Re: [Firewalls] Help me understand servers behind NAT routers

From: Melinda Shore (shore@panix.com)
Date: 11/07/02 

From: shore@panix.com (Melinda Shore)
Date: 7 Nov 2002 14:10:55 -0500

In article <mailman.1036695545.16086.firewalls@section5.cyberbase7.com>,
Jayant Shukla <jshukla@trlokom.com> wrote:
>I will ask you again, did I or did I not address the original posters
>question? In your mail you implied that my response was incorrect and
>turned this into a NAT v/s a firewall issue. Once again, the prime
>concern of the original poster was about exposed ports on the WAN side.

You gave an incomplete answer. If you're unfamiliar with an
area it's often difficult to frame a question, and if you
have a little bit of information you'll tend to frame the
question in terms of that tidbit. If someone comes to you
and asks "Does stainless steel conduct electricity?" they
may be asking out of curiosity, they may be asking because
they're doing a science experiment, or they may be asking
because they saw a smoking toddler lying on the floor in
front of an electrical outlet, grasping a fork, and they
wanted to know what happened.

So, when someone asks "are these ports exposed?" it's a
pretty safe bet that they want to control whether or not
they are, and there are several answer to that question,
including don't run servers and use a firewall. Indeed, a
firewall is a better answer to that question than a NAT is,
in that it can completely disallow access or it can allow
or disallow access on the basis of factors like source
address or range of source addresses.

>Did you know that Barbara had asked us to submit a draft for NAT
>traversal?

When someone is carrying on about something or other it's
SOP to ask them to write it up as an ID and submit it.
That's the way the IETF works. 

-- 
     Melinda Shore - Software longa, hardware brevis - shore@panix.com
          If you send me harassing email, I'll probably post it

Relevant Pages

  • Re: home network behind NAT and firewall ?
    ... >> real Firewall appliance with more than 20 systems at any given time. ... >> firewall provides for the ability to assign both public (not nat) and ... that would reset the router and allow remote control - it was noted ... >> LAN inside their network and it would never have to reach the ISP's ...
    (comp.security.firewalls)
  • Re: NAT vs. True Firewalls
    ... not just mean packet filter. ... A firewall can be made up of one or more ... components that can block or filter protocol traffic between two networks. ... So a NAT can be as much part of a firewall implementation as the ...
    (comp.security.firewalls)
  • Re: 56k dial up on laptop 802.11G ?
    ... NAT is not FW software. ... > firewall is literally anything that defends your network against ... >>By comparing the way NAT functions between two networks, ... >>And I consider the FW appliance to out class the packet filtering NAT ...
    (alt.internet.wireless)
  • Re: do i need a new router
    ... Standard SBS ... > uses IPSec, NAT and port forwarding, Premium SBS includes all that plus ... I've never had a firewall or an appliance ... public connection and always tucked them ...
    (comp.security.firewalls)
  • Re: NAT is not a mechanism for securing a network.. but.. HELP!
    ... For years I have heard people claim that NAT could be circumvented ... > packet is routed. ... but the only outside network I have access to right now ... > Firewall is a term, most people use other than it was intended. ...
    (comp.security.firewalls)
Loading