Re: [v6ops] Are we competitive?

[Ted Lemon <[e-mail]>]

Sorry, what I mean by “block incoming UDP packets” is “block any UDP packet with a source IP address that is not internal, and with a destination IP address that is internal.” I don’t mean “look at UDP packets and figure out whether they are replies, and block them if they are not.” But you’re right—my thinking about QUIC was muddled. It would definitely require a stateful firewall.

Sent from my iPad

> On Aug 15, 2022, at 11:21 AM, Fernando Gont <[e-mail]> wrote:
> 
> Hi, Ted,
> 
>> On 15/8/22 12:03, Ted Lemon wrote:
>> I think the thread model for which you’d want to conceal IIDs is that
>> you want to prevent callbacks: if a host on the protected network
>> makes a connection to a host on the Internet, you don’t want that
>> host (or some other host) to be able to attempt to connect back to
>> that IP address on a different port looking for a vulnerability.
> 
> Yes, that's the obvious case you want to tackle.
> 
> 
>> If that’s the case, then you can accomplish this with a firewall. All
>> you have to do is default-block incoming SYN packets and incoming UDP
>> packets, and you’re done.
> 
> Few obvious questions:
> 
> 1) How do you do this automagically?
> 
> 2) How do you block "incoming UDP packets" without keeping state?
> 
> 3) How is the above super different/better than the NAT66 case?
> 
> FWIW, we discuss this topic in: https://datatracker.ietf.org/doc/html/draft-gont-v6ops-ipv6-addressing-considerations
> 
> 
>> This is a lot cheaper than maintaining
>> per-connection state. The only problem is that it breaks QUIC. I
>> think it might be possible to do the same thing with QUIC, but I
>> don’t actually know how the initial handshake works for QUIC, so
>> that’s an open question in my mind.
> 
> For UDP, the rule of thumb is that you keep state, and if you get a packet from the external realm, it's considered an "incoming packet" unless you have previously seen a packet with the corresponding (local socket, remote socket) in the opposite direction.
> 
> Thanks,
> -- 
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494