Re: [v6ops] Are we competitive?

[Ted Lemon <[e-mail]>]

I think the thread model for which you’d want to conceal IIDs is that you want to prevent callbacks: if a host on the protected network makes a connection to a host on the Internet, you don’t want that host (or some other host) to be able to attempt to connect back to that IP address on a different port looking for a vulnerability.

If that’s the case, then you can accomplish this with a firewall. All you have to do is default-block incoming SYN packets and incoming UDP packets, and you’re done. This is a lot cheaper than maintaining per-connection state. The only problem is that it breaks QUIC. I think it might be possible to do the same thing with QUIC, but I don’t actually know how the initial handshake works for QUIC, so that’s an open question in my mind. 

If any random QUIC packet can’t be distinguished from a QUIC session-initiation packet, then you do need a stateful firewall, at which point NAT66 is no more expensive.

But assuming that’s not the case, a stateless firewall is definitely cheaper than a network address and port translator.