Re: [v6ops] [OPSEC] 3 Volunteers wanted - Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets

[Jeroen Massar <[e-mail]>]

On 2012-08-17 18:53, Philipp Kern wrote:
> Lee,
> 
> am Fri, Aug 17, 2012 at 11:15:49AM -0400 hast du folgendes geschrieben:
>> Finally,
>>    some transition/co-existence mechanisms (notably Teredo) are designed
>>    to traverse Network Address Translators (NATs), which in many
[..]
> and how is that different from obtaining a global IPv4 through a VPN connection
> to the outside? If you allow the UDP communication to the Teredo relays, you're
> probably not stopping such VPNing neither. The lesson being that you need to
> know what passes your organizational firewall and whitelist if you care about
> that. But then I guess your point is that such tunnels are automatic and not
> necessarily user-initiated. But that's an implementation detail with one
> vendor's implementation… \:

That one vendor you mean, being Microsoft, actually disables Teredo when
the host PC is inside an Active Directory/Windows domain, as such, this
covers most organizations. But even then, per default Teredo on Windows
is configured to not allow incoming connections when the standard
Windows Firewall is active.


And indeed, if you want to properly firewall, then you need to educate
your users and whitelist, anything else does not work as there are way
too many ways that one can get out and play...

Also note that the NAT there is obviously not a firewall, as it allows
any connection to be made and tunnels to be punched through it.

Greets,
 Jeroen