# NAT Published articles for NAT. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Worth Reading: NatJack DevFeed: [Worth Reading: NatJack]() Original publisher: [Read original article]() Published: 2026-09-11T07:02:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [Security]() Tags: [attacks](), [nat](), [security](), [worth-reading]() ### AI overview The article recommends NatJack, a website documenting several attacks against typical NAT implementations. It argues that NAT should not be treated as a security feature and dismisses common objections to that conclusion. ### Source excerpt Every time I wrote something along the lines of NAT is not a security feature, I got the expected pushback from people defending their bad suboptimal design choices. Fortunately, rational1 engineers no longer need to have that discussion: the NatJack website documents2 a half-dozen attacks on typical NAT implementations. Obvious next step: coping mechanisms like "this is all theoretical", like the "but the remote host cannot reply" argument made 23 years after the Slammer worm 🤦♂. Read more ... ## Introducing IP Allowlisting DevFeed: [Introducing IP Allowlisting]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2026-09-08T17:37:00Z Content type: release Language: en Sources: [Postmark (en-US)]() Topics: [Security](), [API](), [Network](), [Cloud]() Tags: [api](), [infrastructure](), [ip](), [nat](), [network](), [product-news](), [protection](), [range](), [request](), [security](), [token]() ### AI overview Postmark introduces IP Allowlisting, a security feature that restricts email sending through the Postmark API to up to 10 configured IP ranges in CIDR format. Requests from outside the allowed ranges are rejected with a 403 response. The ranges can be configured at the Server or account level, with Server settings overriding account settings. ### Source excerpt Good security is layered and each layer does a job the others can't. Scoping a token to a Server limits what it reaches. Rotating a token limits how long it lasts. Neither can say anything about where a request came from. We've been hard at work to ship a new layer of protection that can. IP Allowlisting is a new Postmark security feature that lets you name the infrastructure your email should come from. It's available now on all Postmark plans at no extra cost. It's off until you turn it on. How IP Allowlisting works You add up to 10 IP ranges, in CIDR format, that are allowed to send email using the Postmark API. Send requests from outside those ranges are rejected with a 403 status code that includes the IP the request came from. You can set your ranges in two places: On a Server. The ranges apply to that Server, covering every Message Stream on it. This is where we'd suggest starting. On your account. The ranges apply to every Server you have. When a Server has ranges of its own they will override account level settings. That's it! A straightforward security control to protect your API sending. Protect individual Servers or across your account. Set your Allowlist ranges on the account or Server. If you don't write CIDR blocks often, it's a quick 30 seconds to get familiar with them and the correct notation. CIDR blocks allow you to enable a grouped collection of IP addresses (aka ranges.) A CIDR block is an IP address followed by a suffix that says how many addresses it covers. The smaller the suffix, the wider the range: 198.51.100.24/32 one address, and only that address 203.0.113.0/24 256 addresses: 203.0.113.0 through 203.0.113.255 203.0.0.0/16 65,536 addresses: 203.0.0.0 through 203.0.255.255 So a /32 pins the allowlist to a single machine, and a /24 covers a subnet. Most teams end up somewhere in that span. Where you find your own ranges depends on how you send. A single VM has a static public IP you can read off your provider's dashboard. Cloud workloads ## AI, IPv6, and the future Internet at IETF 126 DevFeed: [AI, IPv6, and the future Internet at IETF 126]() Original publisher: [Read original article]() Author: Anlei Hu Published: 2026-08-25T01:20:50Z Content type: article Language: en Sources: [APNIC Blog]() Topics: [Internet](), [Internet Engineering Task Force (IETF)](), [networking](), [Artificial Intelligence](), [AI Agent](), [Network](), [Security](), [Latency](), [telemetry]() Tags: [ai](), [dns](), [guest-post](), [ietf](), [infrastructure](), [internet](), [internet-infrastructure](), [ipv6](), [latency](), [low-latency](), [nat](), [network](), [networks](), [opinion](), [security](), [standards](), [tech-matters](), [telemetry]() ### AI overview The article reports on IETF 126 discussions about how AI is shaping Internet infrastructure. It presents IPv6 as important for the scale, globally unique addressing, and traceability required by distributed AI deployments and agents, while DNS remains central to service discovery. It also covers IPv4/IPv6 mapping, NAT-related identity and security concerns, SRv6, low-latency forwarding, IOAM telemetry, and proposals for DNS-based AI agent discovery. ### Source excerpt Guest