Subject: Re: [homenet] [homegate] HOMENET working group proposal

From: james woodyatt <[email-masked]>
Date: Sat, 06 Aug 2011 18:18:44 -0700

On Jun 29, 2011, at 19:57 , Fernando Gont wrote:
> On 06/29/2011 11:38 PM, Cameron Byrne wrote:
>> 
>> The opportunity for restoring e2e is one of the great opportunities of ipv6 
> 
> This assumes that e2e reachability is a desired property for all networks.

In the context of the HOMENET working group, one imagines that restoring general end-to-end reachability is arguably a worthy goal.  If it isn't, then we should just throw in the towel now.  If you ask me, there isn't any point in setting an open standard if the Internet is just going to be a straight road leading from every home in every town to a small handful of data centers owned and operated by an oligarchy of transnational mega-corporations.  We should just hand the whole thing over to them and let their engineers design everything in secret.

--
james woodyatt <[email-masked]>
member of technical staff, core os networking

---

From: Ray Bellis <[email-masked]>
Date: Sun, 7 Aug 2011 08:18:52 +0000

On 7 Aug 2011, at 02:18, "james woodyatt" <[email-masked]> wrote:

> In the context of the HOMENET working group, one imagines that restoring general end-to-end reachability is arguably a worthy goal.

+1

(no hat)

Ray

---

From: Sander Steffann <[email-masked]>
Date: Sun, 7 Aug 2011 13:50:50 +0200

+1

Sander

---

From: Roger Jørgensen <[email-masked]>
Date: Sun, 7 Aug 2011 14:57:46 +0200

On Sun, Aug 7, 2011 at 3:18 AM, james woodyatt <[email-masked]> wrote:
<snip>
> In the context of the HOMENET working group, one imagines that restoring general end-to-end reachability is arguably a worthy goal.  <snip>

+1 :-)

-- 

Roger Jorgensen           |
[email-masked]          | - IPv6 is The Key!
http://www.jorgensen.no   | [email-masked]

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Sun, 7 Aug 2011 15:16:01 +0200

Looks obvious, but is it?

In one hand, we want the capability to reach anywhere we're allowed to from home. OTOH, if anything in my home is reachable from anywhere, we are back to the firewall paradigm. 

There is an alternate model based on L3 overlays that was presented in various places under names such as route projection, community  of interest or on-demand VPNs.

That model forms dynamic overlays that act as L3 VLANs. Prefixes are no more injected in the main infrastructure but only projected within the overlay. This allows the model to scale with good mobility properties since an overlay separates the locator and the identifier, which BTW can be of different Address Families.

I wanted to ask for a BOF in Taipei to discuss that model. Would anyone be interested?

Pascal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Roger Jørgensen
> Sent: Sunday, August 07, 2011 2:58 PM
> To: james woodyatt
> Cc: [email-masked]; Fernando Gont
> Subject: Re: [homenet] [homegate] HOMENET working group proposal
> 
> > In the context of the HOMENET working group, one imagines that restoring
> general end-to-end reachability is arguably a worthy goal.  <snip>
> 
> +1 :-)
> 
> 
> 
> --
> 
> Roger Jorgensen           |
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet

---

From: David R Oran <[email-masked]>
Date: Sun, 7 Aug 2011 09:41:45 -0400

> Looks obvious, but is it?
Yes.

> In one hand, we want the capability to reach anywhere we're allowed to from home. OTOH, if anything in my home is reachable from anywhere, we are back to the firewall paradigm. 
Why? You are still back to all the security disadvantages of firewalls - soft chewy inside, etc. Reachability does not convey access authorization. Devices must either protect themselves directly or delegate that protection to a proxy of some sort (*not* necessarily a firewall). 

> That model forms dynamic overlays that act as L3 VLANs. Prefixes are no more injected in the main infrastructure but only projected within the overlay. This allows the model to scale with good mobi…
sounds pretty complicated - if it requires manual configuration it may b a non-starter.

> I wanted to ask for a BOF in Taipei to discuss that model. Would anyone be interested?
Not enough data here to judge.

---

From: Russ White <[email-masked]>
Date: Sun, 07 Aug 2011 10:08:29 -0400

> Why? You are still back to all the security disadvantages of firewalls - soft chewy inside, etc. Reachability does not convey access authorization. Devices must either protect themselves directly o…

It seems like to me we're making things very complex (?)... In any given
network, there needs to be some amount of policy. Some of that policy is
best centralized, some of it is best distributed. And more than one
layer of defense is always better than only one layer of defense (though
you can go overboard in the other direction).

Take a house for instance... You have locked doors, and yet you still
have passwords. You have passwords and safes, yet you still have locked
doors... It's always a question of where the most efficient spot is to
implement any bit of policy/security, not whether or not that
policy/security is needed.

