<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Mar 24, 2010, at 1:03 PM, William Herrin wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>On Wed, Mar 24, 2010 at 12:41 PM, Michael K. Smith - Adhost<br><<a href="mailto:mksmith@adhost.com">mksmith@adhost.com</a>> wrote:<br><blockquote type="cite">I'm not sure I understand how NAT fixes this any more than properly<br></blockquote><blockquote type="cite">applied firewall rules would.<br></blockquote><br>Hi Michael,<br><br>Properly applied firewall rules secure a system regardless of the<br>methodology. Dwelling on that misunderstands the nature of security.<br>Strength of security lies in depth: people being people, mistakes will<br>be made. In the config. In the code. Everywhere. What happens then?<br><br></div></blockquote>Agreed.</div><div><br><blockquote type="cite"><div>A firewall is a door with a lock. Unlock the door, forget to re-lock<br>it and you're done.<br><br></div></blockquote>Sort of.</div><div><br><blockquote type="cite"><div>A NAT firewall is a door with a pneumatic closer, a prox card reader<br>and a pin code. This latter is less vulnerable to attack: stealing or<br>duplicating the prox card is as hard or harder than picking a lock and<br>even once you have the card, you still need the matching pin code for<br>entry.<br><br></div></blockquote>No. A NAT firewall is a door with a lock and a deadbolt at best unless</div><div>rules must be expressed in terms of entry/exit zone in addition to source/destination</div><div>address. In the case where rules must be expressed in both therms, then:</div><div><br></div><div>A firewall is a door with a lock and a deadbolt.</div><div>A NAT firewall of this type is a door with a lock, a deadbolt, and a prox-card reader</div><div>capable of unlocking both the lock and deadbolt (NAT).</div><div><br></div><div><blockquote type="cite"><div>Either way you're screwed when an authorized entrant politely holds<br>the door, but that remaining vulnerability doesn't diminish the<br>difference in security between the two.<br><br></div></blockquote>Yep.</div><div><blockquote type="cite"><div><font class="Apple-style-span" color="#000000"><br></font></div><div><font class="Apple-style-span" color="#000000"><br></font>And I will suggest that for any given firewall configuration, the<br>otherwise-identical configuration that also does NAT has implemented<br>stronger security.<br><br></div></blockquote>Nope... I provided an example earlier where NAT actually reduced security.</div><div><br></div><div>Owen</div><div><br></div></body></html>