Beyond the Nat: Cgnat, Bandwidth, and Practical Tunneling
Key topics
The woes of Carrier-Grade NAT (CGNAT) and dwindling IPv4 addresses have sparked a lively debate about the practicalities of tunneling and IPv6 adoption. Nostalgic tales of dial-up internet with static IPs and inbound access have surfaced, while others lament the regression to CGNAT by some modern ISPs, citing issues for gamers and those susceptible to rate limiting. As commenters weigh in, a surprising consensus emerges: IPv6 implementation is long overdue, with some organizations having made the switch nearly a decade ago, and those who resist are missing out on reduced attack surfaces. The discussion highlights the tension between technological progress and frustrating ISP limitations.
Snapshot generated from the HN discussion
Discussion Activity
Active discussionFirst comment
5d
Peak period
19
120-132h
Avg / period
7
Based on 21 loaded comments
Key moments
- 01Story posted
Dec 27, 2025 at 8:59 AM EST
12 days ago
Step 01 - 02First comment
Jan 1, 2026 at 11:22 AM EST
5d after posting
Step 02 - 03Peak activity
19 comments in 120-132h
Hottest window of the conversation
Step 03 - 04Latest activity
Jan 2, 2026 at 10:15 AM EST
5d ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
I guess that works for most people except gamers and people who get rate limited because of the actions of others.
Article is correct, IPv4 didn’t die hard.
At my house I've had SSH open to the V6 internet for 8 years and have the logger set up to email me for any connections, and I have never once seen an attempt. For popular sites with well known DNS names that's obviously different, but I keep DNS current and can SSH by name to that V6 listener from anywhere so it's not my ISP trying to save me from myself either. And that's not even a host with the normal automatic temporary addresses, it's been a fixed interface id portion with an effectively static V6 prefix for years.
For a while I had several other services open as well, at one point we even played around with using NFS and iSCSI over IPv6 on the internet just for giggles, no actual important data. I can imagine some sysadmin's face twisting in horror just reading that knowing the carnage that would have ensued doing that with V4, where we commonly drop entire geo-blocks just to curtail the log spam of all the various automatic admin portal and VPN login scans.
There are of course techniques to gather live V6 addresses but between the vast space and temporary addresses on most end-user devices it really has been a night and day difference.
And when they do give you v6 its a /64.
I wish there might be a category of prosumer friendly ISP of sorts. Those exist but they are hard to find.
They've built such an incredible product I actually feel guilty I pay absolutely nothing for it.
Personally I don't think IPv6 will ever supplant IPv4. As far as big tech is concerned, NAT solves the problem well enough for clients and SNI routing solves it well enough for servers.
What incentive do they have to make things better for small orgs and p2p use cases? Better from their perspective to retain control over IPv4 real estate and extract rent.
Far more important than current adoption is rate of adoption, which is slowing.
US mandates will certainly help and may be enough, but the US can't force other countries to follow. Many countries have far lower adoption rates.
If it can't upgrade in time, it might remain connected using some kind of translator or proxy. Even if not official, someone would surely run one - it's too useful and we're not talking about a censorship scenario where it would be illegal. Experience shows this is very annoying and will quickly be upgraded to native level. Note that tunneling is native.
Most end-user ISPs today use some kind of tunneling to separate the architecture of their network from the architecture of the services they deliver to customers. If you use DSL, your connection is (usually) a PPPoAoE tunnel with one endpoint at your house and another endpoint at one of your ISP's POPs - the entire access network feels transparent to you. If you use a cellular network, it does something similar with GTP.
And considering that fact, it's not as hard to upgrade a network to IPv6 as you might think. Some core routers and edge routers must be upgraded, but the majority of the network is tunneled over. Perhaps during a transitionary period, your CPE (home router) will encapsulate your IPv6 packets in IPv4. This doesn't require a new router because most of them do routing in software and can just get a firmware update.
You create an SSH reverse tunnel (-R option) from a server in your home network to your remote VPS. This gives you a localhost port on your VPS to your server SSH port. Something like:
From your laptop, use your your VPS address and localhost port in the -J option. Something like: I only allow ssh key auth and only my laptop is trusted by my home server. The home server doesn't need to trust the VPS "jump server".