I've always been really suspicious of ALGs, and disable them whenever possible (or simply don't use them in the first place when setting up my own iptables fire

I've always been really suspicious of ALGs, and disable them whenever possible (or simply don't use them in the first place when setting up my own iptables firewall etc). They are generally somewhat neglected, and fairly complex, and they try to understand the flow of a protocol without really implementing the protocol, making them ripe for confusion-type attacks.