5 ms·

No, it doesn't. NAT alone does not prevent inbound connections. You need a stateful firewall in addition to the NAT for that. And if you have that, well, yeah,

No, it doesn't. NAT alone does not prevent inbound connections. You need a stateful firewall in addition to the NAT for that. And if you have that, well, yeah, you obviously don't need NAT.

jandrese 8y ago
NAT is stateful, at least in the most common configuration. Static NAT is not something a home user needs to worry about. Honestly, if you have NAT you almost certainly have a firewall because NAT is nearly always implemented as part of the firewall. It may not be a properly configured firewall, but the functionality is there.
- X-Istence 8y ago
  If send a packet destined for "10.10.10.11" to "71.28.10.10", your router would happily figure out "what interface do I forward 10.10.10.11 to" and it would happily send it to the connected device, because NAT is not a firewall. There is no rule stating that "packets destined for 10.10.10.11 on eth0 should not be forwarded to eth1". That's what a firewall is for. And yes, your little router, is actually a router. It will dutifully take packets from one interface, look at it's routing table and figure where to spit it out. That's what it is supposed to do, NAT just adds a rule that says if a packet comes from eth1 and is destined for 0.0.0.0/0 (default route) out interface eth0 then we (the router) want to masquerade as if we are the source of that packet, so that this entire network looks as if it is coming from one single IP. No firewall involved, and packets arriving on eth0 are going to get routed to eth1 all the same, since after all, we are a faithful little router. This is how routing has worked since the dawn of time. Adding a firewall means we can say "but I should never see traffic destined to 10.10.10.0/24 on eth0, so drop it". --- Either way, NAT may be part of the firewall but there is no requirement for it to be part of the firewall. When it comes to IPv6, just like IPv4, a firewall is required, and as soon as you have a firewall that blocks incoming traffic, then NAT becomes meaningless.
  - blackflame7000 8y ago
    So if I'm understanding correctly, by spoofing the destination IP you can effectively manipulate the routing pathway and bypass the NAT to communicate with devices on the LAN?
    - zAy0LfpBZLC8mAC 8y ago
      There is no "spoofing" or "manipulation" or "bypassing", it's simply sending a packet to the address and a router doing what a router does, in a use case that simply doesn't involve the NAT. The idea that NAT prevents inbound connections is simply a myth believed by tons of people who have no clue how IP works. It simply doesn't. So you don't need to do any "spoofing" or "manipulation" to "bypass" something that NAT simply doesn't do. You might as well say that you can bypass a P.O. box by spoofing the destination address and thus effectively manipulating the snail mail routing. No, it's simply the case that you can address letters to street addresses and the postal service will deliver them to the address written on the envelope. Your mistake is in the completely baseless assumption that a P.O. box is supposed to prevent letters from being delivered to your street address.
      - blackflame7000 8y ago
        Then why is it necessary to Port Forward / have an Open NAT in order to connect remotely in most cases such as online gaming or ssh?
        AstralStorm 8y ago
        That is PAT not NAT. Port numbers are a scarce resource and there are various ways to allocate them. This may be a 1:1 or 1:random or n:n static range or n:n random. A stateful PAT would inspect packets to set up port translation and these things used to have lots of bugs and no filtering to check if the packet is from internal or external network at times. You can often still send to the direct target port and IP if you guess or figure out the mapping. Scanning 64k numbers with packets is not that hard.
        8y ago
- takeda 8y ago
  What you are talking about is PAT. PAT unlike NAT requires firewall to operate. What he pointed out is that if you have a firewall you can provide security through that, you don't need NAT or PAT. In fact having just a firewall is safer, because it is simpler
- zAy0LfpBZLC8mAC 8y ago
  > NAT is stateful, at least in the most common configuration. Which doesn't make it a firewall, just stateful NAT. > Honestly, if you have NAT you almost certainly have a firewall because NAT is nearly always implemented as part of the firewall. It may not be a properly configured firewall, but the functionality is there. Not sure what your point is here?! That a NAT without a firewall would do the job just as well? (no, it wouldn't) That there is some implementation overlap between the code you need for a stateful NAT and a stateful firewall? (yeah, so what?) That stateful NAT being implemented and configured on a device guarantees there is also a working stateful firewall? (no, it obviously doesn't) That there is some security benefit to having the NAT in addition to the stateful firewall? (no, there isn't) For the user, it's completely irrelevant whether "the functionality is there" if it isn't actually set up to do the job the user requires. And NAT only obfuscates things, as is demonstrated by this very thread: Without NAT, it is trivial to check whether there is a stateful packet filter or not. With NAT, it's difficult to test, and most people obviously aren't even aware that there would be something to test because they think NAT implies a stateful firewall.
  - jandrese 8y ago
    The point is that when you have NAT you already have a firewall because they come as a package. For practical purposes complaining that "NAT ins't a firewall" is silly because when you have NAT you always have a firewall too. In the real world SOHO routers that implement NAT also include the absolute bare bones firewall functionality of "block private addresses on the WAN port". Hand wringing over "but if someone convinces my ISP to route a 192.168.x.x packet to my home it could bypass NAT!" is pointless.
    - zAy0LfpBZLC8mAC 8y ago
      You are simply missing the point of the discussion. Even if NAT always implied a firewall, that doesn't change that the NAT is not the thing that is keeping you safe. The firewall is what is keeping you safe. That's why you don't need the NAT to stay safe. You can just drop the NAT and keep the firewall and everything will be fine. You might as well say that a car radio keeps you safe in an accident. Because a car with a car radio for practical purposes nowadays comes with an air bag! Yeah, sure it does, but it's just nonsensical to conclude from that that the car radio is what is keeping you safe. It's not that buying a car with a car radio isn't a way to keep you safe in an accident, it's just that the car radio is completely irrelevant to the problem. Buy the same car without a car radio and you will be just as safe.

