[v6ops] Re: Traffic control protocols (PCP and UPnP IGD)

[Ted Lemon <[e-mail]>]

Gert, this is /precisely/ what PCP is for: to tell the firewall which ports
to allow through. My speaker doesn’t tell PCP to allow anyone on the
outside to play music to my speakers because that wouldn’t make sense. My
ssh server isn’t very useful if I can’t get to it from the outside. But
only that one ssh server—there are other ssh servers on my network that
would not make sense to expose.

This is what PCP enables: fine-grained control over ingress.

Op za 27 jul 2024 om 14:08 schreef Gert Doering <[e-mail]>

> Hi,
>
> On Fri, Jul 26, 2024 at 01:41:30PM -0700, Ted Lemon wrote:
> > This makes perfect sense if your threat model is that services that
> aren't
> > intended to be reachable from the internet become automatically reachable
> > from the Internet. E.g., I don't want some rando in Liechtenstein
> suddenly
> > playing Scriábin on my Homepod stereo pair (well, unless it's really
> good,
> > i guess). But I do want to be able to ssh in to my desktop machine. I
> don't
> > want my ISP to be able to block that because there's a firewall in the
> > cable modem that can't be configured.
>
> So how do you tell your can't-be-configured firewall that the Homepod
> "play my song" port must not be talked to, while the SSH port is fine?
>
> The Homepod might not be configurable either, to tell it "DO NOT ASK!",
> and neither might be whatever you have on your machine that is not SSH but
> should not be talked to...
>
> Gert Doering
>         -- NetMaster
> --
> have you enabled IPv6 on something today...?
>
> SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Ingo
> Lalla,
>                                            Karin Schuler, Sebastian Cler
> Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
> D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
> Tel: [phone]         USt-IdNr.: DE813185279
>