v6 & DSL / Cable modems [was: Private use of non-RFC1918 IP space
newton at internode.com.au
Mon Feb 9 23:33:41 UTC 2009
On 10/02/2009, at 9:54 AM, Stephen Sprunk wrote:
> Yes, an ALG needs to understand the packet format to open pinholes
> -- but with NAT, it also needs to mangle the packets. A non-NAT
> firewall just examines the packets and then passes them on unmangled.
Sure, but at the end of the day a non-NAT firewall is just a special
of NAT firewall where the "inside" and "outside" addresses happen to
be the same.
If I was a commodity consumer hardware manufacturer, that's how I'd
the IPv6 firewalling problem, because that'd let me pass non-NAT'ed v6
packets and NAT'ed v4 packets through the same code paths, thereby
me to avoid reinventing the entire wheel (and an entire new set of bugs)
to do v6 firewalling.
DSL/Cable CPE is already full of v4 ALGs, and it's reasonable to
the only difference between those and the equivalent v6 ALGs will be the
lack of v6 NAT.
Mark Newton Email: newton at internode.com.au
Network Engineer Email:
newton at atdot.dotat.org (H)
Internode Pty Ltd Desk: +61-8-82282999
"Network Man" - Anagram of "Mark Newton" Mobile: +61-416-202-223
More information about the NANOG