We use NAT all the time in industrial settings. Makes it so you can have select devices communicate with the plant level network, while keeping everything else common so that downtime is reduced when equipment inevitably fails.

[–] frezik@lemmy.blahaj.zone 27 points 5 days ago (3 children)

That's nothing that can't be done with a good set of firewalls on IPv6.

[–] socsa@piefed.social 11 points 5 days ago (1 children)

The one thing you can't do with IPv6 is yell the address across the room to the technician plugged into the switch trying to ping the node.

[–] pupbiru@aussie.zone 3 points 3 days ago* (last edited 3 days ago)

no instead you yell the IP address and they spend 30min trying to debug why they can’t ping it or even get ICMP packets through and then you realise you yelled the private IP address and they were on the wrong side of the NAT

[–] IrateAnteater@sh.itjust.works 3 points 5 days ago (1 children)

This is equipment that uses all statically addressed devices. And ignoring the fact that IPv6 is simply unsupported on most of them, there are duplicate machines that share programs. Regardless of IP version you need NAT anyway if you want to be able to reach each of the duplicates from the plant network.

[–] pupbiru@aussie.zone 2 points 3 days ago

there are duplicate machines that share programs

yes.. that’s why every machine has its own IP address… so that they can both use the same port and you don’t have to connect to crazy bullshit like https://myhomerouter.example.com:8443/

[–] Hotzilla@sopuli.xyz 1 points 5 days ago* (last edited 5 days ago) (1 children)

Good luck trying to find industrial stuff that supports IPv6, hell most of it is still serial.

I have legit heard that serial is security mechanism because it cannot communicate long distance like ethernet.

Of course you can do IPv6 magic that hides IPv6 from the end device, but nobody understands how that magic works.

[–] pupbiru@aussie.zone 4 points 3 days ago

Of course you can do IPv6 magic that hides IPv6 from the end device, but nobody understands how that magic works.

it’s not magic… it’s a firewall, and it works pretty much exactly the same as a NAT: a whitelist of IP and port combinations