Consumer Grade - IPV6 Enabled Router Firewalls.
mloftis at wgops.com
Sun Dec 13 14:48:18 CST 2009
--On Sunday, December 13, 2009 9:17 AM -0800 Joel Jaeggli
<joelja at bogus.com> wrote:
>> UPnP is a bad idea that (fortunately) doesn't apply to IPv6 anyway.
>> You don't need UPnP if you'r not doing NAT.
> wishful thinking.
> you're likely to still have a staeful firewall and in the consumer space
> someone is likely to want to punch holes in it.
Amen indeed. Consumers do not care if its a good idea or not. And
honestly in a home network, well, its not as frightening. In a business of
any kind (including home based) it is bad. You should have a DMZ with
carefully controlled open ports lists. But that's preaching to the choir
IPv6 doesn't magically negate the need for UPnP, UPnP is not tied to NAT.
It's a way for applications to ask the firewall to selectively open ports
up to them. Intelligent stateful firewalls can do that for limited
applications, perhaps with some sort of policy control even. Though
Joe/Jill Gamer (which is what UPnP is for) won't know anything about any of
that. They define a gateway as functioning or not.
I really am honestly sick of people thinking IPv6 is a panacea. It isn't.
UPnP is rather a bit of a hack for sure, protocols should be better
designed, but in this modern age of Peer To Peer you need a way for
applications to ask the firewall to selectively open incoming ports.
More information about the NANOG