<p><br>
On Nov 23, 2011 1:45 PM, "Michael Sinatra" <<a href="mailto:michael@rancid.berkeley.edu">michael@rancid.berkeley.edu</a>> wrote:<br>
><br>
> On 11/23/11 13:23, Eugen Leitl wrote:<br>
>><br>
>><br>
>> The SOP for firewalling in IPv4 is to use<br>
>> private (RFC 1918) networks and map external public<br>
>> networks 1:1 to them.<br>
><br>
><br>
> No it's not. It's one of several possible (and rather common) practices, including many-to-one NAT, stateful bridging firewall and a firewalling router. It's not "the SOP" and I'd say that there is no SOP.<br>
><br>
><br>
>> The idea is that defaults to<br>
>> unreachable systems in case of firewall failure.<br>
><br>
><br>
> In the case of a 1:1 NAT firewall, what if the failure mode is that someone accidentally places a 'permit any any' rule on the inbound direction? The NAT functionality would still work, forwarding traffic to the inside.<br>
><br>
> At any rate, this exact subject was discussed quite extensively on NANOG. There were at least several people who thought it was incorrect to say that NAT provides zero security, but who also thought it was incorrect to claim that one needed NAT to have security. Which brings us to IPv6:<br>
><br>
><br>
>> What's the address space to use in IPv6 for such<br>
>> purposes? Is fc00::/7 (RFC 4193) unroutable on<br>
>> the public Internet in the same way as RFC 1918<br>
>> addresses?<br>
><br>
><br>
> My reading of RFC 4193 and the debates surrounding it is that it should not be interpreted as the IPv6 version of RFC1918, that there is significant disagreement as to whether it's a good idea, and that filtering of the ULA prefix is not universally done. (Remember, the thing that makes NAT unroutable is not magic, it's reliance and trust in your upstreams to filter and to not advertise RFC1918 addresses.)<br>
><br>
> IMO, you're almost better off keeping the IPv4 RFC1918 addresses and doing protocol translation at your firewall. But maybe I am just in a festive holiday mood (the US Thanksgiving Holiday is starting).<br>
><br>
> michael</p>
<p>Michael,</p>
<p>I largely agree with your opinions. Ipv6 should be a good opportunity to move back to the e2e principle and a focus shift from stateful middlebox security controls to host based controls.</p>
<p>But at some point, we are going to have to concede that there is no one right way to deploy ipv6, just like there is no one right way to deploy ipv4.</p>
<p>If people come to this list looking for help in deploying ipv6, we should focus on listening to their questions and providing answers without judging their sop.</p>
<p>Otherwise, ipv6 operators will continue to look like a bunch or irrelevant and clubby zealots who are constantly spouting out holier than thou sermons about the one true path.</p>
<p> Not that that is what you have done, but as soon as I saw the initial post, I braced myself.</p>
<p>Cb</p>