Subject: raw thoughts on v6 firewalls

From: Pekka Savola <[email-masked]>
Date: Thu, 19 Sep 2002 00:52:09 +0300 (EEST)

Hi,

Regarding v6ops meeting discussion..

I don't think v6 firewalls can be killed.  They're a mechanism to ensure 
some form of security policy; trusting end nodes to do the right thing is 
not enough.

But there are problems with v6 firewalling.  I've been trying to get
around to writing a draft for a year or so now but never did it (further
than the baseline summary of the content): perhaps now it's a better time.

One potentially major deployment issue is how the firewall is supposed to
handle packets where extension header contains a header it does not not
recognize and thus cannot parse e.g. UDP/TCP headers.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Thu, 19 Sep 2002 09:47:49 +0900

>than the baseline summary of the content): perhaps now it's a better time.

	i understand we can't kill firewall.  they need to be more flexible -
	like allowing inbound connection for p2p protocols and such.  but then,
	we may be opening a big can of worms...

>recognize and thus cannot parse e.g. UDP/TCP headers.

	i'm trying to implement IPv6 stateful inspection into OpenBSD PF,
	but having no time to do so...

itojun

---

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 19 Sep 2002 09:29:37 -0500

Hello Pekka,
  Site-local addresses would provide the same functionality and 
therefore there is no need to introduce firewalls into v6.
  Is there anything wrong with the above argument?

Regards,

-- 
Behcet

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 19 Sep 2002 17:21:07 +0200

>   Is there anything wrong with the above argument?

Lots. It's very similar to the argument that NAT is a security
feature, which is absolutely untrue.

Firewalls block incoming connections with global destination addresses. 
The existence of site-local addresses is orthogonal to this. You still
need to allow some incoming connections to global addresses, and
block others.

(Firewalls do more than that, but this is sufficient to answer
your question.)
  
   Brian

---

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 19 Sep 2002 10:46:45 -0500

Now I understand that it is somewhat orthogonal. Using site local 
addresses the intranet can avoid seeing company emails on Google's 
search engine, but how to avoid having ftp sites to be not accessible 
from the Internet? Maybe this is also possible using site local addresses.

Would then be a good idea to ask MIDCOM WG to come up with new RFCs 
(-bis) replacing the present v4 only ones to standardize v6 firewalls?
Why this such an important issue did not come up during the long 
standardization period in which v6 was developed?

Regards,

-- 
Behcet

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 20 Sep 2002 09:20:24 +0200

Behcet Sarikaya wrote:
> 
> Now I understand that it is somewhat orthogonal. Using site local addresses the intranet can avoid seeing company emails on
> Google's search engine, but how to avoid having ftp sites to be not accessible from the Internet? Maybe this is also possible
> using site local addresses.
> 
> Would then be a good idea to ask MIDCOM WG to come up with new RFCs (-bis) replacing the present v4 only ones to standardize
> v6 firewalls?

There are no standards for firewalls. MIDCOM is working on firewall (and IPv4-NAT)
traversal techniques only.

> Why this such an important issue did not come up during the long standardization period in which v6 was developed?

Because IPv6 is aimed at restoring transparency and enabling
end to end security. Certainly, the MIDCOM mechanisms must be
equally valid for v4 and v6.

   Brian

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Distinguished Engineer, Internet Standards & Technology, IBM 
On assignment at the IBM Zurich Laboratory, Switzerland