Re: [v6ops] [OPSEC] 3 Volunteers wanted - Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets

[Philipp Kern <[e-mail]>]

Lee,

am Fri, Aug 17, 2012 at 11:15:49AM -0400 hast du folgendes geschrieben:
> Finally,
>    some transition/co-existence mechanisms (notably Teredo) are designed
>    to traverse Network Address Translators (NATs), which in many
>    deployments provide a minimum level of protection by only allowing
>    those instances of communication that have been initiated from the
>    internal network.  Thus, these mechanisms might cause an internal
>    host with otherwise limited IPv4 connectivity to become globally
>    reachable over IPv6, therefore resulting in increased (and possibly
>    unexpected) host exposure.  That is, the aforementioned technologies
>    might inadvertently allow incoming IPv6 connections from the Internet
>    to hosts behind the organizational firewall.

and how is that different from obtaining a global IPv4 through a VPN connection
to the outside? If you allow the UDP communication to the Teredo relays, you're
probably not stopping such VPNing neither. The lesson being that you need to
know what passes your organizational firewall and whitelist if you care about
that. But then I guess your point is that such tunnels are automatic and not
necessarily user-initiated. But that's an implementation detail with one
vendor's implementation… \:

Kind regards
Philipp Kern