Consumer Router & IPv6 == Firewall FAIL

I'm using a Linksys wrt610n router (lets call it Eve) at home at the moment and noticed upon upgrading that my home server suddenly had IPv6 connectivity to the world. Apparently Eve supports IPv6, neat! Nowhere in its admin interface are there any settings to control IPv6 behavior.

What does this mean?

Eve has handed out a 6to4 IPv6 address to my internal hosts and is routing IPv6 traffic encapsulated to the IPv4 6to4 anycast 192.88.99.1 address. My current ISP, Comcast, is happily routing this to a 6to4 router. So I have IPv6 connectivity at home. yay... but wait.

Big Trouble In Little Router

Realizing that I had an IPv6 address visible to the world it dawned on me to ask, "hey, what happens to inbound connections? Is there a firewall?".

So I tested it from an IPv6 enabled host at work. Turns out there was no firewall. The entire world (err, the entire 0.01% of it that speaks IPv6 anyways) could connect to my internal file and print servers (samba and cups) among other things. Eek. I solved that by altering the configuration of those servers for now. I really should also configure a firewall on the system to limit what is allowed in.

Cisco (Linksys): The default configuration for any router claiming to be a firewall should be to block inbound connections on IPv6 since the router supports IPv6. Second, the IPv6 firewall should obey the existing port forwarding settings using the associated 6to4 address to allow port forwarding to work the same regardless of IPv4 or IPv6.

Stupid Network Admins In Giant ISP

Comcast is routing the 6to4 anycast 192.88.99.1 traffic to a 6to4 tunnel exit node in Amsterdam. Yes, thats right. My IPv6 traffic on comcast in California is taking an additional 150ms round trip across the Atlantic Ocean to go to a local data center (he.net), wasting transatlantic bandwidth and making the user experience (ie: latency) of most things on IPv6 painful.

Comcast: Stop routing around the world! There are local IPv6 6to4 gateways all around the world. Better yet, setup your own. I realize native IPv6 on cable modem service is a long ways off, likely waiting for DOCSIS 3.0 deployment, but thats no reason to make the experience of IPv6 users suck by default. End users should not need to know anything about IPv6, it should just work. Adding 150ms latency is horrible and will make customers hate you and your customer support will not have a clue how to fix their problems.


P.S. I do not recommend the Linksys wrt610n. It has horrible signal strength compared to anything with external antennas.

Green consumer ethernet switch? D-Link DGS-2208

I just replaced an old Netgear GS105 5 port Gig-E switch with a D-Link DGS-2208 from newegg (on sale for $45 plus a $10 rebate this month). The D-Link touts itself as a "green" ethernet switch which just begs to be measured... So I pulled out the kill-a-watt to measure it.

On the D-Link box is a label stating, "Up to 80% Power savings(*)," with fine print of, "Maximum power savings when compared to a D-Link conventional switch. Uses up to 80% electricity when connected devices are powered down and up to 40% less energy when connected devices are used 10 hours and powered down 14 hours over a 24-hour period, when connected via 20 meter Ethernet cables."

Thats some pretty sad fine print so I lowered my expectations...

But measuring showed otherwise. With nothing plugged into the switch it was too low to register any power draw at all and showed up as 0 watts. With 5 active devices plugged in (a mix of gigabit and 100mbit) it went up to 4 watts. Unplug one device and it went down to 3 watts.

Compared that to my 4+ year old Netgear GS105 with its much larger power brick that drew 8 watts with 5 devices plugged in or 4 watts with no devices plugged in and the D-Link measures up to its claim. Nice.

But is it really anything special? I'd need samplings of other current model switches to find out. The real savings comes from the D-Links ability to save power for switch ports with no link. A live port is going to consume some level of power no matter what as required to maintain ethernet signaling.

For an added bonus the D-Link's 5V 2A wall wart is much smaller than the old netgear's huge 12 1A one and is oriented such that you can plug it into a power strip without covering adjacent outlets. Always a nice touch (tough i'd prefer not to have a wall wart or brick at all).

How the world works

1. Call something a religion.
2. Stuff happens.
3. PROPHET.

Mmm.. efficient power supplies

..geeky entry alert..

Feeling green or just want to lose some computer noise and extra room heat?

I just upgraded an old ATX power supply in Karen's computer to an 80PLUS rated one. Using a kill-a-watt watt meter this dropped the computers power consumption from 104W down to 86W when idle in win2k and from 121W down to 101W when under heavy disk+cpu load. ~20% better efficiency. very nice! highly recommended. Most generic power supplies are in the 50-70% efficiency range. 80+ ones are >= 80% efficient at 20, 50 and 100% load.

I used an Enhance ENP-5140GH but just search google for "80plus power supply" or see 80plus.org and you'll turn up other models (the SeaSonics are also popular among my friends). Its a very quiet PS as well; the fan is the large 120mm variety mounted on the bottom inside of the unit rather than the 80 or 92mm ones commonly mounted on the back.

I've got an ENP-5150GH to install in my server next week which should make an ever greater difference.

[copied from my other blog, written+posted there on 2006-09-28]

this is a blog post

this is the body of the text in the blog in which my blog will blog its blog posts.

this is the footer on the first post of the blog in wich my blog will blog its blog posts.