Re: Hiding NATs with PF
From: Simon Farnsworth (usenet_at_farnz.org.uk)
Date: 09/28/05
- Next message: adelfino: "Difference between package-1.0 and package-1.0p0"
- Previous message: Max Bolingbroke: "Re: Hiding NATs with PF"
- In reply to: Max Bolingbroke: "Re: Hiding NATs with PF"
- Next in thread: Max Bolingbroke: "Re: Hiding NATs with PF"
- Reply: Max Bolingbroke: "Re: Hiding NATs with PF"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Wed, 28 Sep 2005 19:44:45 +0100
Max Bolingbroke wrote:
> None. The only restriction is against routers. The claim is that a NAT
> router causes upstream routing headaches. Is this true? I would have
> thought that since it acts just like a single host all the performance
> penalty is occured by the NAT device itself, as ti does the source port
> translation etc.
>
Assuming the person who sets the NAT router up is competent, it's not an
issue. However, it's not uncommon for internal routing infrastructure to be
running on RFC 1918 private IP addresses (the same batch you'll choose your
private addresses from). If you (by accident or through stupidity) start
letting your "private" addresses through, you could kill parts of their
campus routing by poisoning ARP tables.
>> I know of such networks where there is a strict ``no nat'' policy
>> because they don't want to deal with abuse hidden by that and the
>> resulting expected gefingerpointing. I can't blame them for their
>> motives.
>
> Interesting, they don't cite that as a reason. What abuse could be
> hidden by a NAT that could not be hidden by a single host with firewall
> enabled? Could you please tell me if the one they give (above) is
> actually valid? If so I will of course comply with their request.
>
You and I share one IP via NAT; said IP is registered to you. I break into a
bank's computer system. When the authorities come to get you, you point the
finger at me. I point the finger at you, and we have a standoff. By banning
NAT routers, your upstream can get you for unauthorised NAT even if they
can't get you for the break-in.
-- Simon Farnsworth
- Next message: adelfino: "Difference between package-1.0 and package-1.0p0"
- Previous message: Max Bolingbroke: "Re: Hiding NATs with PF"
- In reply to: Max Bolingbroke: "Re: Hiding NATs with PF"
- Next in thread: Max Bolingbroke: "Re: Hiding NATs with PF"
- Reply: Max Bolingbroke: "Re: Hiding NATs with PF"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
