Messages

Let me communicate this with the product team and see if they can come up with a solution.
« Last Edit: November 28, 2022, 09:11:41 pm by sy »

Any update from the product team please Sy?

Going forward, whatever rules / techniques / capability can be wrought to selectively drop / disable QUIC connections will be vitally appreciated as firewalls worldwide continue their descent into blindness = the new dark age of TLS 1.3, ECH (ESNI), DNS over HTTPS, and DNS over TLS, QUIC, HoQ (HTTP/3), DoQ

Is there an Opnsense working document or advisory on these emerging protocols and their implications to network visibility?


Happy DEC850 user :)

Paul Vixie describes the emergence of DNS over HTTPS (DoH), TLS 1.3 ESNI (Encrypted Server Name Indication), and HTTP/3 over the QUIC Internet transport protocol UDP as the harbinger of end times for conventional firewalls = the loss of privacy due to loss of visibility by managed private networks.

What is the collateral damage (if any) associated with pushing back now and blocking all UDP QUIC connections?


gk
DEC850 running Zenarmour + Intrusion detection (ET Pro, Snort et al)

https://www.youtube.com/watch?v=04Wugl7yb-k&ab_channel=NANOG
https://www.darkreading.com/risk/vixie-the-unintended-consequences-of-internet-privacy-efforts