Yeah, I don't have the interest to get into it about this; but I find
it (informally) inconsistent to take an ideological stance against NAT
and not have a similar stance against NDP proxying. Networking is a lot
cleaner when it can be reasoned about with a rudimentary grasp of graph
theory where a network can roughly be seen as a complete graph and a
node belonging to multiple complete graphs represents a destination in
a routing table.

It is not challenging at all to use route(8) to subnet from a routed
/48 or /56. How many subnets you want is up to you. If you want to
only carve out a single /64 for all your hosts, then do so. You can
then avoid DHCPv6 altogether and use rad(8) to send routing
advertisements allowing clients to use SLAAC which is the much more
popular way for clients to automatically configure IPv6 addresses.

Also not sure where you heard that ICMP does not work with NAT. Surely
you don't believe that. Go ahead and use ping(8) on any device that
relies on NAT to talk to the outside world and witness how it
"magically" works. ICMP uses the Query ID in lieu of a port number.

Will NDP proxying work? Depending on what you want, sure just like NAT
will likely work. Relying on a simple routing table is far more ideal.
NDP proxying is also vulnerable to NDP cache DoS. You can use your
favorite search engine to learn why NDP proxying is not as good as
simple routes.

If you want to use NAT or NDP proxying, then be my guest. It is one
thing to not be willing to leave your ISP because you likely don't have
many to choose from, but that is not the case for VPS providers.

Challenge: reach out to the maintainers of popular NDP proxying daemons
and inquire if they think NDP proxying is "clean" when compared to a
simple routing table. In NDP proxying a host is responsible for
responding to Neighbor Solicitation messages for IPs that don't belong
to it. Hm, sounds a lot like NAT where a host uses its IP to masquerade
the IPs of other hosts as opposed to traffic being handled by the
actual host it was intended for.

Reply via email to