Slashdot Mirror
End Of the Line for SpeakFreely: NATed to Death
Arun writes "John Walker (of AutoDesk and Fourmilab fame), primary author of SpeakFreely, has decided to EOL the program (a pioneering network telephony effort), come January 15th, 2004. He cites difficulty in maintaining a decade-old code base, lack of appropriate developer support and a fundamental change in the peer-to-peer nature of the Internet upon which SF is dependent as motivating factors behind his decision. While the last release of the program will continue to be available from SourceForge, the main web site, mailing list, and web forum will be shut down on the aforementioned date." He's got some good points too, like how once IPv6 is more common, most users probably won't go back to one address per machine. I know I enjoy the added security of a NATed firewall, and without a really good reason, I won't be quick to give it up.
You can have a good and secure firewall even without NAT, in case you didn't know..
Why did I discover this cool application in a discontinuation announcement?
I wish I had discovered it earlier.
Oh well, I can only hope that I can repent this mistake in my next life.
Can you hear me now? Hello? Hello?
Of course, I'm sure there are some technical issues here that are currently beyond my understanding...
They say the first thing to go is your penis. Well, it's either that or your brain. I forget which...
I used this software several years ago. While it does exactly what it does, the biggest problem was the sever lack of an installed base. Once Yahoo started integrating voice chat into their IM client, I really had no use for it. Its unfortunate though, since I always felt the sound quality was inferior on Yahoo (and the others that have since come along), but I'd imagine that was due to those clients compressing more to save bandwidth.
Children in the backseats don't cause accidents. Accidents in the back seats cause children.
As we all know, proper network security is vital to keep our systems from being used by terrorists
SF is a great program. It's not graphical bloatware, it supports many compressions, it's somewhat modular ... I've spent countless hours getting a stable 2-way voice comm over a 33.6 dialup link, back in the days, and it actually worked at some point (the rest of the time it didn't, which prompted me to change from AOL to an Internet provider. Thanks SpeakFreely!)
:)
When I discovered I could have a voice converstaions with anybody in the world, I was so excited I picked up my phone to tell my friend in Canada
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
NAT is about address use, not security. In no way should NAT ever be confused with security, even if it appears to give you some security.
Every single security feature you like about NAT can also be had without NAT.
The common things people think they get with nat:
- Connections that must initiate from inside the network.
This is easily achieved with a normal firewall and routable addresses as well.
- My addresses aren't routable, so I'm more secure.
No, your addresses are perfectly routable, just the internet at large does not route them by agreement. Your ISP could easily configure it's routers to get traffic in to your network on those addresses.
- It hides the real addresses of my machines.
Not really... or more accurately, to an outside attacker, those addresses dont mean anyhting anyway. Whether they are known or not is not relevant. A firewall in front of a network of routable addresses could hide things equally well.
NAT by itslef does not reduce exposure. The best example of this would be those who configure nat in a hurry on linux 2.4 systems..... they set up an SNAT or masquerade rule in postrouting, and that's it.
That's nat, full, 100% working nat.
With absolutely no security.
The ISP could route to their internal network, no problem, making connections to whatever they want.
This is easily fixed by a few rules.. but then you are into firewalling, and not NAT at all.
192.168.0.5/16!
No...
172.18.1.3/12!
No, please, stop
10.255.255.255/8!
AAAAAHHAHAHRRRGGNO CARRIER
Fuck Beta. Fuck Dice
I haven't seen this on /. yet maybe I just missed it
http://skype.com/
very cool p2p voice over IP
http://Lenny.com
I tried contacting 192.168.0.1 and I keep getting larsen. Disappointing really ...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Just as a point of observation wrt NAT for security, I would like to note that NAT is wonderful at making your system incapable of acting as a publicaly accessible network server, but does nothing for a large percentage of the viruses and worms that exist on the internet at this time.
In fact it can be a serious problem as a significant percentage of the people with NAT on their Broadband gateway are doing little or nothing to improve their desktop security. Why be worried when the gateway will block NAT traffic for me?
I am probably preaching to the choir, but as a simple example of the flaw, you probably still get, and read e-mail, even behind your NAT firewall. If someone sends you an infected file as an attachment, (that you happen to execute, automatically or deliberately) that happens to be an IRC-Bot that will turn your workstation into a rdos center, your NAT box is unlikely to do anything to protect your PC. In fact now that the bug is running on your system, it has the potential to check for other systems in your home network that are vulnerable to various exploits that you haven't patched for, because you are "safe behind my nat firewall".
Suddenly you have multiple boxen in your network that are all accessing the internet without your awareness, and downloading whatever the bug writers have decided to have them download. It's not even remotely improbable that your NAT secured network may become a spaming source without you knowing about it.
NAT as a security tool is the network equivalent of Security through Obscurity, and is just as flawed.
-Rusty
You never know...
But isn't the problem really the lack of static port mapping, not NAT? (If you don't understand this question, please skip to the next.) Correct, but experience has shown that a large number of installed NAT boxes either cannot map an externally accessible port to an internal IP address and port, or those who install the boxes do not provide their customers adequate information to permit them to do this. Given the trend, discussed in the last question, toward confining individual Internet users to a consumer role, I believe fewer and fewer users will have the ability to statically map ports as time goes on.
I call BULLSHIT. Each and every firewall/nat box I have worked with supports reverse port mapping, DMZ, or uPnP. It sounds like he is having trouble adapting to the changing technology.
Feed the need: Digitaladdiction.net
What makes you think that NAT implies one address for many machines? Even if you want the extra security provided by NAT, if you have many addresses available, you can translate one routable address per internal machine. I certainly look forward to IPv6 for this reason, but I'm not holding my breath :-)
.sig: file not found
Here in the netherlands at least, both the major broadband providers (UPC adn KPN)give all customers a generically routable IP.
Customers using a cable modem or dsl modem get a live wild-side IP and a unique hostname such as:
node139a2z.xs4all.nl
by which they're already DNS addresable.
Most commodity OS's and even the cheap (horrific!) home-router products I've seen have port forwarding capablity,so there's really no such problem as he describes here.
Does anyone have different experience elsewhere?
The States, for instance? I'd like to hear.
Liam.
Yes, but where's berra?
The IETF midcom group has been working on solutions for passing media streams through NATs and other middleboxes for a few years now. One protocol, STUN, is already a standards-track RFC, and the group has other tools in progress. These tools work with the IETF multimedia suite (SDP, SIP, RTP, etc).
First off, let me say I have no idea what Speak Freely is. My comments are solely in response to some of the reasons he gives for discontinuing the program.
Had his reasoning behind discontinuing the project rested solely on his lack of time and an aging code base, I don't think I'd have an issue. Instead, he goes on to blame the NAT protocol and boxes that implement it, like the very popular cable/DSL "routers," and many of his issues seem to either misunderstand them or deliberately misstate what they can do.
He makes comments like, "Since the user no longer has an externally visible Internet Protocol (IP) address (fixed or variable), there is no way (in the general case--there may be "workarounds" for specific NAT boxes, but they're basically exploiting bugs which will probably eventually be fixed) for sites to open connections or address packets to his machine." He continues to state, "experience has shown that a large number of installed NAT boxes either cannot map an externally accessible port to an internal IP address and port, or those who install the boxes do not provide their customers adequate information to permit them to do this."
First of all, I have yet to see a NAT device that cannot statically map ports to a machine inside the local area connection. If there is one, I'd love to know about it so I can tell anyone to avoid it. Some are more rudimentary than others - like one I know about that has no UI to distinguish TCP and UDP inbound ports - but they all offer some way of mapping inbound ports.
His argument that they don't provide sufficient documentation to allow end-users to do so, and this may be the case. But if one is to discontinue development of a program based on the fact that someone else is providing poor documentation, there wouldn't be any development going on - documentation for most hardware/software products in the last 3 years or more have been horrid in my experience.
His argument that the internet is moving towards a client-server model rather than a peer to peer model is undeniable. It's been moving that way since they allowed home computers on the internet, and shouldn't be a surprise to anyone. Still, this doesn't mean the "clients" can't continue to utilize products that utilize a peer to peer architecture. He dismisses peer to peer file sharing products while overlooking the fact that they're the most successful peer to peer architecture network to exist in the history of the internet, and disproves his argument that NAT spells the end of peer to peer.
In the end, it seems he just didn't want to continue developing his program - and instead of being honest, he thought he'd use this opportunity to climb on his soapbox and make some waves by blaming NAT for the ills of the internet and the death of his program.
FYI NAT is 80% of a firewall, the other 20% is port and protocol filtering.
There is something I don't understand in his announcement: he says it's not feasable to set up a server that acts as a third party to set-up connections between NATed hosts because it would require too much bandwith.
But wouldn't it be possible to build a server that is used just to setup the connection and send the subsequent data directly between the initial hosts, therbey nopt using the server's bandwidth?
David
Call in WIPO, we're gonna have a TacoNATting party!
NAT with direct connectivity... when you need it: NATural IP
Sometimes firewalls don't work
What we see here is the death of all applications and protocols which fail to work with dynamic addressing.
Static addresses are a extremely dangerous threat from security and privacy points of view. Furthermore they make the network non-dynamic and less immersive. People recognized this even in the infancy of the internet, that's why there are static-to-dynamic readdressing scheme like e.g. DNS.
All apps/protocols which don't cooperate with the dynamic addressing paradigm are bound to die in the near future. This might even affect services with only semi-dynamic support.
And that's the real reason why speak freely won't come back to life when ip6 is installed. Not because of an evil, dark ISP conspiracy which wants to enslave customers. But because the dynamics addressing paradigm will still rule the internet and thus speak freely won't work.
Owner of a Mensa membership card.
I'm referring to the average home user here.
By full nat, no security, I mean this:
After the configuration I mentioned, the user will be able to use multiple computers behind his NAT box, and they will all be able to surf the net using his one public IP address. So, as far as nat goes, it's doing it's job.
By "no security" i mean that, let's say his internal interface is 192.168.1.1/24.... if his nat box receives a packet on the outside interface destined for, say, 192.168.1.3, it will route it to the appropriate box. (The response may be obscured by the nat rules.. depending). An outsider now has complete access, more or less, to the network.
To be more secure, you also need to block all connections not originating inside the network... typically by
- Deny forwarding by default
- Permit forwarding of established connections
- Only allow connections to be established from inside the network.
But.. that's not NAT.. that's just general firewall security stuff...
All I'm trying to say is that nat and security are two independent things, that only look similar at first.. you can have either one without the other.
Maybe NAT isn't the best means of securing a network but if it stops one person from getting in then it is providing security. NAT by itslef does not reduce exposure. The best example of this would be those who configure nat in a hurry on linux 2.4 systems. No, that sounds like the worst example. Faulting the whole of NAT for its weakest implementation seems like a straw man fallacy. A weak door is still a security measure. Not as secure as a stronger door by definition. But it does keep out the passing strangers who might be tempted to enter if I left it open.
In a world where virtually every NAT appliance will allow portmapping to an inside address, the only reason why consumers are losing control of the Internet is because-- thanks to their sluggish complacency-- they're making that choice as default by inaction. It takes the brains of a snail and about 5 minutes looking at documentation or ubiquitous and thoughtfully provided online help from the appliance itself to figure out portmapping. As long as most people voluntarily emulate mental midgets, projects like SF are doomed.
This is your fault. How does that make you feel?
The way IPV6 is designed, it will be easier for the ISP to just assign you real address space to all your computers. By "easier", I mean "easier than doing NAT"
IT's not all a scam... the reason ip addresses cost money now, and nat is so common, isn't really becuase ISPs are greedy.. its' because at some point, the technical guys said "Look we don't have enough space for everyone, and it's a pain to manage" so they give out one address per connection... and at some point , after it was determined addresses were sort of scarce, the ISP figures "If there is demand, we can always sell it"
IPV6 will make things easier.. fosho
Why do people just love NAT ?
Is it a "superiority complex" thing ?
"Ha ha ha, I'm better than the hackers, my addresses are hidden".
or
"Hee hee, my ISP doesn't realise I'm connecting more than one PC" BONK. Yes they do.
Its a pitty these NATters don't realise
Its just breaking the Internet, killing off useful peer to peer applications like speakeasy.
Do people like screwing around with their NAT box configuration everytime they add a new P2P application ? (dumb question on slashdot I suppose).
For those that think it is wonderful, spend some time reading and understanding this RFC
RFC 2993 - Architectural Implications of NATUntil that point, you don't have an informed opinion about NAT, so you shouldn't express it.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
I'll be in the paddock drinking shitty whiskey and winning superfectas.
The best part about NAT is that I can hook up a freshly reinstalled Windows computer to it with no firewalls like Zonealarm on it, it picks up an IP and is hooked up to the internet immediately. And I don't have to worry about it instantly getting 0wn3d by MSBlaster, etc. Giving me plenty of time to download service packs, patches, drivers, software, etc. I suppose it can be done with another computer and CD-Rs, but this way is so much easier.
