*** Answering a msg posted in area BINKD (Binkd mailer).

Hello Tony,

On Friday January 13 2017 10:42, you wrote to Nicholas Boel:

Same on mine, manufacturers dumbing things down too much, because
there is a key difference between port forwarding and packet
filtering. In port forwarding, the internal host can use a different
port to what the public sees. With packet filtering, that's normally
not possible, because the router is doing nothing more than accepting
or blocking traffic to a specific port on a LAN host. It is not
rewriting packets.

Same here. In my cable modem/router IPv4 port forwarding and IPv6 port unblocking are done on the same page in the web interface. There are 9 fields:

Local IP Address
Local Start Port
Local End port
External IP Address
External Start Port
External End Port
Protocol (TCP/IDP/BOTH)
Description
Enabled (YEs/No)

When creating a new entry I can choose between "Create IPv4", "Create IPv6" and Create MCv6

When selecting IPv4, alle fields are available. When selecting IPv6 or MACv6, the fields for External IP Address, External Start Port and External End Port gray out.

I don't like this way of presenting it. It is indeed dumbing things down and it creates confusion for both the experienced and the dummies. He, why can't I enter external addresses and ports for IPv6?

So, when you're using IPv6, an extra constraint is that the host needs
to be listening on the same port that the public sees

Indeed, but explain that to a newbie... Considering IPv4 and IPv6 are on the same page named "port forwarding".

(My router only has a single field for the port in IPv6).

Here I can enter a port range, but only one set for IPv6. For IPv4 there is an external and an internal range. (Which must be of equal size of course).


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20130111
# Origin: he.net certified sage (2:280/5555)
* Origin: LiveWire BBS - Synchronet - LiveWireBBS.com (1:2320/100)

Michiel van der Vlist wrote to Tony Langdon <=-

Same here. In my cable modem/router IPv4 port forwarding and IPv6 port unblocking are done on the same page in the web interface. There are 9 fields:

Mine has separate pages, but uses (incorrectly) "port forwarding" terminology for IPv6.

I don't like this way of presenting it. It is indeed dumbing things
down and it creates confusion for both the experienced and the dummies. He, why can't I enter external addresses and ports for IPv6?

Join the club. It would have been better to have the IPv6 filtering as part of the "firewall" settings, where you can allow and block traffic to hosts, ports and protocols, since that is what is happening on IPv6.

So, when you're using IPv6, an extra constraint is that the host needs
to be listening on the same port that the public sees

Indeed, but explain that to a newbie... Considering IPv4 and IPv6 are
on the same page named "port forwarding".

Exactly!

(My router only has a single field for the port in IPv6).

Here I can enter a port range, but only one set for IPv6. For IPv4
there is an external and an internal range. (Which must be of equal
size of course).

I think I can enter a range, has been ages since I've tweaked my IPv6 firewall. :)


... This is abuse, arguments are down the hall.
--- MultiMail/Win32 v0.49
# Origin: Freeway BBS - freeway.apana.org.au (3:633/410)
* Origin: LiveWire BBS - Synchronet - LiveWireBBS.com (1:2320/100)

Hello Tony,

On Saturday January 14 2017 08:31, you wrote to me:

Mine has separate pages, but uses (incorrectly) "port forwarding" terminology for IPv6.

I don't like this way of presenting it. It is indeed dumbing
things down and it creates confusion for both the experienced
and the dummies. He, why can't I enter external addresses and
ports for IPv6?

Join the club. It would have been better to have the IPv6 filtering
as part of the "firewall" settings, where you can allow and block
traffic to hosts, ports and protocols, since that is what is happening
on IPv6.

Indeed, it is a firewall function. What, in my opinion, went wrong is that the IPv4 NAT was presented as a firewall. Which it isn't. Although in some way NAT /acts/ as a firewall in that it blocks unsollicited incoming packets, unless explicitly told what to do with it, it is not a firewall. The blocking is just a emergent effect.

A real firewall is something different. If so configured, it also blocks unsollicited incoming packets. But it can do more that that. It can also detect certain kind of attacks, port scans, flooding etc. Plus that a firewall can also act on outgoing traffic. OTOH, a firewall can not do translation. It is not a NAT.

I guess we will have to live with what seems to be evolving practice: it is both called "forwarding"..

So, when you're using IPv6, an extra constraint is that the host
needs to be listening on the same port that the public sees

Indeed, but explain that to a newbie... Considering IPv4 and
IPv6 are on the same page named "port forwarding".

Exactly!

I am a bad teacher, I won't even try..

(My router only has a single field for the port in IPv6).

