Re: UPNP/SSDP

From: CZ (CZ_at_no99spam.com)
Date: 07/19/04 

Date: Sun, 18 Jul 2004 23:21:06 -0700

Francis:

>> the firewall does stateful inspection of packets

Most end user firewalls are stateless (or primarily so)

>> the NAT router is a packet filter that routes packets

Generally, neither a NAT nor a router are referred to as packet filters. A
NAT does address translation and port matching per a port table, a router
routes packets between two interfaces per a routing table, and a packet
filter makes a forward/discard decision based on info in the packet headers.

>> private IPs are used on the internal LAN side and are not routeable on
>> the WAN (internet) side and vice versa.

Not exactly.
Private IP addresses are routable, as I do it frequently in test scenarios.
It depends upon the routers routing table.
IMO, re: a NAT-router, a router port accepts the packet, passes it to the
NAT (which makes an address change), then the packet is compared to the
router's routing table and is sent to the designated router port.
A key issue here is that outside initiated inbound packets with the WAN port
address are dropped by the NAT (as they do not have a match in the NAT's
port table), not by the router.
And, an outside initiated inbound packet with a private IP address would not
be picked up by the router.

>> you should have *both* a router and a firewall in place, but the
>> application-level firewall is more important to guard against the types
>> of traffic leaving your machine, that perhaps shouldn't be

Agreed, except that I would want more than just an application gate type of
firewall (eg. ZA free) which does not also do packet filtering for outbound
packets (Sygate does both, ZA free does not). Actually, I find using ZA
free (an application gate f/w) together with BlackIce (an ID) to be a fairly
good end user f/w setup.

Relevant Pages

  • Re: command execution on router
    ... which in effect logs the packet info. ... > inbound telnet, etc on the wan port, and port 137 on the lan port. ... > RT314 gateway router. ...
    (Security-Basics)
  • Re: Dropping SSH connections over the internet
    ... Packet corruption will not cause this. ... then the connection will drop. ... the incoming connection port gets mapped to another port on the outbound ... The router has to maintain a list of used ports as each connection gets ...
    (Ubuntu)
  • Re: Windows as Proxy Server vs. other firewall approaches.....
    ... NAT is stateful by definition. ... Here's how an incoming packet is handled: ... Where the SPI firewall becomes criticaly important is when the router is ... > knows that it is a proxy server. ...
    (microsoft.public.windowsxp.network_web)
  • RE: seeking a better understanding
    ... Packet inspection with a home router is a "packet filter" strictly ... source port blocking, it may or may not get through that. ... Other boxes are Linux. ...
    (Security-Basics)
  • Re: Design of a Router
    ... packet forward it and than close the port and move to the next and so ... would ideally like the router as small and as fast as possible. ... size of your buffer (just keep in mind that if you have 4 ports than ...
    (comp.lang.verilog)
Loading