Re: Large-scale 1-1 NAT

Christopher Cowart wrote:
On Mon, Sep 24, 2007 at 11:58:15AM +0300, Cristian KLEIN wrote:
Christopher Cowart wrote:
We're working on expanding our wireless network. Unfortunately, we're
running out of IP addresses (aren't we all). As much as I'd love to just
tell everyone to use IPv6, that isn't gonna fly. The next plan to
consider is using an RFC1918 pool and NATing the traffic.

If only it were that simple. The security folks have mandated that
anyone who can talk to the internet at large must be individually
indentifiable. This means having hundreds of users NATing to a single
internet-routable IP isn't happening.
We used to have this problem too, for some NATed networks. The solution which
has been adopted is to capture the flows on the gateway and send them the
security team. The netflow protocol is very well suited for this.

We have automated intake and processing for security cases. These often
just contain the IP the bad traffic appeared to be coming from. While we
could probably reconstruct things using netflow, we definitely wouldn't
have the staff time to do so. As such, we'd have to keep this
information in a database, which will add up fast. Keeping track who was
using an IP at a given time is relatively easy. Granted, this places the
complexity in the network and not the security processing, but that's
where we have resources.

I must admit I haven't thought of this. With this new information I am missing a
point. Since you need to make a 1-to-1 association between clients and public
IPs, why do you need the NAT at all. Is this to save public IPs by NOT giving
them to unauthenticated users?

There is another thing I wanted to point out. I remember you used the words
"authentication web page". This made me think you are establishing a captive
portal, which is not secure at all. If I understand well the authpf solution
would be secure, except perhaps a small delay. You might proxy your clients to a
"click here and download this preconfigured PuTTY" page.

The real question is: what's the best way to dynamically update the NAT
table?
You may use IPFW with IPNAT or PF instead. PF is able to reload its
configuration without disruption. Moreover, because the state table is not
flushed during a reload, you can even move NATed clients from one public IP to
another, without them noticing.

We would prefer to stick with ipfw. The most common documentation I've
founded is natd+ipfw. I've also seen pf+ipnat. I haven't really seen any
documentation on ipfw+ipnat. Is this possible? Or would we be able to do
ipfw+pf+ipnat? What solution would scale best to 1500-4000 authenticated
users?

I have used ipfw + pf for almost a year, for about 400 clients and I am very
happy with it. Note that I only use ipfw for dummynet. In all other situations I
only use PF.

PF uses a binary tree to store NAT states, so it isn't really affected by the
number of clients. It also features state timeouts reduction based on the number
of NAT states, which is very useful if one Windows station gets a "lets scan the
whole /16" virus.

_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • RE: Dhcp security
    ... Setting up a 802.1x wired network requires: ... vendors, including Cisco, provide solutions to ensure that only properly ... trust agent collects security state information from multiple security ... software clients, such as anti-virus clients, and then communicates this ...
    (Focus-Microsoft)
  • Re: [Full-Disclosure] SSH vs. TLS
    ... > frowned upon by network ops and security. ... > - There must be a secure means by which all server keys are distributed to ... > appropriate ssh clients. ... > servers from using expired keys. ...
    (Full-Disclosure)
  • Re: Shared Win98 Printing in 2003 Mixed Domain
    ... are a lot of security settings - particularly security options in security ... network access:do not allow anonymous access to sam and sam and shares, ... manager authentication level to send ntlmv2 responses only, ... make sure that the W2003 servers are also wins clients. ...
    (microsoft.public.win2000.printing)
  • Re: Shared Win98 Printing in 2003 Mixed Domain
    ... are a lot of security settings - particularly security options in security ... network access:do not allow anonymous access to sam and sam and shares, ... manager authentication level to send ntlmv2 responses only, ... make sure that the W2003 servers are also wins clients. ...
    (microsoft.public.win2000.networking)
  • Re: Shared Win98 Printing in 2003 Mixed Domain
    ... are a lot of security settings - particularly security options in security ... network access:do not allow anonymous access to sam and sam and shares, ... manager authentication level to send ntlmv2 responses only, ... make sure that the W2003 servers are also wins clients. ...
    (microsoft.public.win2000.security)