> The problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you.

> The problem is that you can perfectly fail at implementing a firewall without breaking access to google.com, whereas broken NAT will mean no google for you. Broken NAT: iptables -t nat -A POSTROUTING -o outside0 -j MASQUERADE iptables -P FORWARD ACCEPT Google works fine, but when somebody sends the external interface of my router a packet with destination address 192.168.1.42 (as can often be done from any compromised router on the same cable segment), it gets forwarded to 192.168.1.42 on the internal network. NAT is not a firewall.