Subject: RE: NATs are NOT Firewalls

From: "Michel Py" <[email-masked]>
Date: Thu, 19 Jun 2003 08:40:54 -0700

Daniel,

I agree with the rest of your post, however

> Since NAPT uses stateful inspection to operate,

I think I don't agree with this. I would say that NAPT is a stateful
process but not that it uses inspection. By "inspection" I understand a
more intelligent process that decapsulates packets and looks for "bad"
things inside them, which is a separate function.

In other words, there is a difference between 'stateful' and 'stateful
inspection'. 'Stateful' is a feature of both NAPT boxes and firewalls;
'stateful inspection' is a feature of more sophisticated firewalls only;
if you happen to find a NAPT box that does stateful inspection (the $50
ones don't) it could indeed be called a firewall.

Michel.

---

From: shogunx <[email-masked]>
Date: Thu, 19 Jun 2003 05:28:13 -0400 (EDT)

> > Since NAPT uses stateful inspection to operate,

when referring to NAPT, we are talking about rinetd, right?  you can run
that on a linux box with two network interfaces (ethernet, ppp, token
ring, serial, whatever) to distribute the network service load around your lan
(or across the internet, for that matter).  combine that with snort or so,
and iptables, and you have a firewall, do you not?

> ones don't) it could indeed be called a firewall.

sleekfreak pirate broadcast
world tour 2002-3
live from the pirate hideout
http://sleekfreak.ath.cx:81