At least there's an explicit standard for signalling: RFC 6887 Port Control Protocol. Many routers also support it.

But it's often disabled for the same reason as having router-level firewalls in the first place.

Port forwarding and hole punching have different objectives and outcomes, and I believe PCP only caters to the former.

While the outcomes might be similar (some inbound connections are possible), the scope (one specific external IP/port vs. everybody) and the semantics ("endorsement of public hosting" vs allowing P2P connections that are understood to require at least some third-party mediation) differ.

I also don't think that port forwarding is possible through multiple levels of firewalls (similar to "double NAT").

▲

ninkendo 6 hours ago | parent | prev [-]

> But it's often disabled for the same reason as having router-level firewalls in the first place.

Yeah, anything that allows hosts to signal that they want to accept connections, is likely the first thing a typical admin would want to turn off.

It’s interesting because nowadays it’s egress that is the real worry. The first thing malware does is phone home to its CNC address and that connection is used to actually control nodes in a bot net. Ingress being disabled doesn’t really net you all that much nowadays when it comes to restricting malware.

In an ideal world we’d have IPv6 in the 90’s and it would have been “normal” for firewalls to be things you have on your local machine, and not at the router level, and allowing ports is something the OS can prompt the user to do (similar to how Windows does it today with “do you want to allow this application to listen for connections” prompt.) But even if that were the case I’m sure we would have still added “block all ingress” as a best practice for firewalls along the way regardless.

▲

forgotaccount3 5 hours ago | parent [-]

> Ingress being disabled doesn’t really net you all that much nowadays when it comes to restricting malware.

But how much of this is because ingress is typically disabled so ingress attacks are less valuable relative to exploiting humans in the loop to install something that ends up using egress as part of it's function.

▲

Dylan16807 3 hours ago | parent [-]

Since we're talking about programs that are trying to set up a connection no matter what, I'm going to say "not much". It's not significantly shrinking the attack surface and forcing attackers onto a plan B that's meaningfully harder to do. It just adds this layer of awkwardness to everything, and attackers shrug and adapt.

▲

ectospheno 3 hours ago | parent [-]

You block inbound to block inbound. Of course it doesn’t do anything for outbound. Acting like you can just turn inbound filtering off because of that is disingenuous.

	▲	Dylan16807 2 hours ago \| parent [-]
		Nobody suggested "just turn inbound filtering off"?? We're talking about an alternate universe of program design. And we're talking about malware in general, not inbound or outbound specifically.