RE: Where NAT disenfranchises the end-user ...

Mailman List Mirror (Read Only)
1

From: Scott Gifford [mailto:sgifford@tir.com]
Sent: Monday, September 10, 2001 10:30 AM

Roeland Meyer <rmeyer@mhsc.com> writes:

> Any current protection is strictly the
> result of a side-effect. The side-effect that breaks the internet
> connection. It's a result of the connection being broken.
> A properly built
> firewall is much more effective and definitely more
> deterministic. Neither is it vulnerable to a "fix patch".

I don't understand what kind of "fix patch" you're talking about
here...NAT uses the same techniques that a stateful firewall uses; if
you can find some kind of "fix patch" to bypass NAT, chances are
excellent it will work on a stateful firewally, too.

Mot so. What is needed to truely fix NAT is to propogate the translated
addresses, both ways. This would give you an address product like <Inet

:<NAT addr>. The problem is that almost no stack, that I know of, can

deal with such a form. The reason NAT works is that you only lose one side
and the other side doesn't know that you've lost it.

I've actually seen the question of how NAT breaks the Internet more
than a good stateful firewall come up more than once, and haven't
really seen a satisfactory answer. Where does a stateful firewall
configured to only allow outgoing connections work that NAT doesn't?

The difference is determinism. You control, to very fine detail, how a
firewall works. Things that don't work are intended to not work. Firewalls
aren't accidents. NAT address propogation failures are, they are not
consistent, and can't be relied upon to continue. Who knows, some genius,
somewhere, may fix it tomorrow. Lord knows, there is sufficient incentive to
do so. If that happens, your security is toast, if all you are relying on is
NAT, rather than putting up a real firewall.

2

Yea yea yes! Thats the ticket! Then we just make sure that NATed hosts
have globally unique addresses so that the above idea doesn't break due to
collisions and.....

*WAIT A SECOND*

At that point we've just recreated IP and the beautiful concept of putting
the smarts in the HOST (the only place which must contain state) and not
the Network (the place where state kills flexibility, reliability, and
availability), except that your scheme would have the crack added bonus
of profitable NAT translators!

Why didn't we think of this years ago!

3

Roeland Meyer <rmeyer@mhsc.com> writes:

[...]

Firewalls aren't accidents. NAT address propogation failures are,
they are not consistent, and can't be relied upon to continue. Who
knows, some genius, somewhere, may fix it tomorrow. Lord knows,
there is sufficient incentive to do so. If that happens, your
security is toast, if all you are relying on is NAT, rather than
putting up a real firewall.

The rest of what you're saying makes sense, but I just don't buy
this...

A clever design might allow NAT to work with all protocols and in both
directions, which would have increased connectivity but decreased
security. But how would it get onto my network without me putting it
there, and presumably configuring it securely? The box doing NAT is
under my control...

----ScottG.