2 ms·

I don't dismiss NAT because I don't like it, I am just stating the fact that it does not provide any security, despite what many people, including you, believe.

I don't dismiss NAT because I don't like it, I am just stating the fact that it does not provide any security, despite what many people, including you, believe. Your list is missing one point: 4. They just send you a packet addressed to the internal address of one of your devices. NAT does not prevent inbound connections. A NAT gateway is just a router with additional NAT functionality. When an inbound packet arrives, a NAT gateway will do two things: 1. Check whether the packet belongs to a flow in the table of NATed connections. If so, rewrite the destination address/port to the internal values. 2. Check whether the destination is in the table of port forwardings. If so, add an entry to the table of NATed connections and rewrite the destination port address to the internal values. Other than that, it's just a router. If it receives a packet from the WAN that is addressed to the LAN, that probable won't match either of those two cases, so it's simply forwarded unchanged. The only reason why you cannot just send anyone who uses such a NAT gateway a packet to their LAN is because their ISP doesn't route the address range of their LAN to their router. But the ISP or anyone compromising the ISP can just do that. That is, unless the same device also contains a stateful packet filter firewall. Which you can have without any NAT, with IPv6 just as with IPv4. NAT does not provide security, really.

lolc 9y ago
NAT first and foremost means using private address ranges as opposed to being reachable on a public address. Sure a properly configured firewall would protect against many scenarios where NAT does not. Still, when somebody asks me whether they should flip the NAT switch on their router at home, I will say "yes it protects you". And that's true. A compromised upstream is a whole other league from most threats. At that point you've got to think about physically hardening your network equipment because the people who attack your ISP's network equipment would probably find it worthwhile to sneak into your home to compromise your network directly.

lolc 9y ago

NAT first and foremost means using private address ranges as opposed to being reachable on a public address. Sure a properly configured firewall would protect against many scenarios where NAT does not. Still, when somebody asks me whether they should flip the NAT switch on their router at home, I will say "yes it protects you". And that's true. A compromised upstream is a whole other league from most threats. At that point you've got to think about physically hardening your network equipment because the people who attack your ISP's network equipment would probably find it worthwhile to sneak into your home to compromise your network directly.