Firewall Wizards: tunnel vs open a hole

["Anton A. Chuvakin" <anton () chuvakin org>]

All,

Sorry for this somewhat generic query, but I'd really want to know the
general consensus on the issue from the esteemed list members. I have
seen that such debates often spark on the list, and I think summary (which
might arise as a result of my query) would be useful for everybody, so...

...if to run a new application you'd have to either:

1. open a new port
2. accept tunneling over already open port/protocol

which would you choose?

To clarify, imagine you have to have something that need to talk thru a
firewall from a less secure compartment to a more secure one. And the
options are: open TCP port XXXXX (to the required host only, of course),
or tunnel over currently open (or proxied) port 80?

Best,
-- 
  Anton A. Chuvakin, Ph.D., GCI*
     http://www.chuvakin.org
   http://www.info-secure.org

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards