Subject: RE: [nemo] Nemo Basic Support - IP in IP tunneling vs NAT transversal

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Fri, 7 Nov 2003 08:22:21 -0000

> 
> Pascal Thubert (pthubert) wrote:
> > Note that Doors should work with the T-Mobile IPv4 infrastructure an
> > dtheir active filters, at least if IP-in-UDP does for IPv4 mobile 
> > tunnels.
> 
> Until the day T-Mobile realizes that Doors bubbles try to get 
> through so T-Mobile will stop the Doors bubbles too, no?
> 

For the record, doors does not have bubbles (that's teredo), but the
equivalent service is obtained naturally from Binding Updates.

My understanding is that the probes that T-Mobile is filtering out are
generally offensive and can be seen as DOS attacks on a low bandwidth
s.a. GPRS. This is about filtering things coming from the outside, just
like a firewall.

If T-Mobile wished to deploy a MIPv6 or Nemo service that uses their
CURRENT IPv4 GPRS structure, I believe that they could do so, even with
these filters active, using doors. The 'bubbles' would not be filtered
because:

- they come from the inside
- T-Mobile does not wish to kill their own service

We have an implementation of doors that has already been successfully
tested with some GPRS deployments. I'd be glad to try more :)

Pascal

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 07 Nov 2003 11:33:14 +0100

> equivalent service is obtained naturally from Binding Updates.

Thanks for the clarification.

> My understanding is that the probes that T-Mobile is filtering out
> are generally offensive and can be seen as DOS attacks on a low
> bandwidth s.a. GPRS. This is about filtering things coming from the
> outside, just like a firewall.

Yes, that is right.  I had it the other way around.

> CURRENT IPv4 GPRS structure, I believe that they could do so, even
> with these filters active, using doors.

Ok, I would like to stop talk about T-Mobile explicitely, but a "telecom
operator".  I was not looking at how a telecom operator might deploy
MIP6 into the GPRS infrastructure.

I was looking at how to use MIP6 or NEMO over the GPRS infrastructure of
_any_ telecom operator offering GPRS and/or UMTS, not only one 
particular provider that might have MIP6.  Basically use those as data 
pipes.

Experience with several of those operators show that they behave in very
different ways in terms of IP.  Moreover continuous experience shows the
firewall behaviour evolves: today they let pass some traffic tomorrow
they stop other traffic.  Some operators have NAT's that change the IP
address _and_ the source port number, others change only the IP address.

> The 'bubbles' would not be filtered because:
> 

If abuses of network resources start to be popular among users of 
bubbles then bubbles will be filtered in the wink of the eye.

>  tested with some GPRS deployments. I'd be glad to try more :)

And we have an implementation of parts of UDP-in-IP NAT Traversal of
Mobile IPv4 (RFC3519) combined with another implementation of NEMO and
that we tested with several EU GPRS deployments (two in France, two in
Portugal, one in Italy). Some of the operators we tested are active in
several countries (e.g. Orange is active at least in France, Portugal
and UK and surprisingly they use the same public IP address of their NAT
farm(?) regardless of connecting to their GPRS in France or Portugal).

Seems that T-Mobile in Germany too gives publicly routable addresses
(non-NAT'ed) and for sure Vodafone in Chicago, Illinois gives non-NAT'ed
addresses.

So, where did you try the doors implementation, and what was the NAT
behaviour?

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 07 Nov 2003 11:33:14 +0100

Alex
GBU