Subject: [homenet] section 3.6.3

From: Michael Thomas <[email-masked]>
Date: Mon, 17 Jun 2013 13:31:15 -0700

dissing nat as a security measure is fine by me, but i'm not sure that going on to diss firewalls
is really appropriate. i haven't heard of any great movement to remove them, even though they
cause trouble with new fangled protocols.

the one area that i wonder about is carrier ip connectivity on phones: i assume that they are
behind the carriers firewall? if they aren't, or that firewall is really permissive maybe there's
something to this section. if not, do we really have evidence to be so dismissive of firewalls?

Mike

---

From: Michael Richardson <[email-masked]>
Date: Mon, 17 Jun 2013 20:08:13 -0400

Michael Thomas <[email-masked]> wrote:
    mt> dissing nat as a security measure is fine by me, but i'm not sure that going on to diss firewalls
    mt> is really appropriate. i haven't heard of any great movement to remove them, even though they
    mt> cause trouble with new fangled protocols.

I've yet to see any home other than mine (and 2 technical FreeS/WAN colleagues...) that
had a firewall that was more complicated than NAT. (Port forwards are NAT work around)

    mt> the one area that i wonder about is carrier ip connectivity on phones: i assume that they are
    mt> behind the carriers firewall? if they aren't, or that firewall is really permissive maybe there's
    mt> something to this section. if not, do we really have evidence to be so dismissive of firewalls?

Do you mean things like phone service sold by, for instance, incumbent cable operators?
The ATA is generally built into the NAT/modem.  Sometimes the cable operator
provides two modems, one for phone.  I have seen Rogers in Ottawa do both.

The devices are not behind any firewall or on a seperate VLAN or anything.

At novavision.ca, the business connectivity that we provide for phones using a
hosted PBX uses a seperate VLAN.   We provide firewalled IPv6 and non-routed
IPv4 connectivity. (i.e. RFC1918, no NAT) to the phones, but so far, no phone
manufacturer we deal with ships a phone with IPv6.

--
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: Michael Thomas <[email-masked]>
Date: Mon, 17 Jun 2013 17:17:31 -0700

> provides two modems, one for phone.  I have seen Rogers in Ottawa do both.

No, no, I mean smart phones connected to say, 3g cellular. Are they behind, say,
VZW's firewall, or are they on their own firewallwise?

(I'd actually be happy if it wasn't behind their firewall so the carrier doesn't
hold my phone hostage to their firewall whims.)

Mike

---

From: Michael Richardson <[email-masked]>
Date: Mon, 17 Jun 2013 20:57:24 -0400

>> provides two modems, one for phone.  I have seen Rogers in Ottawa do both.

    mt> No, no, I mean smart phones connected to say, 3g cellular. Are they behind, say,
    mt> VZW's firewall, or are they on their own firewallwise?

My 3G experience has all involved NAT and IPv4.
So there was a unidirectional SYN firewall.  I've seen port-25 and port-139
blocked, but that was all.

I don't know what happens when there IPv6.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Michael Thomas <[email-masked]>
Date: Mon, 17 Jun 2013 18:08:09 -0700

> I don't know what happens when there IPv6.

Yeah, I haven't actually tried listening on port 80 on my android when I happen
to be on v6 and seeing if it's walled off. I was hoping that lazywebs would help
me out here. *If* phones are not walled off now, I have no objection to this section as
it's a stake in the ground that hosts can be their own firewalls. But I'd like to have
some belief that that is true before we declare homenet firewalls obsolete.

Mike

Mike

---

From: Mark Andrews <[email-masked]>
Date: Tue, 18 Jun 2013 12:03:08 +1000

> some belief that that is true before we declare homenet firewalls obsolete.

While I don't want a reply only in firewall I do want source address
filtering on by default in the border routers.  The are too many
places that pass spoofed addresses.

Allow out only source address announced in RA's/learn't by PD.  Deny
in source addresses announced in RA's/learnt by PD.  This would put
the IPv6 side on par (or better as it would actually drop the spoofed
traffic rather than map it to the public address) with IPv4 + PNAT
in preventing spoofed addresses leaving the network.

Mark

> Mike
> 
> Mike
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]