4 ms·
> Just go back to the early 00s or mid-90s to see the ramifications that exposing ports from Windows machines to the Internet had, then tell me NAT hasn't had a
by simoncion 11y ago
> Just go back to the early 00s or mid-90s to see the ramifications that exposing ports from Windows machines to the Internet had, then tell me NAT hasn't had a positive security impact.
NAT has had the same _security_ impact that a default REJECT ingress firewall policy would have. (Coincidentally, this is the default firewall policy for non-Enterprise Windows Firewall configurations.)
If you combine default REJECT with a port opening protocol like uPnP, you have a really nice, reasonably secure, self-maintaining border firewall. (Hyperventilation about security issues with particular implementations of uPnP notwithstanding.)
- nly 11y agoI'm not saying we need NAT, just that without prior need for NAT, perpetuated by ISPs only giving us one IP, I doubt anybody would have any ingress filtering at the border. It's a lot easier just to block ingress to the whole house than it is to ensure a dozen devices are secure against unwanted incoming connections... this problem will present itself with the IoT sooner or later.
- simoncion 11y ago> ...just that without the need for NAT, perpetuated by ISPs only giving us one IP, I doubt anybody would have any ingress filtering at the border. I disagree. Defaults are a powerful thing. If one's router ships with a default REJECT ingress firewall, a non-technical user is not likely to change it.