Once again - "addressability != accessibility". I think the benefits of being able to reference the host even if for abuse tracking, or netflow cross-correlatio

Once again - "addressability != accessibility". I think the benefits of being able to reference the host even if for abuse tracking, or netflow cross-correlation, etc. - outweigh the obscurity advantages of NATs. If I were concerned to have a diode-like gateway, I'd get a stateful firewall, or on cisco boxes, configure the reflexive ACL. It comes for free with the base code, IIRC. This all said - each individual network's mileage can vary, so we could argue till dawn - and I think we'd need to agree to disagree on the matter of the "security of NAT" :) If it makes someone sleep better - I think it's served its purpose. Much like throwing away the soda bottle before boarding the plane.