<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><pre>Its been awhile since I could try to simulate a good use case. <br>In short its peeling an onion and just exposed a whole bunch of <br>bad factors. There are other issues in these gateways. They do a <br>"lot of stuff" that has no customer tuning or even visibility. <br>This confounds any honest testing. If port-mapping-connections, <br>entanglement, and business-guest isolation double NAT ... <br>... and added fun carrier NAT, ugh ...<br>were the only problems, then maybe this idea had a place. <br>Considering all, its ready for the recycle bin.<br><br>Eric<br><br>> If you want to experiment with strategies, and your C is OK, it should
> be quite easy to do. Look at allocate_rfd() in src/forward.c. That has
> two bits of code, the first makes a new random socket, and if that
> fails (kernel resource issues, or maximum number (RANDOM_SOCKS) in
> use) it falls through to the second bit, which uses an existing
> socket/port instead. All the reference-counting stuff to share random
> ports is already there, you just need to add some code to decide when
> to use an existing port instead of making a new one.
> It would be interesting to hear if this actually improves things.
> Cheers,
> Simon.
<i>
</i>>><i> I would like to propose that DNSMASQ move [</i><i>random per port# <br>>> over short time] and also DNSMASQ move client ports
</i>>><i> when so many requests have processed (max-concurrent reused or
</i>>><i> %10 of cache or random again?). This will keep its profile on
</i>>><i> the NAT down and it will maintain the moving target against
</i>>><i> attacks.<br>>> ..............<br></i>>><i> The use case is in some new products for home and small business
</i>>><i> with cable ISP. These are a super-media-gateway-box with media
</i>>><i> server, cable interface, two independent VOIP lines, cable modem,
</i>>><i> and wireless gateway. MOCA serves TV through client media boxes.
</i>>><i> One public IPV4 to do all of this. These are a great concept, but
</i>>><i> the modem, firewall, and wireless are poorly implemented. However,
</i>>><i> this combo may be the most economic offering for monthy cost.</i><i>
</i>>><i> Super-gateways often don't provide even Primary and Guest networks
</i>>><i> (ie isolate Coffee Shop POS and Guest Free WiFi). There's nothing
</i>>><i> if you want to prevent neighbor business from free-loading into
</i>>><i> your Guest Wifi, and so use beverage receipt passwords.<br>>> .......<br>>> Eric<br></i></pre> </div></body>
</html>