5 ms·
Stop acting like a NAT is going to save you. Protip: it isn't. You need proper firewalls, NAT, and physical network design. It's an entire security package, yo
by urda 8y ago
Stop acting like a NAT is going to save you. Protip: it isn't.
You need proper firewalls, NAT, and physical network design. It's an entire security package, you don't just slap NAT on it and call it done.
- blackflame7000 8y agoCould you help me understand some of the weaknesses of NAT vs a firewall? I was under the impression they were almost synonymous
- buzer 8y agoWith just NAT someone who is on same L2 domain as you could you packet that has private IP address in the destination address. If there's no firewall (i.e. no deny rules for packets coming from outside interface directed to private addresses or more commonly just blanket deny for all non-established/related packets), router would happily forward the packet. The return packet may end up being weird (router may or may not change the source IP & port), but the attacker would be able to talk to the given host. Firewalls may not even have NAT functionality. They are used to figure decide if packet coming from interface with some flags (source, destination, ip, protocol, port, tcp flags etc.) is allowed to be passed to another interface. These days virtually all routers have at least basic firewall support & firewalls have at least basic NAT support.
- X-Istence 8y agoI tried to explain it here in case someone wants a little more information with some "real" examples: https://news.ycombinator.com/edit?id=17141287 https://news.ycombinator.com/edit?id=17141287