Subject: RE: NATs as firewalls

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 5 Mar 2007 09:15:47 -0800

DQo+IEZyb206IEJyaWFuIEUgQ2FycGVudGVyIFttYWlsdG86YnJjQHp1cmljaC5pYm0uY29tXSANCg0KPiBKb2huLA0KPiANCj4gKGFmdGVyIGFsc28gcmVhZGluZyBNaWNoYWVsJ3MgcmVzcG9uc2UpDQo+IA0KPiBJIGRvbid0IGRpc2FncmVlLiBJIHRoaW5rIHRoZXJlIGlzIHNjb3BlIGZvciB3cml0aW5nIGEgbGlzdCANCj4gb2YgZGVzaXJhYmxlIHByb3BlcnRpZXMgZm9yIFNPSE8gcm91dGVycyBpbiB0aGUgbGlnaHQgb2YgDQo+IHRoZXNlIHZhcmlvdXMgaW5wdXRzLiBJJ20gbGVzcyBjZXJ0YWluIGl0IGNhbiBiZSBkb25lIGZvciANCj4gZW50ZXJwcmlzZSBib3VuZGFyeSByb3V0ZXJzLiBCdXQgaXQgd291bGQgYmUgYSB0cmlja3kgYW5kIA0KPiBjb250ZW50aW91cyBqb2IgaW4gYm90aCBjYXNlcy4gRXZlbiBkcmFmdC1pZXRmLXY2b3BzLW5hcCB0b29rIA0KPiBtYW55IG1vb25zIGFuZCBzZXZlcmFsIG1ham9yIGVkaXRpbmcgcGFzc2VzLCBhbmQgaXQgb25seSANCj4gc3RhcnRzIHRoZSB3b3JrLg0KDQpTT0hPIGlzIHRoZSBvbmUgdGhhdCB3b24ndCBnZXQgZG9uZSBvdGhlcndpc2UuIFRoZSBlbnRlcnByaXNlIGZvbGsgaGF2ZSBHYXJ0bmVyLCBCdXJ0b24gYW5kIHRoZSBKZXJpY2hvIGZvcnVtIHRvIGV4cHJlc3MgdGhlaXIgbGlzdCBvZiByZXF1aXJlbWVudHMgdGhyb3VnaCAoYW5kIHRoZSBSRlAgcHJvY2VzcyB0byBwdXQgdGhvc2UgcmVxdWlyZW1lbnRzIG9uIHRoZSB2ZW5kb3IgcHJvZHVjdCByb2FkbWFwcykuDQoNCkZyb20gdGhlIFNPSE8gcGVyc3BlY3RpdmUgSSBoYXZlIGJlZW4gc2F5aW5nIGZvciB5ZWFycyBub3cgdGhhdCBtYW55IG9mIHRoZSBwcm9ibGVtcyB3ZSBoYXZlIHdpdCBib3RzIHdvdWxkIGJlIHNpZ25pZmljYW50bHkgcmVkdWNlZCBpZiBTT0hPIHJvdXRlcnMgYW5kIGNhYmxlIG1vZGVtcyBjYW1lIGNvbmZpZ3VyZWQgd2l0aCBhbiBvdXRib3VuZCBmaXJld2FsbCBieSBkZWZhdWx0Lg0KDQpUaGUgcmVzdHJpY3Rpb25zIEkgd291bGQgbGlrZSB0byBzZWUgd291bGQgaGF2ZSB6ZXJvIGltcGFjdCBvbiBldmVuIHRoZSBtb3N0IGFnZ3Jlc3NpdmUgcmVzaWRlbnRpYWwgdXNlciBwYXJ0aWNpcGF0aW5nIGluIHBlZXIgdG8gcGVlciBuZXR3b3JrcyBldGMuIA0KDQogICogUHJldmVudCByb3V0aW5nIG9mIHNwb29mIHNvdXJjZSBhZGRyZXNzIHBhY2tldHMNCiAgKiBMaW1pdCB0aGUgbnVtYmVyIG9mIG91dGJvdW5kIFRDUCBjb25uZWN0aW9ucyBpbml0aWF0ZWQgcGVyIHRpbWUgaW50ZXJ2YWwNCiAgICAgICAqIEdlbmVyYWwgbGltaXQNCiAgICAgICAqIFNtYWxsZXIgbGltFrom [email-masked] Mon Mar 05 12:16:49 2007Return-path: <[email-masked]>Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com)	by megatron.ietf.org with esmtp (Exim 4.43)	id 1HOGmv-00025b-E3; Mon, 05 Mar 2007 12:15:53 -0500Received: from [10.91.34.44] (helo=ietf-mx.ietf.org)	by megatron.ietf.org with esmtp (Exim 4.43) id 1HOGmu-00023d-7m	for [email-masked]; Mon, 05 Mar 2007 12:15:52 -0500Received: from colibri.verisign.com ([65.205.251.74])	by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HOGms-0006Ft-Sf	for [email-masked]; Mon, 05 Mar 2007 12:15:52 -0500Received: from MOU1WNEXCN02.vcorp.ad.vrsn.com (mailer2.verisign.com	[65.205.251.35])	by colibri.verisign.com (8.13.6/8.13.4) with ESMTP id l25HFlR6013352;	Mon, 5 Mar 2007 09:15:47 -0800Received: from MOU1WNEXMB04.vcorp.ad.vrsn.com ([10.25.13.157]) by	MOU1WNEXCN02.vcorp.ad.vrsn.com with Microsoft	SMTPSVC(6.0.3790.1830); Mon, 5 Mar 2007 09:15:46 -0800X-MimeOLE: Produced By Microsoft Exchange V6.5Content-class: urn:content-classes:messageMIME-Version: 1.0Date: Mon, 5 Mar 2007 09:15:47 -0800Message-ID: <[email-masked]>X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: NATs as firewallsThread-Index: AcdfE054jadanOzWSdCug24R+dNxUgAJs/MQFrom: "Hallam-Baker, Phillip" <[email-masked]>To: "Brian E Carpenter" <[email-masked]>,	"John C Klensin" <[email-masked]>X-OriginalArrivalTime: 05 Mar 2007 17:15:46.0970 (UTC)	FILETIME=[EA314FA0:01C75F49]X-Spam-Score: 0.1 (/)X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9fCc: [email-masked]: RE: NATs as firewallsX-BeenThere: [email-masked]: 2.1.5Precedence: listList-Id: IETF-Discussion <ietf.ietf.org>List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/ietf>,	<mailto:[email-masked]?subject=unsubscribe>List-Post: <mailto:[email-masked]>List-Help: <mailto:[email-masked]?subject=help>List-Subscribe: <https://www1.ietf.org/mailman/listinfo/ietf>,	<mailto:[email-masked]?subject=subscribe>Content-Type: multipart/mixed; boundary="===============1914860132=="Errors-To: [email-masked]