Also, I can have file shares open between different computers on the NATed (natted? NATted?) network, allowing for easy sharing of files. If each computer was hooked directly to the internet there would be no way I'd have ports 135-139 open for Windows file shares!
TEN WIN ON THE NINE HORSE!!!!
i just had a neat idea what if you combined the function of the speak freely relay server, to get around the NAT issue, with bit torrent, to get around the bandwidth issue.
Saying "NAT as a security tool is the network equivalent of Security through Obscurity, and is just as flawed" is like saying that a key is not a security tool in a house with windows, since I can break the windows to get in.
NAT makes an attack on the inside of the network substantial more difficult. It doesn't prevent an attack through email, but it's only one part of a proper consumer security toolkit, which should include some form of antivirus software as well. It does prevent MSBlaster, and not just through obscurity, but because it's physically impossible to attack the vulnerability.
In addition, a system on a network with NAT can indeed act as a server. It just requires the user to be aware that he/she is setting one up.
Each and every firewall/nat box I have worked with supports reverse port mapping, DMZ, or uPnP.
This doesn't help when your ISP doesn't provide an affordable Internet access plan that forwards incoming connections to your network. Switching ISPs is not generally an affordable option either unless you're willing to take a 25-fold reduction in download throughput.
Will I retire or break 10K?
He is completely correct, you are completely incorrect.
RFC 2993 - Architectural Implications of NATThe Internet's nature is peer to peer - 20050301_cs_profs.pdf
What you are describing is typical of hardware NAT firewalls like linksys, dlink, etc, ,or most PROPERLY configured firewall/NAT gateways...
But in the example I gave, there is no filtering enabled on incoming/outgoing connections.. the only thing being done (other than routing) is NAT...
and NAT has nothing to do with blocking connections... which was the original point.
If you take a linux box, turn on forwarding, and set up SNAT (or masquerade) in prerouting.. you have EVERYTHING you need to share one internet IP address among many computers using a private local network..... and NOTHING you need to enforce any kind of security.
So, yes, I agree that if you control your nat router, you can set it up so that the ISP cannot initiate inbound TCP.... but that is not related to NAT.
You THINK it's related to NAT, because you always see the two set up together.. but they are not related.
if you have many addresses available
One major reason that many-to-one NAT is so common is that most single-family residential Internet access customers don't "have many addresses available."
Will I retire or break 10K?
This guy is making it sound like the internet is somehow changed for the worse simply because changing times have made his old software irrelevant.
The net is still free, you can still talk to whoever you want to talk to. No need for Chicken Little here. Heard of blogs? ICQ? Instant messaging? IRC?
Next thing you know he'll be complaining that the net is no longer free since no one uses gopher or AOL's TurboBrowser (from version 2.6) or Hotline anymore.
Mac OS X and Windows XP working side by side to fight back the night.
RFC 2993 - Architectural Implications of NAT
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
I'm not faulting NAT whatsoever, NAT is good, NAT is great..
but NAT is not security.
Perhaps my point is too subtle... let me try to put it another way.
All the security features you think you get by using NAT are actually not related to NAT at all.. they just happen to be configured along side it, and nobody ever really thinks about it. All of them are available, and work equally well, without NAT in the picture. NAT works equally well without any security features.
My point is not that "NAT devices are insecure" or that NAT is evil.. but that implying that NAT == sequrity in any way, shape, or fashion, is wrong.
From http://www.nanog.org/mtg-0306/pdf/doyle.ppt (search google for above URL for conversion to HTML):
NAT Causes Problems
- Breaks globally unique address model
- Breaks address stability
- Breaks always-on model
- Breaks peer-to-peer model
- Breaks some applications
- Breaks some security protocols
- Breaks some QoS functions
- Introduces a false sense of security
- Introduces hidden costs
--- IPv6 = plentiful, global addresses = no NAT
NAT is one of the ugliest and most widespread Nasty Hacks in the history if the Interweb.
"Hee hee, my ISP doesn't realise I'm connecting more than one PC" BONK. Yes they do.
If you use packet mangling on the ttl of outgoing
packets on the gateway and set them *all* to 255, it's actually pretty hard for them to tell...
-L.
There's no added security to NAT. A nat box that blocks incoming connections is no more secure than a router that blocks incoming connections.
Ipchains used to let udp packets addressed to your internal net pass through untouched. All a hacker need do is guess your internal address space (all signs point to 192.168.0.*) and he could bombard your innards with all kinds of silly shit. And most exploits are emailed/downloaded trojans, not viruses in the old sense.
What NAT is, is convenient. I have my router box equipped with NAT and DHCP. I can bring home a laptop or plug something in, and presto! I'm online. No calling ISP and asking for another IP, no hoops to jump through.
I could pay for extra IPs from my ISP, but why? I dont serve anything from home, and neither do most home and small business users - thats what colos are for.
NAT is just way too convienient and sensible. It's like just plugging a phone into an extension, vs running it's own line.
And it works 99.9% of the time for me. Transparent proxies (ya mofo i violate RFCs by even transparently proxying http, i'm fucking crazy man, crazy!!) fill the gap for the 0.999%, leaving 0.001% of stuff a pain in the ass, and I can avoid that pain in the ass stuff since it's all warez clients, err p2p applications.
So, I don't mourn the loss of SpeakFree. Open source needs to be able to adapt to survive, too. NAT is here to stay.
I don't need no instructions to know how to rock!!!!
Isn't GnomeMeeting do the same thing and more? I think it supports NAT too.
He should have Googled before giving up
An interconnected system of networks that connects computers around the world via the TCP/IP protocol..
This means that the Internet is made up of networks which may themselves may be made up of networks, etc. These networks use a common protocol. Most would say that not every device on the network, or even every sub network on the network has to be connected to the Internet. It is quite arguable that there are benefits, both personal and for the commons, to not have every device connected to the Internet.
What is for sure is that for the Internet to run, everyone who uses it must contribute to it's well being. There has to be enough devices connected directly to the Intent to process and forward all the packets in an efficient and timely manner. I personally pay a number of services that manage such activity on my behalf. My personal machines, which are not in the primary bussiness of routing packets, are behind a NAT, which is.
Being behind a NAT allows me to manage my network with less effect on the rest of the community. There are still many security issues, and i can still flood others if I get infected, but it is a first step. I would argue that assuming every computer on every network to be directly addressable from every other computer on the every other network might not be the best design decision. It certainly fits in well with the TelCo desire to sell at least one IP per device, as they tried to do in the past with telephones, but other than that I do not see the benifit.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
I am in no way trolling.
