[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: implications of 6to4 for v6coex
On Tue, 16 Sep 2008 15:43:39 -0700, Christian Huitema
<huitema@windows.microsoft.com> wrote:
> Teredo relays should only originate packets to an IPv4 address if the
> communication was initiated from the IPv6 side. That's enough to build a
> stateful address filter in the relay, so it only accepts IPv4 packets if
> there was prior initiation from the IPv6 side. I don't know whether
> commercial implementations of Teredo actually implement this stateful
> filtering, but if they did that would go a long way towards alleviating
the
> ISP's fear.
At least those Teredo relay deployments I know of _do_ discard traffic from
IPv4 to IPv6 unless solicited by one native IPv6 node. That's the most
basic protection against blind spoofing Teredo clients.
However, if I understand James right, his concern is with the IPv6 to IPv4
direction, whereby a IPv6 ISP could steal the relaying capacity of another
IPv6 ISP. To address that, one must (simply?) discard packets toward
2001:0::/32 and coming from unauthorized IPv6 nodes (although this will
obviously cause a split Internet).
> Failing that, it is also possible to run the Teredo relay at an arbitrary
> port number, or even one that changes periodically. That, too, would
make
> it very hard for "leeches" to steal the relay service by pointing to the
> IPv4 address of the relay.
It is my understanding that a Teredo relay must server traffic to/from the
*whole* IPv4 Internet. So I do not get this.
A Teredo relay can restrict which chunk of the native IPv6 Internet it
relays from/to, not which chunk of the IPv4 Internet.
> The remaining possibility for the "leeches" would be to set up a static
> IPv6 route for 2001::/32 towards the relay that they want to target. If
ISP
> are concerned with that, they can simply black-hole traffic to 2001::/32
at
> their border router. It will not hurt, since the internal hosts are
> supposed to use the internal relay.
Yes. Or at the relay itself - checking that the non-Teredo IPv6 address
belongs to the ISP.
--
Rémi Denis-Courmont