Re: [v6ops] Thoughts about wider operational input

[Joe Maimon <[e-mail]>]

>
>>
>>
>> JORDI PALET MARTINEZ wrote:
>>> To demonstrate how NAT is not security, you just need to enable Teredo or any other UDP tunneling traversing the NAT, so the security guys can see that without any special config in the NAT, you can dig a whole on it (Teredo Navalis = Shipworm).
>>>
On 31 Mar 2022, at 02:56, Joe Maimon <[e-mail]> wrote:

>> And then you need to demonstrate how the equivalent would not happen on IPv6.

Mark Andrews wrote:
> The fix is the same in both protocols.  Install a FIREWALL and properly configure it to block port 3544.
> NAT is not and never has been a FIREWALL.
>
> A flat screw drive and a flat chisel can both be used to remove screws or dig out wood.  They both work
> well at what they are designed to do and not for which they are not designed to do.
>

There is no actual permanent solution for internal to external 
worm/tunneling protocols, except yanking the plug or equivalent security 
policy.

There is just blocking the method du-jour. When possible.

All this is irrelevant to my point, which seems to have sailed overhead 
that Jordi's little demonstration says nothing about NAT and security 
that it does not also say about a similarly configured IPv6 firewall and 
hence would be dishonest showboating.

Joe