I am also in no way implying that "NAT is bad" or "NAT devices are insecure".
The article was about NAT... and NAT is not in any way related to firewalling, other than by conveniently often being handled by the same device. So a mention that "Nat won't go away becaues I like the security of being behind my natted firewall" is totally inaccurate. Yes, I got the firewall part.. but what's NAT got to do with that? Nothing, it doesn't need to be there.
Can I name any appliances that don't do firewalling as well as NAT? Not offhand, nope.. though I can mention a few configurations of cisco routers or linux boxes that can easily accomplish NAT with no firewalling (and have used both with good reason)
I understand the concepts quite well, thanks.
A single snat rule works one way... yes, correct.
So, what happens when I send, let's say, a ping... to your IP address (192.168.1.3) behind your little linux NAT box that ONLY has an SNAT rule, and no other filtering enabled. It has forwarding enabled, and SNAT.. it's a pure NAT box.
Let's pretend for a moment I have a buddy at the ISP, and I've had them add a route to your location for that network... so routing isn't an issue.
Do you think your nat box is going to reject the packet I'm sending? It's not.. it's going to forward it right to your workstation.. it has the proper address.. and there are no rules in place to prevent it.
If it DOES reject it, in a typical linux nat/firewall setup, it is because of a rule on the FORWARD table, usually set to not allow things to initiate from outside.. but then, that has nothign to do with nat, does it....
Will the SNAT rule cause issues with the return packets? Yes... but the fact is, I just routed traffic to your machine.. and that's all it takes to send several of the latest worms.. a single UDP datagram.
Nobody is saying there is one true firewall, or one true way to set it up. in fact I'm not saying anything at all about wha you SHOULD do for security.. only that the feature we call NAT is not a security feature, but a convenience one. All the cool pocket firewalls we have will be just as useful with IPV6 WITHOUT NAT... the ONLY purpose of NAT is to translate addresses.. and all the other percieved security features of NAT are actually firewalling features that could equally be had without NAT.
Actualy NAT does little to nothing to reduce the IP space needed on most modern installations where most computers are participating on the internet. NAT just remapes IP's on a 1 to 1 basis. Just like it's name nates Network Address Translation.
PAT reduced used IP addresses by mapping ports rather than IP's.
NAT especialy is no substitute of good security as incomming connections are allowed by default. This method breaks less protcals than PAT.
Now as far as NAT beign a good or bad thing I'm all for NAT and PAT. IPv6 fixes the perceived address space issue (there isn't an address space issue there is an address cost issue IMHO) While fixing space issues it makes address near imposible to remember and not everything participates in DNS nor should it. It also required multicast to work thats an administrative nightmare along with a plethera of secuirty and billing issues. Think of Bittorrent when a single DSL user can send 128 kb a sec out to every peer of there ISP on a statement ISP thats a lot of traffic. IPv6 also does not address routing table complexity and thus memory requirements.
Now your 50 buck a pop little DSL AP generaly has the settings correct by default with an easy way to make a DMZ host thats entirly unprotected.
Ipv6 may be the furture but if we realy want to make things work better look at replacing BGPv4 while your at it. Something that allows link redundancy along with carrier redundancy while perserving state is needed. You should be able to have a cable modem and a DSL line and combine the bandwith. Right now you have to do that through NAT and proxies and it works well for outgoing sessions allthough it's failover is stateless so a single line going down drops a portion of your connections.
No sir I dont like it.
Wierd, I keep getting sitefinder...
Rocket science is easy. Neurosurgery, now *that's* difficult.
Ok, so what is left for us to use for this?
---- Booth was a patriot ----
You mean somebody else saw through the veiled hatred of NAT in that RFC?
Lets look at the issues of NAT (PAT in cisco parlience as NAT is entrily different) as compared to a normal statefull non inspecting firewall with no administrative restrictions they each:
Dissallow incomming IP sessions unless specified.
Function as a single point of failure.
Require a singe point of state.
Persoanly I think EVERYTHING should be firewalled but that dosent fit with the academic modle. Now those three big ugly issues the only thing that NAT adds on is address and possibly port tranlation gee thats what it's supposed to do. The state and sinle point issues can be and are fixed by more advanced firewalls and NAT boxes that cross communicate.
No sir I dont like it.
..at least with Sonera ADSL and cable. They give you five IP addresses for no extra cost.
Escher was the first MC and Giger invented the HR department.
"No, your addresses are perfectly routable, just the internet at large does not route them by agreement. Your ISP could easily configure it's routers to get traffic in to your network on those addresses."
:)
Of course the ISP gets traffic in to your network even with NAT but that's how you get to surf the web.
"That's nat, full, 100% working nat.
With absolutely no security."
Seriously tho, while your ISP can easily subvert data and existing connections (and so can Verisign etc), it is nontrivial for your ISP to make new inbound connections into your network through a NAT device.
If you know how typical NATs work, it isn't that easy. (BTW Cisco calls them PATs because Cisco used to have inferior NAT solutions that didn't support IP sharing or overloading as they called it).
In the simplest case that supports multiple NAT'ed hosts, a NAT device builds a table based on outbound packets: src address, src port, dest address, dest port -> new src address, new src port, dest address, dest port.
You need a new source port because two source hosts could use the same source port.
Reply packets that match are then translated back.
Packets that don't match can't go through the device because the device just doesn't know where they should go.
Unless the device is terribly buggy you should be reasonably safe from inbound connections.
In fact with NAT, in order to allow inbound connections you need to add more code.
So with NAT having inbound connections is harder, and that is a good thing.
Coz there are some tricks you can play with IP fragments, where you get a fragment to overlap the original header on a vulnerable operating system. But if you have a reasonably recent O/S this shouldn't work anymore even on Windows.
Simple example of how it works, an inbound packet fragment goes through a firewall with an legit destination address and port and is stored in a packet buffer on the destination host. Subsequent fragments are sent and allowed through by the firewall and they overwrite/overlap the original destination port on the packet buffer, so the destination host actually ends up with a packet that connects to a service that should have been blocked by the firewall.
If you don't allow inbound connections and only allow outbound, such subversion is a lot harder, someone needs to be able to see your outbound packets as they head towards to the real destination, in order to construct suitable "inbound" packets and fragments.
And that's the point.
