Subject: RE: NATs as firewalls

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 7 Mar 2007 10:14:37 -0800

> From: John C Klensin [mailto:[email-masked]] 

>   And, when I conclude that IPv6 is inevitable 
> (unless someone comes up with another scheme for global 
> unique addresses RSN),

Here we disagree, I don't think that IPv6 is inevitable. When I model the pressures on the various parties in the system and consider the shortest route by which the participants can reach their short term goals there are certainly alternative schemes.

I certainly do not want to see these schemes deployed but they are certainly possible outcomes. For example, a hyperNAT where the ISP NATs residential Internet as a matter of course. I suspect we will start to see this deployed on a large scale as soon as the market price for IP address allocation reaches a particular point.

There is a major difference between a NAT box plugged into the real Internet and a NAT box plugged into another NAT box. It is a pretty ugly one for the residential user.

I don't want to go into too much detail as it might encourage deployment but it is certainly possible to design something that works *for the ISPs*.

And yes, I did give a thought to patenting the ideas in an attempt to keep them off the market (the only real utility of the USPTO these days), there is ample prior art for schemes that are even worse.

IPv6 is not inevitable, the issue is how to make it so. I believe that we need a branding scheme that tells the user that they are getting a next generation Internet hookup, that they have a next generation router box etc. and that the presence of the brand means that they can absolutely expect everything they want to work to simply work without the current level of fuss.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Darryl \(Dassa\) Lynch" <[email-masked]>
Date: Thu, 8 Mar 2007 07:52:32 +1100

> the client.  For example, multimedia streaming has been=20
> fraught with security exploits.
>=20
> As traffic merges into common channels, there will be a=20
> desire to minimize cryptographic identifier abuse, in=20
> particular for things like DKIM.  While there exists an=20
> experimental method for a domain to "authorize" a client,=20
> this technique represents a significant hazard.  This hazard=20
> is created by the iterative construction of address lists and=20
> the macro expansion of local-part components of a=20
> email-address.  The inherent capability of this method=20
> permits a sizable attack to be stage without expending=20
> additional resources of the attacker.  In addition, this=20
> experimental scheme fails to identify the point of=20
> transmission staging the attack.
>=20
> Those offering outbound services desire that acceptance be=20
> based upon their customer's reputation rather than upon that=20
> of their stewardship.  With the experimental scheme, the=20
> administrative entity for the client is not relevant,=20
> although essential when guarding against abuse.  There are=20
> several orders of magnitude more customers than outbound=20
> service providers.  Guarding against abuse must depend upon a=20
> means to consolidate the entities being assessed.
>=20
> There are millions of new domains generated every day at no=20
> cost to the bad actors.  When IPv6 becomes more common, the=20
> IP address may even exceed a scalable defensive.  The long=20
> standing practice allowing clients to remain nameless will=20
> need to change.  For SMTP, the EHLO should resolve.  Any=20
> authorization scheme should then be based upon a name lookup=20
> and not upon a list of IP addresses for thousands of transmitters.
>=20
> -Doug
>=20
>=20

---

From: "Darryl \(Dassa\) Lynch" <[email-masked]>
Date: Thu, 8 Mar 2007 07:52:32 +1100

Hallam-Baker, Phillip wrote:
>>>   And, when I conclude that IPv6 is inevitable (unless someone comes
>>> up with another scheme for global unique addresses RSN),
>> 
>> Here we disagree, I don't think that IPv6 is inevitable.
>> When I model the pressures on the various parties in the
>> system and consider the shortest route by which the
>> participants can reach their short term goals there are
>> certainly alternative schemes.
>> 
>> I certainly do not want to see these schemes deployed but
>> they are certainly possible outcomes. For example, a
>> hyperNAT where the ISP NATs residential Internet as a matter
>> of course. I suspect we will start to see this deployed on a
>> large scale as soon as the market price for IP address
>> allocation reaches a particular point.
>> 
>> There is a major difference between a NAT box plugged into
>> the real Internet and a NAT box plugged into another NAT
>> box. It is a pretty ugly one for the residential user.

I'm afraid it is already happening on a large scale in some parts.  Here in
Australia I've seen multiple ISP's who NAT all residential customers.  Some
of them amongst the largest players in the market.  Even some commercial
offerings are on NATs.

Personally I'm more set against the wholesale blocking of ports and services
which ISPs seem to be favouring at the moment, and the pricing that is
applied to have the blocks removed.  There are artificial blocks being
deployed to keep usage down that are a bigger problem than NATs IMHO.

