Subject: RE: avoiding NAT with IPv6

From: "Michel Py" <[email-masked]>
Date: Mon, 31 Mar 2003 11:49:06 -0800

Margaret,

> Margaret Wasserman wrote:
> That depends on what you mean by "global reachability".
> I am writing to you from behind a NAT right now.
> From here, I can reach web sites on the global
> Internet, etc. I can't run servers here

Why is that? (note that I am not trying do defend or condone NAT by any
means, just for my understanding). I run my HTTP, HTTPS, FTP, SMTP
servers on RFC1918 addresses behind NAT. At home I also do p2p music
sharing on RFC1918 behind NAT. This is an extremely common setup these
days. 

> The one-way reachability (outbound, but not inbound)
> that is experienced by users of IPv4 NAT is a side-effect
> of NAT. So, if we are successful in avoiding NAT in IPv6,
> the "security" models that depend on this one-way
> reachability won't apply in IPv6.

Correct, this is why we will need IPv6 firewalls. Although NAT itself
does not perform stateful packet inspection for other purposes than
ALGs, it does implement hard state that provides this "one-way
reachability" which is a most desired feature of firewalls.

> I don't have any interest in eliminating load balancers,
> but are you sure that this is how they work?

The ones that I have seen, yes.

> What happens when the server passes its IP addresses in FTP,
> SCTP or SIP packets (or any other application-layer protocol)?
> Does the loadbalancer also translate those addresses to point
> to the loadbalancer,

You meant to the host I suppose and the answer is yes. There are ALGs in
the load balancers that I have seen that rewrite packets and they do
have the exact same issues as NAT WRT apps that embed IP addresses in
the packet. The typical config of load balancers is that the load
balancer's address is the one published in DNS, and the load balancer is
indeed a NAT box that NATs traffic to the least busy server in a pool.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: John Bartas <[email-masked]>
Date: Mon, 31 Mar 2003 12:48:22 -0800

Hi All,

	We may not have to worry about it - NAT is now illegal in 4 of the
United States, and counting:

http://news.com.com/2100-1028-994667.html

	One thing I have not seen addressed in this thread is anonymity. One
reason I wrote my first NAT in 1996 was because I can do things on the
net (like send this email), and no one could trace it back any further
than my company DSL link. It's up to me if I want to identify myself or
not.

	I don't see any good way to do this without NAT, which has well
understood drawbacks. 

	If IPv6 has a better anonymity solution, can someone point me to it? Or
do I have to start working on NATv6?  (See, this is why I don't always
want to identify myself! :-)

-JB-

#############################################################
          H
(==)o(==) H John Bartas - Main Propeller head
   _I_    H InterNiche Technologies Inc. (408) 257-8014 x219
  /   \   H 1340 S. DeAnza Blvd. Suite 102
  -----   H San Jose CA 95129
   O O    H [email-masked]
    "     H www.iniche.com
  \___/   H
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Jeroen Massar" <[email-masked]>
Date: Mon, 31 Mar 2003 23:10:05 +0200

John Bartas wrote:

> 	We may not have to worry about it - NAT is now illegal 
> in 4 of the United States, and counting:
> 

I don't see anything in that article that applies to NAT's.
It's about copyrights not about IP addressing maybe that's
why I don't see it ;)

> want to identify myself! :-)

Email is SMTP which runs on top of TCP/IP. You could just let
your SMTP service not log any headers and tada you are 'anonymous'.
This is an application 'problem' not a stack 'problem'.
Then again if you want to be 'anonymous' then don't use the internet
there fortunatly are enough ways to find a person who is using it.
Then again there are also enough ways of making finding a person
quite hard. If you want to be anonymous you probably have something
to hide which is not normal to do or not even talking about illegal
things.
And one of the few reasons to use 'anonymous' SMTP is to spam, eeuw...

Greets,
 Jeroen

---

From: Alper Yegin <[email-masked]>
Date: Mon, 31 Mar 2003 13:34:30 -0800

> want to identify myself! :-)

Please see:

http://www.ietf.org/internet-drafts/draft-ietf-mobileip-hmipv6-07.txt

You can search for "location privacy" in this draft. This protocol can help
with what you are looking for without having to "break IP".

alper

---

From: John Bartas <[email-masked]>
Date: Mon, 31 Mar 2003 14:07:22 -0800

Hi Jeroen,

        Well, my main point was how to provide anonymity without forcing
users
to use NATv6.

But....

        Here's some other URLs which indicate that NAT is outlawed by
some of
this new legislation. What these laws proscribe, in general terms, is
any technology which hides the actual source of an internet session.
This pretty clearly covers NAT, Bluetooth, Proxy Servers, forwarding
services, load balancers, and probably other things I haven't thought of
yet. 

        Long-term I don't think this group should reply on these laws as
a
solution to NATv6, for the same reasons that banning it in the RFC may
not work.

        Here's the short explanation:

http://www.theinquirer.net/?article=8595

        Here's the URL of the Michigan law's official analysis:

http://michiganlegislature.org/documents/2001-2002/billanalysis/house/htm/2001-HLA-6079-b.htm

        It says in part:

"Telecommunications service and devices. Currently the code prohibits a
person from manufacturing, possessing, "delivering", offering to
deliver, or
advertising a counterfeit telecommunications device or a
telecommunications device, if he or she intends to use the device or to
allow the device to be
used--or knows or has reason to know that the device is intended to be
used--for either of the following illicit purposes:

·  to obtain or attempt to obtain telecommunications service with the
intent to avoid or aid or abet or cause another person to avoid any
lawful charge
for the service in violation of the prohibition described above; or

·  to conceal the existence or place of origin or destination of any
telecommunications service

...

        When you read the surrounding definitions, this last clause
clearly
covers NAT, firewall proxies, I suspect this is unintentional; but for
now NAT is illegal in Michigan. 

-- 
-JB-

---

From: John Bartas <[email-masked]>
Date: Mon, 31 Mar 2003 14:11:00 -0800

Hi Alger,

	This looks like a potential solution. I would not have thought of
looking into Mobile IPv6 for an anonymity service, but there it is.

	Of course it's illegal in Michigan (;-), but for the rest of the world
it might be quite popular.

	Thanks,

-JB-

-- 
-JB-

---

From: "Tony Hain" <[email-masked]>
Date: Mon, 31 Mar 2003 14:44:26 -0800

John Bartas wrote:
> 	If IPv6 has a better anonymity solution, can someone 
> point me to it? Or do I have to start working on NATv6?  
> (See, this is why I don't always want to identify myself! 
> :-)

See RFC 3041 - It does exactly what you want without the drawbacks of
NAT.

Tony

---

From: Greg Daley <[email-masked]>
Date: Tue, 01 Apr 2003 12:42:13 +1000

Hi John and Alper,

> it might be quite popular.

I think that Hesham et al. were already aware of the issue in Michigan.
They have provided an 'M' flag for the local binding update.

Greg Daley