Re:Firefox Send: Private, Encrypted File Sharing
by ac2u on Wednesday October 11, 2017 @09:39AM
(#15449628)
> There does exist at least one NAT hole-punching technique that can traverse two NATs with no central server using ICMP-based holepunching and UDP. Obviously, like all hole punching techniques, it only works on certain kinds of NATs, and firewalls can kill it.
I think you're referring to this? Clever hack indeed. https://github.com/samyk/pwnat
Re:Firefox Send: Private, Encrypted File Sharing
by dingaling on Wednesday October 11, 2017 @09:39AM
(#15449627)
IPv6 doesn't help in corporate environments, where it's often firewalled harder than IPv4.
The fact that it doesn't support NAT is seen as a risk in such environments ( which rightly or wrongly consider it as a second level of firewalling ). Some deployments that I've seen use only site-scoped with no globally-routed prefixes. Everything Internetty has to go over IPv4, which makes the Security team's job easier; drop all IPv6 at the DMZ and drop all non-NAT IPv4.
- IPv6 kind of helps here, at least if we hope that no NAT standard ever makes it into IPv6. Crossing my fingers.
- There does exist at least one NAT hole-punching technique that can traverse two NATs with no central server using ICMP-based holepunching and UDP. Obviously, like all hole punching techniques, it only works on certain kinds of NATs, and firewalls can kill it.