[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: IPv6-PMP?



	Hello,

Le mercredi 11 avril 2007 00:37, Fred Baker a écrit :
> of course there will be stateful firewalls.
>
> I compare this to the health management system of the human body.
> Apart from blood loss and things like that, the mechanisms that keep
> the body healthy would mostly do so without the skin. But the skin
> makes it ever so much more effective.

I don't ask my parents or the local police officer to protect me from 
microbes and bacterias... I use my own skin, and similarly my PC has 
its own firewall that knows much better what it should pass and what it 
should keep out than my CPE. And even if the CPE knew (we just agreed 
this is currently impossible in the listening TCP port case...), I 
would not expect it to keep up with software upgrades on every single 
IPv6-capable software I might ever install on any of my IPv6-capable 
devices.

> Firewalls that permit the end to end principle to remain in force are
> a good thing for networks.

Sure, but I don't know any such firewall. And the typical stateful 
firewall allowing everything out and nothing unsolicited in DEFINITELY 
DOES NOT respect the end-to-end principle. Try to establish a COMEDIA 
SIP session with such a thing <-- this is a very basic benchmark for 
IPv6 to have any practical advantage over IPv4+NAT.

> Where the so-called "personal firewall" on a desktop/laptop protects
> the system, the firewall protects the investment in the network

The "investment" in the typical household network is a WiFi+Ethernet 
switch and a few Cat-5 cables. The switch can drop anything packet sent 
to its address from the outside. Cables don't need protection. Every 
thing else has its personal firewall.

> Doesn't SOCKS/GSSAPI open pinholes in firewalls?

AFAIK, SOCKS creates *outbound* connections when there is no routing at 
all.

> And the stateful firewalls I am most familiar with actually open
> pinholes automagically. They observe SYN-etc messages going out and
> open pinholes for the responses.

With all due respect, that's nonsense. The passive side of a TCP 
connection does not send anything until it received a packet from the 
foreign peer. Stateful firewalls block exactly that.

With stateful firewalls everywhere, we are back to a full 
client-server-only Internet. That happens to work very well with IPv4 
already. What would anyone switch then?

> A SIP proxy can similarly open a pinhole for a SIP data call.

So I have to upgrade my (supposedly dirty cheap) CPE every time I want 
to use a new protocol. That's not at all end-to-end principle as far as 
I understand it.

Regards,

-- 
Rémi Denis-Courmont
http://www.remlab.net/

Attachment: pgpr4BfzaEWUf.pgp
Description: PGP signature