Ok; let's have the "Does DNAT contribute to Security" argument one more time...

Mon Nov 14 21:10:32 UTC 2011

On Mon, 14 Nov 2011 15:55:14 EST, Jay Ashworth said:

> On the other hand, since a firewall's job is to stop packets you don't want,

One of Marcus Ranum's "5 Stupidest Security Blunders" - "enumerating badness".
A firewall's job isn't to stop unwanted packets, it's to pass only wanted packets.

> if it stops doing it's just as a firewall, it's likely to keep on doing it's
> other job: passing packets.

As a result, a firewall that fails open rather than closed is mis-designed.

And if you're deploying a firewall and don't know if the failure mode is open or
closed, you probably get what you deserve when it fails.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20111114/f2664b3b/attachment.sig>