荔园在线
荔园之美，在春之萌芽，在夏之绽放，在秋之收获，在冬之沉淀
[回到开始]
[上一篇][下一篇]
发信人: georgehill (人生不定式), 信区: Linux
标 题: NAT is NOT necessary for IPv6 security(转寄)
发信站: BBS 荔园晨风站 (Sat Sep 16 11:31:50 2000), 站内信件
【 以下文字转载自 georgehill 的信箱 】
【 原文由 georgehill.bbs@smth.org 所发表 】
发信人: hhuu (什么是水，就是water啊), 信区: FreeBSD
标 题: NAT is NOT necessary for IPv6 security(转寄)
发信站: BBS 水木清华站 (Sat Sep 16 00:12:00 2000)
NAT is NOT necessary for IPv6 security
Kazu, KAME Project, 07/08/98
Many people believe that NAT(network address translator) is necessary for IP
security. This is completely wrong.
Recently, many sites install firewall to protect their security. In many cases,
NAT is used combined with firewall. This probably lets people
misunderstand that NAT is essencial for firewall.
The main purpose of NAT is to save the IP space assigned to site. As you know,
the current assign policy of IPv4 is really severe. Many sites
can't get enough IPv4 space. So, they are drived to use private IPv4 addresses.
To communicate a host with a private address in a site and a host with a global
address in the Internet, address conversion is necessary. This
convertion makes one-way connection. That is, outgoing connections are OK but
incoming connections are rejected.
This feature is considered useful to protect site security. But it can be
accomplished by other technologies. A good example is filtering.
Again, the point is that NAT is not essential for firewall.
By the way, one of the biggest advantages in IPv6 is its huge address space.
Each and every site can get enough IPv6 addresses(by default,
16bit subnets, each subnet has 64bit identifiers). So, we don't have to save
IPv6 address space. This means that NAT is completely
unnecessary.
To implement one-way connection for IPv6 site, you can make use of filtering.
If you want two-way connection environment, just use IPv6
without filtering. You should understand that the two-way connection
environment cannot be implemented with IPv4, where NAT is
required.
NAT is necessary evil for IPv4. But NAT is evil itself for IPv6. IPv6 is
desired to eliminate any and all NATs in the Internet.
--
行列中 作不朽文章
谈笑间 论古今英雄
痴狂里 诉红尘情爱
来去时 不枉一生风流
--------- bbs.ntu.edu.tw
※ 来源:·BBS 水木清华站 smth.org·[FROM: 166.111.161.33]
--
※ 转载:·BBS 荔园晨风站 bbs.szu.edu.cn·[FROM: 192.168.1.115]
[回到开始]
[上一篇][下一篇]
荔园在线首页 友情链接：深圳大学 深大招生 荔园晨风BBS S-Term软件 网络书店