Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #247884

Re: Networking book recommendation

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Wed, May 04, 2022 at 04:27:52AM +0800, Jeremy Ardley wrote:

[...]

> [...] NAT in itself
> provides quite good security because internal hosts can't be scanned by
> attackers.

Uh, oh. I think general opinion these days disagree with this
statement strongly (see e.g. [1], but this has been rough
consensus since at least the 2000s).

That said, even "normal" hands-off firewalls don't help against
the most widespread threats of these days: malicious actors that
are located inside your network: be it some random javascript
running in your browser, a printer phoning home or your so-called
smart TV.

All of those will connect to outside things from the inside, and
a no-trouble hands-off firewall is configured to allow just that.

The known attacks against NAT dwindle given the above-mentioned
cornucopia :-)

Don't get me started on things like UPMP's NAT-PMP [2] which are
explicitily designed for clients to punch holes into the firewall.

Cheers

[1] https://security.stackexchange.com/questions/8772/how-important-is-nat-as-a-security-layer
[2] https://en.wikipedia.org/wiki/NAT_Port_Mapping_Protocol
-- 
t

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Networking book recommendation Tom Browder <tom.browder@gmail.com> - 2022-05-03 21:50 +0200
  Re: Networking book recommendation john doe <johndoe65534@mail.com> - 2022-05-03 22:20 +0200
    Re: Networking book recommendation Jeremy Ardley <jeremy@ardley.org> - 2022-05-03 22:30 +0200
      Re: Networking book recommendation <tomas@tuxteam.de> - 2022-05-04 07:00 +0200
        Re: Networking book recommendation Jeremy Ardley <jeremy@ardley.org> - 2022-05-04 08:00 +0200
    Re: Networking book recommendation Tom Browder <tom.browder@gmail.com> - 2022-05-03 22:40 +0200
      Re: Networking book recommendation Dan Ritter <dsr@randomstring.org> - 2022-05-03 23:10 +0200
      Re: Networking book recommendation john doe <johndoe65534@mail.com> - 2022-05-04 18:10 +0200
        Re: Networking book recommendation Tom Browder <tom.browder@gmail.com> - 2022-05-05 16:40 +0200
          Re: Networking book recommendation john doe <johndoe65534@mail.com> - 2022-05-05 21:40 +0200
            Re: Networking book recommendation David Christensen <dpchrist@holgerdanske.com> - 2022-05-05 23:10 +0200
              Re: Networking book recommendation Tom Browder <tom.browder@gmail.com> - 2022-05-06 00:40 +0200
                Re: Networking book recommendation Celejar <celejar@gmail.com> - 2022-05-06 03:50 +0200
                Re: Networking book recommendation Dan Ritter <dsr@randomstring.org> - 2022-05-06 04:00 +0200
                Re: Networking book recommendation john doe <johndoe65534@mail.com> - 2022-05-06 09:00 +0200
          Re: Networking book recommendation David Christensen <dpchrist@holgerdanske.com> - 2022-05-05 22:50 +0200
  Re: Networking book recommendation Charles Curley <charlescurley@charlescurley.com> - 2022-05-03 22:40 +0200
    Re: Networking book recommendation Tixy <tixy@yxit.co.uk> - 2022-05-03 23:00 +0200
  Re: Networking book recommendation Dan Ritter <dsr@randomstring.org> - 2022-05-03 23:00 +0200
  Re: Networking book recommendation Tom Browder <tom.browder@gmail.com> - 2022-05-03 23:20 +0200
    Re: Networking book recommendation Greg Wooledge <greg@wooledge.org> - 2022-05-03 23:30 +0200
      Re: Networking book recommendation Tom Browder <tom.browder@gmail.com> - 2022-05-03 23:40 +0200
    Re: Networking book recommendation Bob Weber <bobrweber@gmail.com> - 2022-05-04 00:30 +0200
      Re: Networking book recommendation Tom Browder <tom.browder@gmail.com> - 2022-05-04 01:40 +0200
  Re: Networking book recommendation David Christensen <dpchrist@holgerdanske.com> - 2022-05-04 01:50 +0200
  Re: Networking book recommendation "Rick Thomas" <rick.thomas@pobox.com> - 2022-05-07 10:00 +0200

csiph-web