Re: [OPSEC] [v6ops] 3 Volunteers wanted - Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Warren Kumari writes:
> 
> On Aug 14, 2012, at 2:58 PM, Lee Howard wrote:
> 
> > 
> 
> > 
> 
> > From: [e-mail] [mailto:[e-mail]] On Behalf Of
>  Eric Vyncke (evyncke)
> > Sent: Tuesday, August 14, 2012 4:43 AM
> > To: Gunter Van de Velde (gvandeve); [e-mail]; v6ops v6ops WG (v6ops
> @ietf.org)
> > Cc: Fernando Gont
> > Subject: Re: [v6ops] [OPSEC] 3 Volunteers wanted - Draft: draft-gont-opse
> c-ipv6-implications-on-ipv4-nets
> > 
> 
> > -       1.0 please avoid all discussion about NAPT being =91minimal/simpl
> e=92 security, the days of scanning are over and have been replaced by malw
> are download/email propagated
> 
> > This is demonstrably false, and I can send you logs of scanning attempts
> foiled by NAPT.  NAT is crap security, but it=92s not zero security.
> 
> Heretic!
> 
> Actually, I'd go so far as to drop the "crap" from the above -- while it is
> n't "real" security (whatever that means) it has become cool to simply beat
>  on the NAT.
> 
> 
> Yes, it's not awesome, but it *does* help prevent the secretary's desktop f
> rom getting owned quite as often. Yes, he should have it patched, yes it sh
> ould be capable of protecting itself, yes, there should be a "real" securit
> y widget in front of it, but, well=85
> 
> 
> W

But the problem is that people think they need "NAT" as opposed to
a "stateful firewall with default allow out all, block in all".
NAPT effectively establishes the latter + munges with addresses and
ports.  It's the state table not the address/port translation that
stops scans.

Stateless NAT44 or NAT66 doesn't stop scans.

As for the secretary's desktop how many of them would be owned
if LSR was being used to scan 192.168/16 though the NAT box?

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]