<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Heya Tristram<div class=""><br class=""></div><div class="">I won't pass comment on the technical or political appropriateness of the approach, but I can pass comment in regard to your question about anyone else coming across that type of service before.</div><div class=""><br class=""></div><div class="">I've saw it widely deployed in New Zealand schools in the pre-N4L days. I'm sure there are still some out there using it now (possibly many). The NZ Ministry of Education funded said ISP (who I am guessing is the same one you've come across, only because I haven't seen it done by anyone else) to provide a web-filtering service to the schools and this was how it was implemented if the school had a connection through a different ISP. Most (not necessarily all) of their outbound port 80 and port 443 traffic traversed said tunnel (naked GRE was an alternative tunnelling option).</div><div class=""><br class=""></div><div class="">It reminded me of the days way back when we had an iHug 'Ultra' satellite connection which used a 33k6 dialup modem for the upstream path. As soon as 'Jetstream' (128K DSL) service became available we re-routed our upstream traffic over the DSL which in turn meant much better TCP throughput on the satellite downstream. iHug were none the wiser and the DSL provider obviously wasn't filtering on source IP back then or it would have never worked.</div><div class=""><br class=""></div><div class="">Anyway just thought I'd chime in and say it was quite common on NZ school connections just a year or two ago. The schools perceived it to be a 'free service' since it was centrally funded rather than coming out of their operational budgets.</div><div class=""><br class=""></div><div class="">Pete</div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 16/02/2016, at 12:38 pm, Tristram Cheer <<a href="mailto:t@uber.co.nz" class="">t@uber.co.nz</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Menlo-Regular; font-size: 10px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi All,<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I came across a client on our network that is using a filtering service where the client installs a device that sends all of their upload traffic over an IPSec tunnel to a 3<sup class="">rd</sup><span class="Apple-converted-space"> </span>party network for inspection before that network then sends the request on with the “spoofed” IP of the client’s public IP so that the download stream returns directly to the client. This way the filtering service doesn’t have to deal with the download traffic volumes. Initially It seemed ok but the more I thought about it the more it didn’t sit right with me.<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Has anyone else come across this type of service before? Have you run into problems with what is in effect one way traffic from a SME/Residential connection? It seems to me that BCP38 would knock this service out and if the ISP was doing any sort of inspection that would require both up and down streams it may break their connection/degrade it. Whilst it’s technically ok it just seems a little off for a non-enterprise connection to potentially be acting “odd”. Not looking at the pro’s and con’s of filtering but just thought I’d put it to the list to see what everyone’s thoughts are on it<span class="Apple-converted-space"> </span><span style="font-family: Wingdings;" class="">J</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Cheers<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> </span></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="675" style="width: 405pt; border-collapse: collapse;"><tbody class=""><tr class=""><td width="650" style="width: 390pt; border-style: none none solid; border-bottom-color: rgb(0, 0, 1); border-bottom-width: 1pt; padding: 0cm 0cm 7.5pt 15pt;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 14pt; font-family: 'Arial Narrow', sans-serif;" class="">TRISTRAM</span><span style="font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> </span><span style="font-size: 14pt; font-family: 'Arial Narrow', sans-serif;" class="">CHEER</span></div></td><td width="100" style="width: 60pt; border-style: none none solid; border-bottom-color: rgb(0, 0, 1); border-bottom-width: 1pt; padding: 0cm 15pt 7.5pt 0cm;" class=""><br class=""></td></tr></tbody></table></div></div></blockquote></div></div></body></html>