netdev - Re: [RFC PATCH 00/18] netfilter: IPv6 NAT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 29 Nov 2011 11:03:13 +1300
From:	Amos Jeffries <squid3@...enet.co.nz>
To:	Ulrich Weber <Ulrich.Weber@...hos.com>
Cc:	<sclark46@...thlink.net>, <kaber@...sh.net>,
	<netfilter-devel@...r.kernel.org>, <netdev@...r.kernel.org>
Subject: Re: [RFC PATCH 00/18] netfilter: IPv6 NAT

 On Mon, 28 Nov 2011 20:25:48 +0000, Ulrich Weber wrote:
> Am 28.11.11 18:14 schrieb "Stephen Clark" unter:
>
>>Probabably a dumb question but are these patches for natting ipv6 to
>>ipv6 or ipv4 to ipv6?
>
> These patches are for natting IPv6 addresses behind whole IPv6 
> subnets
> or just behind one IPv6 address.
>
> This is useful for multiple Internet uplinks, where you want full 
> control
> on the router what connections are sent over which interface. Or its 
> quite
> easy to setup Load Balancing rules or create a DMZ. There a lots of 
> use
> casesŠ

 I'm going to dare to call FUD on those statements...

  * Load Balancing - what is preventing your routing rules or packet 
 marking using the same criteria as the NAT changer? nothing. Load 
 balancing works perfectly fine without NAT.

  * outgoing packet control - packets will happily leave the "wrong" 
 interface after NAT unless you add routing and firewall controls 
 separate to NAT. Packet control works *better* without NAT erasing 
 original IP information resulting in mistakenly NAT'ed packets go out 
 the wrong interface.

 I have long been of the opinion that all NAT really offers is the 
 ability to easily and cleanly multi-home several global public prefixes 
 from a unified PI space. This is a very important aspect for some 
 networks, even with plentiful IPv6 addresses.

 Claims and use of NAT as a security, load balancing, and routing 
 control is where most of the nasty side effects and behaviours are 
 streaming in from.

 AYJ

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html