7 ms·

And this is the confusion most people have! NAT isn't doing that filtering, the stateful firewall is.. Every NAT device sold in a very long time has both featu

And this is the confusion most people have! NAT isn't doing that filtering, the stateful firewall is.. Every NAT device sold in a very long time has both features.. Some early DSL modems for example had only NAT, and they were horribly insecure. NAT is not a firewall, and provides near zero security. And, in combination with a stateful firewall, it provides exactly zero additional security.

iforgotpassword 8y ago
But how so? If my public address gets a random packet and there are 5 devices on the lan side, which local address did those devices send unsolicited inbound traffic to? Where's the insecure part?
- justincormack 8y ago
  Yes, because there is no firewall state. There is both firewall and NAT state for every established connection.
  - kiallmacinnes 8y ago
    Exactly. Remove the firewall state, and you're wide open for all the NAT'd ports. And if someone thinks they don't have any NAT ports, they would be wrong. You likely have 10's or 100's ports NATd for every device activity being used on your network.
- pilif 8y ago
  To the various remote management ports listening on the DSL modem itself. Between RCE vulnerabilities, accidentally unauthenticated management features or even just upnp listening on the WAN port, there are infinite means for owning the network behind the device.
  - iforgotpassword 8y ago
    But that's more of a general problem that still happens on modern devices, even with ipv6. ISP wants some port open on the device for remote management but is so incompetent that it's actually reachable worldwide.
    - pilif 8y ago
      Yes. I was just responding to the claim that with IPv4, thanks to NAT a malicious packet would not be able to be routed anywhere unsafe. A NAT router without any kind of firewall functionality is incredibly unsafe too so even the cheapest ones have some of it these days. Which follows that the cheapest IPv6 routers would also have a firewall and thus would not be inherently worse at protecting the internal network than a v4 router doing NAT would.
- kiallmacinnes 8y ago
  If one of those 5 tries to connect e.g. to a remote windows file server .. you now have an open port on your public IP which will accept packets from any IP on the internet and will forward them to the windows file share service on your desktop. Add a stateful firewall with connection tracking, and that port is only open to the 1 server you tried to connect to.
  - iforgotpassword 8y ago
    Yes that's true, but not a problem for TCP since the attacker had to know the outgoing port from the ephemeral port range your PC or router picked, and then had to take over the running TCP session by additionally knowing the connections state (sequence number etc). For UDP you indeed have higher chances of talking to that device in an unsolicited manner, and this has been exploited by games and later Skype in the past. So yes, indeed more insecure, I stand corrected. I'm still more worried for actual exploits or security holes even in modern devices that can do proper firewalling the ISPs provide due to incompetence or laziness. Like the TR069 port being open on many devices two years ago.
    - kiallmacinnes 8y ago
      Yes, the modem/router is likely buggy as hell, most "consumer grade" CPEs are. The best defence for that IMO is to remove as much code as possible - like the unnecessary for IPv6 NAT stack..
- Dagger2 8y ago
  If your public address gets a random packet then the packet is addressed to your router, not one of your local devices. This is insecure if the router is providing some insecure service on that port, but otherwise it's irrelevant to this discussion. The problem comes when your router receives a packet addressed to one of your local devices. Many people in this thread believe that if the router is NATing outbound connections, it'll drop this inbound packet, but that's not what happens -- the packet will actually be routed to whichever local device it was addressed to, just like any other packet would be. This should be fairly obvious, because the only thing NAT does is change the apparent source address on outbound connections. It does nothing at all to inbound ones (and you can demonstrate this to yourself by setting up a test network in some VMs and NATing traffic between them with Linux and iptables). (You can configure a NAT to do things to inbound connections using port forwarding rules and/or a DMZ, but those rules only apply to specific inbound connections. Connections not covered by those rules are treated as normal, and "as normal" for a router means normal routing.) NAT isn't a firewall, because it doesn't drop connections. All it does is rewrite addresses on connections, not decide which connections can and can't be made.
  - kiallmacinnes 8y ago
    > This should be fairly obvious, because the only thing NAT does is change the apparent source address on outbound connections. It does nothing at all to inbound ones (and you can demonstrate this to yourself by setting up a test network in some VMs and NATing traffic between them with Linux and iptables). Absolutely. It's trivial to demonstrate how utterly useless a router configured with NAT, with routing, but without a firewall is. (Useless in the context of a home CPE device for the average home internet subscriber..) As a side note, yes, packets arriving towards your router with a destination address on your LAN will be forwarded by the router piece of your router.. the firewall piece would prevent this. This is independent of the use of/absence of NAT though..
Dylan16807 8y ago
You can't just separate it out like that. It's impossible to do a connection-based NAT without state. But it's not trying to drop anything. You can set a default device to throw all incoming connections at. And with a pure NAT you can't set any rules about what to allow or drop. It only acts like a firewall from one very narrow angle.
- kiallmacinnes 8y ago
  This seems to be agreeing with me and many of the others? A stateful firewall is a useful thing on its own, but it's also a fundamental requirement for modern NAT implementations. NAT on the other hand is not a fundamental requirement for a firewall. NAT bolts onto a firewall, and it's the firewall that provides the security. Remove NAT, and you haven't lost anything in terms of security.
  - Dylan16807 8y ago
    I'm saying that such a NAT can exist by itself without a true firewall.
  - Dagger2 8y ago
    A stateful firewall isn't a fundamental requirement for NAT though, even modern NAT ("or actually PAT", as other posters seem to like saying...). State tracking is certainly a requirement, but tracking state is separate from firewalling based on that state. This is why firewalling is separate from NAT, and why NAT isn't a firewall. Yes, it's true that both NATing and firewalling rely on tracking state, and typically both NAT and firewalling are implemented together in the same software and hardware, but they're two separate behaviors and you can do one without doing the other.

