3 ms·

> It isn't. The arguments that it is a 'myth' boil down to arguments that it isn't perfect and doesn't protect against every attack. Well, guess what: no securi

> It isn't. The arguments that it is a 'myth' boil down to arguments that it isn't perfect and doesn't protect against every attack. Well, guess what: no security measure is perfect and no security measure protects against every attack. Except NAT provides absolutely no security, and complicates your network setup, thus making it more prone to configuration errors and other attack vectors due to complexity. > At the very least, a secure IPv6 network will need to hide end user addresses somehow, because giving everyone a unique, globally-addressable and trackable ID is a security showstopper. That is called privacy extensions. Also, it's pointless if you allow cookies in the browser.

simias 9y ago
Only Siths deal in absolutes. NAT has the side effect of behaving like a crappy firewall, so it gives you the added security of a crappy firewall. It's not much but it's something. But in the end I agree that it's a bit silly to use that as an argument in favor of NAT, if you want a firewall then use a firewall. I guess the advantage of NAT is that while you could forget to setup a firewall and not notice, you'll definitely notice it pretty quickly if you have a few computers on your LAN and you don't have a NAT...
- zAy0LfpBZLC8mAC 9y ago
  > NAT has the side effect of behaving like a crappy firewall, so it gives you the added security of a crappy firewall. No, it doesn't. Unless by "crappy firewall" you mean "a firewall that doesn't firewall". > I guess the advantage of NAT is that while you could forget to setup a firewall and not notice, you'll definitely notice it pretty quickly if you have a few computers on your LAN and you don't have a NAT... ... and you could then set up a NAT and still forget the firewall. Especially so if you mistakenly believe that NAT provides firewall functionality. There is absolutely nothing that prevents your ISP, and by extension anyone who happens to compromise your ISP('s router) from connecting to your RFC1918 addresses through your NAT gateway if you don't also have a firewall.
  - simias 9y ago
    You're really splitting hairs here. A NAT prevents direct access from the outside to the LAN, except is certain situations. That's part of a firewall's functionality. It's actually probably the first rule you'd set up on most firewalls, then you'd open select ports as necessary (which you do with port forwarding on NATs). A firewall can do a whole lot more of course, but there is some overlap. Anyway, I think we're in agreement on the core of the issue, it's just a matter of definition. Praising NATs for security is like praising a snowstorm because it makes it harder to steal my car. I guess some people really like to see the glass half-full.
    - zAy0LfpBZLC8mAC 9y ago
      > A NAT prevents direct access from the outside to the LAN, except is certain situations. Well, an unreliable link prevents direct access from the outside to the LAN, except is certain situations!? Yes, there are certain scenarios of remote access that are prevented by NAT. But they are a lot less than what people generally think. ISPs' networks not being configured particularly securely is not exactly unheard of, from default passwords on routers to broken VLAN setups in FTTC/B/H setups where people could talk directly on the same ethernet to their neighbours' routers. And even if that is all configured perfectly, you still add their network and their staff to your trusted base. That might not be a big concern for home networks, but this subthread was also and in particular about corporate networks, where targeted attacks are much more likely, and in that case, NAT is in no way a "good enough" solution.
      - lolc 9y ago
        Crossing a router that does NAT is not easy, here's the possible attacks I see: 1. Somebody on the inside is punching holes for you, then you're already inside and even a firewall would not protect against it. 2. You're hijacking existing connections or sending spoofed packets. That's a vector firewalls also have trouble protecting against. 3. The router NAT implementation might have a defect you can exploit. Because NAT isn't intended as a protection measure, it's implementation might be more likely to have flaws than comparable firewall implementations.[1] In summary, flipping the NAT switch will give you basic protection much as a basic firewall does. That does not make NAT a good technology. But don't dismiss it just because you don't like it. [1] Though actually in most cases if you fumble the NAT configuration, you won't have any connections at all. Whereas if you fumble your firewall configuration, your gateway might be open both ways and you don't notice. So NAT is easier to get right. It's not simple, it's ugly and easy!

simias 9y ago

Only Siths deal in absolutes. NAT has the side effect of behaving like a crappy firewall, so it gives you the added security of a crappy firewall. It's not much but it's something. But in the end I agree that it's a bit silly to use that as an argument in favor of NAT, if you want a firewall then use a firewall. I guess the advantage of NAT is that while you could forget to setup a firewall and not notice, you'll definitely notice it pretty quickly if you have a few computers on your LAN and you don't have a NAT...

zAy0LfpBZLC8mAC 9y ago
> NAT has the side effect of behaving like a crappy firewall, so it gives you the added security of a crappy firewall. No, it doesn't. Unless by "crappy firewall" you mean "a firewall that doesn't firewall". > I guess the advantage of NAT is that while you could forget to setup a firewall and not notice, you'll definitely notice it pretty quickly if you have a few computers on your LAN and you don't have a NAT... ... and you could then set up a NAT and still forget the firewall. Especially so if you mistakenly believe that NAT provides firewall functionality. There is absolutely nothing that prevents your ISP, and by extension anyone who happens to compromise your ISP('s router) from connecting to your RFC1918 addresses through your NAT gateway if you don't also have a firewall.
- simias 9y ago
  You're really splitting hairs here. A NAT prevents direct access from the outside to the LAN, except is certain situations. That's part of a firewall's functionality. It's actually probably the first rule you'd set up on most firewalls, then you'd open select ports as necessary (which you do with port forwarding on NATs). A firewall can do a whole lot more of course, but there is some overlap. Anyway, I think we're in agreement on the core of the issue, it's just a matter of definition. Praising NATs for security is like praising a snowstorm because it makes it harder to steal my car. I guess some people really like to see the glass half-full.
  - zAy0LfpBZLC8mAC 9y ago
    > A NAT prevents direct access from the outside to the LAN, except is certain situations. Well, an unreliable link prevents direct access from the outside to the LAN, except is certain situations!? Yes, there are certain scenarios of remote access that are prevented by NAT. But they are a lot less than what people generally think. ISPs' networks not being configured particularly securely is not exactly unheard of, from default passwords on routers to broken VLAN setups in FTTC/B/H setups where people could talk directly on the same ethernet to their neighbours' routers. And even if that is all configured perfectly, you still add their network and their staff to your trusted base. That might not be a big concern for home networks, but this subthread was also and in particular about corporate networks, where targeted attacks are much more likely, and in that case, NAT is in no way a "good enough" solution.
    - lolc 9y ago
      Crossing a router that does NAT is not easy, here's the possible attacks I see: 1. Somebody on the inside is punching holes for you, then you're already inside and even a firewall would not protect against it. 2. You're hijacking existing connections or sending spoofed packets. That's a vector firewalls also have trouble protecting against. 3. The router NAT implementation might have a defect you can exploit. Because NAT isn't intended as a protection measure, it's implementation might be more likely to have flaws than comparable firewall implementations.[1] In summary, flipping the NAT switch will give you basic protection much as a basic firewall does. That does not make NAT a good technology. But don't dismiss it just because you don't like it. [1] Though actually in most cases if you fumble the NAT configuration, you won't have any connections at all. Whereas if you fumble your firewall configuration, your gateway might be open both ways and you don't notice. So NAT is easier to get right. It's not simple, it's ugly and easy!