Subj : Connection Tests
To : Victor Sudakov
From : Michiel van der Vlist
Date : Mon Apr 24 2023 04:22 pm
Hello Victor,
On Monday April 24 2023 01:20, you wrote to me:
VS>>> Only when you know the IPv6 address and port beforehand.
MV>> When runing servers you normally do...
VS> P2P apps like Transmission are not really servers.
VS> Well they are in the strict sense of the word, but people just start
VS> them up and hope for them to work out of the box,
That's their problem...
VS> and they are often configured by default to randomize port numbers on
VS> each start.
Bad practise...
VS>>> Usually an IPv6 address on the home LAN is dynamic (SLAAC),
MV>> No. SLAAC addresses are not dynamic. They are derived from the
MV>> MAC address.
VS> Not any more. AFAIK the recent implementation of SLAAC uses the
VS> privacy extensions which do not use the MAC address but some random
VS> numbers to derive the IPv6 host address.
Privacy extensions use random numbers for the host part. AFAIK SLAAC still uses the MAC address. What I do see is that DHCP6 is often preferred over SLAAC and the host part of a DHCP6 address also looks random. But it definitely is a fixed address. So no problem.
VS>>> and the port in peer-to-peer applications, VoIP applications etc
VS>>> is often dynamic too.
MV>> VOIP normally uses standard ports.
VS> SIP (the signalling protocol) does, but the RTP uses random ports. A
VS> firewall has no way to know the RTP dynamic port numbers unless it
VS> inspects the SIP protocol.
If those "random" ports are previously initaiated by the SIP protocol there should be no problem.
VS>>> The situation is different of course when you are hosting an
VS>>> IPv6 web-server or something like that. It would have a fixed
VS>>> IPv6 address and port anyway, so there is no need for
VS>>> punch-holing the firewall.
MV>> Indeed.
VS> I don't really understand your point. If we decide that UPnP (think
VS> "automatic firewall configuration from the inside") is desirable for
VS> IPv4,
That "we" does not include me. I have never used UPnP, have always had it disabled in my routers and never had any need for it.
I consider UPnP a security risk.
So maybe I am not the right person to discuss this "issue".
VS> then it's desirable for IPv6 too. If we decide that UPnP is not
VS> desirable, you can do without it in IPv4: just configure a static
VS> RFC1918 address and port on your internal "server" and create a static
VS> NAT/portmapping entry on the router.
