[OpenWrt-Devel] OpenWRT IPv6 firewall
bmoffitt at ayrstone.com
Fri Jul 18 13:21:56 EDT 2014
Gert Doering wrote:
On Thu, Jul 17, 2014 at 10:20:09AM +0200, Steven Barth wrote:
>> Regarding firewalling: I understand and support your point for
>> end-to-end connectivity though there are still quite a few people
>> (including myself) who have reservations about the security
> This discussion here is very much the same discussion as everywhere
> when the topic pops up.
> There's basically 3 sides here:
> - I want a firewall that mimics IPv4 NAT default-closed behaviour
> - I want IPv6 to be end-to-end so applications can just work and not
> bother with PCP, firewall traversal, etc.
> - I want a firewall but one that defaults to open for $somestuff and
> to close for $otherstuff (swisscom model)
> I don't think we will be able to agree here any more than on the IETF
> lists or whatever.
> But what we (uh, Steven :) ) can do is: provide easily selectable
> "firewall profiles" that match the 3 "common scenarios". As of today,
> OpenWRT routers are not "autoconfig" yet, but you need to put in some
> config anyway (like, the protocol and username/password used to
> connect to your ISP).
> If we could have a "basic firewall switch" there that has 4 settings
> "closed", "fully open", "balanced (swisscom model)" or "customized",
> this should enable users to get what they want without having to
> really think about firewall rules, ports, etc.
I agree - this is an excellent approach
> Of course the question remains "what should the default be", and I'm
> not sure we can come to an agreement on this.
My own thoughts on this are evolving. In real life (whatever that is), I
consider myself more a product manager (marketing guy) than a developer,
so I'm interested in the customer experience of the final product. Of
course, the final product is really a router, and OpenWRT would be a
component of that router.
In all fairness, as I'm building that router product, I'm going to
modify OpenWRT to meet the needs of the market. So, the bottom line is
that, whatever the default is in OpenWRT, I'm going to go ahead and set
it to what I need it to be in my build, before I blow it on to the
router (or whatever) that the customer sees.
The end user of the router would be a random customer (let's just say,
"someone's mom"), and I am responsible for that customer's experience.
Being the experienced (some might say, "cynical") individual I am, I'd
want it to be "idiot-friendly" - removing as many opportunities for the
end user to get into trouble as possible. So, at least at this point in
time, I'm going to close all the ports by default. I'd rather face the
prospect of helping the customer open the ports as they need that
"end-to-end" connectivity than the prospect of someone saying, "you sold
me a router that's unexpectedly wide open to the Internet and everyone
in the world is sending all manner of nasty stuff to my printer."
However, *I* am actually the end user of OpenWRT - it's reasonable to
assume that anyone who is downloading OpenWRT or building it from source
is sufficiently advanced in their knowledge (or at least wants to be)
that they would expect it to be "expert-friendly," not "idiot-friendly."
From that perspective, I still think that having the router block all
ports (as is done in v4 "consumer-grade" routers today) is the
"idiot-friendly" default, but, after thinking about it more, I think
that Gert's "balanced" approach is probably the "expert-friendly"
default and the one I would want and expect in the OpenWRT builds.
P.S. No, my printer is not v6-ready, either, but let's assume there are
some that are...
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
More information about the openwrt-devel