3 ms·

I don't believe you. I'm willing to listen though. Do you have a link to a detailed, technical explanation of this?

• Dylan16807 16y ago
  I need a reference that exposing more information about systems that are nearly guaranteed to have security flaws is bad? I'll give you a simple scenario and then go look for something to make you happy. I have a computer running services A and B and several computers running service B. Service A exposes information about the computer's configuration that helps attack service B, but only if the attacker can figure out which one. Edit: I haven't really been able to find a comparison between firewalling and firewalling+NAT, just comparisons between nothing and NAT.
  • loup-vaillant 16y ago
    By the way, I wasn't completely explicit. I supposed that in both cases all incoming ports are closed, except for the ones you explicitly open. That way, the only difference between the NAT and the firewall is the address translation. My scenario is narrow, but I expect it to be a common one: IPv6 internet boxes will likely include such a firewall by default.
• bmelton 16y ago
  I have to agree with Dylan on this one. By default, the security of a system with ANY public addressability (vs. one that can't be seen except on outbound requests) is dramatically less secure than not exposing it at all. If we can believe the old adage that "The only secure server is one encased in concrete", then the average non-NATTED device is more akin to one that is concreted than one with public addressability.
  • loup-vaillant 16y ago
    http://news.ycombinator.com/item?id=1744736 http://news.ycombinator.com/item?id=1744736 (I supposed that going from NAT to clean firewall would open any incoming ports.)
    • loup-vaillant 16y ago
      Errata: wouldn't open any incoming port.