3 ms·

"NAT isn't providing ANY security" - except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT. That

"NAT isn't providing ANY security" - except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT. That sounds quite a lot like security. As for "your private addresses are betrayed all the time by your browser", I'm not sure what an internet host is going to do after discovering my IP address is 192.168.something that they couldn't already do.

lmm 11y ago
> except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT Not true. Someone on the Internet can mark your router's external IP as the gateway for your internal network range and send packets to your internal devices fine. (In practice most NAT devices also do firewalling to prevent this, but the two functions are independent)
- jameshart 11y ago
  That's a characterization of a network gateway, not a NAT - there's no reason for a NAT router to accept and gateway packets addressed to its internal network since there's no reason for external hosts to be using those addresses in the first place. I would be astonished to find a NAT which also enabled routing to its private address space for external-origin packets.
  - c22 11y ago
    You might be astonished to find such a NAT gateway without the functionality you describe, but what you're describing is a firewall.
    - Dylan16807 11y ago
      I would not describe having two different routing domains as a firewall. It's not a fence set up by a firewall that only lets correct packets through. It's a gaping chasm that only the NAT process crosses; packets are transformed as they cross and only some packets are possible to transform.
      - pdkl95 11y ago
        In general, if you're intentionally dropping packets it's a firewall. NAT is just an address translator. > only the NAT process crosses Nope, a router that doesn't have a firewall but supports NAT will route a packet if it has the proper destination address. That is, if a packet is received that has a destination address of e.g. 192.156.1.2, it will be routed onto the LAN. However, this is a very rare configuration, as most routers (including ~all home routers) also include a firewall that does packet filtering.
        Dylan16807 11y ago
        >will route a packet if it has the proper destination address Iff the ports are logically connected. Nothing forces routing to be global. If they're separate, it doesn't have to intentionally drop packets. An example configuration: You're NATing 15.x.x.x to 10.x.x.x, with a 1:1 mapping. It's wide open. But it simply doesn't understand what to do with a packet addressed to 10.x.x.x on the external port. No destinations in the external port routing table contain 10.x.x.x, so it gives up.
        pdkl95 11y ago
        Filtering packets that don't match a criteria (such as a destination port) is done by a firewall, in addition to the NAT. These are typically used together, such as in the "full-cone" situation you described. Yes, I'm making a pedantic argument about terminology, but it's an important one because IPv6 means we can remove just the NAT part - all of the other filtering/etc features can remain. The goal is to make all devices addressable globally[1], which some people assume is a change in security. That isn't a correct assumption, as an IPv6 router (with a stateful firewall) should drop the same types of packets as their current IPv4-with-NAT router. [1] NAT badly damages the network by imposing an imprimatur[2] on the hosts behind the NAT. [2] https://www.fourmilab.ch/documents/digital-imprimatur/ https://www.fourmilab.ch/documents/digital-imprimatur/
        Dylan16807 11y ago
        But filtering packets because you don't have a routing destination is not done by a firewall. If I send a packet destined for 253.7.7.7 to a pure router, it will get dropped. The routing engine on the outside port has a destination for 15.x.x.x. Those packets go into the NAT engine. It does not have a destination for 10.x.x.x. Those packets suffer the same fate they would if you gave them to any router in the middle of the internet. Nowhere to send, abort.
- Dylan16807 11y ago
  When you say "someone on the Internet", you mean "someone who has a device on the same network segment as your router's external connection", right?
  - pdkl95 11y ago
    While that is still a serious risk, IP packets support a source routing header option header. http://www.networksorcery.com/enp/protocol/ip/option003.htm http://www.networksorcery.com/enp/protocol/ip/option003.htm http://www.networksorcery.com/enp/protocol/ip/option009.htm http://www.networksorcery.com/enp/protocol/ip/option009.htm I have no idea how well supported these headers are on the modern internet, but they are still part of the protocol.

lmm 11y ago

> except for the fact that there's no way for a host outside your NAT to initiate contact with any host inside your NAT Not true. Someone on the Internet can mark your router's external IP as the gateway for your internal network range and send packets to your internal devices fine. (In practice most NAT devices also do firewalling to prevent this, but the two functions are independent)

jameshart 11y ago
That's a characterization of a network gateway, not a NAT - there's no reason for a NAT router to accept and gateway packets addressed to its internal network since there's no reason for external hosts to be using those addresses in the first place. I would be astonished to find a NAT which also enabled routing to its private address space for external-origin packets.
- c22 11y ago
  You might be astonished to find such a NAT gateway without the functionality you describe, but what you're describing is a firewall.
  - Dylan16807 11y ago
    I would not describe having two different routing domains as a firewall. It's not a fence set up by a firewall that only lets correct packets through. It's a gaping chasm that only the NAT process crosses; packets are transformed as they cross and only some packets are possible to transform.
    - pdkl95 11y ago
      In general, if you're intentionally dropping packets it's a firewall. NAT is just an address translator. > only the NAT process crosses Nope, a router that doesn't have a firewall but supports NAT will route a packet if it has the proper destination address. That is, if a packet is received that has a destination address of e.g. 192.156.1.2, it will be routed onto the LAN. However, this is a very rare configuration, as most routers (including ~all home routers) also include a firewall that does packet filtering.
      - Dylan16807 11y ago
        >will route a packet if it has the proper destination address Iff the ports are logically connected. Nothing forces routing to be global. If they're separate, it doesn't have to intentionally drop packets. An example configuration: You're NATing 15.x.x.x to 10.x.x.x, with a 1:1 mapping. It's wide open. But it simply doesn't understand what to do with a packet addressed to 10.x.x.x on the external port. No destinations in the external port routing table contain 10.x.x.x, so it gives up.
        pdkl95 11y ago
        Filtering packets that don't match a criteria (such as a destination port) is done by a firewall, in addition to the NAT. These are typically used together, such as in the "full-cone" situation you described. Yes, I'm making a pedantic argument about terminology, but it's an important one because IPv6 means we can remove just the NAT part - all of the other filtering/etc features can remain. The goal is to make all devices addressable globally[1], which some people assume is a change in security. That isn't a correct assumption, as an IPv6 router (with a stateful firewall) should drop the same types of packets as their current IPv4-with-NAT router. [1] NAT badly damages the network by imposing an imprimatur[2] on the hosts behind the NAT. [2] https://www.fourmilab.ch/documents/digital-imprimatur/ https://www.fourmilab.ch/documents/digital-imprimatur/
        Dylan16807 11y ago
        But filtering packets because you don't have a routing destination is not done by a firewall. If I send a packet destined for 253.7.7.7 to a pure router, it will get dropped. The routing engine on the outside port has a destination for 15.x.x.x. Those packets go into the NAT engine. It does not have a destination for 10.x.x.x. Those packets suffer the same fate they would if you gave them to any router in the middle of the internet. Nowhere to send, abort.
Dylan16807 11y ago
When you say "someone on the Internet", you mean "someone who has a device on the same network segment as your router's external connection", right?
- pdkl95 11y ago
  While that is still a serious risk, IP packets support a source routing header option header. http://www.networksorcery.com/enp/protocol/ip/option003.htm http://www.networksorcery.com/enp/protocol/ip/option003.htm http://www.networksorcery.com/enp/protocol/ip/option009.htm http://www.networksorcery.com/enp/protocol/ip/option009.htm I have no idea how well supported these headers are on the modern internet, but they are still part of the protocol.