Re: ipfilter(4) needs maintainer

On Mon, Apr 15, 2013 at 1:44 PM, Lev Serebryakov <lev_at_freebsd.org> wrote:
> Hello, Kimmo.
> You wrote 15 апреля 2013 г., 14:36:27:
>
>>>  And, yes, NAT64 will be useful for sure, but it is another story,
>>> not IPv6<->IPv6 translation.
> KP> You're forgetting set ups where outgoing traffic is controlled by
> KP> filter rules, outgoing passive mode ftp needs help from the proxy to
> KP> open holes for arbitrary ports. This is not limited to IPv4 and NAT.
>    It could  be  done without IPv6 prefix mapping. Yes, firewall should
>  have  ability  to expect some connections fro FTP commands (some flag
>  on rule, for sure), but it is not prefix rewriting (there are some
>  other protocols, which need similar treatment, like SIP)! I was
>  shocked by idea of true NAT from IPv6 to IPv6. IPv6 has its own
>  problems and complications, but one REALLY GOOD side of it, that we
>  don't need NAT for it anymore! Some special tricks in firewall -- yes,
>  maybe, for bad-designed, but widely-deployed application level
>  protocols, but not address translations!
>
>   I, personally, don't see any problems to enable all outbound
>  connections for dedicated FTP server, though.
>

Server side is the easy part, no need for proxy because you know the
passive mode data ports and you can open holes in your firewall using
the known port numbers.

I'm however talking about an ftp client behind a very restrictive
firewall making an IPv6 connection an ftp server that uses passive
mode data ports that can't be known in advance.

-Kimmo