The original posting mentioned that nat would be around because he "Liked being behind his NAT firewall"... my point was only that NAT has nothing to do with it... and that what he really likes is the firewalling, not the nat.
I'm not trying to bash NAT products, or say NAT is bad.. just that.. we are talking about whether or not we will be using NAT so much in the future, and a LOT of people are thinking and saying "YES, because it's secure" which is wrong.
In the future, I bet we will still have little SOHO firewalls.. but we won't be using the NAT feature.
Web != Net. There are other protocols out there than HTTP, ya know.
Ah, ok I get what the original poster means.
If the NAT device also behaves as a normal router then without any firewall rules it could forward packets destined for the internal network.
OK my error.
It astonishes me how people believe that they derive security from NAT. It's like saying blind folks are fortunate because they don't have to see ugly things.
It is trivial to achieve the same level of security in a firewall as you get with NAT. IPv6 will need firewalls just like IPv4 does. The difference, however, is that if you *want* to allow a certain type of communication to more than one hosts behind the firewall, you don't have to do a bunch of tortured port mapping nonsense (which often isn't good enough).
NAT breaks the Internet. If you like NAT, you should be using AOL instead.
you have an agenda. You have an intellectual agenda. I know it's routable but currently not by agreement.
...hard to do isn't it?
But you forgot the current result is that it's not routable.
ok...someone try to reach my 10.10.10.3 machine
Asterisk uses the IAX protocol which goes through NATs without problems. That might be the way to go.
Also, you can check the configuration of netfilter in your Linux kernel, or even the netfilter source code: less than 20% will be about NAT.
So, where did you get your knowledge about "80% of a firewall is NAT?"
Less is more !
Fundamentally, you are 100% correct. NAT provides no security that simple filtering can't do better.
However, practical security is about more than fundamentals. It is about what happens when you screw up.
I have a gateway with filtering. If I mess up a config, my gateway might come up without the iptables rules, and I might not notice for ages.
However, all the workstations I use are NATted, (All things being equal I would prefer that they weren't, but the charges from my ISP would be far from equal), and if the NAT is accidentally deactivated, I'll notice pretty damn quick because nothing will work.
Yes, you could say "If you screw up your config that's your own fault, you're incompetent", but a large proportion of real-world security breaches are caused by administrator errors, and a security system that is more resistant to errors is "more secure" by reasonable definitions.
Having said all that, your point about the ISP being able to route directly to your internal IPs is a good one. Luckily (because I hadn't really thought about it), my iptables setup will reject any such packets.
So I don't see NAT dominating the Internet. I assume most people will just use a PC with two ethernet cards rather than dedicated routers and use that PC for stuff that requires incoming connections.
I suspect the author is just bitter that his stuff is not popular anymore. Even if it's possible to talk peer-to-peer, instant messangers with hosted servers are more convinient to use.
Well, its a free world, but he should have asked if anyone wants to take over the project and then forward the links to that person.
Can you explain how with your simplified linux boxen SNAT a packet could make it's way to an internal computer and initiate a responce. What I don't see is why the linux box would rename the address of an inbound packet to the local address of an internal computer if the internal computer did not initiate anything. So a packet is addressed to a certain port to the external ip x. I don't see why the linux box would change the address ip to 192.168.a.b and even if it had a reason how would the outside attacker specify 192.168.a.b from 192.168.a.c. Sure the attacker could compromise the linux box itself and once compromised attempt to compromise an internal computer. But this is more secure than if the attacker didn't have to compromise the linux box itself. Sure this might be equivilant to a screen door with a lock on it but that is not the same as offering no security.
I have used SF for ~ 8 yrs and over a slow connection, no other program came close especially with the new CELP compression protocol.
o ip /2003/09/04.html#a174
l
Can some one explain how the new H.350 standard by the ITU (International Telecommunication Union) will influence programs like SpeakFreely.
http://www.itu.int/osg/spu/newslog/categories/v
http://www.nwfusion.com/news/2003/0903ipvid.htm
Thanks
The amount of available free software is overwhelming. I used to be able to scavenge most of those cool things that become news, before they became news [ :-) ]. Not anymore.
Now, even Freshmeat is too fast for me. I pity those corporate fellows with month long cycles of product evaluation. They don't have a chance.
We are coming to a regrettable state in which the "brand", the "griffe" -- be it Gnome or KDE -- starts to influence how much an application is known. While I don't argue that is important, this should not come in the way of a potential killer app.
But what is the solution? I don't know. Maybe more people creating entries at dmoz/Google directories...
What NAT is, is convenient.
I have to disagree with this point. I find it rather inconvenient.
Consider my IPv6 network. I get all of the benefits you describe (plugging in a new machine and having it magically appear on the network), except it does so with real, routable addresses.
-- The world is watching America, and America is watching TV.
It's sad, but I agree with John Walker's analysis. The Internet is slowly turning into another channel of your TV set. And since 99.9% of the population doesn't care, I don't see anything changing this trend. Unfortunately, this will make true peer-to-peer services very difficult.
And he's right about powerful forces at work here. The government, major content providers, and software vendors want you to be a consumer. As long as there is a clear separation between client and services, it makes it easier to control. If they don't like something, they just shut down the central service, and it's gone. That's much more difficult in a true peer-to-peer environment.
Sure, NATs screw up P2P applications. But you don't see the media monopolies demanding that everybody install one. No, they want all the content to be "managed" and to make it illegal for anybody to get around the management. A lawyer-and-technomagic solution. Which is itself pretty naive. Won't work in the long run, but extremely dangerous to society in the short run. Which is something we need to deal with -- and inventing new conspiracies to blame (admitedly evil) people for doesn't help.
So what drives the use of private networks? Hackers (I refuse to call them Farmers From Georgia), Script Kiddies, and Spammers. They want to break into your system and do silly things with it. A NAT is the simplest, least headache inducing protection against these folks. Yeah, you can always use a firewall. But firewalls are a pain to deal with -- you're constantly trying to solve the tourist-or-terrorist problem, and usually getting it wrong. I'd rather use a NAT and do without the P2P software.
As would most users. All these strange and arcane P2P applications are insteresting, but very few people can be bothered with them. For the same reason Ham and CB radios never replaced the telephone system.
The open Internet is an outdated concept on many levels. Security is just one of them. A bigger issue is scalability. If you want to make some kind of service available on the Internet, you do not want to put the service on your own machine and then publish your address. Not if you expect any real response. I mean most of us have heard of the Slashdot effect, right? There are also issues of data backup, etc. For these things, you go and pay a few bucks to somebody who can offer the necessary, expertise, scalability, and so on.
