Comment by platesmead

When I want to debug reachability concerns, it's a shame that I can only use ping/traceroute between the non-NAT peers, and then have to SSH to my reverse proxy to do yet another ping to the backend. Similar for tcpdump.

This is the cost to splitting your routing between layer 3 and 4.

I'm now IPv6 everywhere, and so I get to just use ping. Much simpler.

Further, protecting IPv6 services is simpler, because I can terminate (m)TLS on the backend. With a reverse proxy on another host, I have to have yet another means of securing the proxy-backend path. Yet more complexity!

> And the fact that consumers can't just directly connect to each other is a feature.

Consumers should be protected by firewalls. That's independent of routing.