Re: CPE equipments and stateful filters

[itojun@itojun.org (Jun-ichiro itojun Hagino)]

> There might be a misunderstanding here. As far as I can tell, UPnP, NAT-PMP 
> and ALD all allow (unauthenticated) requests coming from the inside, and 
> discard any requests coming from the outside. In the physical world, most 
> locks can be undone without key from the inside, and only need a key from the 
> inside.

	i mentioned about the following story:
	- machines inside of your organization gets infected by viruses, trojan
	  hoses or whatever and bad guys take control of the box.
	  this can be due to poorly-mangaged laptop with VPN reachability
	  towards inside of your organization, infected laptop goes into your
	  organization after a trip to chicago, whatever.
	- bad guys plays with UPnP and punch holes on your firewall

itojun