2 ms·

But my point is that the safest thing for most end-devices is NOT to be directly addressable from the wider internet. Any network admin will tell you that so it

by cletus 16y ago

But my point is that the safest thing for most end-devices is NOT to be directly addressable from the wider internet. Any network admin will tell you that so it'll be interesting to see how that unfolds in the IPv6 world (if it ever unfolds).

loup-vaillant 16y ago
The safest thing for most end-devices is not being servers in the first place. Now, if the device is cracked through one of its client software (NATs don't prevent that), then it could start up a rogue server, while if it were behind a NAT it couldn't. That's no worse for the machine itself (it's hosed anyway), but you could argue that's worse for the rest of the network. I think it's not. Botnets are annoying and dangerous when they act as clients. Spam, DDoS, automatic attacks are all client behaviour. Even if you want server behaviour, connections don't have to be initiated from the outside. The compromised device just have to know the relevant IP, and initiate the connexion itself. Finally, if you want to block incoming connections anyway, a plain firewall is cleaner. At least FTP will work.
- jauer 16y ago
  The point about NAT blocking unforwarded servers, not necessarily true: http://samy.pl/pwnat/ http://samy.pl/pwnat/ The goal of some botnets is to set up servers for software distribution or to host phishing sites. You can't characterize botnets activity as simply client behavior. Thanks to UPnP being enabled on most modern consumer routers you can't even count on the NAT protecting you from having a unauthorized server. Having end-devices NOT be servers is ignoring the fact that the UI for many home devices is delivered over a embedded web server. This is becoming more commonplace over time. Ultimately you need a firewall that controls inbound and outbound traffic.
- calloc 16y ago
  Why do firewalls suddenly go away when IPv6 is introduced? If NAT is the only thing stopping packets from coming into your network then that is bad. Set up appropriate firewall rules.
  - loup-vaillant 16y ago
    They don't. And I'd still like to have one. I was just saying that the root of the problem is insecure services.

by cletus 16y ago

loup-vaillant 16y ago

The safest thing for most end-devices is not being servers in the first place. Now, if the device is cracked through one of its client software (NATs don't prevent that), then it could start up a rogue server, while if it were behind a NAT it couldn't. That's no worse for the machine itself (it's hosed anyway), but you could argue that's worse for the rest of the network. I think it's not. Botnets are annoying and dangerous when they act as clients. Spam, DDoS, automatic attacks are all client behaviour. Even if you want server behaviour, connections don't have to be initiated from the outside. The compromised device just have to know the relevant IP, and initiate the connexion itself. Finally, if you want to block incoming connections anyway, a plain firewall is cleaner. At least FTP will work.

jauer 16y ago
The point about NAT blocking unforwarded servers, not necessarily true: http://samy.pl/pwnat/ http://samy.pl/pwnat/ The goal of some botnets is to set up servers for software distribution or to host phishing sites. You can't characterize botnets activity as simply client behavior. Thanks to UPnP being enabled on most modern consumer routers you can't even count on the NAT protecting you from having a unauthorized server. Having end-devices NOT be servers is ignoring the fact that the UI for many home devices is delivered over a embedded web server. This is becoming more commonplace over time. Ultimately you need a firewall that controls inbound and outbound traffic.
calloc 16y ago
Why do firewalls suddenly go away when IPv6 is introduced? If NAT is the only thing stopping packets from coming into your network then that is bad. Set up appropriate firewall rules.
- loup-vaillant 16y ago
  They don't. And I'd still like to have one. I was just saying that the root of the problem is insecure services.