iforgotpassword 8y ago

But how so? If my public address gets a random packet and there are 5 devices on the lan side, which local address did those devices send unsolicited inbound traffic to? Where's the insecure part?

justincormack 8y ago
Yes, because there is no firewall state. There is both firewall and NAT state for every established connection.
- kiallmacinnes 8y ago
  Exactly. Remove the firewall state, and you're wide open for all the NAT'd ports. And if someone thinks they don't have any NAT ports, they would be wrong. You likely have 10's or 100's ports NATd for every device activity being used on your network.
pilif 8y ago
To the various remote management ports listening on the DSL modem itself. Between RCE vulnerabilities, accidentally unauthenticated management features or even just upnp listening on the WAN port, there are infinite means for owning the network behind the device.
- iforgotpassword 8y ago
  But that's more of a general problem that still happens on modern devices, even with ipv6. ISP wants some port open on the device for remote management but is so incompetent that it's actually reachable worldwide.
  - pilif 8y ago
    Yes. I was just responding to the claim that with IPv4, thanks to NAT a malicious packet would not be able to be routed anywhere unsafe. A NAT router without any kind of firewall functionality is incredibly unsafe too so even the cheapest ones have some of it these days. Which follows that the cheapest IPv6 routers would also have a firewall and thus would not be inherently worse at protecting the internal network than a v4 router doing NAT would.
kiallmacinnes 8y ago
If one of those 5 tries to connect e.g. to a remote windows file server .. you now have an open port on your public IP which will accept packets from any IP on the internet and will forward them to the windows file share service on your desktop. Add a stateful firewall with connection tracking, and that port is only open to the 1 server you tried to connect to.
- iforgotpassword 8y ago
  Yes that's true, but not a problem for TCP since the attacker had to know the outgoing port from the ephemeral port range your PC or router picked, and then had to take over the running TCP session by additionally knowing the connections state (sequence number etc). For UDP you indeed have higher chances of talking to that device in an unsolicited manner, and this has been exploited by games and later Skype in the past. So yes, indeed more insecure, I stand corrected. I'm still more worried for actual exploits or security holes even in modern devices that can do proper firewalling the ISPs provide due to incompetence or laziness. Like the TR069 port being open on many devices two years ago.
  - kiallmacinnes 8y ago
    Yes, the modem/router is likely buggy as hell, most "consumer grade" CPEs are. The best defence for that IMO is to remove as much code as possible - like the unnecessary for IPv6 NAT stack..
Dagger2 8y ago
If your public address gets a random packet then the packet is addressed to your router, not one of your local devices. This is insecure if the router is providing some insecure service on that port, but otherwise it's irrelevant to this discussion. The problem comes when your router receives a packet addressed to one of your local devices. Many people in this thread believe that if the router is NATing outbound connections, it'll drop this inbound packet, but that's not what happens -- the packet will actually be routed to whichever local device it was addressed to, just like any other packet would be. This should be fairly obvious, because the only thing NAT does is change the apparent source address on outbound connections. It does nothing at all to inbound ones (and you can demonstrate this to yourself by setting up a test network in some VMs and NATing traffic between them with Linux and iptables). (You can configure a NAT to do things to inbound connections using port forwarding rules and/or a DMZ, but those rules only apply to specific inbound connections. Connections not covered by those rules are treated as normal, and "as normal" for a router means normal routing.) NAT isn't a firewall, because it doesn't drop connections. All it does is rewrite addresses on connections, not decide which connections can and can't be made.
- kiallmacinnes 8y ago
  > This should be fairly obvious, because the only thing NAT does is change the apparent source address on outbound connections. It does nothing at all to inbound ones (and you can demonstrate this to yourself by setting up a test network in some VMs and NATing traffic between them with Linux and iptables). Absolutely. It's trivial to demonstrate how utterly useless a router configured with NAT, with routing, but without a firewall is. (Useless in the context of a home CPE device for the average home internet subscriber..) As a side note, yes, packets arriving towards your router with a destination address on your LAN will be forwarded by the router piece of your router.. the firewall piece would prevent this. This is independent of the use of/absence of NAT though..

Dylan16807 8y ago

You can't just separate it out like that. It's impossible to do a connection-based NAT without state. But it's not trying to drop anything. You can set a default device to throw all incoming connections at. And with a pure NAT you can't set any rules about what to allow or drop. It only acts like a firewall from one very narrow angle.

kiallmacinnes 8y ago
This seems to be agreeing with me and many of the others? A stateful firewall is a useful thing on its own, but it's also a fundamental requirement for modern NAT implementations. NAT on the other hand is not a fundamental requirement for a firewall. NAT bolts onto a firewall, and it's the firewall that provides the security. Remove NAT, and you haven't lost anything in terms of security.
- Dylan16807 8y ago
  I'm saying that such a NAT can exist by itself without a true firewall.
- Dagger2 8y ago
  A stateful firewall isn't a fundamental requirement for NAT though, even modern NAT ("or actually PAT", as other posters seem to like saying...). State tracking is certainly a requirement, but tracking state is separate from firewalling based on that state. This is why firewalling is separate from NAT, and why NAT isn't a firewall. Yes, it's true that both NATing and firewalling rely on tracking state, and typically both NAT and firewalling are implemented together in the same software and hardware, but they're two separate behaviors and you can do one without doing the other.