From owner-freebsd-current@FreeBSD.ORG  Tue Jul 29 09:42:24 2014
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 692E9F7F
 for <freebsd-current@freebsd.org>; Tue, 29 Jul 2014 09:42:24 +0000 (UTC)
Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com
 [66.111.4.26])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 3845922A9
 for <freebsd-current@freebsd.org>; Tue, 29 Jul 2014 09:42:24 +0000 (UTC)
Received: from compute3.internal (compute3.nyi.internal [10.202.2.43])
 by gateway1.nyi.internal (Postfix) with ESMTP id CFD2922FAE
 for <freebsd-current@freebsd.org>; Tue, 29 Jul 2014 05:42:13 -0400 (EDT)
Received: from frontend1 ([10.202.2.160])
 by compute3.internal (MEProxy); Tue, 29 Jul 2014 05:42:13 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=
 messagingengine.com; h=message-id:date:from:mime-version:to:cc
 :subject:references:in-reply-to:content-type
 :content-transfer-encoding; s=smtpout; bh=jd/yza6T0q0gblG3RTNaJB
 ynTM0=; b=V3ruOf6wNWF0eYFFblrHnJIzQwFoMOtxXMJsqAQhB7Mgs5M+KF7joP
 5ErNjfpOpmXvwlNVhFvJqgU8MEZA7Z1G6rip11TzG2POBx5alyFpW4y5r1yciSC4
 f0Fs5WX4/WPKg61u2oOGWrEyr7TMc4qbnpF79g0QNSTqVnAwJN/lc=
X-Sasl-enc: QBcO9t13WH41ZC1RIlp3cDfDeK0ynR8aIRAx29QRRamt 1406626933
Received: from [192.168.1.31] (unknown [203.206.138.26])
 by mail.messagingengine.com (Postfix) with ESMTPA id 91CC2C0000C;
 Tue, 29 Jul 2014 05:42:12 -0400 (EDT)
Message-ID: <53D76C73.4010201@freebsd.org>
Date: Tue, 29 Jul 2014 19:42:11 +1000
From: Darren Reed <darrenr@freebsd.org>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Kevin Oberman <rkoberman@gmail.com>
Subject: Re: Future of pf / firewall in FreeBSD ? - does it have one ?
References: <201407261843.s6QIhcx4008597@slippy.cwsent.com>	<53D61AC6.5030305@freebsd.org>
 <CAN6yY1uHJn4xA-5zFr4fZez3FyXi7tT0LmhyR8yWkqG7k1A+=A@mail.gmail.com>
In-Reply-To: <CAN6yY1uHJn4xA-5zFr4fZez3FyXi7tT0LmhyR8yWkqG7k1A+=A@mail.gmail.com>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Cc: FreeBSD Current <freebsd-current@freebsd.org>
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jul 2014 09:42:24 -0000

On 29/07/2014 8:07 AM, Kevin Oberman wrote:
...
> And all IPv6 NAT is evil and should be cast into (demonic residence
> of your choosing) on sight!

For the most part, I agree with you but the problem is "checkbox"
comparisons. That IPv6 shouldn't be NAT'd is why I didn't implement
it for such a long time.

However given the problem that EIDs pose for privacy, I'm of the
opinion that maybe NAT66 does have a place but not in the way that
the NAT66 RFC prescribes.

Darren