On the other hand, you offer services on a private network very easily. But that's only practical because your private network is isolated from the network at large.
It's too bad the Internet is no longer the friendly little place it was when SpeakFreely was invented. But it's moved past that, and you can't go back, not without kicking of 90% of the users. It's especially unproductive to blame the problem on the media monopolies. We've already got plenty to blame them for!
While the user can contact and freely exchange packets with sites not behind NAT boxes, he cannot be reached by connections which originate at other sites. In economic terms, the NATted user has become a consumer of services provided by a higher-ranking class of sites, producers or publishers, not subject to NAT.
Even cheap consumer firewalls allow you to accept incoming connections and run services. Furthermore, despite a lot of noise, most broadband providers do not seem to block incoming traffic; too many games and other popular software rely on it.
The only thing that NATs change is that services should be more flexible in the ports they will work with: when you have multiple machines behind a NAT box, you end up having to assign non-standard ports to services if they are being offered by multiple firewalled machines.
I agree that the trend towards relegating end users to a "client" status is disturbing, but NAT is not primarily responsible for that. Inventing bogus technical arguments will not help us reverse that trend.
Yeah, my wife is seriously hooked on playing Shadowbane, and I've noticed most of the "more effective" clans in the game agree to run Teamspeak while they play. That way, they can form attack strategies and figure out amongst themselves which character attributes are best to have against other types of characters.
It's almost become the unofficial "other half" of a Shadowbane installation, for anyone serious about playing the game.
I feel a bit more optimistic now :-)
But you forgot the current result is that it's not routable.
...hard to do isn't it?
g ro und/Hacking/Methods/Technical/Source_Routing/defau lt.htm
ok...someone try to reach my 10.10.10.3 machine
http://www.iss.net/security_center/advice/Under
That method will not work if you have a quality firewall. But the reason for that not working has absolutely nothing to do with the fact that you are NATing.
Yeah, nice, but you can't exactly get one of those free with a box of Cheerios.
IPv6 will be grand...when I can buy it for a reasonable price from my ISP. It's disingenouous for you to say "Well, just use IPv6!" when that's simply not an option for the overwhelming majority of Internet users.
Why yes, I AM a rocket scientist!
Because you don't have NAT doesn't mean you don't firewall your network. You could have a physically Identical setup which does the same job, but with "real" ip addresses for each machine. And theres no reason why the firewall can't do dhcp (so you don't have to configure it)
Real (but firewalled) ips are nearly always better than your usual nat setup (unless you don't want people to know how many machines you have.)
From RFC 2775:
Abstract
This document describes the current state of the Internet from the
architectural viewpoint, concentrating on issues of end-to-end
connectivity and transparency. It concludes with a summary of some
major architectural alternatives facing the Internet network layer.
[...]
3.5 Network address translators
Network address translators (NATs) are an almost inevitable
consequence of the existence of Intranets using private addresses yet
needing to communicate with the Internet at large. Their
architectural implications are discussed at length in [NAT-ARCH], the
fundamental point being that address translation on the fly destroys
end-to-end address transparency and breaks any middleware or
applications that depend on it. Numerous protocols, for example
H.323, carry IP addresses at application level and fail to traverse a
simple NAT box correctly. If the full range of Internet applications
is to be used, NATs have to be coupled with application level
gateways (ALGs) or proxies. Furthermore, the ALG or proxy must be
updated whenever a new address-dependent application comes along. In
practice, NAT functionality is built into many firewall products, and
all useful NATs have associated ALGs, so it is difficult to
disentangle their various impacts.
And remember kids: Never trust a computer you can actually lift.
And I don't want to keep repeating myself.
NAT is not firewlaling. NAT provides NO security.
What security you DO get from the average NAT-in-a-box device, firewall, whatever, is not because of NAT but because of OTHER rules and things put in besides NAT.
Quoting that RFC number sure made you look smarter. I'm talking about a threat from your ISP, not from me across the world.. you have no way of controlling whether or not that route exists... and assuming "RFC 1518 says they aren't routed normally on the net" means if I use those addresses, I'm safe, is rediculous.
A single NAT rule is not enough for anyone out there, and you won't find many devices in the home or business market (other than load balancers) that use JUST a nat rule.. all of them have other security measures in place, either built into the default nat setup, or put alongside it by default... but be very clear, nat is not a necessary component to get the same security.
The article referred to not needing nat in the future. Then the guy says "I wont' be quick to give up my NATed firewall." implying that the NAT has something to do with it."
All the security he wants, he gets without NAT... so his allegation that NAT will stay because of his need for a firewall is absurd.
Get it? Look at the topic.
This is from the motd on irc.homelien.no:
"Second, we get overwhelmed by requests to add special access for
LAN parties and small businesses running NAT (for the
illiterate, if your IP address starts with 192.168. or 10., you are
probably running NAT -- and your personal freedom is severely
restricted).
Please understand; our answer will always be NO. It always has
been, and it always will be. I will try to put this in simple
terms; NAT (Network Address Translation) and similar "technologies"
(masquerading, etc) are detrimental to the Public Internet.
NAT destroys the end-to-end transparency of the Internet. If you
do not understand this or the ramifications of this, please READ
UP ON IT and make up your mind. It is a short-term, detrimental
solution to a long-term problem which is most easily solved by
USING UP ALL AVAILABLE IPV4 ADDRESSES AS SOON AS POSSIBLE to force
a transition to IPv6.
irc.homelien.no will never succumb to the incompetence of
consultants. We do, however, realize that a number of our users
actually constitute part of the technician and consultant
community. If you want to give us something in return for
providing this service, increase your awareness of the above
issues. Short and to the point. --edison, Oystein Homelien"
(irc.homelien.no is a popular server on EFnet)
And remember kids: Never trust a computer you can actually lift.
Quoting the RFC is easier for me than desribing my experience.
However, briefly,
a) I first implemented NAT for a customer of mine in 1995. NAT broke their application, because IP address information was embedded inside the payload. That was my first sign something was wrong with NAT.
b) I've seen a 10 000 user network crash because the powersupply in the NAT box failed. At the time there wasn't an alternate path, but if there was, the NAT boxes would have some sort of proprietory state sharing protocol, and the boxes would have to be directly connected together - which provides a geographical limit as to how far apart the NAT boxes can be. Too bad if you want to have diverse geographical Internet connections.
