How did they get past my NAT?

Not at you.

Don't know.

My GV-based box does Symmetric NAT, with port preservation whenever possible.

Chris

I've not been Abusive to any person here. While I certainly know that NAT appliances are not firewalls (but firewalls can do NAT), there is a misconception as to what the public is being told a firewall is.

Yea, you don't like it, you must be one that purchased one of those BEFSR41 units and fell for the "it's a firewall" crap - did you know that when the BEFSR41 was introduced it was called a ROUTER with no mention of firewall - a year later, with no changes, it was being marketed as a "Firewall" - same box, same firmware.....

So, like it or not Todd H, most residential users are not using firewalls, they are using ROUTERS.

My personal guess: The "visitor" came over one of the open ports. Especialy "remote access" sounds "inviting"! Peer-to-peer is another possibility.

I would open those ports only when needed. (And only for that time) (And only for one IP-Address)

Just my 2 cents

Rudy

I'd say this would be an excellent gateway for the low-cost consumer market. Since it tries to avoid hassles with the NAT, the user is happy and, due to lowerr support costs, the vendor is happy. That's exactly why they implement it that way.

true but then again people who use things like that shouldn't be allowed to have a router/network in my humble opinion. these are prob the same folks that go on fastrack or edonkey and share their c:\\ drive. but if my router did that (5000-10000) i would throw it out of the winow in an instant.

For 1:1 NAT aka IP masquerading you got it quite wrong: Such an implementation could and even should forward every incoming connection, because the target is always exactly known. For 1:many, dropping the incoming connections would be the only correct, but not surely the most reasonable implementation.

FTP data traffic is not directly defined to be related to the control data. Let's say the client surfs to a website containing a Java or Flash applet that implements the FTP protocol, it might still issue correct commands to open associated ports.

If the router closes all ports and conceals LAN IP addresses then it's just as good, and in one respect better than, any software firewall.

Uh oh. Someone said "software firewall."

Brace for the impending ranting about how they aren't firewalls either.

opps, I didn't expect to get off scott free.

IF it closes all ports (nat is irrelevant). But the hypothesis of the thread was that ports were being punched through the router. Note that a router which refuses to pass on ports IS a firewall. And since it operates on software loaded on the router, it is a software firewall.

Actually, a NAT Router is better than any PERSONAL firewall solution installed on a non-dedicated computer.

what if your Personal Computer runs a BSD (ipfw,pf) or GNU/Linux distribution (iptables) and is there such a big difference between a firewall that has its code burned in flash (firmware) and a firewall that hooks into the tcp/ip stack of a a general purpose OS

As long as it a dedicated computer and not one that users are playing/working on, then it can easily be a firewall. Checkpoint running on a Nix OS is a great example of a dedicated server class firewall - notice the dedicated.

With all that is available at a reasonable cost today, a firewall that is just a router is not really a firewall. The appliances I install can tell the difference between SMTP and HTTP or FTP and do a lot more, that's the least I would install.

This still goes back to these cheap residential units called firewalls by the marketing department - if you look up NAT, it's routing, simple and plain, not Firewalling.

And if you look up firewalling um... it can be implemented by.... wait for it.....

ROUTERS!

I don't dispute marketing departments being very prone to overblowing capabilities of many devices, but show me a good citation from a widely known source for "firewall" implying or requiring all the things you include in your definition.

Point is, it's not nearly as narrowly defined as you seem to require.

No doubt a "firewall" appliance that implements IPS, IDS, allows no traffic by default, has the ability to provide a higher level of security than your garden variety broadband router for the home office market, but... that does not mean the latter class of devices don't also fit the definition of firewall. They're just lesser firewall appliances.

Firewalls can route, routers are not firewalls.

I'll give you that, but people seem to think a firewall will protect them from many things that these NAT Routers don't protect them from, and a firewall appliance can and does protect them from.

And now you are going to tell us what the difference is between a NAT router that rejects all incoming unsolicited connections, and a firewall that rejects all unsolicited incoming connections. It is certainly true that a firewall can be a slightly less blunt instrument, and can reject or accept more subtly that a NAT router can, but IF that router is set up not to do any port forwarding, then it is also a firewall set up to reject all incoming connections.

There are two major differences:

1. NAT is not designed to work as a security solution.
2. Depending on the implementation, it might forward the connection anyway without any explicit rule.

No, I'm not going to go around in circles for you - you've already shown that you can't comprehend what is written vs what you think was written.

Leythos wrote in news: snipped-for-privacy@adfree.Usenet.com: ...snip more of Leythos' whinging...

Still hard at the weaselling, eh Leythos? Your stupidity is exceeded only by your tenacity.

Regards,