Re: Hairpin NAT - possible without packet marking?

["Neal P. Murphy" <neal.p.murphy@alum.wpi.edu>]

On Tue, 04 Jul 2017 07:48:36 +0200
K <netfilter@quintux.com> wrote:

> What do all the locks in the world help when you invite the burglar in for tea? In other words: most IT departments have the incoming traffic pinned down as you described, but a single executable disguised as a clip of a cute kitty, downloaded and executed by any employee is what nowadays forms the real threat.

And that's why I maintain that SSL/TLS is the one of the worst things that could've happened to The Internet: our peripheral firewalls are powerless to prevent malware from traversing conns encrypted with SSL/TLS.

Neal


> 
> On July 4, 2017 3:14:59 AM GMT+02:00, Robert White <rwhite@pobox.com> wrote:
> >They had
> >people sharing segments of their hard drives. Pooled servers with just
> >ludicrously broad write policies, printers, store and forward scanners,
> >all the normal stupid things that let business function. And you know,
> >what, its well they should. Security that becomes a denial of service
> >attack on the corporation's innards just encourages misuse.  
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html