3 ms·

> NAT is stateful, at least in the most common configuration. Which doesn't make it a firewall, just stateful NAT. > Honestly, if you have NAT you almost cert

> NAT is stateful, at least in the most common configuration. Which doesn't make it a firewall, just stateful NAT. > Honestly, if you have NAT you almost certainly have a firewall because NAT is nearly always implemented as part of the firewall. It may not be a properly configured firewall, but the functionality is there. Not sure what your point is here?! That a NAT without a firewall would do the job just as well? (no, it wouldn't) That there is some implementation overlap between the code you need for a stateful NAT and a stateful firewall? (yeah, so what?) That stateful NAT being implemented and configured on a device guarantees there is also a working stateful firewall? (no, it obviously doesn't) That there is some security benefit to having the NAT in addition to the stateful firewall? (no, there isn't) For the user, it's completely irrelevant whether "the functionality is there" if it isn't actually set up to do the job the user requires. And NAT only obfuscates things, as is demonstrated by this very thread: Without NAT, it is trivial to check whether there is a stateful packet filter or not. With NAT, it's difficult to test, and most people obviously aren't even aware that there would be something to test because they think NAT implies a stateful firewall.

jandrese 8y ago
The point is that when you have NAT you already have a firewall because they come as a package. For practical purposes complaining that "NAT ins't a firewall" is silly because when you have NAT you always have a firewall too. In the real world SOHO routers that implement NAT also include the absolute bare bones firewall functionality of "block private addresses on the WAN port". Hand wringing over "but if someone convinces my ISP to route a 192.168.x.x packet to my home it could bypass NAT!" is pointless.
- zAy0LfpBZLC8mAC 8y ago
  You are simply missing the point of the discussion. Even if NAT always implied a firewall, that doesn't change that the NAT is not the thing that is keeping you safe. The firewall is what is keeping you safe. That's why you don't need the NAT to stay safe. You can just drop the NAT and keep the firewall and everything will be fine. You might as well say that a car radio keeps you safe in an accident. Because a car with a car radio for practical purposes nowadays comes with an air bag! Yeah, sure it does, but it's just nonsensical to conclude from that that the car radio is what is keeping you safe. It's not that buying a car with a car radio isn't a way to keep you safe in an accident, it's just that the car radio is completely irrelevant to the problem. Buy the same car without a car radio and you will be just as safe.

jandrese 8y ago

The point is that when you have NAT you already have a firewall because they come as a package. For practical purposes complaining that "NAT ins't a firewall" is silly because when you have NAT you always have a firewall too. In the real world SOHO routers that implement NAT also include the absolute bare bones firewall functionality of "block private addresses on the WAN port". Hand wringing over "but if someone convinces my ISP to route a 192.168.x.x packet to my home it could bypass NAT!" is pointless.

zAy0LfpBZLC8mAC 8y ago
You are simply missing the point of the discussion. Even if NAT always implied a firewall, that doesn't change that the NAT is not the thing that is keeping you safe. The firewall is what is keeping you safe. That's why you don't need the NAT to stay safe. You can just drop the NAT and keep the firewall and everything will be fine. You might as well say that a car radio keeps you safe in an accident. Because a car with a car radio for practical purposes nowadays comes with an air bag! Yeah, sure it does, but it's just nonsensical to conclude from that that the car radio is what is keeping you safe. It's not that buying a car with a car radio isn't a way to keep you safe in an accident, it's just that the car radio is completely irrelevant to the problem. Buy the same car without a car radio and you will be just as safe.