🚀 go-pugleaf

In article <MPG.1a36cd3d8712184d989eb5@news-server.columbus.rr.com>,
Leythos  <void@nowhere.com> wrote:
>I think that your above description of a quality router/NAT device is 
>specifically what I was suggesting. I'm not sure why anyone would want 
>to use a NAT device that didn't ensure the returned packets were from 
>the correct location.

Ouch.  Please don't rely on NAT for security.

But anyway, it's not as simple as what you're suggesting.
There's been some work done on categorizing types of NAT
behavior (see, for example, RFC 3489), and for better or
worse fully symmetric NAT will not allow some NAT
workarounds to function properly.  In the grander picture
that's probably a good thing (most NAT workarounds introduce
their own security problems), but it does mean that
symmetric NATs are harder to live with if you want to do
much beyond web browsing or other stuff that's
single-connection.  

>So, we're back to what I said before - if ISP's were to use NAT (not 
>some unsecure version of NAT) we would all be a lot better off and 
>customers would be must less at risk.

If you want a firewall, you're really much better off with a
real packet-filtering firewall that provides some means for
policy expression (rules).
-- 
     Melinda Shore - Software longa, hardware brevis - shore@panix.com

            Bad taste is better than no taste -- Arnold Bennett