Re: NATs as firewalls

[Douglas Otis <dotis at mail-abuse.org>]

On Mar 1, 2007, at 9:57 AM, John C Klensin wrote:

> I continue to believe that, until and unless we come up with models  
> that can satisfy the underlying problems that NATs address in the  
> above two cases and implementations of those models in mass-market  
> hardware, NATs are here to stay, even if we manage to move to IPv6  
> for other reasons.  And, conversely, the perceived difficulties  
> with NATs will be sufficiently overcome by the above issues to  
> prevent those difficulties from being a major motivator for IPv6,  
> at least for most of the fraction of the ISP customer base who  
> cannot qualify for PI space.

One of the "features" contained within Microsoft Vista is a stack  
terminating an IPv6 address encapsulated using RFC4380 Teredo (IPv6  
over IPv4 UDP).  This also works in conjunction with their new name  
resolution protocol offering address structures for navigating  
through Teredo compliant NATs and firewalls.

While this may require rather heavily lifting track the UDP traffic,  
this constrains the growth of router tables and helps retain the  
viability of IPv4 addressing.  At the same time, offers a transition  
into the IPv6 address space which moves a bit closer to the end-to- 
end ideals by leveraging compliant NATs and Firewalls.  Whether  
Teredo proves secure or PRNP functions well, the PNRP name resolution  
service represents a proprietary solution that appears to be without  
IETF IPR statements.  Is this good or bad?  It is concerning.

-Doug

_______________________________________________
Ietf mailing list
Ietf at ietf.org
https://www1.ietf.org/mailman/listinfo/ietf