Re: [Patch 0/2] Avoid direct connections between NATed hosts

["Rémi Denis-Courmont" <rdenis@simphalempin.com>]

[-- Attachment #1: Type: text/plain, Size: 1600 bytes --]

Le vendredi 12 janvier 2007 19:20, Patrick McHardy a écrit :
> > In this particular case, your approach is a completely associal
> > short-term solution. In the long run, it will simply cause people
> > with normal/correct NATs to have to relay even more traffic when
> > they should not have to, because of people like you. And it
> > certainly won't prevent Skype from running on your network either.
>
> Port randomization would still be a useful feature, not to wilfully
> break skype, but to make spoofing attacks harder. Currently we
> undo randomization done by the operating system/application. Since
> its optional I don't see real harm in it.

Right, randomizing port numbers when they are allocated can make it 
slightly more difficult to spoof DNS. Does the "regular" socket code 
picks port at random or not though? And is the port allocation logic 
shared between socket and NAT code (IMHO it should either be shared or 
at least be equivalent)? It makes little sense to secure host behind 
the NAT and not secure yourself; that also imples there should be no 
need for an iptables option to enable/disable it.

My concern is with when (and how) Netfilter NAT code allocates a new 
port number. If the source private-IP/port are identical, the external 
NATed-IP/port ought be identical too, and certainly not another 
randomized value.

With that, you have the advantage of random source port numbers (better 
spoof protection), while not breaking any NAT-aware P2P app.

Sorry for the misunderstanding.

-- 
Rémi Denis-Courmont
http://www.remlab.net/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]