4 ms·

> NAT has the side effect of behaving like a crappy firewall, so it gives you the added security of a crappy firewall. No, it doesn't. Unless by "crappy firewa

> NAT has the side effect of behaving like a crappy firewall, so it gives you the added security of a crappy firewall. No, it doesn't. Unless by "crappy firewall" you mean "a firewall that doesn't firewall". > I guess the advantage of NAT is that while you could forget to setup a firewall and not notice, you'll definitely notice it pretty quickly if you have a few computers on your LAN and you don't have a NAT... ... and you could then set up a NAT and still forget the firewall. Especially so if you mistakenly believe that NAT provides firewall functionality. There is absolutely nothing that prevents your ISP, and by extension anyone who happens to compromise your ISP('s router) from connecting to your RFC1918 addresses through your NAT gateway if you don't also have a firewall.

simias 9y ago
You're really splitting hairs here. A NAT prevents direct access from the outside to the LAN, except is certain situations. That's part of a firewall's functionality. It's actually probably the first rule you'd set up on most firewalls, then you'd open select ports as necessary (which you do with port forwarding on NATs). A firewall can do a whole lot more of course, but there is some overlap. Anyway, I think we're in agreement on the core of the issue, it's just a matter of definition. Praising NATs for security is like praising a snowstorm because it makes it harder to steal my car. I guess some people really like to see the glass half-full.
- zAy0LfpBZLC8mAC 9y ago
  > A NAT prevents direct access from the outside to the LAN, except is certain situations. Well, an unreliable link prevents direct access from the outside to the LAN, except is certain situations!? Yes, there are certain scenarios of remote access that are prevented by NAT. But they are a lot less than what people generally think. ISPs' networks not being configured particularly securely is not exactly unheard of, from default passwords on routers to broken VLAN setups in FTTC/B/H setups where people could talk directly on the same ethernet to their neighbours' routers. And even if that is all configured perfectly, you still add their network and their staff to your trusted base. That might not be a big concern for home networks, but this subthread was also and in particular about corporate networks, where targeted attacks are much more likely, and in that case, NAT is in no way a "good enough" solution.
  - lolc 9y ago
    Crossing a router that does NAT is not easy, here's the possible attacks I see: 1. Somebody on the inside is punching holes for you, then you're already inside and even a firewall would not protect against it. 2. You're hijacking existing connections or sending spoofed packets. That's a vector firewalls also have trouble protecting against. 3. The router NAT implementation might have a defect you can exploit. Because NAT isn't intended as a protection measure, it's implementation might be more likely to have flaws than comparable firewall implementations.[1] In summary, flipping the NAT switch will give you basic protection much as a basic firewall does. That does not make NAT a good technology. But don't dismiss it just because you don't like it. [1] Though actually in most cases if you fumble the NAT configuration, you won't have any connections at all. Whereas if you fumble your firewall configuration, your gateway might be open both ways and you don't notice. So NAT is easier to get right. It's not simple, it's ugly and easy!
    - zAy0LfpBZLC8mAC 9y ago
      I don't dismiss NAT because I don't like it, I am just stating the fact that it does not provide any security, despite what many people, including you, believe. Your list is missing one point: 4. They just send you a packet addressed to the internal address of one of your devices. NAT does not prevent inbound connections. A NAT gateway is just a router with additional NAT functionality. When an inbound packet arrives, a NAT gateway will do two things: 1. Check whether the packet belongs to a flow in the table of NATed connections. If so, rewrite the destination address/port to the internal values. 2. Check whether the destination is in the table of port forwardings. If so, add an entry to the table of NATed connections and rewrite the destination port address to the internal values. Other than that, it's just a router. If it receives a packet from the WAN that is addressed to the LAN, that probable won't match either of those two cases, so it's simply forwarded unchanged. The only reason why you cannot just send anyone who uses such a NAT gateway a packet to their LAN is because their ISP doesn't route the address range of their LAN to their router. But the ISP or anyone compromising the ISP can just do that. That is, unless the same device also contains a stateful packet filter firewall. Which you can have without any NAT, with IPv6 just as with IPv4. NAT does not provide security, really.

simias 9y ago

You're really splitting hairs here. A NAT prevents direct access from the outside to the LAN, except is certain situations. That's part of a firewall's functionality. It's actually probably the first rule you'd set up on most firewalls, then you'd open select ports as necessary (which you do with port forwarding on NATs). A firewall can do a whole lot more of course, but there is some overlap. Anyway, I think we're in agreement on the core of the issue, it's just a matter of definition. Praising NATs for security is like praising a snowstorm because it makes it harder to steal my car. I guess some people really like to see the glass half-full.

zAy0LfpBZLC8mAC 9y ago
> A NAT prevents direct access from the outside to the LAN, except is certain situations. Well, an unreliable link prevents direct access from the outside to the LAN, except is certain situations!? Yes, there are certain scenarios of remote access that are prevented by NAT. But they are a lot less than what people generally think. ISPs' networks not being configured particularly securely is not exactly unheard of, from default passwords on routers to broken VLAN setups in FTTC/B/H setups where people could talk directly on the same ethernet to their neighbours' routers. And even if that is all configured perfectly, you still add their network and their staff to your trusted base. That might not be a big concern for home networks, but this subthread was also and in particular about corporate networks, where targeted attacks are much more likely, and in that case, NAT is in no way a "good enough" solution.
- lolc 9y ago
  Crossing a router that does NAT is not easy, here's the possible attacks I see: 1. Somebody on the inside is punching holes for you, then you're already inside and even a firewall would not protect against it. 2. You're hijacking existing connections or sending spoofed packets. That's a vector firewalls also have trouble protecting against. 3. The router NAT implementation might have a defect you can exploit. Because NAT isn't intended as a protection measure, it's implementation might be more likely to have flaws than comparable firewall implementations.[1] In summary, flipping the NAT switch will give you basic protection much as a basic firewall does. That does not make NAT a good technology. But don't dismiss it just because you don't like it. [1] Though actually in most cases if you fumble the NAT configuration, you won't have any connections at all. Whereas if you fumble your firewall configuration, your gateway might be open both ways and you don't notice. So NAT is easier to get right. It's not simple, it's ugly and easy!
  - zAy0LfpBZLC8mAC 9y ago
    I don't dismiss NAT because I don't like it, I am just stating the fact that it does not provide any security, despite what many people, including you, believe. Your list is missing one point: 4. They just send you a packet addressed to the internal address of one of your devices. NAT does not prevent inbound connections. A NAT gateway is just a router with additional NAT functionality. When an inbound packet arrives, a NAT gateway will do two things: 1. Check whether the packet belongs to a flow in the table of NATed connections. If so, rewrite the destination address/port to the internal values. 2. Check whether the destination is in the table of port forwardings. If so, add an entry to the table of NATed connections and rewrite the destination port address to the internal values. Other than that, it's just a router. If it receives a packet from the WAN that is addressed to the LAN, that probable won't match either of those two cases, so it's simply forwarded unchanged. The only reason why you cannot just send anyone who uses such a NAT gateway a packet to their LAN is because their ISP doesn't route the address range of their LAN to their router. But the ISP or anyone compromising the ISP can just do that. That is, unless the same device also contains a stateful packet filter firewall. Which you can have without any NAT, with IPv6 just as with IPv4. NAT does not provide security, really.