4 ms·

> There will never be "no firewall involved" because NAT functionality is implemented as part of the firewall in the real world. So, you are telling me that, s

• jandrese 8y ago
  Hint: It does. NAT is part of the netfilter module. Pull netfilter out of the kernel and you don't get NAT. It's even configured using the iptables command. You can configure your firewall to do no filtering, but your packets are still going to be processed by the firewall module. You will still get automatic protections like reverse path filtering for example. In practice when someone who doesn't know a damn thing about networking clicks the "do NAT" button on their router they're going to at least get basic protections like "No RFC 1918 destinations in on external interface" by default unless their vendor is pants on head. There's obviously more room to screw up if you're manually typing in iptables commands at a bash prompt, but at that point you should know better.
  • zAy0LfpBZLC8mAC 8y ago
    > Hint: It does. So, if I configure NAT, that prevents inbound connections? Or are you saying that it implies a firewall that won't filter a single packet, i.e., a firewall that is functionally equivalent to no firewall at all, but that you insist on calling a firewall because it makes you "win the argument" while not contributing anything useful to the discussion? Yeah, and next I'll be selling cars with an air bag that isn't hooked up. I guarantee you, your head will be processed by an air bag module when you have an accident. So, who are you to claim that my cars don't have an airbag!