Re: DNAT TCP 12345 -> 22

On 2008-03-21 Frédéric Massot wrote:
> Ansgar -59cobalt- Wiechers wrote:
>> On 2008-03-20 Frédéric Massot wrote:
>>> How I can ensure that access will possible only on ****t 12345/TCP
>>> and not on ****t 22/TCP ?
>> 
>> Have your sshd listen on both ****ts, and allow only 12345/tcp inbound
>> on your external firewall.
> 
> Yes it is a solution that works, but I would like to find a solution
> with the firewall.

Why? Using NAT (or rather PAT) for this will not gain you any security.
You may even lose security, because NAT requires additional code on your
firewall, that may contain additional (exploitable) holes. Keep it
simple.

Regards
Ansgar
-- 
"The Mac OS X kernel should never panic because, when it does, it
seriously inconveniences the user."
--http://developer.apple.com/technotes/tn2004/tn2118.html


-- 
To UNSUBSCRIBE, email to debian-firewall-REQUEST@[EMAIL PROTECTED]
 a subject of "unsubscribe". Trouble? Contact
listmaster@[EMAIL PROTECTED]