> From: Brian E Carpenter [mailto:[email-masked]] 

> John,
> 
> (after also reading Michael's response)
> 
> I don't disagree. I think there is scope for writing a list 
> of desirable properties for SOHO routers in the light of 
> these various inputs. I'm less certain it can be done for 
> enterprise boundary routers. But it would be a tricky and 
> contentious job in both cases. Even draft-ietf-v6ops-nap took 
> many moons and several major editing passes, and it only 
> starts the work.

SOHO is the one that won't get done otherwise. The enterprise folk have Gartner, Burton and the Jericho forum to express their list of requirements through (and the RFP process to put those requirements on the vendor product roadmaps).

From the SOHO perspective I have been saying for years now that many of the problems we have wit bots would be significantly reduced if SOHO routers and cable modems came configured with an outbound firewall by default.

The restrictions I would like to see would have zero impact on even the most aggressive residential user participating in peer to peer networks etc. 

  * Prevent routing of spoof source address packets
  * Limit the number of outbound TCP connections initiated per time interval
       * General limit
       * Smaller limit for connections to the same IP
       * Smaller limit for outbound SMTP connections
  * Limit the number of DNS requests

Even the most generous limits significantly cut the value of a bot. A machine that can only send ten thousand spams an hour will at most fetch 1% of the rent that a bot capable of a million an hour.

In the home of the future Mr Coffee will be WiFi capable. I for one do not want to be spending my time dealling with the consequences of botted coffee pots, fidges and light switches.

What distinguishes the network from the inter-network is responsibility. I am responsible for the impact that my network has on the inter-network. Even as the perimiter security model becomes obsolete the perimeter will still mark the boundary for accountability.
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: John C Klensin <[email-masked]>
Date: Mon, 05 Mar 2007 13:54:13 -0500

--On Monday, 05 March, 2007 09:15 -0800 "Hallam-Baker, Phillip"
<[email-masked]> wrote:

> SOHO is the one that won't get done otherwise. The enterprise
> folk have Gartner, Burton and the Jericho forum to express
> their list of requirements through (and the RFP process to put
> those requirements on the vendor product roadmaps).
> 
> From the SOHO perspective I have been saying for years now
> that many of the problems we have wit bots would be
> significantly reduced if SOHO routers and cable modems came
> configured with an outbound firewall by default.
>...

While I have disagreed with many of the other things Phillip has
said in this thread, I am in complete agreement with this one
and taken much the same position for some time.  Indeed, I have
long suspected that the highest-leverage remedy for many spam
and malware issues would start with considering ISPs who supply
SOHO and, even more important, residential, connections without
supplying or requiring such firewalls at the boundary to be
liable for the damage that results.

While an IETF Standard specifying the capabilities such a
firewall should have and how it should be configured is neither
necessary nor sufficient to hold ISPs to that level of
accountability and liability, it would certainly be a very
useful step to clearly establish the requirements and their
importance.   While I don't think the IETF list is the right
place to try to sort out Philip's specific configuration
suggestions, I note that none of the mass-market inexpensive
devices sold as "Cable/DSL Routers" or firewalls (at least those
I'm aware of) are even capable of being configured to do the
type of outbound rate limiting that he suggests.

    john