Wotcha,
Number 1 gets you thinking along the IPv6 route (no pun, and imho
)
since you have to treat each boxes as if it was public.
I see this kind of statement surprisingly often. Having a public address
doesn't make a device public.
I don't really see a drive to have devices exposed to the internet without
a stateful device in front of them in IPv6 world. People shouldn't allow
unsolicited connections to hit your internal workstation on any address
scheme.
Cheers,
Alex.
Wotcha,
Number 1 gets you thinking along the IPv6 route (no pun, and imho
since you have to treat each boxes as if it was public.I see this kind of statement surprisingly often. Having a public address
doesn't make a device public.
Yes it does, it makes end to end connectivity work again. NAT broke that
(and its one of the best things about v6). People have been relying on the
fact that you need rules to get through a NAT to reach a box - thereby
having NAT work as an inbound firewall. NAT != Security.
But yes having a public address means your box is public, you have to do
something to STOP traffic getting to it. With NAT you have to do something
to ENABLE traffic to get to it.
>Wotcha,
>
>>Number 1 gets you thinking along the IPv6 route (no pun, and imho
>>since you have to treat each boxes as if it was public.
>
>I see this kind of statement surprisingly often. Having a public address
>doesn't make a device public.Yes it does, it makes end to end connectivity work again. NAT broke that
(and its one of the best things about v6). People have been relying on the
fact that you need rules to get through a NAT to reach a box - thereby
having NAT work as an inbound firewall. NAT != Security.But yes having a public address means your box is public, you have to do
something to STOP traffic getting to it. With NAT you have to do something
to ENABLE traffic to get to it.
Correct. IPv6 correctly supports the end to end model.
Firewalls can be scalably implemented on host, not middle boxes.
The firewall mindset is locked in from the win2k days, NAT reinforced
that, and it is worth re-evaluated removing firewalls with ipv6
Question: are nanog meeting networks stateful firewalled? Follow up
question -- if there is no firewall, do folks experience a higher degree of
malware infection after the meeting ?
CB
>I don't really see a drive to have devices exposed to the internet
without
Yes, if you know the IP address of my printer you can use up my toner (it’s already low) and paper. Then again, It’s IPv6 so good luck finding it. The first nibble is 2. Let me know when you’ve found it.
I’ve actually had to deal with too many networks that perform MITM or other activities that I actually find it useful to VPN to get a public, unfiltered IP address.
The days of a machine that are hit with malware in minutes/seconds are done. The background radiation is still there, but it’s far more effective to use other methods (spam, social networks, ad networks, etc)…
Doesn’t mean that’s the only way, but many of the ‘easily exploitable’ methods from a decade ago are no longer there.
- Jared
Greetings,
Correct. IPv6 correctly supports the end to end model.
Yes, if you know the IP address of my printer you can use up my toner (it�s already low) and paper. Then again, It�s IPv6 so good luck finding it. The first nibble is 2. Let me know when you�ve found it.
    I think I have narrowed it down a wee bit (based on your email header).
    [2001:418:3f4::5] plus or minus a few on the last digit...
       --- Jay Nugent
         () ascii ribbon campaign in
         /\ support of plain text e-mail
   Averaging at least 3 days of MTBWTF!?!?!?
  The solution for long term Internet growth is IPv6.