Hi, On Thu, Jul 17, 2014 at 10:20:09AM +0200, Steven Barth wrote: > Regarding firewalling: I understand and support your point for > end-to-end connectivity though there are still quite a few people > (including myself) who have reservations about the security > implications.
This discussion here is very much the same discussion as everywhere
when the topic pops up.
There's basically 3 sides here:
- I want a firewall that mimics IPv4 NAT default-closed behaviour
- I want IPv6 to be end-to-end so applications can just work and not
bother with PCP, firewall traversal, etc.
- I want a firewall but one that defaults to open for $somestuff and
to close for $otherstuff (swisscom model)
I don't think we will be able to agree here any more than on the IETF
lists or whatever.
But what we (uh, Steven :) ) can do is: provide easily selectable
"firewall profiles" that match the 3 "common scenarios". As of today,
OpenWRT routers are not "autoconfig" yet, but you need to put in some
config anyway (like, the protocol and username/password used to
connect to your ISP).
If we could have a "basic firewall switch" there that has 4 settings
"closed", "fully open", "balanced (swisscom model)" or "customized",
this should enable users to get what they want without having to
really think about firewall rules, ports, etc.
Of course the question remains "what should the default be", and I'm
not sure we can come to an agreement on this.
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgpG13MFLVJiR.pgp
Description: PGP signature
_______________________________________________ openwrt-devel mailing list [email protected] https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
