3 ms·

This cannot be understated. It's amazing how many networks still have absolutely shitty NATs that breaks things like VOIP, video conferencing, remote access, fi

This cannot be understated. It's amazing how many networks still have absolutely shitty NATs that breaks things like VOIP, video conferencing, remote access, file sharing, and online games. It make the internet almost unusable.

josteink 11y ago
> It's amazing how many networks still have absolutely shitty NATs that breaks things like VOIP, video conferencing, remote access, file sharing, and online games. It make the internet almost unusable. What's amazing is how many companies who buy expensive firewalls for their corporate networks to do this on purpose under the illusion that somehow having LAN computers not being able to access anything besides outbound HTTP and HTTPS on the internet makes you more secure. Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days? Even VPNs. You're protecting nothing.
- darkr 11y ago
  > Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days? Blocking outbound traffic at layer 3/4 does not require an expensive firewall. It provides protection against certain attack vectors, but as you say, most stuff nowadays uses http/https and in the case of trojans, likely reverse shells. Any firewall should be able to do this. The expense usually comes in when doing application layer filtering and/or transparent/active proxying, which is the point at which you can block SSL VPN clients and the like. To do this over HTTPS it obviously requires MITMing TLS traffic, which I have mixed feelings about.
- jlgaddis 11y ago
  The best solution I've seen is PCs ("LAN computers") without a default gateway. Give them static routes to access the local (within the company) resources they need, point them towards a proxy server for outbound web access, and you've went a long way towards reducing your risk.

3 ms·

This cannot be understated. It's amazing how many networks still have absolutely shitty NATs that breaks things like VOIP, video conferencing, remote access, fi

by thescriptkiddie 11y ago

josteink 11y ago
> It's amazing how many networks still have absolutely shitty NATs that breaks things like VOIP, video conferencing, remote access, file sharing, and online games. It make the internet almost unusable. What's amazing is how many companies who buy expensive firewalls for their corporate networks to do this on purpose under the illusion that somehow having LAN computers not being able to access anything besides outbound HTTP and HTTPS on the internet makes you more secure. Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days? Even VPNs. You're protecting nothing.
- darkr 11y ago
  > Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days? Blocking outbound traffic at layer 3/4 does not require an expensive firewall. It provides protection against certain attack vectors, but as you say, most stuff nowadays uses http/https and in the case of trojans, likely reverse shells. Any firewall should be able to do this. The expense usually comes in when doing application layer filtering and/or transparent/active proxying, which is the point at which you can block SSL VPN clients and the like. To do this over HTTPS it obviously requires MITMing TLS traffic, which I have mixed feelings about.
- jlgaddis 11y ago
  The best solution I've seen is PCs ("LAN computers") without a default gateway. Give them static routes to access the local (within the company) resources they need, point them towards a proxy server for outbound web access, and you've went a long way towards reducing your risk.