxes every few weeks, to
> clear out the garbage.

I'm curios to understand more of what you mean by this? Are you running out
of ports? Do you have any ideas what is causing this? (I have a strong
interest in the many ways NATs fail :-)

---

From: Peter Dambier <[email-masked]>
Date: Wed, 12 Apr 2006 16:51:40 +0200

> interest in the many ways NATs fail :-)

Linux: http://www.eisfair.org/
host_type("echnaton","(none)","Linux echnaton 2.2.19 #15").

No problems, but from time to complains about not so clean seesion
termination by dtag.de

_____

Fritz_Box_Eumex300IP
cpu model               : MIPS 4KEc V4.8
BogoMIPS                : 149.91
Linux version 2.4.17_mvl21-malta-mips_fp_le

No problem either, but from time to time I find in my telnet session:

Apr 11 05:22:04 dsld[381]: Channel 0 closed (physical)
Apr 11 05:22:04 dsld[381]: EVENT(36): Zeitüberschreitung bei der PPP-Aushandlung. (PPP_LCP)
Apr 11 05:22:04 dsld[381]: internet: PPP_LCP TIMEOUT
Apr 11 05:22:04 dsld[381]: starting autodetection
Apr 11 05:22:04 voipd[402]: connstatus 4 -> 2
Apr 11 05:22:07 dsld[381]: autodetect: failed
Apr 11 05:22:07 dsld[381]: atm socket rmem 65534
Apr 11 05:22:07 dsld[381]: PPPoEFW: set_snd_mtu: 1492
Apr 11 05:22:07 dsld[381]: PPPoEFW: set_rcv_mtu: 1492
Apr 11 05:22:07 dsld[381]: PPPoE forwarding for lan enabled.
Apr 11 05:22:07 dsld[381]: internet: set_rcv_ipaddr: 192.168.179.1
Apr 11 05:22:07 dsld[381]: internet: connecting
Apr 11 05:22:07 dsld[381]: internet: 00:04:0e:6d:8a:43
Apr 11 05:22:07 dsld[381]: internet: 00:04:0e:6d:8a:43
...
repeating

_____

Grandstream ATA-486
Red lite blinking, saying VoIP is dead.
HTML does not connect at all.
No Ping either.

Only unplugging power get the box back.

_____

dtag.de forces session termination every 24 hours. Sometimes
they are nasty and terminate the session several times within
a short time or they simply go dead. Happens rarely.

Everytime I get a new ip-address after reconnecting. That is
all what this silly session termination is about. Just to
anger the VoIP people. They are selling VoIP themselves those
silly buggers :)

The Grandstream goes bonkers when session terminations is
forced but the session is not terminated propperly but simply
broken.

There is another problem with the GrandStream: It does not
handle ICMP properly. It breaks MTU discovery and traceroute.

Cheers
Peter and Karin