3 ms·
> Relay does not allow UDP traffic (applications that attempt to use UDP will find their traffic blocked on the device itself). Eventually it will allow UDP tra
by octoberfranklin 4y ago
> Relay does not allow UDP traffic (applications that attempt to use UDP will find their traffic blocked on the device itself). Eventually it will allow UDP traffic to certain destination port numbers, such as 443.
This is a very weird restriction that I've never seen before. Can you explain where it emanates from? I can only assume that this is motivated by logging.
Do you reject ICMP as well?
What happens if I tunnel UDP inside of headers that make the packet look like a TCP SYN+ACK packet? This would be IPv6 to avoid CGNAT of course.
PS, your blog is missing the RSS/ATOM feed.
- barathr 4y agoOh, perhaps we should have gone into it in more detail, but this is a direct consequence of the architecture of IETF MASQUE. It's not a VPN tunnel of the classic sort. Instead it's nested HTTPS-based proxying of E2EE TLS streams. The reason UDP is a risk to Fastly in that context is that their infrastructure can be instructed in connection requests to create non-congestion-controlled streams to arbitrary destinations, and they have a lot of bandwidth at their disposal. We want to put mitigations in place to prevent use of this infrastructure for DoS attacks before opening up UDP widely.
- octoberfranklin 4y agoYou're providing network access. Layer 3. IP. HTTP(S) is at layer 5; has nothing to do with your service. Nor does Fastly. Serious, WTF does a CDN have to do with being an ISP? > they have a lot of bandwidth at their disposal. You think Level3/Lumen/Centurylink and Verizon don't? They certainly allow UDP. Besides, who are you going to DOS using a cellular uplink?