Post: At IETF 126, discussions highlighted how AI is beginning to shape the future of Internet infrastructure. Participants identified IPv6 as a critical foundation for large-scale AI ecosystems and explored new approaches. ## Deploying IPv6-first EKS on AWS: What Still Doesn't Work, and What It Saves DevFeed: [Deploying IPv6-first EKS on AWS: What Still Doesn't Work, and What It Saves]() Original publisher: [Read original article]() Author: Spiro Stathakis Published: 2026-08-14T08:57:28Z Content type: article Language: en Sources: [RIPE Labs]() Topics: [Amazon Elastic Kubernetes Service](), [Amazon Web Services](), [VPC](), [networking](), [cloud-infrastructure](), [Kubernetes]() Tags: [2026](), [amazon](), [amazon-elastic-kubernetes-service](), [aws](), [cni](), [competition](), [cost](), [ip](), [ipv4](), [ipv6](), [kubernetes](), [nat](), [networking](), [networks](), [vpc]() ### AI overview A field report on deploying an IPv6-first Amazon Elastic Kubernetes Service platform on AWS. It explains how IPv6 pods, VPC networking, and an egress-only Internet gateway reduce dependence on NAT gateways and public IPv4 addresses, while legacy IPv4-only dependencies such as databases, payment APIs, and container registries still impose compatibility requirements and costs. ### Source excerpt In this field report on IPv6-first Amazon Elastic Kubernetes Service (EKS), the isp6 team shares which dependencies still drag IPv4 back in, what they learnt from /28s, and why the saving is large but not automatic. ## IP Addressing, Part II: Scaling IPv4 Across the Internet DevFeed: [IP Addressing, Part II: Scaling IPv4 Across the Internet]() Original publisher: [Read original article]() Author: Franco Fernando Published: 2026-08-01T11:36:30Z Content type: article Language: en Sources: [The Polymathic Engineer]() Topics: [Internet]() Tags: [internet](), [ip](), [ipv4](), [nat]() ### AI overview This article explains how CIDR replaced classful addressing and how private addresses and NAT helped extend the usable life of IPv4. ### Source excerpt How classful addressing gave way to CIDR, and how private addresses and NAT kept the world from running out of IPv4. ## Remote Access That Works Behind NAT, CGNAT, and Uncontrolled Firewalls DevFeed: [Remote Access That Works Behind NAT, CGNAT, and Uncontrolled Firewalls]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Martin) Published: 2026-05-28T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [remote access](), [Authorization](), [ssh](), [Virtual Private Network](), [Firewall](), [Network]() Tags: [authorization](), [devices](), [firewall](), [guide](), [how-to](), [nat](), [network](), [remote-access](), [ssh](), [vpn]() ### AI overview This guide explains why inbound SSH and VPN access can fail for remote devices behind NAT, CGNAT, or customer-controlled firewalls. It introduces outbound connections and device identity as approaches for routing access and maintaining authorization across network changes. ### Source excerpt In this guide, learn how to securely access remote devices behind NAT, CGNAT, or uncontrolled firewalls. ## Cloudflare's Automatic Return Routing Is Described as Inter-VRF NAT at Scale DevFeed: [Cloudflare's Automatic Return Routing Is Described as Inter-VRF NAT at Scale]() Original publisher: [Read original article]() Published: 2026-05-06T06:12:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [Cloudflare](), [Routing (disambiguation)](), [networking](), [Virtual Private Network]() Tags: [article](), [blog](), [cloudflare](), [nat](), [routing](), [technology](), [vpn](), [worth-reading]() ### AI overview The article critiques Cloudflare's marketing of Automatic Return Routing, arguing that its session-based forwarding and address remapping are effectively VRFs and NAT in another form. It also notes that the solution appears to demonstrate session-based forwarding at scale, while leaving its speed and CPU requirements as open questions. ### Source excerpt A while ago, I found the How Automatic Return Routing solves IP overlap article on Cloudflare's blog. They evidently have a technology that addresses a pain point well worth solving (access to shared resources from clients using overlapping address ranges). I just hate how they're selling it. Go read the article first; I'll wait. OK, here's what bothers me: the "VRFs and NAT are bad" claims, while they use the same technology in disguise. Read more ... ## Response: Peer-to-Peer Communication in IPv6 World DevFeed: [Response: Peer-to-Peer Communication in IPv6 World]() Original publisher: [Read original article]() Published: 2025-04-15T05:23:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [P2P](), [Networks](), [Firewall](), [WebRTC]() Tags: [firewall](), [firewalls](), [ipv6](), [nat](), [p2p](), [webrtc]() ### AI overview This article presents Daryll Swer's response about peer-to-peer communication over IPv6. It argues that native IPv6 avoids shared-address NAT and related port-exhaustion issues, while stateful firewalls can still affect connectivity. The response reports