X

Firewall programmer gets his way with OpenVZ

Stephen Shankland Former Principal Writer
Stephen Shankland worked at CNET from 1998 to 2024 and wrote about processors, digital photography, AI, quantum computing, computer science, materials science, supercomputers, drones, browsers, 3D printing, USB, and new computing technology in general. He has a soft spot in his heart for standards groups and I/O interfaces. His first big scoop was about radioactive cat poop.
Expertise Processors, semiconductors, web browsers, quantum computing, supercomputers, AI, 3D printing, drones, computer science, physics, programming, materials science, USB, UWB, Android, digital photography, science. Credentials
  • Shankland covered the tech industry for more than 25 years and was a science writer for five years before that. He has deep expertise in microprocessors, digital photography, computer hardware and software, internet standards, web technology, and more.
See full bio
Stephen Shankland
2 min read

SWsoft programmers are working on an open-source virtualization project called OpenVZ that would make it possible to give a single installation of Linux the appearance of being several independent copies of the operating system. But Harald Welte, the lead programmer of the netfilter/iptables firewall software used in Linux, griped last week on his blog that the software didn't support the next-generation IPv6 Internet standard.

Welte's complaint didn't fall on deaf ears. "We have listened to the community and appreciate the feedback and will implement IPv6 support in OpenVZ in a month or two," SWsoft said in a statement.

Welte is delighted with the response. "I never expected such a thorough and immediate response. This is amazing, and it shows how much they actually care even about subjects that might seem a bit obscure in the first place," he told CNET News.com.

Version 6 of the Internet Protocol adds a vastly larger number of Internet addresses than the current IPv4. That's important because some parts of the world--notably Asia--have many fewer fixed addresses than United States companies. Linux and the firewall software has supported IPv6 networking for years.

It's also important for firewall software. Today a technology called network address translation (NAT) effectively lets many computers share the same IP address. But doing so obscures addressing information useful for firewalls--and, according to Welte, standards for voice over Internet Protocol. "NAT breaks end-to-end transparency, which is in turn the single most problematic issue when it comes to fast adoption of new protocols," he said.

Welte would prefer for OpenVZ to make a virtualized version of the lower-level Ethernet network support. That would mean OpenVZ programmers wouldn't have to worry about which higher-level IPv6 or IPv4 a server administrator was using.