Re: draft-ietf-v6ops-cpe-simple-security-06

[Brian E Carpenter <brian.e.carpenter@gmail.com>]

On 2009-06-26 16:50, Gert Doering wrote:
> Hi,
> 
> On Fri, Jun 26, 2009 at 04:08:47PM +0200, Rémi Després wrote:
>> - I had to open the Mac to incoming VNC connections from another  
>> computer of the site.
>> - If I had opened the VNC port in the Mac without disabling IPv6,  
>> this would have opened it also for connections from any host of the  
>> IPv6 global Internet.
> 
> I'd argue that this is something that should be improved in the 
> "host firewall" - instead of "completely closed" and "opened from 
> everywhere", there should be a third state "open for connections from the 
> local network"...

s/local network/trusted zone/ and this reflects the behaviour of at
least one very popular personal firewall. I think this is proven safe
practice, and actually means that with such a personal firewall
installed, the CPE can be wide open. Needless to say, this level
of on-board protection is essential for roaming anyway.

I'd certainly want my CPE to have an option to switch off all
firewall behaviour.

    Brian