[ILUG] Somewhat OT: Dynamic vs. Static NAT?

[Gareth Eason]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

paul at clubi.ie wrote:
[snip]
| I.e., and this can't be stressed enough, *ONLY* the remote ends of the
| TCP sessions have the state needed to reliably drop packets. Anything in
| the middle is *bound* to get it wrong (and firewalls do, over and
| again!) - plus it makes redundant routing difficult.
|
| In short, stateful filtering of TCP is simply needless and harmful.
[snip]

	In an attempt to put this argument to bed, allow me for a moment to
demonstrate that there is, in fact, a use for stateful packet inspection
and firewalling techniques based on same:

[host]-----[router]-----[firewall]=====[evil_net]===[www_host]

~     -----  = very slow connection
~     =====  = very fast connection

	Let's use the example where 'host' initiates a web connection and gets
a response on port 1666. Also, the responding host decides to flood on
port 1667. (No, I don't know why - but let's say it does.)

	In that case, to protect the network of slow connections behind the
firewall, a stateful firewall is (possibly) the appropriate solution.
Waiting for the state machine in the 'host' to discard useless (possibly
DoS) packets is too late, whereas the firewall has the knowledge to do
this at the edge.

	So, there is a place for stateful inspection and firewalls operating in
that mode. Protection at the edge of a network is often deployed to
protect the network, not just the hosts. Unless the edge router
omnipotently knows all legal activities of the hosts behind it at all
times, it can be shown that it cannot protect the network in all cases
without gathering and acting on some kind of state.

	Of course, this may bring some or all of the problems Paul describes,
such as wrongful packet drops, problems with rerouting, HA, etc.
However, it describes a valid function for a stateful firewall, I hope.

	This e-mail is not, and is not intended to be in any way a statement of
advocacy for stateful firewalls or otherwise. No pets were harmed in the
writing of this e-mail.

	Best regards,
	-->Gar



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHjVY+K36C50PvIR8RApsTAJ9yIyWUigLYBmO4Wy5DGFKbhN6DwwCeJcnd
+oLgR1Sb1FNJEavddu2iZE8=
=nQlO
-----END PGP SIGNATURE-----