<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 10, 2019, at 1:20 PM, Amos Rosenboim <<a href="mailto:amos@oasis-tech.net" class="">amos@oasis-tech.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii" class="">
<div dir="auto" class="">
Owen,
<div class=""><br class="">
</div>
<div class="">Let me clarify a few points:</div>
<div class=""><br class="">
</div>
<div class="">1. I am in favor of end to end connectivity and IPv6 can help restore this.</div>
<div class=""><br class="">
</div>
<div class="">2. In the fixed broadband portion of the network this is the case.</div>
<div class="">IPv6 is routed to the subscriber CPE.</div>
<div class="">Firewall on the CPE is turned on by default, but can be turned off by the user.</div>
<div class=""><br class="">
</div>
<div class="">3. In the mobile portion life are a bit more complicated.</div>
<div class="">Unsolicited traffic from the internet towards an idle subscriber triggers a signaling process called paging.</div>
<div class="">Extra paging is expensive in terms of signaling resource utilization, as well as on device battery.</div></div></div></blockquote><div><br class=""></div>That’s a problem I leave for the developers of the platform to improve/solve in the design of 5G or subsequent protocols.</div><div><br class=""></div><div>It should not be worked around by permanently and irrevocably disabling end user functionality.</div><div><br class=""></div><div>Owen</div><div><br class=""></div><div><blockquote type="cite" class=""><div class=""><div dir="auto" class="">
<div class=""><br class="">
</div>
<div class=""><br class="">
<div dir="ltr" class="">
<div style="text-align: left;direction: ltr; " class="">Amos</div>
<div class=""><br class="">
</div>
Sent from my iPhone</div>
<div dir="ltr" class=""><br class="">
On 10 Apr 2019, at 22:52, Owen DeLong <<a href="mailto:owen@delong.com" class="">owen@delong.com</a>> wrote:<br class="">
<br class="">
</div>
<blockquote type="cite" class="">
<div dir="ltr" class="">
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" class="">
<div class="m_3121359702253685714WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt" class="">We have an ongoing discussion about Gi firewall (adding a firewall between the subscribers and the internet, allowing only subscriber initiated connections), for the IPv6 traffic.<u class=""></u></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" class="">
<div class="m_3121359702253685714WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt" class=""> <u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt" class="">The firewall is doing very little security, the ruleset is very basic, allowing anything from subscribers to the internet and blocking all traffic from the internet towards the subscribers.<u class=""></u><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt" class="">We have a few rules to limit the number of connections per subscriber (to a relatively high number) and that is it.<u class=""></u></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
What would be the process for a subscriber who wishes to allow inbound connections?</div>
<div class=""><br class="">
</div>
<div class="">If you are simply saying that as a customer of your ISP you simply can’t allow inbound IPv6 connections at all, then you are becoming a very poor substitute for an ISP IMHO.</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" class="">
<div class="m_3121359702253685714WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt" class=""><u class=""></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt" class=""><u class=""></u> </span><span style="font-size: 11pt;" class="">One of the arguments in favor of having the firewall is that unsolicited traffic from the internet can “wake” idle mobile devices, and
create signaling (paging) storms as well as drain user batteries.</span></p>
<div class=""><br class="">
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
There are lots of ways to configure alerts and reduce this problem space. If you want to provide a checkbox on the my.t-mobile page for the user to turn this firewall on or off on a per device basis, then sure, I could see that as viable. Even if it annoyingly
defaults to on.</div>
<div class=""><span style="font-size: 11pt;" class=""> </span><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" class="">
<div class="m_3121359702253685714WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt" class="">On the other hand, allowing only subscriber initiated traffic is mostly achievable using ACLs on the mobile core facing routers, or is it with the growing percentage of UDP traffic ?<u class=""></u></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
Is it even desirable to allow only subscriber initiated traffic?</div>
<div class=""><br class="">
</div>
<div class="">Case in point, I will occasionally end up tethering my laptop (mobile hot spot) and want certain authorized individuals to be able to VNC into it via that tethering connection.</div>
<div class=""><br class="">
</div>
<div class="">There have been other times when I’ve had things on the other side of a tether that I wanted to ssh into.</div>
<div class=""><br class="">
</div>
<div class="">There are also things like Particle IONs where it is desirable to be able to push firmware updates OTA. I realize that Particle is sadly lagging on IPv6 support, but it will, hopefully, one day become a valid use case as well.</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" class="">
<div class="m_3121359702253685714WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt" class=""><u class=""></u></span></p><p class="MsoNormal"><span style="font-size: 11pt;" class="">BTW – I don’t mention IPv4 traffic on the mobile network as it’s all behind CGNAT which don’t allow internet initiated connections.</span></p>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
Yes, but IPv6 is supposed to hope us recover from this travesty.</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" class="">
<div class="m_3121359702253685714WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt" class="">Anyway, we are very interested to know hear more opinions, and especially to hear what are other mobile operators do.<u class=""></u></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
As is tradition, most operators screw the customer in one way or another in this regard. Some haven’t thought about screwing customers in this particular way in IPv6 yet and so IPv6 sometimes works as one would hope.</div>
<div class=""><br class="">
</div>
<div class="">Owen</div>
<div class=""><br class="">
</div>
<br class="">
</div>
</blockquote>
</div>
</div>
</div></blockquote></div><br class=""></body></html>