Re: [fw-wiz] IPv6



$quoted_author = "John Kougoulos" ;

I see NAT66 helpful on eg site-to-site VPNs.

eg. Suppose that I have the prefix 2001:db8:85a3::/48 and I have some my
internet accessible machines on 2001:db8:85a3:3::/64 and some "internal"
machines on 2001:db8:85a3:2::/64 , 2001:db8:85a3:4::/64.

If the other side of the site-to-site VPN routes the whole
2001:db8:85a3::/48 over the VPN in order to access the "internal"
machines, they will try to access also the Internet accessible machines
over the site-to-site VPN, which could mean that they may bypass some
controls, or that I have to open tons of ACLs on various firewalls,
not to mention the possible asymmetric routing issues.

If I could NAT66 the 2001:db8:85a3::/48 to a ULA::/48 space, I
believe it would be much easier to manage, since the other side
would have to route the ULA space to the VPN.

Why not just build the VPN with only the two /64s in the configuration and
not the entire /48?

And if you need to adjust routing and other firewalls, surely that's the
best way to do it rather than NATing them into some IPs that are already
privilaged.

cheers
Marty
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards



Relevant Pages

  • Re: Adding a PC onto a domain via a VPN
    ... If you connect it using a site-to-site VPN, ... The machines in the remote site should be able to see any machine in the WAN and join the domain with no trouble as long as they have the correct DNS address. ... would like to add them onto a domain vai a VPN. ...
    (microsoft.public.windows.server.general)
  • Re: [fw-wiz] IPv6
    ... Or do you have other reasons for wanting NAT66? ... If the other side of the site-to-site VPN routes the whole ... they will try to access also the Internet accessible machines ...
    (Firewall-Wizards)