Subject: Re: NAT->IPv6

From: Leonid Yegoshin <[email-masked]>
Date: Wed, 26 Apr 2000 10:31:24 -0700

>From: "Steven M. Bellovin" <[email-masked]>
>
>In message <[email-masked]>, "Eliot Lear" writes:
>>It is a complete fallacy that NAT provides any sort of security.  It does
>>no such thing.  Security is provide by a firewall, and (more importantly)
>>by strong security policies that are policed and enforced.
>
>Eliot is absolutely right.  A NAT box *might* be part of a firewall, but by
>itself it isn't one.  It's no more secure, and often less so, than an
>application-level firewall.
>
   You both right ... from strong point of view. But if intruder
can't hook target host simply because he does not know - how he can open
TCP to it then it is also part of security.

>The myth that NATs per se provide strong security is one of the greatest
>barriers to their elimination.

   It is not a myth. It is level of thinking. If you setup only firewall
and you are not very good network engineer you can't understand where could
be the next threat. Your TCP stack/firewall/etc may have a bug, some new
protocol may have a misdesign. But anybody clear understand that if your
internal hosts do not have a public address then all attacks may be
only static - wait until internal host open TCP to somewhere. And this
kind of attack may be at least investigated and compromised external host
may be found.

  I am not NAT defender but I recognize how IS dept thinks.
I prefer a mixed solution like uniq host system ID + some controllable
route address.

		       - Leonid Yegoshin, LY22

---

From: Greg Hudson <[email-masked]>
Date: Wed, 26 Apr 2000 14:54:21 -0400

> But anybody clear understand that if your internal hosts do not have
> a public address then all attacks may be only static - wait until
> internal host open TCP to somewhere.

This is a naive understanding.  Source-routing would let me get
packets through to an internal address unless your NAT also acts as a
firewall.

(Granted, I think it turns out that pretty much all NATs do this kind
of firewalling in all cases.  But there's no reason why a firewall
allowing only outgoing connections should be any more error-prone than
a NAT gateway.)