Text 12597, 136 rader
Skriven 2010-11-26 00:11:24 av Peter Knapper (3:772/1.0)
  Kommentar till text 12573 av Michiel van der Vlist (2:280/5555)
Ärende: Routers and firewalls
=============================
Hi Michiel,

 PK> However I was not thinking of processing power, rather reducing
 PK> complexity by removing the WAN interface requirement from the
 PK> Computer. This means that just about any computer can be dropped in
 PK> place of the original with no (or minimal) Networking changes
 PK> required. With a fixed Host doing the WAN 
 PK> interfacing, this would add
 PK> (IMHO) complexity to that one computer.

 MvdV> I see your point and share you opinion. Up to a 
 MvdV> point. True, having the WAN interface implemented in 
 MvdV> a seperate device removes complexity from the 
 MvdV> computer. Making it easier to replace. However it 
 MvdV> adds overall complexity to the system by adding that 
 MvdV> extra device. If that device needs to be replaced, 
 MvdV> you have to do the networking configuration anyway. 
 MvdV> So in case of just one computer as far as overall 
 MvdV> complexity is concerned, there may be little or no 
 MvdV> gain. The gain may even be negative.

I guess this area comes down to personal likes and dislikes, and cost. Myself,
I find the cost minimal and perfectly acceptable (IMHO).


 MvdV> In case of a single computer, it does not make much 
 MvdV> difference where you place the barrier.

As long as you can really trust that Barrier. Myself, I treat the internet as a
cesspool of black movements, so anything I can do to lessen the potential
impact is welcome, as long as that "lessening" does not allow other issues to
arise...

 MvdV> Ah, wait a minute. Now we are talking about an EXTRA 
 MvdV> barrier. 

Remember, we are saving by not including the WAN iterfacing cost on that PC,
and any addition expense (IF it exists), is minimal to me and well worth it.

 MvdV> In the previous paragraph we were discussing 
 MvdV> removing complexity from the computer. Now, when it 
 MvdV> is an EXTRA barrier, the reducing complexity no 
 MvdV> longer applies. An extra barrier adds complexity.

No, because most of that complexity is simply relocated from one place to
another. Any ADDITIONAL complexity is well worth it (IMHO)...

 PK> Of course nothing is ever permanently resolved in this setup, as new
 PK> issues are found almost daily. However these 
 PK> "issues" are most likely protocol specific.

 MvdV> I also note that two barriers are not necesarily 
 MvdV> harder to take than one. 

This really comes down to how those barriers are formed. If done effectively
they are usually combined, rather than read as 2 single devices, so the SUM of
them is either greater or at least equals a single Barrier. The real problem is
that a Barrier has to be fully understood by those building it, before one has
any idea that it is doing its job effectively...

 MvdV> One 2 meter high wall may be 
 MvdV> more effective than two 1 meter high walls. Multiple 
 MvdV> barriers are more effective if they are not of the 
 MvdV> same kind. 

Al this is very true...

 PK> If just one machine is managing that Barier, 
 PK> then I have to be pretty
 PK> confident on getting it exactly right, and I have worked in the
 PK> Professional Networking area for long enough to 
 PK> know that even purpose
 PK> built devices can still have bugs. One only has to search the Cisco
 PK> Database on fixed issues to find out about these...

 MvdV> All very true. No intrusion protection os perfect and 
 MvdV> it is an ongoing battle.

Which is why people are often reluctant to discuss HOW they do such things in
public...

 MvdV> Still... if you have only one computer, you do not 
 MvdV> need a router, what you need is a firewall. Then 
 MvdV> again the easiest and cheapest way for a home user to 
 MvdV> get an external hardware firewall is to buy a home router...

Preferably with an integrated Firewall...

 MvdV>  MvdV>> It is just that I get the impression that many think that a
 MvdV>  MvdV>> router with NAT is essential for connecting to the While in fact
 MvdV>  MvdV>> NAT is a kludge needed because ISPs will only 
 MvdV> give one IPv4 address
 MvdV>  MvdV>> to private customers.

 PK> I do not consider NAT a Kludge at all, however it IS an added
 PK> "work-around" to the limited IP Address space issue with IPV4,

 MvdV> I call it a kludge because it breaks a lot of things that have to be 
 MvdV> fixed with other work arounds like UPnP. 

I prefer to keep things reasonably simple, and not rely on Automated
functionality unless it is truly appropriate. I feel that too often there are
unexpected side effects of PnP...;-(

 MvdV> Things would be far less comples and work better if there were  
 MvdV> no shortage of addresses and the Internet could work as 
 MvdV> origially designed - full end to end connectivity for 
 MvdV> all devices. 

I think the one thing the internet has NOT considered in its IPV4
implementation, is HOW people may use it, because it has effectively created a
HUGE market for things like Firewalls. 

 MvdV> IPv6 will restore that functionality

Sorry, but I simply dont see that like you do...;-( The door has been
openned,and Firewalls are beign used to control that Door. I would expect IPV6
to help a lot here either, the world is full of people who have worked out how
to break things...

 MvdV> But that is only a side effect. The only protection 
 MvdV> that NAT (One to many NAT to be precise) offers is 
 MvdV> that it drops unsolliciteted incoming packets because 
 MvdV> it does not know where to forward them to unless 
 MvdV> explicitly told. A statefull firewall does exactly 
 MvdV> that but without the holes created by work arounds to 
 MvdV> make some p2p applications work across NAT.

Which is why a Router WITH a Statefull F/W included is a reasonable start to
handling that (IMHO).

Cheers..............pk.


--- Maximus/2 3.01
 * Origin: === Maxie BBS.  Ak, NZ +64 9 444-0989 === (3:772/1)