successful STUN-based IPv6 peer connections in tested applications but notes that many CGNAT deployments remain problematic. ### Source excerpt Daryll Swer posted a very informative response to my NAT Traversal Mess blog post, focusing on: Punching holes through that firewall is equivalent to establishing NAT translations. It would be a shame to let that response wither as small print at the bottom of a blog post; here it is: Read more ... ## Response: NAT Traversal Mess DevFeed: [Response: NAT Traversal Mess]() Original publisher: [Read original article]() Published: 2025-04-10T06:00:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [networking](), [firewalls](), [client](), [Protocol (disambiguation)]() Tags: [connectivity](), [firewalls](), [github](), [internet](), [libraries](), [nat](), [networking](), [openssh](), [pypi](), [python](), [security](), [video-conferencing]() ### AI overview The article examines NAT traversal for client-to-client connectivity, explaining the roles and limitations of STUN, TURN, and ICE, and contrasting them with protocols that request public ports from NAT devices. It argues that NAT remains difficult to avoid and notes the availability of libraries that simplify implementation. ### Source excerpt Let's look at another part of the lengthy comment Bob left after listening to the Rise of NAT podcast. This one is focused on the NAT traversal mess: You mentioned that only video-conferencing and BitTorrent use client-to-client connectivity (and they are indeed the main use cases), but hell, do they need to engineer complex systems to circumvent these NATs and firewalls: STUN, TURN, ICE, DHT... Cleaning up the acronym list first: DHT is unlike the others and has nothing to do with NAT. Read more ... ## Response: Any-to-Any Connectivity in the Internet DevFeed: [Response: Any-to-Any Connectivity in the Internet]() Original publisher: [Read original article]() Published: 2025-03-27T06:45:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [Internet](), [client](), [networking](), [firewalls]() Tags: [firewalls](), [internet](), [ipv6](), [nat](), [protocol]() ### AI overview The article responds to criticism of claims about the rise of NAT and argues that NATs and firewalls contributed to the Internet's client/server asymmetry. It contends that early IP networking generally provided any-to-any connectivity, while the client/server split emerged as lower-end personal computers became common and NAT gained acceptance as a pragmatic boundary between internal and public networks. ### Source excerpt Bob left a lengthy comment arguing with the (somewhat black-and-white) claims I made in the Rise of NAT podcast. Let's start with the any-to-any connectivity: From my young millennial point of view, the logic is reversed: it is because of NATs and firewalls that the internet became so asymmetrical (client/server) just like the Minitel was designed (yes, I am French), whereas the Internet (and later the web, although a client/server protocol, was meant for everyone to be a client and a server) was designed to be more balanced. Let's start with the early Internet. It had no peer-to-peer applications. It connected a few large computers (mainframes) that could act as servers but also allowed terminal-based user access and thus ran per-user clients. Read more ... ## IPv6 Support for Multiple Routers and Multiple Interfaces DevFeed: [IPv6 Support for Multiple Routers and Multiple Interfaces]() Original publisher: [Read original article]() Published: 2024-11-28T10:57:00Z Content type: opinion Language: en Sources: [ipSpace.net blog]() Topics: [Internet Engineering Task Force (IETF)](), [Networks](), [Internet](), [Protocol (disambiguation)](), [Mobile]() Tags: [ietf](), [internet](), [ipv6](), [mobile](), [nat](), [networks](), [protocol](), [tcp]() ### AI overview The article comments on Fernando Gont's Individual Internet Draft about IPv6 support for multiple routers and interfaces. It argues that the draft clearly describes a long-standing multihoming problem and says current practical options are NAT or rarely implemented host-based solutions, while questioning whether an IETF working group will adopt the draft. ### Source excerpt Fernando Gont published an Individual Internet Draft (meaning it hasn't been adopted by any IETF WG yet) describing the Problem Statement about IPv6 Support for Multiple Routers and Multiple Interfaces. It's so nice to see someone finally acknowledging the full scope of the problem and describing it succinctly. However, I cannot help but point out that: I was ranting about that problem in 2009 (15 years ago) and did a summary of older rants in 2015. It was evident to everyone but the religious zealots that the only solution we have at the moment is either NAT (because stuff simply does not work otherwise) or host-based solutions that never got implemented (apart from a few rare cases of multipath TCP). Anyway, Fernando wraps up his draft with: Read more ... ## SSH Tunnel - Local and Remote Port Forwarding Explained With Examples DevFeed: [SSH Tunnel - Local and Remote Port Forwarding Explained With Examples]() Original publisher: [Read original article]() Author: sensible.io team Published: 2014-05-17T17:57:00Z Content type: tutorial Language: en Sources: [Sensible]() Topics: [ssh](), [OpenSSH](), [Database](), [PostgreSQL](), [Firewall](), [Rails](), [SockTz]() Tags: [browser](), [database](), [examples](), [firewall](), [local](), [nat](), [network](), [port](), [postgresql](), [rails](), [remote](), [security](), [server](), [ssh](), [syntax](), [tutorial]() ### AI overview A tutorial explaining SSH local and remote port forwarding through examples, including access to blocked web resources, databases behind firewalls, and locally hosted applications without public IP addresses. ### Source excerpt There are two ways to create an SSH tunnel, local and remote port forwarding (there's also dynamic forwarding, but we won't cover that here). The best way to understand these is by an example, let's start with local port forwarding. Imagine you're on a private network which doesn't allow connections to a specific server. Let's say you're at work and imgur.com is being blocked. To get around this we can create a tunnel through a server which isn't on our network and thus can access Imgur. $ ssh -L 9000:imgur.com:80 user@example.com The key here is -L which says we're doing local port forwarding. Then it says we're forwarding our local port 9000 to imgur.com:80, which is the default port for HTTP. Now open your browser and go to http://localhost:9000. The awesome thing about SSH tunnels is that they are encrypted. Nobody is going to see what sites you're visiting, they'll only see an SSH connection to your server. Connecting to a database behind a firewall Another good example is if you need to access a port on your server which can only be accessed from localhost and not remotely. An example here is when you need to connect to a database console, which only allows local connection for security reasons. Let's say you're running PostgreSQL on your server, which by default listens on the port 5432. $ ssh -L 9000:localhost:5432 user@example.com The part that changed here is the localhost:5432, which says to forward connections from your local port 9000 to localhost:5432 on your server. Now we can simply connect to our database. $ psql -h localhost -p 9000 Now let's stop here for a little bit an explain what is actually going on. In the first example the 9000:imgur.com:80 is actually saying forward my local port 9000 to imgur.com at port 80. You can imagine SSH on your server actually making a connection (a tunnel) between those two ports, one on your local machine, and one on the target destination. If we however say something like 9000:localhost:5432, it means localhost ## Bind before connect DevFeed: [Bind before connect]() Original publisher: [Read original article]() Author: Marek Published: 2014-04-02T22:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Linux Kernel](), [TCP/IP](), [API](), [Code](), [Python]() Tags: [article](), [linux](), [linux-kernel](), [nat](), [port](), [python](), [socket](), [tcp-ip]() ### AI overview This article explains how the Linux kernel allocates source ports for TCP/IP connections, including ephemeral port selection, port reuse, connection limits, and the bind-before-connect technique. ### Source excerpt Bind before connect A TCP/IP connection is identified by a four element tuple: {source IP, source port, destination IP, destination port}. To establish a TCP/IP connection only a destination IP and port number are needed, the operating system automatically selects source IP and port. This article explains how the Linux kernel does the source port allocation. Ephemeral port range To establish a connection BSD API requires two steps: first you need to create a socket, then call on it. ## Configuring dnsmasq with VMware Workstation DevFeed: [Configuring dnsmasq with VMware Workstation]() Original publisher: [Read original article]() Author: Nelson Elhage Published: 2010-10-24T23:15:23Z Content type: tutorial Language: en Sources: [Nelson Elhage]() Topics: [networking](), [Network](), [Development](), [Server](), [ssh]() Tags: [development](), [dhcp](), [domain](), [install](), [linux](), [local](), [nat](), [network](), [networking](), [server](), [ssh](), [vmware](), [workstation]() ### AI overview A tutorial on configuring VMware Workstation virtual machines to use dnsmasq for DHCP address assignment and local DNS resolution, allowing VM hostnames to be accessed from the host over a local NAT network. ### Source excerpt I love VMware workstation. I keep VMs around for basically every version of every major Linux distribution, and use them heavily for all kinds of kernel testing and development. This post is a quick writeup of my networking setup with VMware Workstation, using dnsmasq to assign my VMs addresses and provide a DNS server to resolve VM addresses. The objective I want to be able to resolve my VM's hostnames so that I can ssh to them, or run other network services and access them from the host.