Re: Arguing against using public IP space

[Phil Regnauld <regnauld () nsrc org>]

Doug Barton (dougb) writes:
> On 11/13/2011 13:27, Phil Regnauld wrote:
> >     That's not exactly correct. NAT doesn't imply firewalling/filtering.
> >     To illustrate this to customers, I've mounted attacks/scans on
> >     hosts behind NAT devices, from the interconnect network immediately
> >     outside: if you can point a route with the ext ip of the NAT device
> >     as the next hop, it usually just forwards the packets...
>
> Have you written this up anywhere? It would be absolutely awesome to be
> able to point the "NAT IS A SECURITY FEATURE!!!" crowd to an actual
> demonstration of why it isn't.

        Nope, but I could do a quick tut on how to do this against a natd/pf/
        iptables or IOS with IP overload.

        Arguably in *most* cases your CPE or whatever is NATing is behind
        some upstream device doing ingress filtering, so you still need to
        be compromising a device fairly close to the target network.

        P.