On Sat, Apr 19, 2014 at 2:03 AM, Matthew Kaufman <matthew@matthew.at> wrote:
Ignoring security, A is superior because I can change it to DNAT to the new server, or DNAT to the load balancer now that said server needs 10 replicas, etc.
B requires re-numbering the server or *if* I am lucky enough that it is reached by DNS name and I can change that DNS promptly, assigning a new address and adding another firewall rule that didn't exist.
What you're describing is how to set up infrastructure to handle rapidly changing environments in cases where the whole setup not thought out in it's entirety to account for that. My point with IPv6 is that we get the chance to clear up all the mess that happened with IPv4 (or the lack of addresses in IPv4) with NATs and NATs over even more NAT. I'm not arguing against NAT completely in IPv6, I'm arguing against applying IPv4 style thinking applied to IPv6. Eugeniu