Darryl (Dassa) Lynch 

f it isn't spam) or
	label similar future email.  If you have any questions, see
	the administrator of that system for details.
	Content preview:  Hallam-Baker, Phillip wrote: >>> From: John C Klensin
	[mailto:[email-masked]] >> >>> And, when I conclude that IPv6 is
	inevitable (unless someone comes >>> up with another scheme for global
	unique addresses RSN), >> >> Here we disagree, I don't think that IPv6
	is inevitable. >> When I model the pressures on the various parties in
	the >> system and consider the shortest route by which the >>
	participants can reach their short term goals there are >> certainly
	alternative schemes. >> >> I certainly do not want to see these schemes
	deployed but >> they are certainly possible outcomes. For example, a >>
	hyperNAT where the ISP NATs residential Internet as a matter >> of
	course. I suspect we will start to see this deployed on a >> large
	scale
	as soon as the market price for IP address >> allocation reaches a
	particular point. >> >> There is a major difference between a NAT box
	plugged into >> the real Internet and a NAT box plugged into another
	NAT
	>> box. It is a pretty ugly one for the residential user. [...] 
	Content analysis details:   (0.5 points, 5.0 required)
	pts rule name              description
	---- ----------------------
	--------------------------------------------------
	-1.4 ALL_TRUSTED Passed through trusted hosts only via SMTP
	0.5 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org
	1.4 DNS_FROM_RFC_POST      RBL: Envelope sender in
	postmaster.rfc-ignorant.org
Subject: RE: NATs as firewalls
Reply-To: [email-masked]

Hallam-Baker, Phillip wrote:
>>>   And, when I conclude that IPv6 is inevitable (unless someone comes
>>> up with another scheme for global unique addresses RSN),
>> 
>> Here we disagree, I don't think that IPv6 is inevitable.
>> When I model the pressures on the various parties in the
>> system and consider the shortest route by which the
>> participants can reach their short term goals there are
>> certainly alternative schemes.
>> 
>> I certainly do not want to see these schemes deployed but
>> they are certainly possible outcomes. For example, a
>> hyperNAT where the ISP NATs residential Internet as a matter
>> of course. I suspect we will start to see this deployed on a
>> large scale as soon as the market price for IP address
>> allocation reaches a particular point.
>> 
>> There is a major difference between a NAT box plugged into
>> the real Internet and a NAT box plugged into another NAT
>> box. It is a pretty ugly one for the residential user.

I'm afraid it is already happening on a large scale in some parts.  Here in
Australia I've seen multiple ISP's who NAT all residential customers.  Some
of them amongst the largest players in the market.  Even some commercial
offerings are on NATs.

Personally I'm more set against the wholesale blocking of ports and services
which ISPs seem to be favouring at the moment, and the pricing that is
applied to have the blocks removed.  There are artificial blocks being
deployed to keep usage down that are a bigger problem than NATs IMHO.

Darryl (Dassa) Lynch

---

From: David Morris <[email-masked]>
Date: Wed, 7 Mar 2007 18:16:20 -0800 (PST)

> of them amongst the largest players in the market.  Even some commercial
I've also encountered a local ISP who is using a NAT between their network
and the 'world'. So there is at least one US based ISP who has adopted
this approach.

Dave Morris

---

From: Mark Andrews <[email-masked]>
Date: Thu, 08 Mar 2007 13:51:27 +1100

> and the 'world'. So there is at least one US based ISP who has adopted

	Well they are not a ISP as far as I am concerned.   If you
	want you VoIP phone to work (accept calls) you need a real
	address.  Arranging to have VoIP work through a NAT which
	you fully control is hard enough.  Making it work through
	a NAT that you don't control is almost impossible.

	I suppect loss of services that remote / double nat causes
	will be enough to kill this "solution".

	Mark
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: John C Klensin <[email-masked]>
Date: Wed, 07 Mar 2007 22:25:40 -0500

--On Wednesday, 07 March, 2007 10:14 -0800 "Hallam-Baker,
Phillip" <[email-masked]> wrote:

>...
> IPv6 is not inevitable, the issue is how to make it so. I
> believe that we need a branding scheme that tells the user
> that they are getting a next generation Internet hookup, that
> they have a next generation router box etc. and that the
> presence of the brand means that they can absolutely expect
> everything they want to work to simply work without the
> current level of fuss.
>...

And that takes us full circle back to RFC 4084 (or a possible
update to it), so it is probably time for me to drop out of the
conversation.

    john

---

From: Simon Leinen <[email-masked]>
Date: Sun, 11 Mar 2007 12:46:56 +0100

> I'm afraid it is already happening on a large scale in some parts.
> Here in Australia I've seen multiple ISP's who NAT all residential
> customers.

While I'm not seeing this in the traditional retail (home) ISP market
in my area of Europe, provider-operated NAT is common/prevalent in

* mobile (GPRS/UMTS) Internet access
* public WLANs

Some operators even use the same NAT for both, selling "seamless
roaming" (that doesn't break TCP connections) between WLAN and 3G
service as a feature.
-- 
Simon.