Subject: Re: RFC3484 problem: scoping with site-locals/ULAs

From: "Walt Lazear" <[email-masked]>
Date: Tue, 9 May 2006 16:22:03 -0400

Eliot makes a good point about DNS.  This sounds like a perfect case for
split DNS, to maintain isolation of both the (private) inside of the NAT
point and the site local addresses from the public Internet.  What
people see on DNS inside should be reachable from the inside, but what
they see on DNS outside should be nothing(?).  It sounds like the site
in question has a single DNS and it's telling outsiders about private
stuff that should not be allowed to escape.

Walt Lazear

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Tue, 9 May 2006 23:43:13 +0300 (EEST)

On Tue, 9 May 2006, Walt Lazear wrote:
> It sounds like the site in question has a single DNS and it's 
> telling outsiders about private stuff that should not be allowed to 
> escape.

Exactly the opposite.  To solve this problem using split DNS, the DNS 
resolvers at the site would need to BLOCK any global IPv6 addresses 
from being received (in DNS packets) from _outside_ the site.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings