3 ms·

NAT doesn't prevent someone from sending a packet to your external interface (eth0) saying "this is destined for 10.10.10.9" which happens to be a 10.10.10.0/24

NAT doesn't prevent someone from sending a packet to your external interface (eth0) saying "this is destined for 10.10.10.9" which happens to be a 10.10.10.0/24 that you have assigned to eth1. Routers gonna route. Firewall is the one that would block that by saying "Sorry, but I shouldn't ever see packets destined for 10.10.10.0/24 on my eth0 interface".

jandrese 8y ago
Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. Also, every competently designed router has a rule that blocks that address range on the external interface. The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall.
- zAy0LfpBZLC8mAC 8y ago
  > Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. It's not necessarily the whole internet. If someone wants to compromise you, they only need to gain access to a router at your ISP. Also, ISPs do misconfigure stuff and allow direct layer 2 communication from neighbours, or accept routing protocol advertisements from customer-facing ports. Whether you like it or not, those things just happen, and a well-secured network has a firewall that makes sure it is completely inconsequential to you, so, no, you actually don't have "bigger issues", you have an absolute non-issue. > Also, every competently designed router has a rule that blocks that address range on the external interface. So, like those with hard-coded default passwords and shell injection vulnerabilities in the web admin interface? Is that the kind of competently designed router that you are talking about? Noone claims that a properly configured firewall isn't part of a "competently designed router". The question is how many of the routers out there are competently designed. If anything, this idea of "NAT implies a firewall" is one reason why border gateways end up "incompetently designed", because it doesn't, but if you believe that when designing such a device (be it for mass production or as an individual manual configuration), chances are you'll end up with a completely unprotected network. > The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall. That is like saying that saying "Word isn't Excel" is pedantry because Word is implemented as part of Excel. It's just nonsense. Both share some common technical foundation, and even code for common functionality. That doesn't make one "implemented as part of the other".
  - jandrese 8y ago
    Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor.
    - zAy0LfpBZLC8mAC 8y ago
      > Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. Which is just completely irrelevant to the question of whether the device has a firewall, see my inactive air bag analogy in my reply elsewhere in this thread. > It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor. Except that you are arguing for the idea that a chart builder necessarily implies a spreadsheet program and that therefore you need a chart builder, because otherwise you can't have a spreadsheet problem.

jandrese 8y ago

Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. Also, every competently designed router has a rule that blocks that address range on the external interface. The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall.

zAy0LfpBZLC8mAC 8y ago
> Yes, but if someone has managed to convince the internet to route a packet addressed to 10.10.10.0/24 to your subnet then you've got bigger issues. It's not necessarily the whole internet. If someone wants to compromise you, they only need to gain access to a router at your ISP. Also, ISPs do misconfigure stuff and allow direct layer 2 communication from neighbours, or accept routing protocol advertisements from customer-facing ports. Whether you like it or not, those things just happen, and a well-secured network has a firewall that makes sure it is completely inconsequential to you, so, no, you actually don't have "bigger issues", you have an absolute non-issue. > Also, every competently designed router has a rule that blocks that address range on the external interface. So, like those with hard-coded default passwords and shell injection vulnerabilities in the web admin interface? Is that the kind of competently designed router that you are talking about? Noone claims that a properly configured firewall isn't part of a "competently designed router". The question is how many of the routers out there are competently designed. If anything, this idea of "NAT implies a firewall" is one reason why border gateways end up "incompetently designed", because it doesn't, but if you believe that when designing such a device (be it for mass production or as an individual manual configuration), chances are you'll end up with a completely unprotected network. > The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall. That is like saying that saying "Word isn't Excel" is pedantry because Word is implemented as part of Excel. It's just nonsense. Both share some common technical foundation, and even code for common functionality. That doesn't make one "implemented as part of the other".
- jandrese 8y ago
  Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor.
  - zAy0LfpBZLC8mAC 8y ago
    > Most SOHO routers are built using either a Linux kernel where it is part of the netfilter (firewall) module or VxWorks where it is part of the Firewall subsystem. Which is just completely irrelevant to the question of whether the device has a firewall, see my inactive air bag analogy in my reply elsewhere in this thread. > It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor. Except that you are arguing for the idea that a chart builder necessarily implies a spreadsheet program and that therefore you need a chart builder, because otherwise you can't have a spreadsheet problem.