Re: [Patch 0/2] Avoid direct connections between NATed hosts

[Patrick McHardy <kaber@trash.net>]

Rémi Denis-Courmont wrote:
> Le vendredi 12 janvier 2007 18:59, Eric Leblond a écrit :
> 
>>Some algorithms can be used to established direct connections between
>>NATed hosts. Skype is one of the programs using this kind of
>>"feature".
> 
> 
> NAT are not *security* devices; NATs are meant to *improve* IP usability 
> by allowing as many protocols as possible to operate even though there 
> are not enough public IP addresses. Making it more difficult for P2P 
> apps to operate through is hence completely not only non-sensical, but 
> a plain contradiction.
> 
> NATs are sufficiently broken and annoying already to handle for software 
> development; please do not make them worst. Also, this patch goes 
> completely against work-in-progress NAT standards.

Fully agreed.

> In this particular case, your approach is a completely associal 
> short-term solution. In the long run, it will simply cause people with 
> normal/correct NATs to have to relay even more traffic when they should 
> not have to, because of people like you. And it certainly won't prevent 
> Skype from running on your network either.

Port randomization would still be a useful feature, not to wilfully
break skype, but to make spoofing attacks harder. Currently we
undo randomization done by the operating system/application. Since
its optional I don't see real harm in it.