🚀 go-pugleaf

In article <ajs8n5$hav$1@panix3.panix.com>, shore@panix.com says...
 
> NAT introduces a host of other problems, including
> nasty protocol interactions, host unreachability, and
> security unpleasantness (NAT is indistinguishable from an
> attacker).  They undermine network performance and jack up
> the cost of equipment (there are several large manufacturers
> I can think of that I would guess are each spending about
> $10,000,000/year figuring out how to work around problems
> that NAT introduces).  Many of the workarounds also double
> as tools to allow your users, should they choose to do so,
> to violate local firewall policy.  But hey, it's your
> network.
 
I don't entirely disagree, so I will only mention the points that I 
disagree with you on for brevity.

NAT is indistinguishable from an attacker? I'm not sure what you mean 
there.

NAT doesn't significantly increase the cost of equipment. You may need 
more memory, but memory is cheap (unless you buy "Cisco" memory LOL). 
The router folks wrote the code for NAT because the demand, and lack of 
IP space, was there. They either had to support NAT, or put a rush on 
the IPv6 code, which I suspect wasn't near standardized at the 
introduction time of NAT.

A lot of the problems NAT introduces is because of programmers that have 
written code without regard for the OSI model. If they would have left 
IP addresses at layer 3, there wouldn't be nearly the problem that there 
is. FTP and Netmeeting are two examples.

As far as firewalling, NAT performs as a very good, cheap firewall for 
millions of hosts every day on networks without incident. For many 
people, the router performing NAT is the firewall also. If people want 
to enforce a more stingent firewall policy, then they must be prepared 
to spend the money that it takes. 

Tell me, exactly how does NAT enable users to violate firewall policy? I 
don't see how translating an internal address at the firewall somehow 
bypasses firewall restrictions.

-- 
Dave Phelps
Phone Masters Ltd.
deadspam=tippenring