Re: Should jail treat ip-number?

[Warner Losh]

In message <[EMAIL PROTECTED]> Ollivier Robert writes:
: NAT breaks too many things (like IPsec, incoming connections and many
: protocols) to be anything else than an abomination in my eyes.

It breaks any protocol that encodes an IP address and/or a port into
the data stream.  Without datastream snooping and translation, talk,
ftp real autio and a few others would break.  When I was working on
TIA (a commercial SLIRP-like program) we ran into these problems all
the time.  As soon as we put in upgrades for a recently released
protocol, a new one would come along, or an old one would break in
subtle ways (eg, we did the translation when we had no business doing
the translation) leading to configuration nightmares.  When it worked
it was cool, when it didn't...

This is why you can't, for example, NAT China :-)

Warner


To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message