netdev
[Top] [All Lists]

Re: Kernel 2.6 IPV6 Busted

To: Quantum Scientific <Info@xxxxxxxxxxxxxxx>
Subject: Re: Kernel 2.6 IPV6 Busted
From: Jeff Garzik <jgarzik@xxxxxxxxx>
Date: Sun, 27 Feb 2005 13:59:35 -0500
Cc: netdev@xxxxxxxxxxx
In-reply-to: <200502271220.06560.Info@xxxxxxxxxxxxxxx>
References: <200502270928.44402.Info@xxxxxxxxxxxxxxx> <422205F7.4080401@xxxxxxxx> <200502271220.06560.Info@xxxxxxxxxxxxxxx>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040922
Quantum Scientific wrote:
On Sunday 27 February 2005 11:40, Andre Tomt wrote:

Connection tracking (as in stateful firewalling) do not a useful ipv6 stack make.. The stack works fine, at least the stack provided in 2.6 kernels.

...

You seem to be fixed on the idea that a ipv6 stack has to have stateful firewalling, or else its utter crap, correct? :-)


No, I'll try to say this clearer.

The stack works fine in. And out. But for a useful virtual circuit you must have something like connection tracking.

Remember what my issue is: - I have a very tight firewall,
- I ping6 out,
- The firewall blocks the reply back, because the connection is stateless!
- Same with http, etc.

This means that I have to open for incoming, virtually every port I send outgoing to, or else I do not get any replies. This is what I call non-functional, because one does not open incoming ports, for the most part.

Why are you not having this problem?

Connection tracking doesn't scale. It's impossible to hash the entire Internet.

        Jeff




<Prev in Thread] Current Thread [Next in Thread>