Re: Automatic tunnels

[itojun@iijlab.net]

>Which type of abuse are you concerned with? We can deploy native-to-6to4
>relays in several modes:
>
> - host specific=20
>	(host is multi-homed to 6to4, local routing entry to 2002::/16)
> - AS specific=20
>	(some routers act as relay, export a route to 2002::/16 in IGP)
> - Across multiple AS
>	(export a route to 2002::/16 in BGP)
>
>The first two modes don't seem particularly prone to abuse. Host
>specific relays certainly are not an issue, and the abuse to AS specific
>relay fall in the general category of "abusing peering agreements",
>which is by no means specific to 6to4. I agree that exporting a route
>through BGP is hard to control, as the route can be re-exported by
>peering ASes. But, again, this fall in the category of "peering abuses",
>which can be contained by proper peering contracts.

	we are afraid of our native-to-6to4 device being used as open relay
	of packet (bullet 3 in the above, of course).  the IPv4 source address
	will be ours, so we will get compliants from random people, because of
	malicious traffic from somewhere to 2002::/16.  running 6to4 relay
	router is like running open relay smtp server.

itojun