Re: Kernel 2.6 IPV6 Busted

[Jeff Garzik <jgarzik@pobox.com>]

Quantum Scientific wrote:
> On Sunday 27 February 2005 11:40, Andre Tomt wrote:
> 
>>Connection tracking (as in stateful firewalling) do not a useful ipv6 
>>stack make.. The stack works fine, at least the stack provided in 2.6 
>>kernels.
> 
> ...
> 
>>You seem to be fixed on the idea that a ipv6 stack has to have stateful 
>>firewalling, or else its utter crap, correct? :-)
> 
> 
> No, I'll try to say this clearer.
> 
> The stack works fine in.  And out.  But for a useful virtual circuit you must 
> have something like connection tracking.
> 
> Remember what my issue is:  
> - I have a very tight firewall,
> - I ping6 out,
> - The firewall blocks the reply back, because the connection is stateless!
> - Same with http, etc.
> 
> This means that I have to open for incoming, virtually every port I send 
> outgoing to, or else I do not get any replies. This is what I call 
> non-functional, because one does not open incoming ports, for the most part.
> 
> Why are you not having this problem?

Connection tracking doesn't scale.  It's impossible to hash the entire 
Internet.

	Jeff