Organisations that don't use NAT

[StinkyPinky]

For work I've come across a couple of large networks that don't appear to use NAT. Usually a university of some sort. All the clients tend to have a public non-private range (often class b) which I presume they purchased in bulk years ago when such things were easy to do.

I'm by no means a networking expert but why isn't this a security risk? Wouldn't that leave each client PC exposed directly to the internet? Is there some inherent advantage to not using NAT that I'm not aware of?

 

[tomt4535]

Even without NAT, there is presumably a firewall in place to restrict traffic in/out to the internet. Think about how IPv6 works. There is no NAT with IPv6, so every client will get a publicly routable internet IP. You can still restrict what IPs can talk between each other with a firewall or router ACL.

 

[postmortemIA]

even with public IPs, all traffic goes through proxy server.

 

[alkemyst]

The only main danger is someone DDOSing a known IP or something like that....but there are measures that can be put in place.

With IPv6, NAT will be a dinosaur. Even your USB stick may have an address.

 

[azazel1024]

NAT can still be done with IPv6 and still typically is if your ISP is supplying you with an IPv6 address.

 

[dave_the_nerd]

The only main danger is someone DDOSing a known IP or something like that....but there are measures that can be put in place.

With IPv6, NAT will be a dinosaur. Even your USB stick may have an address.

Heh.

 

[yinan]

I will believe IPv6 when I see it. No one wants to use that thing. The only reason we are "out" of IPs is people like the OP designed their networks wrong.

 

[alkemyst]

I will believe IPv6 when I see it. No one wants to use that thing. The only reason we are "out" of IPs is people like the OP designed their networks wrong.

Companies are using it.

 

[drebo]

NAT != security. It's security through obfuscation. NAT without any other services doesn't help you at all.

You can have stateful packet inspection, layer 7 inspection, IPS, IDS, etc, etc, all without requiring NAT.

 

[RadiclDreamer]

As others are pointing out, NAT is NOT security. NAT is only for translating addresses to other addresses, it gives some security through obscurity but is no replacement for a true firewall.

 

[RadiclDreamer]

I will believe IPv6 when I see it. No one wants to use that thing. The only reason we are "out" of IPs is people like the OP designed their networks wrong.

When I started at my current company they had a /22 block of IP addresses and were using some as internal addresses because someone designed it that way a long time ago (mid 90s). That promptly was changed at the earliest possible opportunity.