Verizon DSL is moving to Carrier Grade NAT(www22.verizon.com)

56 pointsby ianlevesquevor 13 Jahren39 comments

www22.verizon.com

Verizon DSL is moving to Carrier Grade NAT

http://www22.verizon.com/support/residential/internet/highspeedinternet/networking/troubleshooting/portforwarding/123897.htm

12 comments

agwavor 13 Jahren

I'm surprised this is happening already in the US. ARIN still has address space available[1] (not much, but more than Europe and Asia) and (unlike Asia) broadband growth is slowing in the US (since nearly everyone has broadband now)[2]. Does Verizon really expect to run out of IP addresses for new subscribers soon? Or do they need IP addresses for something else? I'd love to hear the thoughts of someone more knowledgeable about this.

[1] https://www.arin.net/resources/request/ipv4_countdown.html

[2] http://gigaom.com/2012/11/14/us-broadbands-new-reality-slowi...

kevin_nisbetvor 13 Jahren

I can't speak for Verizon, but in Canada I know we're looking at Carrier grade NAT since Cellular is requiring additional IP space and is still a massive growth area.

We already use NAT for cellular users, but as the network grows, public IP space is still needed for network equipment, for the NAT gateways, etc.

bryanmigvor 13 Jahren

This isnt that big a deal. They say that you can opt out of this and that it does not apply to Fios or Business customers.

I'm sure there is a huge amount of customers who will never have any clue that anything has changed since they dont play games, run servers, need VPNs, etc.

It's probably a good thing for everyone else given that it does raise even more awareness of the problem.

georgemcbayvor 13 Jahren

There are some large-ish groups of people out there for whom this will cause issues, eg. people who play console multiplayer gamers (millions of people including Halo/COD/etc players).

As someone who games on Xbox Live, a part of me would actually like to see this become more common with other carriers to force next gen consoles to move to a dedicated server model since the current "pick a host among the gamers in the lobby and hope for the best" model results in a fairly poor experience a lot of time even without pervasive CGNATing.

icebrainingvor 13 Jahren

Unfortunately, things seem to be moving the other way, with PC FPSs (traditionally using dedicated servers) adopting the lobby model - it's why I never moved beyond CoD 4.

Alohavor 13 Jahren

And so? You can still opt out?

vy8vWJlcovor 13 Jahren

I can also opt out of my ISP's DNS hijacking, but I don't bother to anymore. (It keeps forgetting me when I get a new address.) It's simply become the new norm.

ianlevesquevor 13 Jahren

This is unfortunately going to be just the first of many consumer ISPs that resort to CGNAT before they have an IPv6 rollout underway.

pixl97vor 13 Jahren

http://www22.verizon.com/Support/Residential/Internet/HighSp...

Verizon shows some IPv6 support over FIOS. In the quick search I performed I didn't see any info about DSL. I've been hounding Suddenlink about their IPv6 support for some time. The response I received from one of the techs was that they were having issues with Cisco on the headend equipment.

rwgvor 13 Jahren

This agrees with what I've read about Comcast's IPv6 deployment to cable modem customers — they're rolling it out quickly in markets served by Arris CMTSes and not at all in markets served by Cisco CMTSes, citing problems with the Cisco gear.

If IPv6 really is undeployable on the uBR line with the current IOS releases, that's one hell of a black eye for Cisco.

wmfvor 13 Jahren

Verizon is doing IPv6; hopefully they'll turn on IPv6 at the same time as CGN.

trotskyvor 13 Jahren

I wouldn't count on it - it seems they plan on a rather limited trial on fios where they control 100% of the CPE. They only started shipping the router they've qualified for it late last year, and even so they are pushing a lot of firmware updates to it.

Not that it would be of much help to folks stuck with private space in the near term - it's not like their gaming or file sharing peers will be on routable 6. Except for some VOIP providers the big traffic sinks with 6 enabled are just bog standard http.

If this isn't just sabre rattling it's pretty stupid that heavy hitters like verizon are SOL while so many old school /8's sit around 99% unreachable. Somebody needs to cut the shit and start the auctions.

Sami_Lehtinenvor 13 Jahren

This is exactly what I was thinking about. IPv4 with NAT and full IPv6 connectivity. Btw. Does carrier grade NAT support UPnP?

ianlevesquevor 13 Jahren

UPnP doesn't leave your local network, so no. You cannot forward ports at all behind CGNAT.

