Subject: Re: Kernel 2.6 IPV6 Busted

From: Jeff Garzik <[email-masked]>
Date: Tue, 01 Mar 2005 11:26:34 -0500

Denis Vlasenko wrote:
> On Sunday 27 February 2005 23:35, David S. Miller wrote:
> 
>>On Sun, 27 Feb 2005 14:10:39 -0600
>>Quantum Scientific <[email-masked]> wrote:
>>
>>
>>>I am skeptical about this assertion that the whole internet needs to be hashed 
>>>if connection tracking.
>>
>>Connection tracking and NAT broke entirely the end-to-end host
>>assumption that used to be valid on the internet.
>>
>>There are many very important optimizations we've had to disable
>>by default just in TCP alone because of NAT.
> 
> 
> I don't think future Internet will be safe enough to open
> corporate networks. I definitely won't do it.
> NAT firewall in front of my net is an absolute requirement
> for me.
> 
> However, IPv6 in Internet won't happen tomorrow,
> no rush...

You don't need NAT to secure a corporate network.

Just write sane firewall rules that don't allow incoming.

	Jeff