On Wednesday 2005-November-30 12:32, Derick Anderson wrote:
> My inclination would be to use NAT (MASQUERADE) for your internal
> hosts just because it makes things simpler (not necessarily more
> secure) and your DMZ doesn't need routes to your internal network.
> Some may say then that simpler is more secure and I agree, but I
> still say that NAT is a routing tool and not a security tool.
The only potential security issue is one that SHOULD have already been
addressed by disabling packet forwarding on the DMZ machines, and that
is that an upstream attacker might route packets to your LAN machines
using [a] DMZ machine[s] as gateway.
Otherwise I agree with you and Derick. I prefer routing when it's a
possibility.
Even without the LAN routes the DMZ machines should not allow packet
forwarding.
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