Sami_Lehtinenvor 13 Jahren

Well, in case of CGNAT is run (naturally) by the ISP, and network connection from that point is bridged. So yes, I think UPnP will reach their system. If they just want to honor it. Maybe with very restricted port number ranges / portscustomer IP or so. If they have smart mapping system, they can map customers even to multiple IP's so that everyone really needing to open specified port can actually do, because I'm sure they'll NAT to range of public IPs.

trotskyvor 13 Jahren

You misunderstand CGN deployments - there are still different address spaces on either side of the customer router. It's just now both of them are private/non routable prefixes, or in some cases the telco side is done using six. There's no briding and UPNP will never work - once you are on CGN data paths have to be set up from the customer side.

MichaelApprovedvor 13 Jahren

Are there any good alternatives to this?

wmfvor 13 Jahren

The correct solution is IPv6 + Dual Stack Lite, but it's probably not mature enough for deployment yet.

zokiervor 13 Jahren

What advantages DSLite has vs. dual-stack with CGN IPv4? Seems to complicate things for no good reason.

wmfvor 13 Jahren

Dual Stack Lite has a single layer of NAT while NAT444 or 464 have two layers.

zokiervor 13 Jahren

You mean by two layers the NAT by CPE and the CGN?

wmfvor 13 Jahren

Yes.

fiatmoneyvor 13 Jahren

Does this mean it will become much more difficult to associate an IP address with a customer account for the purposes of file-sharing-suit trolls?

smutticusvor 13 Jahren

No. The ISP will just look at a different table to find you.

with CGN: Look in the NAT logs and DHCP logs. without CGN:Look in the DHCP logs.

tzsvor 13 Jahren

What is a "file-sharing-suit troll"? Generally "troll" in lawsuit context means a plaintiff whose business model is to buy rights to IP that the IP owner is not using and then litigate. None of the file sharing suits I'm aware of fit that model.

Maxiousvor 13 Jahren

Prenda Law. https://news.ycombinator.com/item?id=5204665 They were caught recently trying to use the identity of a janitor they knew as a defendant. http://www.techdirt.com/articles/20130402/12223322549/deep-d...

np422vor 13 Jahren

Or one may argue that all file-sharing law suits are indeed trolls and a gross waste of resources.

Please read http://www.copyrightreform.eu/sites/copyrightreform.eu/files... , English is not my native language and I can't make the argument half as good as it is written in this book.

ianlevesquevor 13 Jahren

No because they will just associate IP address and NAT port number. I'm sure the ISPs are keeping track of the NAT associations for this and other abuse tracking purposes.

simcop2387vor 13 Jahren

That means there will be even more data to log to do this though. Many times the NAT will end up on a different port for different connections so you'll end up with something like 64k (assuming the CGNAT doesn't map under 1024) times as much data to log. It will make it harder and the companies doing the logging will have to have more information to narrow it all down.

agwavor 13 Jahren

There are techniques to reduce the logging overhead, such as [http://tools.ietf.org/html/draft-donley-behave-deterministic...]. Basically give each customer their own range of ports on the NAT address so you only need to log that range.

shmerlvor 13 Jahren

Thanks for posting this. I'd completely miss that option to opt out.

JoshGlazebrookvor 13 Jahren

I'm really not looking forward to this in general.

Isn't there also the option of using the same ipv4 address on a few thousand customers and just assign them 10 routable ports?

joenathanvor 13 Jahren

That's pretty much what this is.

toomuchtodovor 13 Jahren

Goodbye cookieless IP-based metrics.

lucb1evor 13 Jahren

I wonder what's more expensive, putting up carrier-grade NAT (which sounds like a lot of work) or implementing IPv6 and buying IPv4 addresses for the time being.

wmfvor 13 Jahren

Lee Howard from Time Warner Cable has run some numbers: http://asgard.org/documents.html

Alohavor 13 Jahren

I've been waiting for a large ISP to do this, its just a matter of time. In the future its going to be IPv6 + CGN. Public IPv4 will be a rarity.

jamescunvor 13 Jahren

If there is an opt-out scheme, I cannot see this becoming that big a deal for the majority of customers and their service will likely continue working as it did before.

(I am not saying there aren't downsides to CGNAT for consumers, but these downsides aren't likely to be noticed by the average joe)

salemvor 13 Jahren

Personally, I'm surprised this has not happened sooner. I heard rumors of other large US carriers planning this. Maybe now gamers will lead the charge on IPv6 :-)

[deleted]vor 13 Jahren