nanog mailing list archives
Re: mh (RE: OMB: IPv6 by June 2008)
From: "Jay R. Ashworth" <jra () baylink com>
Date: Fri, 8 Jul 2005 14:10:25 -0400
On Fri, Jul 08, 2005 at 01:15:42PM -0400, David Andersen wrote:
On Jul 8, 2005, at 12:49 PM, Jay R. Ashworth wrote:On Thu, Jul 07, 2005 at 01:31:57PM -0700, Crist Clark wrote:And if you still want "the protection of NAT," any stateful firewall will do it.That seems a common viewpoint. I believe the very existence of the Ping Of Death rebuts it. A machine behind a NAT box simply is not visible to the outside world, except for the protocols you tunnel to it, if any. This *has* to vastly reduce it's attack exposure.Not really. Consider the logic in a NAT box:
[ ... ]
and the logic in a stateful firewall:
Sorry. Given my other-end-of-the-telescope perspective, I was envisioning an *on-machine* firewall, rather than a box. Clearly *any* sort of box in the middle helps in the fashion I alluded to, whether it NATs or not. Cheers, -- jra -- Jay R. Ashworth jra () baylink com Designer Baylink RFC 2100 Ashworth & Associates The Things I Think '87 e24 St Petersburg FL USA http://baylink.pitas.com +1 727 647 1274 If you can read this... thank a system administrator. Or two. --me
Current thread:
- Re: mh (RE: OMB: IPv6 by June 2008), (continued)
- Re: mh (RE: OMB: IPv6 by June 2008) Dave Crocker (Jul 07)
- RE: mh (RE: OMB: IPv6 by June 2008) Tony Hain (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Dave Crocker (Jul 07)
- RE: mh (RE: OMB: IPv6 by June 2008) Kuhtz, Christian (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Fergie (Paul Ferguson) (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Andre Oppermann (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Crist Clark (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Petri Helenius (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Crist Clark (Jul 07)
- Message not available
- Re: mh (RE: OMB: IPv6 by June 2008) Jay R. Ashworth (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) David Andersen (Jul 08)
- Message not available
- Re: mh (RE: OMB: IPv6 by June 2008) Jay R. Ashworth (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) Crist Clark (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) Andre Oppermann (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Fred Baker (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) Iljitsch van Beijnum (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) Crist Clark (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) Sean Doran (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) Sean Doran (Jul 08)
- Re: mh (RE: OMB: IPv6 by June 2008) David Andersen (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Daniel Senie (Jul 09)
- RE: mh (RE: OMB: IPv6 by June 2008) Tony Hain (Jul 07)
- Re: mh (RE: OMB: IPv6 by June 2008) Steven M. Bellovin (Jul 07)