[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: IPv6 adoption behavior



On 2003-10-21 at 14:15, Todd T. Fries wrote:

> I'm sorry to reply late to this, but I can't help but realize that
> NAT+IPv4 vs IPv6+firewall can be equivalent in `isolation'.  Simply
> `block in all' and `pass out on $ext_if keep state' (in the pf terms of
> OpenBSD) and in two rules you have the same isolation of a NAT+IPv4 as
> you do with IPv6+firewall.

Imagine that two internal hosts are communicating in your scenario. They
have a TCP connection running for weeks. Then the outside connection to
the Internet breaks and is brought back up, but assigned a different
address. In the IPv4+NAT case hosts that only contact other hosts on the
internal network do not notice the failure at all. In the IPv6+firewall
case the new addresses are provided to the hosts and eventually the old
addresses time out -- and the internal TCP connection breaks. Ouch.


/Benny




--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------