Re: (D)NAT with IPv6 (was "nf_conntrack & NAT")

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1487 bytes --]

On Mon, Dec 12, 2005 at 09:42:33PM +0100, Balazs Scheidler wrote:
> [ trimmed Cc line ]
> 
> On Fri, 2005-12-09 at 10:27 +0530, Harald Welte wrote:
> > On Thu, Dec 08, 2005 at 12:56:32PM +0100, Patrick Schaaf wrote:
> > > > So each time you add a service on a host, you should assign a new IP to it
> > > > (and create the respective DNS name for this IP/service couple!), just in
> > > > case you may have to redirect its traffic one day? (even if temporary)
> > > 
> > > This has proven to be a very valuable strategy, at work, even for normal
> > > IPv4 operation. Saves headaches every time we want to migrate something.
> > > I can warmly recommend this practise.
> > 
> > oh btw, this also solves the usual ssl certificate problem, where you
> > for example tell people to use smtp/tls or imap/tls or whatever to
> > "smtp.foo.org" which might be a cname, and thus the certificate name
> > doesn't always match the 'dn' of the cert.
> 
> Even though this is usually a question of paying for several
> certificates and not being unable to put different certificates to
> different ports.

Has the issue of trying to load balance serveral machine behind a nat
box been brought up for ipv6, if DNAT (and SNAT) are not available for
ipv6 how are you going to hid a farm of servers behind a single (or
multiple addresses), DNS round robin doesn't work because it doesn't
take into account weather the ip is active or not ?


> 
> -- 
> Bazsi
> 
> 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]