4 ms·
I guess this is yet another reason not to rely on firewalls and outdated notions of "internal" and "external" networks for any kind of real security. Increasin
by dlitz 13y ago
I guess this is yet another reason not to rely on firewalls and outdated notions of "internal" and "external" networks for any kind of real security.
Increasingly, it seems that firewalls are doing less to improve actual security, while continuing to hinder legitimate network connectivity and the deployment of new protocols.
- gnu8 13y agoI think you're conflating firewalls and NAT. The idea of "internal" and "external" networks still apply in a non-NAT environment but what takes some getting used to is that with full end-to-end connectivity, you're back to an implicit "default-allow" policy where NAT created an implicit "default deny". The answer is to have a default deny firewall rule on your border router (your home gateway appliance), and then allow services as needed.
- zurn 13y agoEverything he said applies to a typical legacy corporate network that has a centralised default-deny firewall on front of it (but no NAT). Host-based firewalls are much more flexible and have many security advanteges.