Re: [v6ops] Thoughts about wider operational input

[Vasilenko Eduard <[e-mail]>]

Hi Joe,

What about the capability to initiate connectivity from the outside?
It is easy for the Firewall - just a rule on the CPE.
It is more difficult in NAT44 where the rule should be on the centralized CGNAT.
It restricts the potential list of services that is possible through NAT.

Eduard
-----Original Message-----
From: v6ops [mailto:[e-mail]] On Behalf Of Joe Maimon
Sent: Thursday, March 31, 2022 3:08 AM
To: Mark Andrews <[e-mail]>
Cc: v6ops list <[e-mail]>; JORDI PALET MARTINEZ <jordi.palet=[e-mail]>
Subject: Re: [v6ops] Thoughts about wider operational input



>
>>
>>
>> JORDI PALET MARTINEZ wrote:
>>> To demonstrate how NAT is not security, you just need to enable Teredo or any other UDP tunneling traversing the NAT, so the security guys can see that without any special config in the NAT, you can dig a whole on it (Teredo Navalis = Shipworm).
>>>
On 31 Mar 2022, at 02:56, Joe Maimon <[e-mail]> wrote:

>> And then you need to demonstrate how the equivalent would not happen on IPv6.

Mark Andrews wrote:
> The fix is the same in both protocols.  Install a FIREWALL and properly configure it to block port 3544.
> NAT is not and never has been a FIREWALL.
>
> A flat screw drive and a flat chisel can both be used to remove screws 
> or dig out wood.  They both work well at what they are designed to do and not for which they are not designed to do.
>

There is no actual permanent solution for internal to external worm/tunneling protocols, except yanking the plug or equivalent security policy.

There is just blocking the method du-jour. When possible.

All this is irrelevant to my point, which seems to have sailed overhead that Jordi's little demonstration says nothing about NAT and security that it does not also say about a similarly configured IPv6 firewall and hence would be dishonest showboating.

Joe



_______________________________________________
v6ops mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/v6ops