Subject: Re: (ngtrans) filtering against IPv6 in IPv4

From: Scott Bradner <[email-masked]>
Date: Wed, 19 Jan 2000 10:00:21 -0500 (EST)

the statement has been made that ISPs are filtering to block IPv6 in
IPv4 traffic - I have not heard of such a thing (and in general ISPs do
not do this sort of filtering due to the perfoe`rmance impact on their
routers) - does anyone have specific informatyion information on what
ISPs are said to be doing this and why they might want to (since there is no
ISP operational reason to do this)

Scott

---

From: Randy Bush <[email-masked]>
Date: Wed, 19 Jan 2000 11:18:58 -0800

> IPv4 traffic

we have this bit of hysteria every six months.  it has yet to be true.

randy

---

From: Yoshinobu Inoue <[email-masked]>
Date: Thu, 20 Jan 2000 15:08:58 +0900

> ISP operational reason to do this)

I received reports that some ISPs are filtering IPv6 over
IPv4, but I don't think they are specifically or intentionally
filtering it.
They would be just passing some specific well knonwn protocols
for security reason, and other packets like IPv6 over IPv4 is
just filtered as the result.
So actually this is not an IPv6 only issue. I also received
same kind of report that mobile-ip packets are filtered by
some ISP.

Also, those filtering seems to be done at dial-up access
points, so performance issue won't be so significant.

I don't think we should check and make the name of such ISPs
public in this stage, but we should annouce the possibility of
such problem widely, and let ISPs notice that they might be
doing such kind of filtering, and prompt them to check the
current filtering configuration and let them alter it if it
has any problem. (e.g. If they are filtering packets such as
IPv6 over IPv4.)

And if there are still problems after such announcement, then
I think we need to enumerate specific names of such ISPs.

Yoshinobu Inoue
KAME project

---

From: Jim Bound <[email-masked]>
Date: Thu, 20 Jan 2000 20:50:11 -0500

very good point.  on not naming any ISPs.  this should not be a witch
hunt but a means to let folks know that we want to encap IPv6 via
proto-id 41.  I also would guess its not intentional but rather a
screening of proto-ids that are yeah or nay.

/jim

---

From: "Perry E. Metzger" <[email-masked]>
Date: 22 Jan 2000 19:42:05 -0500

> we have this bit of hysteria every six months.  it has yet to be true.

It is, however, the case that people behind NATs have a hard time
running v6 in v4. A v6 in UDP in v4 protocol would help with that.

Perry

---

From: Randy Bush <[email-masked]>
Date: Sat, 22 Jan 2000 23:31:39 -0800

> running v6 in v4. A v6 in UDP in v4 protocol would help with that.

funny, i somehow misread the statement to be about ISPs filtering.  silly
and irrelevant me.

randy

---

From: "Perry E. Metzger" <[email-masked]>
Date: 23 Jan 2000 16:05:04 -0500

Randy Bush <[email-masked]> writes:
> funny, i somehow misread the statement to be about ISPs filtering.

It was. There are ISPs using NAT these days. Even without filtering,
those users do have some issues that ngtrans could help smooth
out. You might think this is irrelevant, but I don't, given that this
is the ngtrans mailing list...

-- 
Perry Metzger		[email-masked]
--
"Ask not what your country can force other people to do for you..."

---

From: "Matt Crawford" <[email-masked]>
Date: Mon, 24 Jan 2000 09:58:23 -0600

> funny, i somehow misread the statement to be about ISPs filtering.  silly

Not quite irrelevant.  Often it's the ISP who imposes the use of NAT.

---

From: "Peter Tattam (IPv6 Mail)" <[email-masked]>
Date: Sat, 29 Jan 2000 16:06:18 +1100 (EST)

As a typical case, this issue bit me when I first hooked up to the 6bone.

I had to have a word to my sysadmin to make sure we passed the right traffic.
It is good network security practice to only allow traffic that you are sure
about and then to open up the filters slightly as needs arise.

I don't think our case would be uncommon.

Peter

--
Peter R. Tattam                            [email-masked]
Managing Director,    Trumpet Software International Pty Ltd
Hobart, Australia,  Ph. +61-3-6245-0220,  Fax +61-3-62450210