Subject: NAT/Proxy combinations

From: "Atul Sabharwal" <[email-masked]>
Date: Sat, 27 Aug 2005 23:51:19 -0700

Generally, people use NAT or Proxy as firewalls.  Would it be more secure to
use a NAT Proxy combination ?
Say, a NAT connected to Proxy connected to NAT.  Would this prevent external
as well as internal attacks.
Also, use static routes between the NAT/proxy/NAT to prevent internal route
spoofing.
 
Most proxies I have known are software based and NAT's are firmware based.
Assumption being all required 
application level gateways are available for NAT.
 
e.g. Use hardware NAT's are from two different vendors (with different
packet processing algorithm), and proxy is squid. 
--
Atul
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sun, 28 Aug 2005 09:25:20 +0200

On 28-aug-2005, at 8:51, Atul Sabharwal wrote:

> Generally, people use NAT or Proxy as firewalls.  Would it be more  
> secure to use a NAT Proxy combination ?

Basically, a NAT is just a simple and general-purpose way to  
implement a proxy.

If you define "more secure" as "less likely that random packets will  
be delivered": sure, put in as much stuff that makes everything less  
transparent as you can.

Obviously this won't help against many popular attack vectors which  
prey upon the gullibility of the typical user, which mostly happen  
over HTTP or through mail, which don't need a transparent  
communication channel.

And please don't expect the IETF to make its protocols work through  
your multiple layers of NAT and proxies.

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 28 Aug 2005 10:17:08 +0200

You might want to look at draft-ietf-v6ops-nap-01.txt

Although it is mainly about IPv6, it analyzes aspects of your question.

    Brian

Atul Sabharwal wrote:
> ------------------------------------------------------------------------
>

---

From: Peter Dambier <[email-masked]>
Date: Mon, 29 Aug 2005 08:19:13 +0200

>> secure to use a NAT Proxy combination ?

In the hand of a hacker NAT is a very useful device. He can safely hide
behind a NAT that rapidly switches ip addresses. Nobody can follow him.

> 
> Basically, a NAT is just a simple and general-purpose way to  implement 
> a proxy.

It does play the role of a proxy nobody has ordered and nobody does
even no it exists. So it does breake security by providing a
proxy that should bo be there in the first place.

> 
> If you define "more secure" as "less likely that random packets will  be 
> delivered": sure, put in as much stuff that makes everything less  
> transparent as you can.

In fact it provides a loophole destroying every attept to security from
end to end.

> prey upon the gullibility of the typical user, which mostly happen  over 
> HTTP or through mail, which don't need a transparent  communication 
> channel.

But it provides a great way to break into any established secure link.

Just wait for them to exchange passwords. Break the connection and do
your evil. Dont care any longer and let the connection drop to the
floor. NAT and windows will cope and nobody will ever see a trace in
their logs.

> your multiple layers of NAT and proxies.

NAT was never designed for security. NAT was designed as a loophole.
That loophole has improved greatly over time.

All bad things said I would like to mention that a windows computer
wont stay long in the internet if you dont hide them behind NAT

It really does not make a difference wether you proxy on the NAT or
somewhere else except when you proxy after the NAT you proxy after
a proxy. You can replace several proxies by a tunnel through a
low speed data line. In fact that will break SSH wordbook attacks.
Just delay everything longer than the hacker probably waits

Regards,
Peter Dambier

-- 
Peter and Karin Dambier
Public-Root
Graeffstrasse 14
D-64646 Heppenheim
+49-6252-671788 (Telekom)
+49-179-108-3978 (O2 Genion)
+49-6252-750308 (VoIP: sipgate.de)
+1-360-448-1275 (VoIP: freeworldialup.com)
mail: [email-masked]
http://iason.site.voila.fr
http://www.kokoom.com/iason

---

From: "Nicholas Staff" <[email-masked]>
Date: Mon, 29 Aug 2005 00:29:05 -0700

> proxy that should bo be there in the first place.
I don't understand what you mean here?  NAT is going to have to be the
default gateway somewhere along the route path so whether manually
configured on the client, done via dhcp, or configured on a router, how is
it something that nobody has ordered?  Also it breaks security for whom (I
can see how it makes it tougher for the destination, but it sounds like you
are inferring it breaks security for the network using the NAT?).

I have comments/questions about your other remarks but I want to first make
sure we are talking about the same thing.

Thanks,
Nick

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 29 Aug 2005 13:44:22 +0200

Nicholas Staff wrote:
>>>Basically, a NAT is just a simple and general-purpose way 
>>
>>to  implement 
>>
>>>a proxy.
>>
> it something that nobody has ordered?

I think the statement refers to the fact that neither party to the
communication session that the NAT interferes with has ordered it.
Some network manager in the middle ordered it.

> Also it breaks security for whom (I

Exactly. It breaks IPSEC, or at best forces IPSEC into a UDP based kludge.

All this is explored in RFC 2993.

    Brian
>>>If you define "more secure" as "less likely that random 
>>
>>packets will  be 
>>
>>>Obviously this won't help against many popular attack 
>>
>>vectors which  
>>
>>>prey upon the gullibility of the typical user, which mostly 
>>
>>happen  over 
>>
>>>And please don't expect the IETF to make its protocols work 
>>
>>through  
>>