[146554] in North American Network Operators' Group
Re: Have they stopped teaching Defense in Depth?
daemon@ATHENA.MIT.EDU (William Herrin)
Tue Nov 15 17:01:42 2011
In-Reply-To: <20111115215055.72C851737568@drugs.dv.isc.org>
From: William Herrin <bill@herrin.us>
Date: Tue, 15 Nov 2011 17:01:09 -0500
To: Mark Andrews <marka@isc.org>
Cc: NANOG <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Tue, Nov 15, 2011 at 4:50 PM, Mark Andrews <marka@isc.org> wrote:
> If you want to use unroutable addresses then use a bastion host /
> proxy. =A0Don't expect to be able to open a TCP socket and have it
> connect to something on the outside. =A0Do it right or don't do it
> at all.
Mark,
What is a modern NAT but a bastion host proxy for which application
compatibility has been maximized?
Regards,
Bill Herrin
--=20
William D. Herrin ................ herrin@dirtside.com=A0 bill@herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004
