7 ms·

NAT is not an 'implicit firewall'. Firewalls do packet filtering, NAT mangles routing. These are different things. If you're trying to solve the problems of "H

• kortilla 8y ago
  NAT overloading private IPs onto a single IP (what 99% of consumer routers are doing) is an implicit firewall. Without additional protocols like UPNP or manual configuration of port forwarding, nothing behind this style NAT can receive unsolicited traffic. “Mangling routing” to a single source IP requires state tracking of outbound sessions to know where to send inbound traffic. No outbound traffic, no session, no inbound traffic.
  • growse 8y ago
    If NAT is an implicit firewall, then so is an unplugged network cable. I guess it's technically true, but isn't a particularly meaningful assertion - you might as well say that NAT is also 'not a donkey'. Again, technically true, but doesn't really help. Firewalls are packet filters. Confusing routing and packet filtering doesn't help anybody solve any problems. We're talking (I think) about how to mitigate threats from the public internet by dropping unwanted traffic with IPv6. The answer is a firewall (as it is with IPv4).
    • nikanj 8y ago
      I can hook grandma up with a $30 chinese NAT box, disable UPNP and she's mostly safe from all sorts of port knocking attempts - while still having internet that seems to work great for her. What would be the ipv6 equivalent? You can call it a donkey all you want.
      • growse 8y ago
        The equivalent is buying her a $30 Chinese router that supports IPv6 and comes with a firewall enabled by default (or is configurable).
        • KMag 8y ago
          Exactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's obviously less complex. It's difficult to see how ripping out the address translation could be more exploitable or costly to maintain. Ideally, we'd start with things written from the beginning to be stateful firewalls, but if I worked for a home/small office router ventor, my first course of action would be to just ripp out that potentially buggy address translation part of our existing NAT implementation.
        • tjoff 8y ago
          Great! Which one is that? Do I need to buy it and perform some extensive testing first to figure that out? Looking forward to it!
          • jmanderley 8y ago
            Pretty much all of them?
            • tjoff 8y ago
              My expectation is far far lower. And those that are might not still be decent after an upgrade (and you won't know if the hardware or software you buy will be of another revision). Hardware that happens to be popular are often updated to a cheaper variant where the manufacturer rides on the fame and good reviews of the original version. So you can't even do the research once and expect it to hold for future purchases/replacements.
              • takeda 8y ago
                Well, instead having "expectations", how about just checking it yourself before spreading FUD?
    • Dylan16807 8y ago
      A connection-based NAT does filter! Any source not in the database gets the packet discarded.
      • kiallmacinnes 8y ago
        And this is the confusion most people have! NAT isn't doing that filtering, the stateful firewall is.. Every NAT device sold in a very long time has both features.. Some early DSL modems for example had only NAT, and they were horribly insecure. NAT is not a firewall, and provides near zero security. And, in combination with a stateful firewall, it provides exactly zero additional security.
        • iforgotpassword 8y ago
          But how so? If my public address gets a random packet and there are 5 devices on the lan side, which local address did those devices send unsolicited inbound traffic to? Where's the insecure part?
          • justincormack 8y ago
            Yes, because there is no firewall state. There is both firewall and NAT state for every established connection.
            • kiallmacinnes 8y ago
              Exactly. Remove the firewall state, and you're wide open for all the NAT'd ports. And if someone thinks they don't have any NAT ports, they would be wrong. You likely have 10's or 100's ports NATd for every device activity being used on your network.
          • pilif 8y ago
            To the various remote management ports listening on the DSL modem itself. Between RCE vulnerabilities, accidentally unauthenticated management features or even just upnp listening on the WAN port, there are infinite means for owning the network behind the device.
  • KMag 8y ago
    Nobody is advocating replacing cheap NAT home routers with unprotected routers. They're all advocating replacing cheap NAT home routers with cheap stateful firewall home routers. What the GP is trying to tell you is that you're conflating sateful filtering with NAT. If you rip the address translation part out of a NAT implementation, you get a stateful firewall. You're probably better off with a purpose-designed stateful firewall, but ripping the NAT out of NAT works and is an obvious reduction in complexity. Insisting that you lose packet filtering if you get rid of NAT is a straw man argument. Nobody is arguing for that. They just want to remove the address mangling portion of the cheap router while keeping the packet filtering.
  • lloeki 8y ago
    No it's not. Case in point, I've had a misconfigured router provided by an ISP with proper NAT but bad firewalling, and hacking on routes allowed me to jump into neighbors LANs on the same ISP. Crazy.
  • kiallmacinnes 8y ago
    This is true, and it's the very minor security benefit of NAT. However, without the stateful firewall in addition, you're wide open to attack. Have a windows PC? Did you try access a network share that exists outside your network? Well, now the SMB port is open. Anyone on the internet can reach it. Hopefully your desktop has a stateful firewall to mitigate the hole in your router.... There's going to be hundreds of other examples.
    • jankeymeulen 8y ago
      Not really, NAT will keep track of destination address as well so unless the network share outside the network is also the address of an adversary, the SMB port isn't open to the internet.
      • kiallmacinnes 8y ago
        NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall. NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs. (Well, PAT style NAT anyway... But that's what everyone here is talking about...)
      • packet_nerd 8y ago
        Your thinking of the firewall that's built into most consumer routers. The exact technicalities of NAT (PAT actually) are not super well defined, and many implementations will not track the destination address.
    • dotancohen 8y ago
      I don't think that remote network share access is very common among home Windows users, but Skype is. The last time that I pointed nmap at a PC with Skype on a conversation, the output of open ports was more than a screenful. Skype listens on literally tens of ports. Granted, this was a while ago.
      • kiallmacinnes 8y ago
  • packet_nerd 8y ago
    > nothing behind this style NAT can receive unsolicited traffic This isn't really 100% true though. Since IPv4 NAT was never standardized, many many variations exist in the wild and some can be exploited to send unsolicited traffic inside the network defeating the implicit "firewall" aspect of NAT. NAT translates IPs. Firewalls allow or block traffic based on a policy. In some configurations (static NAT, port forwarding, etc. etc.), there's no firewall aspect to NAT at all. In others (PAT, what this discussion is mostly about), there's often an implicit firewall, but different implementations have widely variable behavior, and it basically should not be depended on as a firewall. If you want to deny inbound unsolicited traffic, then you need a firewall.