Re: [pntaw] TURN over websockets

[Melinda Shore <[e-mail]>]

On 8/31/13 9:33 AM, Martin Thomson wrote:
> I'm glad someone raised this point.  It's core to the discussion.
> What, if any, visibility will a firewall or proxy be given into the
> purpose of this exchange?   HTTP CONNECT followed by TLS doesn't give
> the intermediary much of a chance to enforce policy.

Well, arguably NAT is not really a policy enforcement mechanism.
But yes, if you're using firewall/nat traversal technologies to
get around firewall policy enforcement, there's a huge problem.
For what it's worth we've been trying to have *that* discussion
for years.

One of the advantages of using a mechanism that signals the
firewall directly (say, midcom, pcp, etc.) is that it allows
the firewall to accept or deny the request based on policy.
However, it requires a forklift upgrade to pretty much everything
and is extremely difficult to deploy for that reason.  This
is the primary (but not the only) reason that midcom flopped, so
I was surprised to see pcp chartered since it's got the same
barriers to deployment.  But that is a different discussion.

Melinda