Whether the policy that's needed is on something called a "firewall," or
a "bridge between multiple control planes," or... It doesn't matter.
Policy is policy.

Or maybe I don't understand the question... :-)

Russ

---

From: Cameron Byrne <[email-masked]>
Date: Sun, 7 Aug 2011 07:35:21 -0700

On Aug 7, 2011 4:51 AM, "Sander Steffann" <[email-masked]> wrote:
>
> >> In the context of the HOMENET working group, one imagines that
restoring general end-to-end reachability is arguably a worthy goal.

+1

Cb

---

From: Wouter Cloetens <[email-masked]>
Date: Mon, 08 Aug 2011 00:57:14 +0200

> Or maybe I don't understand the question... :-)

Your analysis is spot on.
Yes, firewalls will happen. CPE routers, at least the ISP-managed 
variety, will ship with those on by default.
No, firewalls don't necessarily break end-to-end connectivity. Not as 
badly as NAT does.
Indeed, the average user cannot be expected to manually administer a 
firewall.

Yes, there are solutions (e.g. UPnP IGD) that manage IPv4 port 
forwarding and IPv6 firewall pin-holing without user intervention. Is 
that secure? It's as secure as allowing someone already inside your 
house to open the door to let someone else in. Whether you want to allow 
that is a matter of policy; you generally don't want that in a military 
facility, you do want it in a residence. If you want to keep criminals 
out of your house, disabling the ability to open the front door from the 
inside is the wrong approach.

Removing the front door, just to be sure that the milkman can deliver 
milk straight to your fridge, and the electricity company guy can read 
your meter while you're not home, is not the best policy in most parts 
of the world either.

Indeed, none of this needs to be particularly complicated. Everybody 
understands your house and locked doors metaphor.  Being able to open 
the front door from the inside is not the problem of the company that 
sells front doors with locks and security bolts, and that is understood 
by everyone. People are perfectly content with the soft, chewy inside 
nature of their homes.
Like you, I don't understand why this issue should be so contentious.

People who want to run complex services inside their homes normally have 
the expertise to perform a manual policy change. Those are the people 
who are managing just fine today to set up manual port forwardings on 
residential gateways. That is the exception case; it must be possible, 
but not automatic.

bfn, Wouter
-- 
Architect Core Gateway   SoftAtHome R&D RGW  http://www.softathome.com/

---

From: Mark Andrews <[email-masked]>
Date: Mon, 08 Aug 2011 10:15:35 +1000

One think I haven't seen mentions w.r.t. firewalls is protecting
the rest of the world from compromised home machines.  While ISP's
should be doing BCP 38 filtering,  CPE devices should also be
filtering outgoing traffic that is not from a valid prefix.  The
border CPE also needs to filter ULA sourced traffic.

Similary, if you are going to have a squishy inside, you need to
filter attempts to spoof internal sources.

Even if you open up the firewall to allow incoming from anywhere,
these filters should require a second step to be taken to be removed.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Baugher <[email-masked]>
Date: Mon, 8 Aug 2011 00:15:08 -0700

> In one hand, we want the capability to reach anywhere we're allowed to from home. OTOH, if anything in my home is reachable from anywhere, we are back to the firewall paradigm. 

I want my mobile phone to connect to my home NAS from anywhere without explicitly poking a hole in a firewall.  It's not so much an inside versus outside issue; it's about ensuring that the devices are trusted to conform to a particular policy prior to establishing a connection.  I think this generally requires manual association by the user, such as in a pairing ceremony with mutual key signing.  In general, this can't be made "plug and play" because the networks that are used might contain uninvited hardware or software.

> That model forms dynamic overlays that act as L3 VLANs. Prefixes are no more injected in the main infrastructure but only projected within the overlay. This allows the model to scale with good mobi…

Protocols for securely associating devices seems to be the place to start, along with default policies for ACLs, etc.

Mark

---

From: james woodyatt <[email-masked]>
Date: Mon, 08 Aug 2011 10:43:51 -0700

On Aug 7, 2011, at 5:15 PM, Mark Andrews wrote:
> 
> One think I haven't seen mentions w.r.t. firewalls is protecting the rest of the world from compromised home machines.  While ISP's should be doing BCP 38 filtering,  CPE devices should also be filtering outgoing traffic that is not from a valid prefix. [...]

Then I would direct your attention to Recommendation #5 in RFC 6092, which informs the implementers of residential firewalls thusly:

   REC-5: Outbound packets MUST NOT be forwarded if the source address
   in their outer IPv6 header does not have a unicast prefix configured
   for use by globally reachable nodes on the interior network.

Does that about cover it?

---

From: Ole Troan <[email-masked]>
Date: Mon, 8 Aug 2011 19:48:31 +0200

Mark,

> these filters should require a second step to be taken to be removed.

RFC6204, ULA-4, S-2

cheers,
Ole