4 ms·

NAT does not prevent inbound connections, and noone is giving devices "publicly reachable IP address". The only thing a sensible IPv6 setup does is that it give

NAT does not prevent inbound connections, and noone is giving devices "publicly reachable IP address". The only thing a sensible IPv6 setup does is that it gives every device a unique address. And the stateful firewall that you also need with IPv4 to prevent inbound connections works just as well with IPv6, so no need to add a pile of NAT crap.

jandrese 8y ago
> NAT does not prevent inbound connections True, but it also doesn't route them anywhere unless you've explicitly configured it to OR there was outbound traffic on that 5-tuple recently, so it's also wrong. The NAT functionality drops the errant packet on the floor just as much as a traditional firewall. Note: this is referring to dynamic NAT, which is the kind of NAT that every SOHO router supports by default out of the box and is the only kind normal users ever use.
- X-Istence 8y ago
  NAT doesn't prevent someone from sending a packet to your external interface (eth0) saying "this is destined for 10.10.10.9" which happens to be a 10.10.10.0/24 that you have assigned to eth1. Routers gonna route. Firewall is the one that would block that by saying "Sorry, but I shouldn't ever see packets destined for 10.10.10.0/24 on my eth0 interface".
  - jandrese 8y ago
    Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. Also, every competently designed router has a rule that blocks that address range on the external interface. The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall.
    - zAy0LfpBZLC8mAC 8y ago
      > Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. It's not necessarily the whole internet. If someone wants to compromise you, they only need to gain access to a router at your ISP. Also, ISPs do misconfigure stuff and allow direct layer 2 communication from neighbours, or accept routing protocol advertisements from customer-facing ports. Whether you like it or not, those things just happen, and a well-secured network has a firewall that makes sure it is completely inconsequential to you, so, no, you actually don't have "bigger issues", you have an absolute non-issue. > Also, every competently designed router has a rule that blocks that address range on the external interface. So, like those with hard-coded default passwords and shell injection vulnerabilities in the web admin interface? Is that the kind of competently designed router that you are talking about? Noone claims that a properly configured firewall isn't part of a "competently designed router". The question is how many of the routers out there are competently designed. If anything, this idea of "NAT implies a firewall" is one reason why border gateways end up "incompetently designed", because it doesn't, but if you believe that when designing such a device (be it for mass production or as an individual manual configuration), chances are you'll end up with a completely unprotected network. > The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall. That is like saying that saying "Word isn't Excel" is pedantry because Word is implemented as part of Excel. It's just nonsense. Both share some common technical foundation, and even code for common functionality. That doesn't make one "implemented as part of the other".
      - jandrese 8y ago
        Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor.
        zAy0LfpBZLC8mAC 8y ago
        > Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. Which is just completely irrelevant to the question of whether the device has a firewall, see my inactive air bag analogy in my reply elsewhere in this thread. > It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor. Except that you are arguing for the idea that a chart builder necessarily implies a spreadsheet program and that therefore you need a chart builder, because otherwise you can't have a spreadsheet problem.
- zAy0LfpBZLC8mAC 8y ago
  > True, but it also doesn't route them anywhere unless you've explicitly configured it to OR there was outbound traffic on that 5-tuple recently, so it's also wrong. No, what you are describing is a stateful firewall. Also, neither a NAT nor a firewall route anything, that's what a router is for. > The NAT functionality drops the errant packet on the floor just as much as a traditional firewall. NAT does not drop anything. NAT translates. Hence, "network address translation". And it's not an errant packet. It's simply a packet addressed to an address reachable on one of the interfaces attached to the router, and not matching any NAT rules that would initiate translation of a connection nor any existing tracking state of a previously seen connection where return packets need to be translated. Packets that don't fit in either of those categories are simply left untouched by a NAT. And the router the NAT is running on will then just forward them as any IP router would do. That is, unless there is a stateful firewall present as well. In which case you still don't need the NAT to use it.

jandrese 8y ago

> NAT does not prevent inbound connections True, but it also doesn't route them anywhere unless you've explicitly configured it to OR there was outbound traffic on that 5-tuple recently, so it's also wrong. The NAT functionality drops the errant packet on the floor just as much as a traditional firewall. Note: this is referring to dynamic NAT, which is the kind of NAT that every SOHO router supports by default out of the box and is the only kind normal users ever use.

X-Istence 8y ago
NAT doesn't prevent someone from sending a packet to your external interface (eth0) saying "this is destined for 10.10.10.9" which happens to be a 10.10.10.0/24 that you have assigned to eth1. Routers gonna route. Firewall is the one that would block that by saying "Sorry, but I shouldn't ever see packets destined for 10.10.10.0/24 on my eth0 interface".
- jandrese 8y ago
  Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. Also, every competently designed router has a rule that blocks that address range on the external interface. The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall.
  - zAy0LfpBZLC8mAC 8y ago
    > Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. It's not necessarily the whole internet. If someone wants to compromise you, they only need to gain access to a router at your ISP. Also, ISPs do misconfigure stuff and allow direct layer 2 communication from neighbours, or accept routing protocol advertisements from customer-facing ports. Whether you like it or not, those things just happen, and a well-secured network has a firewall that makes sure it is completely inconsequential to you, so, no, you actually don't have "bigger issues", you have an absolute non-issue. > Also, every competently designed router has a rule that blocks that address range on the external interface. So, like those with hard-coded default passwords and shell injection vulnerabilities in the web admin interface? Is that the kind of competently designed router that you are talking about? Noone claims that a properly configured firewall isn't part of a "competently designed router". The question is how many of the routers out there are competently designed. If anything, this idea of "NAT implies a firewall" is one reason why border gateways end up "incompetently designed", because it doesn't, but if you believe that when designing such a device (be it for mass production or as an individual manual configuration), chances are you'll end up with a completely unprotected network. > The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall. That is like saying that saying "Word isn't Excel" is pedantry because Word is implemented as part of Excel. It's just nonsense. Both share some common technical foundation, and even code for common functionality. That doesn't make one "implemented as part of the other".
    - jandrese 8y ago
      Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor.
      - zAy0LfpBZLC8mAC 8y ago
        > Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. Which is just completely irrelevant to the question of whether the device has a firewall, see my inactive air bag analogy in my reply elsewhere in this thread. > It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor. Except that you are arguing for the idea that a chart builder necessarily implies a spreadsheet program and that therefore you need a chart builder, because otherwise you can't have a spreadsheet problem.
zAy0LfpBZLC8mAC 8y ago
> True, but it also doesn't route them anywhere unless you've explicitly configured it to OR there was outbound traffic on that 5-tuple recently, so it's also wrong. No, what you are describing is a stateful firewall. Also, neither a NAT nor a firewall route anything, that's what a router is for. > The NAT functionality drops the errant packet on the floor just as much as a traditional firewall. NAT does not drop anything. NAT translates. Hence, "network address translation". And it's not an errant packet. It's simply a packet addressed to an address reachable on one of the interfaces attached to the router, and not matching any NAT rules that would initiate translation of a connection nor any existing tracking state of a previously seen connection where return packets need to be translated. Packets that don't fit in either of those categories are simply left untouched by a NAT. And the router the NAT is running on will then just forward them as any IP router would do. That is, unless there is a stateful firewall present as well. In which case you still don't need the NAT to use it.