With dumb old routers you can do this easily, because they don't maintain state, and therefore would operate independantly of each other.
c) Approximately a year ago I spent two _months_ solid working on NAT for VPN solutions There something in the order of 50+ different combinations of VPN toplogogies, and NAT options. It was a Brain F**k.
All that work could have been avoided by just using unique public address space.
I'm not to worried what the slashdot audience thinks of my opinion, I suspect most of them are aged between 14 to 20, and don't have much or any real world experience.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Try running two SMTP servers behind a NAT box - which one are you going to map TCP port 25 to, and which one isn't going to receive external email ? All you NAT-lovers, solve that one ...
(and no, you are not allowed use a single SMTP server, for security reasons for example).
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
Okay... good example.
let's assume eth0 is "outside" 66.32.64.1, say... and eth1 is "inside" 192.168.0.
The behavior you stated won't happen unless there is an additional rule to block packets arriving for other addresses... becaues
a) forwarding is on
b) the kernel has a route to 192.168.0.0/24 to eth1.. so it has somewhere to forward the packet.
I know I enjoy the added security of a NATed firewall, and without a really good reason, I won't be quick to give it up.
Well, if "it breaks worthwhile applications" isn't a good enough reason to dump NAT when it's no longer really needed, then there's not much hope, is there?
Edith Keeler Must Die
Actually, NAT can be serious security flaw, if poorly configured, especially with the rise of wireless networks.
1) Someone walks into your AP range - he gets hidden behind your NAT IP -> absolutely no clue where the traffic came from.
2) If the NAT is improperly configured (and it mostly is done so) it can be used for hidding in a different way. If you have wireless network with public IPs, and bunch of "customers" using their NAT boxes, one can set the NAT box as a gateway on his malicious wardrive notebook and the NAT box will happily accept such packets (even when from wrong interface) and NAT them...
This was announced months ago. About time Slashdot caught up. Try OpenH323 or something.
Although I never got SF working (guess why? NATs), I'd always admired it for including encryption. Maybe now's our chance to write a portable clone of PGPfone.
Call it GPGfone... but more clever.
The US Army: promoting democracy through unquestioned obedience
however, what happens when i want to have two machines inside the network both serving content?
well, i could have the NAT box forward all connections to port 80 to 10.0.0.2:80 and port 81 to 10.0.0.3:81. however, this mythical protocol that uses port 80 has a lot of clients implementing it that are stupid and always assume port 80 is the one to connect to. all of a sudden, binding a forward to port 81 isn't an option.
As I see it, this is a problem that solves itself, over time. I mean, when there's a problem, solutions are created.
For example, in NAT, there's the problem of user stupidity. Not knowing how to forward ports, for example. uPnP is only the most obvious solution to this, and while it's not very widespread, it *is* a solution that will take hold over time. Most home level NAt boxes support uPnP pretty well now, and several client programs now are starting to support it. Microsoft's various clients are the most obvious of these, I grant you, but uPnP does work to solve the problem. It lets the application forward ports on it's own, without help from the end-user.
The problem you address is one of multiple similar services behind a NAT box. Given that you have one external IP, clients that take the port for granted don't have the easy option of choosing which service they're talking to. This has two possible solutions:
a) Get someone in the network administrator position who has a freakin' clue and won't be using a cheap and simple NAT box for all their internet access to the company, but will instead use a real firewall and router and will therefore give those boxes external IP's of their own, or at least route different IP's to those boxes.
b) Make smarter client applicatons.
Solution A is the one most usually implemented. In a company I used to be at, we had this exact problem. We wanted to run a new webserver for our section of the organization ourselves. So we convinced the network admins that we had a need for it, and eventually they pulled a real IP address out of their uplink's block of IP's and set up rules in the firewall to route those connections to our internal IP'd webserver. Problem solved. Of course, we had to secure that server and convince them of the fact in order to get them to do it, but then that's the way it's supposed to be anyway. This sort of thing is what a router is made to do, no?
Solution B is taking shape more slowly, but newer applications don't make assumptions like the IP address is real, and so forth. The reason things like ALG's are needed is that applications made an assumption which is no longer necessarily valid, and then did something like passing the IP address around between machines in the application data level of the packets. There's simplistic fixes for this, like providing a configuration setting to override what the IP address should be, and complex fixes like auto-detection of internal addresses and using other methods to detect the real external IP address.
So, solutions are available, just not yet widespread. The NAT problem the original article mentions is real, but blaming it for discontinuing your work on a project is disingenuous at best. The truth is that the author is too lazy to properly investigate the available solutions and then help to promote them correctly. Old obsolete software and protocols must make way for the changing face of the internet and the network.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
is absolutely fucked
for your firewall just put
iptables -t filter -m state --state NEW -j DROP
that's *all* the functionality that NAT gives you.
For all those singing the praises of NAT - you are fucking idiots
How would this work?
It still knows where the packets are supposed to come from. By default it would not accept packets from your internal network if they came from the outside and entered the wrong interface.
Some time during the thirties, some German company manufactured a meat locker, which was installed in Dresden. During the war, it was sometimes used as a lockup for POWs. But in the end, it did a really good job as a bomb shelter. A barrier is a barrier.
There are roughly 100 messages in this discussion saying, "but they don't keep out viruses." Well duh! It's also true that a kevlar vest won't keep out another kind of virus. Yet cops and soldiers persist in wearing them. Could they all be superstitious? Misinformed? Or maybe a virus isn't the kind of penetration they're worried about.
I understand that. Most single-family residential internet access customers still use IPv4 :-).
I was replying to the assertion (by CowboyNeal in the OP) that people would wish to maintain this once IPv6 becomes common. At that point, every home user should have hundreds of addresses available, and IMO, even if the benefits of NAT are desirable, it will be better to NAT one-to-one.
.sig: file not found
> A NAT is the simplest...protection.... I'd rather use a NAT and do without the P2P software.
As would most users...[just as] Ham and CB radios never replaced the telephone system -- fm6
I understand the mentality that says "everybody should be a peer to everybody" on the Internet. That's the architectural model. It's a good one.
But when you need to get Nicky Naperville's little office up and running and connected, you don't want to a) make him hire a net tech to worry about a firewall and proper security, or b) sign up to do it yourself (unless you get paid for this service). For a large segment of the Internet, clueless administration is the norm -- and this won't get any better. We might as well expect them to understand two's complement arithmetic or write their own parsers. Anything that (optionally) protects these folks from themselves a little is good. They have become the dominant Internet clients.
Like it or not, we've had an enormous 'dumming down' of the 'net, and no amount of wishing will make it back into a hacker's paradise. Trying to do that is incredibly elitist -- even more than the admittedly elitist step of dividing the world into clients and non-clients.