Here I can enter a port range, but only one set for IPv6. For
IPv4 there is an external and an internal range. (Which must be
of equal size of course).

I think I can enter a range, has been ages since I've tweaked my IPv6 firewall.
:)

I put this new IPv6 capable modem/router into service six weeks ago. So I had to delve into it again.

... This is abuse, arguments are down the hall.

I loved that sketch! ;-)


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20130111
# Origin: he.net certified sage (2:280/5555)
* Origin: LiveWire BBS - Synchronet - LiveWireBBS.com (1:2320/100)

Michiel van der Vlist wrote to Tony Langdon <=-

Indeed, it is a firewall function. What, in my opinion, went wrong is that the IPv4 NAT was presented as a firewall. Which it isn't. Although in some way NAT /acts/ as a firewall in that it blocks unsollicited incoming packets, unless explicitly told what to do with it, it is not
a firewall. The blocking is just a emergent effect.

Again, we agree. :)

A real firewall is something different. If so configured, it also
blocks unsollicited incoming packets. But it can do more that that. It can also detect certain kind of attacks, port scans, flooding etc. Plus that a firewall can also act on outgoing traffic. OTOH, a firewall can not do translation. It is not a NAT.

Again, agree. Packet filtering is only one function that a firewall can perform, as you point out. Either way, it's not NAT. NAT has a different purpose - rewriting IP addresses to achieve some networking goal (most commonly share a single public IP among multiple hosts).

I guess we will have to live with what seems to be evolving practice:
it is both called "forwarding"..

Looks like it. :(

I am a bad teacher, I won't even try..

:)

I put this new IPv6 capable modem/router into service six weeks ago. So
I had to delve into it again.

Mine's been in service for years. I occasionally tweak it when I change something on the LAN, last tweak was to put the HAMnet router as the IPv4 exposed host, so IP-IP encapsulation works.

... This is abuse, arguments are down the hall.

I loved that sketch! ;-)

Yes! I haven't seen it for many years.


... Go on, be yourself! There isn't anyone better qualified.
--- MultiMail/Win32 v0.49
# Origin: Freeway BBS - freeway.apana.org.au (3:633/410)
* Origin: LiveWire BBS - Synchronet - LiveWireBBS.com (1:2320/100)

Hello Tony!

Jan 14 15:42 2017, Tony Langdon wrote to Michiel van der Vlist:

A real firewall is something different. If so configured, it also
blocks unsollicited incoming packets. But it can do more that that.

That would be a stateful firewall. The most common setup is to allow everything from LAN to the WAN, and only allow related packets from WAN to LAN.

It can also detect certain kind of attacks, port scans, flooding etc.

And that's an IDS. But an IDS could be integrated in a firewall product. Commonly they are labeled "UTM".

Plus that a firewall can also act on outgoing traffic. OTOH, a
firewall can not do translation. It is not a NAT.

A firewall is a special kind of router. So NAT is an optional feature of a firewall.

Again, agree. Packet filtering is only one function that a firewall
can perform, as you point out. Either way, it's not NAT. NAT has a different purpose - rewriting IP addresses to achieve some networking goal (most commonly share a single public IP among multiple hosts).

Sometimes it's the side effect you're interested in :)

ciao,
Markus

---
# Origin: *** theca tabellaria *** (2:240/1661)
* Origin: LiveWire BBS - Synchronet - LiveWireBBS.com (1:2320/100)

Markus Reschke wrote to Tony Langdon <=-

That would be a stateful firewall. The most common setup is to allow everything from LAN to the WAN, and only allow related packets from WAN
to LAN.

Yes, that is by far the most common default setup, and then exceptions to allow specific incoming traffic are added by the admin as needed.

It can also detect certain kind of attacks, port scans, flooding etc.

And that's an IDS. But an IDS could be integrated in a firewall
product. Commonly they are labeled "UTM".

A firewall can be a combination of other components, such as a stateful packet filter and an IDS

Plus that a firewall can also act on outgoing traffic. OTOH, a
firewall can not do translation. It is not a NAT.

A firewall is a special kind of router. So NAT is an optional feature
of a firewall.

Depends what the intent is.

Sometimes it's the side effect you're interested in :)

True, provided you do it with full knowledge of the implications, and not simply using ignorant assumptions and hearsay. :)


... In matters of conscience, the law of majority has no place.
--- MultiMail/Win32 v0.49
# Origin: Freeway BBS - freeway.apana.org.au (3:633/410)
* Origin: LiveWire BBS - Synchronet - LiveWireBBS.com (1:2320/100)