4 ms·

This is true, and it's the very minor security benefit of NAT. However, without the stateful firewall in addition, you're wide open to attack. Have a windows P

This is true, and it's the very minor security benefit of NAT. However, without the stateful firewall in addition, you're wide open to attack. Have a windows PC? Did you try access a network share that exists outside your network? Well, now the SMB port is open. Anyone on the internet can reach it. Hopefully your desktop has a stateful firewall to mitigate the hole in your router.... There's going to be hundreds of other examples.

jankeymeulen 8y ago
Not really, NAT will keep track of destination address as well so unless the network share outside the network is also the address of an adversary, the SMB port isn't open to the internet.
- kiallmacinnes 8y ago
  NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall. NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs. (Well, PAT style NAT anyway... But that's what everyone here is talking about...)
- packet_nerd 8y ago
  Your thinking of the firewall that's built into most consumer routers. The exact technicalities of NAT (PAT actually) are not super well defined, and many implementations will not track the destination address.
dotancohen 8y ago
I don't think that remote network share access is very common among home Windows users, but Skype is. The last time that I pointed nmap at a PC with Skype on a conversation, the output of open ports was more than a screenful. Skype listens on literally tens of ports. Granted, this was a while ago.
- kiallmacinnes 8y ago
  It's been a while since I used a windows machine that wasn't connected to a domain / managed by a IT dept... But isn't windows file sharing enabled by default on home editions? And from memory, no authentication is required to interact with the service - it's only after you connect, obtain a list of shares, and attempt to open a share that authentication becomes required - leaving plenty of room for bugs to be exploited. At the end of the day, opening ports, any ports, is "dangerous".. A stateful firewall prevents much of the danger introduced by ports opened via NAT.
  - Dagger2 8y ago
    Windows ships with an enabled-by-default stateful firewall which rejects any connections from sources not on the local subnet.
    - kiallmacinnes 8y ago
      Right, but if someone thinks NAT on its own is protecting them... I'll bet they turned that local firewall off too the moment it got in the way of $thing they needed to do ;)

jankeymeulen 8y ago

Not really, NAT will keep track of destination address as well so unless the network share outside the network is also the address of an adversary, the SMB port isn't open to the internet.

kiallmacinnes 8y ago
NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall. NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs. (Well, PAT style NAT anyway... But that's what everyone here is talking about...)
packet_nerd 8y ago
Your thinking of the firewall that's built into most consumer routers. The exact technicalities of NAT (PAT actually) are not super well defined, and many implementations will not track the destination address.

dotancohen 8y ago

I don't think that remote network share access is very common among home Windows users, but Skype is. The last time that I pointed nmap at a PC with Skype on a conversation, the output of open ports was more than a screenful. Skype listens on literally tens of ports. Granted, this was a while ago.

kiallmacinnes 8y ago
It's been a while since I used a windows machine that wasn't connected to a domain / managed by a IT dept... But isn't windows file sharing enabled by default on home editions? And from memory, no authentication is required to interact with the service - it's only after you connect, obtain a list of shares, and attempt to open a share that authentication becomes required - leaving plenty of room for bugs to be exploited. At the end of the day, opening ports, any ports, is "dangerous".. A stateful firewall prevents much of the danger introduced by ports opened via NAT.
- Dagger2 8y ago
  Windows ships with an enabled-by-default stateful firewall which rejects any connections from sources not on the local subnet.
  - kiallmacinnes 8y ago
    Right, but if someone thinks NAT on its own is protecting them... I'll bet they turned that local firewall off too the moment it got in the way of $thing they needed to do ;)