Re: Curious on NAT traversal possibility on PF

2006-06-21 Thread Daniel Ouellet
Nick Guenther wrote: On 6/13/06, Stuart Henderson <[EMAIL PROTECTED]> wrote: On 2006/06/13 22:07, Nick Guenther wrote: > What is the prefered method for NAT-traversal these days? The options > I know are: > UPnP I suppose this one doesn't work unless the protocol bends well to it, and both end

Re: Curious on NAT traversal possibility on PF

2006-06-15 Thread Martin Toft
Late reply due to mail server problems at my ISP... Stuart Henderson wrote: Depends what you're trying to do, but if it's e.g. throttling p2p users, that's only going to be of limited help. I haven't tried the approach yet and, as you, I'm in doubt about its abitily to throttle p2p. However, t

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Nick Guenther
On 6/13/06, Stuart Henderson <[EMAIL PROTECTED]> wrote: On 2006/06/13 22:07, Nick Guenther wrote: > What is the prefered method for NAT-traversal these days? The options > I know are: > UPnP I suppose this one doesn't work unless the protocol bends well to it, and both ends support it too, whic

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Stuart Henderson
On 2006/06/13 22:07, Nick Guenther wrote: > What is the prefered method for NAT-traversal these days? The options > I know are: > UPnP > a proxy > having the in-kernel NAT code do the work itself Look at how /usr/sbin/ftp-proxy works with anchors - it's a nice hybrid, keeping L7 work out of the ke

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Nick Guenther
On 6/13/06, Stuart Henderson <[EMAIL PROTECTED]> wrote: (warning, a bit long and might not be of very general interest, but some of the points probably need getting down somewhere...) executive summary: passing some protocols through NAT can be pretty hairy. Of course this is quite like active-

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Stuart Henderson
(warning, a bit long and might not be of very general interest, but some of the points probably need getting down somewhere...) executive summary: passing some protocols through NAT can be pretty hairy. On 2006/06/13 16:47, Daniel Ouellet wrote: > Stuart Henderson wrote: > >On 2006/06/13 14:58, D

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Daniel Ouellet
Stuart Henderson wrote: On 2006/06/13 14:58, Daniel Ouellet wrote: That's cool! No worry, I guess your subject is way more interesting to many, or no one is using NAT traversal or have any needs for it. I don't know much about H.323, but for SIP draft-biggs-sip-nat has some useful information,

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Stuart Henderson
On 2006/06/13 14:58, Daniel Ouellet wrote: > That's cool! No worry, I guess your subject is way more interesting to many, > or no one is using NAT traversal or have any needs for it. I don't know much about H.323, but for SIP draft-biggs-sip-nat has some useful information, care needs to be taken

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Daniel Ouellet
Martin Toft wrote: To Daniel Quellet: Sorry for disturbing the topic of your thread. That's cool! No worry, I guess your subject is way more interesting to many, or no one is using NAT traversal or have any needs for it. That's fair game. (;> Daniel

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Stuart Henderson
On 2006/06/13 08:26, Jeff Quast wrote: > On 6/13/06, Stuart Henderson <[EMAIL PROTECTED]> wrote: > > > > On 2006/06/13 12:26, Martin Toft wrote: > > > Spruell, Darren-Perot wrote: > > > >Maybe a better-designed application wouldn't have to make use of such a > > > >clusterbag of ports in the first

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Jeff Quast
On 6/13/06, Stuart Henderson <[EMAIL PROTECTED]> wrote: > > On 2006/06/13 12:26, Martin Toft wrote: > > Spruell, Darren-Perot wrote: > > >Maybe a better-designed application wouldn't have to make use of such a > > >clusterbag of ports in the first place? > > > > The ports do not belong to a single

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Stuart Henderson
On 2006/06/13 12:26, Martin Toft wrote: > Spruell, Darren-Perot wrote: > >Maybe a better-designed application wouldn't have to make use of such a > >clusterbag of ports in the first place? > > The ports do not belong to a single application. I operate a gateway and > want to give high priority to

Re: Curious on NAT traversal possibility on PF

2006-06-13 Thread Martin Toft
Spruell, Darren-Perot wrote: Maybe a better-designed application wouldn't have to make use of such a clusterbag of ports in the first place? The ports do not belong to a single application. I operate a gateway and want to give high priority to legitimate protocols and low priority to everythi

Re: Curious on NAT traversal possibility on PF

2006-06-12 Thread Spruell, Darren-Perot
From: [EMAIL PROTECTED] > Until recently I also pictured pf as feature complete. However, after > having had hands-on experience with writing a rule set with special > queueing of traffic directed to a (relative high) number of > unsucceeding > port numbers, I am annoyed with the limited table

Re: Curious on NAT traversal possibility on PF

2006-06-12 Thread Martin Toft
Daniel Ouellet wrote: Looking in the archive, looks like PF is view as feature complete and really I can't think of anything I can't do with it except nat traversal in VoIP setup. Maybe a bit off topic, but it immediately popped up in my head... Until recently I also pictured pf as feature co

Curious on NAT traversal possibility on PF

2006-06-12 Thread Daniel Ouellet
Looking in the archive, looks like PF is view as feature complete and really I can't think of anything I can't do with it except nat traversal in VoIP setup. Would it be possible to consider the addition of this may be? Just curious? Best, Daniel