No, it doesn't. NAT alone does not prevent inbound connections. You need a stateful firewall in addition to the NAT for that. And if you have that, well, yeah, you obviously don't need NAT.

jandrese 8y ago

NAT is stateful, at least in the most common configuration. Static NAT is not something a home user needs to worry about. Honestly, if you have NAT you almost certainly have a firewall because NAT is nearly always implemented as part of the firewall. It may not be a properly configured firewall, but the functionality is there.

X-Istence 8y ago
If send a packet destined for "10.10.10.11" to "71.28.10.10", your router would happily figure out "what interface do I forward 10.10.10.11 to" and it would happily send it to the connected device, because NAT is not a firewall. There is no rule stating that "packets destined for 10.10.10.11 on eth0 should not be forwarded to eth1". That's what a firewall is for. And yes, your little router, is actually a router. It will dutifully take packets from one interface, look at it's routing table and figure where to spit it out. That's what it is supposed to do, NAT just adds a rule that says if a packet comes from eth1 and is destined for 0.0.0.0/0 (default route) out interface eth0 then we (the router) want to masquerade as if we are the source of that packet, so that this entire network looks as if it is coming from one single IP. No firewall involved, and packets arriving on eth0 are going to get routed to eth1 all the same, since after all, we are a faithful little router. This is how routing has worked since the dawn of time. Adding a firewall means we can say "but I should never see traffic destined to 10.10.10.0/24 on eth0, so drop it". --- Either way, NAT may be part of the firewall but there is no requirement for it to be part of the firewall. When it comes to IPv6, just like IPv4, a firewall is required, and as soon as you have a firewall that blocks incoming traffic, then NAT becomes meaningless.
- blackflame7000 8y ago
  So if I'm understanding correctly, by spoofing the destination IP you can effectively manipulate the routing pathway and bypass the NAT to communicate with devices on the LAN?
  - zAy0LfpBZLC8mAC 8y ago
    There is no "spoofing" or "manipulation" or "bypassing", it's simply sending a packet to the address and a router doing what a router does, in a use case that simply doesn't involve the NAT. The idea that NAT prevents inbound connections is simply a myth believed by tons of people who have no clue how IP works. It simply doesn't. So you don't need to do any "spoofing" or "manipulation" to "bypass" something that NAT simply doesn't do. You might as well say that you can bypass a P.O. box by spoofing the destination address and thus effectively manipulating the snail mail routing. No, it's simply the case that you can address letters to street addresses and the postal service will deliver them to the address written on the envelope. Your mistake is in the completely baseless assumption that a P.O. box is supposed to prevent letters from being delivered to your street address.
    - blackflame7000 8y ago
      Then why is it necessary to Port Forward / have an Open NAT in order to connect remotely in most cases such as online gaming or ssh?
      - AstralStorm 8y ago
        That is PAT not NAT. Port numbers are a scarce resource and there are various ways to allocate them. This may be a 1:1 or 1:random or n:n static range or n:n random. A stateful PAT would inspect packets to set up port translation and these things used to have lots of bugs and no filtering to check if the packet is from internal or external network at times. You can often still send to the direct target port and IP if you guess or figure out the mapping. Scanning 64k numbers with packets is not that hard.
      - 8y ago
takeda 8y ago
What you are talking about is PAT. PAT unlike NAT requires firewall to operate. What he pointed out is that if you have a firewall you can provide security through that, you don't need NAT or PAT. In fact having just a firewall is safer, because it is simpler
zAy0LfpBZLC8mAC 8y ago
> NAT is stateful, at least in the most common configuration. Which doesn't make it a firewall, just stateful NAT. > Honestly, if you have NAT you almost certainly have a firewall because NAT is nearly always implemented as part of the firewall. It may not be a properly configured firewall, but the functionality is there. Not sure what your point is here?! That a NAT without a firewall would do the job just as well? (no, it wouldn't) That there is some implementation overlap between the code you need for a stateful NAT and a stateful firewall? (yeah, so what?) That stateful NAT being implemented and configured on a device guarantees there is also a working stateful firewall? (no, it obviously doesn't) That there is some security benefit to having the NAT in addition to the stateful firewall? (no, there isn't) For the user, it's completely irrelevant whether "the functionality is there" if it isn't actually set up to do the job the user requires. And NAT only obfuscates things, as is demonstrated by this very thread: Without NAT, it is trivial to check whether there is a stateful packet filter or not. With NAT, it's difficult to test, and most people obviously aren't even aware that there would be something to test because they think NAT implies a stateful firewall.
- jandrese 8y ago
  The point is that when you have NAT you already have a firewall because they come as a package. For practical purposes complaining that "NAT ins't a firewall" is silly because when you have NAT you always have a firewall too. In the real world SOHO routers that implement NAT also include the absolute bare bones firewall functionality of "block private addresses on the WAN port". Hand wringing over "but if someone convinces my ISP to route a 192.168.x.x packet to my home it could bypass NAT!" is pointless.
  - zAy0LfpBZLC8mAC 8y ago
    You are simply missing the point of the discussion. Even if NAT always implied a firewall, that doesn't change that the NAT is not the thing that is keeping you safe. The firewall is what is keeping you safe. That's why you don't need the NAT to stay safe. You can just drop the NAT and keep the firewall and everything will be fine. You might as well say that a car radio keeps you safe in an accident. Because a car with a car radio for practical purposes nowadays comes with an air bag! Yeah, sure it does, but it's just nonsensical to conclude from that that the car radio is what is keeping you safe. It's not that buying a car with a car radio isn't a way to keep you safe in an accident, it's just that the car radio is completely irrelevant to the problem. Buy the same car without a car radio and you will be just as safe.