The legit fear is that, once the client/non-client distinction is made, that the big boys will chase out all the hackers, and force us to become castrated clients. "You can't have your own IP address. You can only send approved protocols. You can't use IP tunneling. So there." Lots of ISP's force their customers into highly restricted interfaces and protocol sets. This is a dangerous trend.
But we can't put the djini back in the bottle. NAT and private intranets are just too damn convenient. I won't consider getting rid of any of mine. We need a different way to protect our informational rights (a formless concept).
-- We all have enough strength to endure the misfortunes of other people. La Rochefoucauld
This was designed to solve this issue, you get state information about the connection (external IP and speed etc) and are able to control the connection if thats enabled. You can setup incoming NAT redirection remotely using it. Why does noone like it? Oh yeah, microsoft had a lot to do with the engeneering of it.
The Network Address Translation effects the author speaks of, is increasingly done by your ISP. He is not talking about NAT routers that consumers setup for IP sharing or protection. This is a distinct point that could have been more clear in the article.
When the author talks about port mapping, he speaks of the ISP mapping a port through their NAT router to your IP without which a server could never be hosted in the classic sense.
This is what the author refers to in the changing infrastructure of the internet that increasing precludes peering as a communications option. That the fundamental and original internet infrastructure is changing as a result of ISPs adopting NAT routing so that most user connections only support computers in the role of clients, not peers or servers.
The author understands that in this changed environment, his software cannot continue to function for it is based on a premise that is disappearing rapidly. The only solution would be to establish a central server would is not cost effective in this instance. What Internet infrastructure would support in the early 1990's is no longer true today and the outcome is that his program will die since the environment needed to sustain it no longer exists.
This is a loss for us all since we are not treated equal, with most users relegated to the simple status of client consumer as a general class with the internet reduced to little more than a digital distribution network for paid content and services. A great deal of that loss stems from computer to computer communication requiring a third party intermediary.
SpeakEasy sounds allot like a forerunner to VOIP telephony. With VOIP looking like the next big thing and the peering model going down the drain, there is a requirement for vast third party server farms to facilitate this application of technology. This fits the business model of the Bells and the Cable companies selling bandwidth and services perfectly. As the author notes, there will be no imputus to discard NATing even with the adoption of IPv6. Quite the contrary it would seem.
IPv6 will be grand...when I can buy it for a reasonable price from my ISP. It's disingenouous for you to say "Well, just use IPv6!" when that's simply not an option for the overwhelming majority of Internet users.
I got an IPv6 over an IPv4 tunnel over my cable for free. You can, too.
But yeah, my point is that it's not ``the internet,'' just yet. When it is, we can do away with all this NAT/PAT crap.
-- The world is watching America, and America is watching TV.
(unless you don't want people to know how many machines you have.)
You can do the same thing by having many more IPs than you actually use. You can even cycle through them as a form of obfuscation. (Although there is, of course, no security through obscurity).
In fact, I would say that NAT provides the illusion of security.
If you have a NAT, which doesn't do advanced stateful packet filtering, then you can be reached. Something simple like source-routed packets can allow someone to connect to your internal network, no problem at all.
Even if you are set to reject all source-router packets, there are plenty of other tricks. All someone needs is access to a machine on the same network as you, and they are in, without much hassle at all.
Right now, NAT provides a slight ammount of security over nothing at all, because worms and amatures aren't smart enough to break-through it. However, it wouldn't be hard to add a couple lines of code into a worm, and suddenly it is able to get through all NATs connected to network the rooted machine resides on. Enjoy the rooting.
You see, now there's the mixup right there. It certainly isn't NAT that you find convient, but DHCP! (I find DHCP incredibly inconvient in 99% of cases myself, but to each his own).
Now, with IPv6, DHCP is done-away with completely. You have ample IPv6 addresses, and IPv6 has a built-in method to automatically chose an available address.
In other words, once IPv6 is a hit, NAT is long gone.
MANY people have FAR worse luck that you. As usual, just because you don't need something, doesn't mean it is unnecessary.
Besides, with IPv6, it will work 100% of the time, no proxies, no NAT, no other hacky-crap.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
John Walker is also the author of a fascinating set of free programs and book on dieting called the Hacker's Diet in which he discusses a realistic way to lose weight while remaining healthy, using techniques of project management which have served him well in other fields of endeavor. Check it out! (I have the Palm version running myself and have lost 6kg)
I was replying to the assertion (by CowboyNeal in the OP) that people would wish to maintain this once IPv6 becomes common. At that point, every home user should have hundreds of addresses available
What makes you think, even though IPv6 theoretically has 2^128 addresses available, that residential ISPs won't try to charge extra for more than a /128 (i.e. one address)? Greed is greed, even on IPv6. Sure, all the RFCs state is that ISPs should give customers a /64 or bigger, but where the ISP sees should in an RFC, the ISP thinks "opportunity to fleece its customers," especially if the ISP is a Fortune 500 corporation, as is the case for almost all cable ISPs.
Will I retire or break 10K?
I just went there and can't figure out squat.
That is one of the most annoying sites I have ever visited. Even the FAQ doesn't reveal a single piece of useful information as to how it works.
Anybody know?
Parent has posted a naughty link which is obscured.
This makes me question the entire TinyURL idea.
"Please don't use NAT! "
My subject says all that needs to be said. The world is ignoring your plea, whether or not I agree to heed it. I think we need to deal with it.
An external, compact and convenient box is the best choice for most of us. Whether it uses NAT or not is an implementation detail. Most of them are going to use NAT for a long time to come, and that is something that needs to be dealt with.
You are justifying the use of NAT to avoid the problems that a broken operating system such as Windows has?
So you are "fixing" windows network flaws by isolating yourself from the internet?
I can't believe we got to the point were a user just can't share a directory or a file through the internet without needing such viscuios ways of hiding itself through firewalls.
Did anyone but me feels this as a Windows design flaw, instead of a problem in all other OS's..
I use debian GNU/linux at home. I share what i please without needing a firewall. I only have a firewall for fun of researching on it, and i have fun stopping, starting it, stopping it for days, idontcare.
I regularly connect to remote Linux servers in other countries to do some CGI/php/perl work on them, and I notice they are not behind firewalls, and are online for months or more. This servers never met the blaster or whichnameitis worm.
What does the 135 port mean? WINDOWS RPC. So what the f**k do i need to block it? I laugh at the blaster worm.
--heavy