Security gain from NAT (was: Re: Cool IPv6 Stuff)

Valdis.Kletnieks at vt.edu Valdis.Kletnieks at vt.edu
Mon Jun 4 20:24:50 UTC 2007


On Mon, 04 Jun 2007 12:20:38 PDT, Jim Shankland said:

> I can't pass over Valdis's statement that a "good properly configured
> stateful firewall should be doing [this] already" without noting
> that on today's Internet, the gap between "should" and "is" is
> often large.

Let's not forget all the NAT boxes out there that are *perfectly* willing
to let a system make an *outbound* connection.  So the user makes a first
outbound connection to visit a web page, gets exploited, and the exploit
then phones home to download more malware.

Yeah, that NAT *should* be providing security, but as you point out, there's
that big gap between should and is... :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20070604/61b5e940/attachment.sig>


More information about the NANOG mailing list