6 ms·

I've heard before that "NAT is not intended as security", but isn't the effect still the same, that an external device can't connect to a device behind NAT with

by jfries 7y ago

I've heard before that "NAT is not intended as security", but isn't the effect still the same, that an external device can't connect to a device behind NAT without explicit configuration allowing it?

AmericanChopper 7y ago
I find this argument to be completely ridiculous, and it’s become remarkably common among those who wish to justify some of IPv6s shortcomings. Whether it was designed to be a security control or not, it is one, and it’s an incredibly important one. Anything that controls how hosts are allowed to communicate with each other is a security control. The argument is so absurd that I literally can’t believe people go around parroting it.
- zAy0LfpBZLC8mAC 7y ago
  Please explain how NAT without a stateful firewall provides security against what.
  - AmericanChopper 7y ago
    It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. It’s a form of access control. What is your justification for saying that access control measures are not security controls? That is so incredibly contrived.
    - zAy0LfpBZLC8mAC 7y ago
      > It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. So, how does it do that? > What is your justification for saying that access control measures are not security controls? I am not saying that. It simply isn't an access control measure.
      - AmericanChopper 7y ago
        > So, how does it do that? By rewriting the IP headers of packets as they traverse routing devices. If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought. > It simply isn't an access control measure. Then why can’t other internet connected devices connect to my internet connected laptop? If I’d connected my laptop directly to my ISP then they would be able to. But I didn’t do that, I connected my home router to my ISP, and I connected my laptop to my home router, which is providing access control for me.
        zAy0LfpBZLC8mAC 7y ago
        > By rewriting the IP headers of packets as they traverse routing devices. How does that prevent hosts on that other network from accessing hosts on your "private network"? Like, a packet addressed to one of the hosts on your "private network" arrives at your NAT gateway from the "other network". How does the NAT rewrite the IP headers, and how does that provide access control? > If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought. Even that would not be contrived. If removing the NAT function does not change the security functions of a router, then the NAT obviously does not provide security, at best it implies the presence of certain security functions. But even that just isn't the case. > But I didn’t do that, I connected my home router to my ISP, and I connected my laptop to my home router, which is providing access control for me. Then that presumably is because your home router provides access control? What does that have to do with NAT, though?
        AmericanChopper 7y ago
        Because without NAT, none of the devices on my home network would be able to connect to any internet connected hosts. That is, unless I assigned internet routable addresses to their network interfaces. If I did that, I’d either have to install firewalls on my devices, or expose all services running on my devices to the internet. But I don’t have to do that, because my home router uses NAT to allow all devices on my home network to connect to the internet, without allowing other devices on the internet inbound access. If you have a point to make, then explain what it is. If you’re just gonna keep asking more contrived questions then I’ll presume you’re simply trolling.
TrueDuality 7y ago
That is generally true, but has weird edge cases. For example using not so specially crafted ICMP packets[1] two hosts each behind independent NATs can communicate with each other without any change to a firewall configuration. Also honorable mentions: The UPnP protocol & STUN servers [1]: https://samy.pl/chownat/ https://samy.pl/chownat/
- zx2c4 7y ago
  For an even cooler trick, check out pwnat, also from Samy: https://samy.pl/pwnat/ https://samy.pl/pwnat/ Server sends constant icmp pings with fixed payload to unreachable dead Internet IP. Client sends icmp time exceeded message to server containing original fixed ping subpayload, which the server NAT lets through because the payloads match as related traffic. Server then learns client IP and usual chownat udp hole punching tricks apply.
  - jakoblorz 7y ago
    Wow that's insane!
zAy0LfpBZLC8mAC 7y ago
No, NAT does not prevent connections, it only rewrites addresses. If your NAT router also has a stateful firewall, that is what prevents inbound connections, and removing the NAT from that equation does not change that.
- ComodoHacker 7y ago
  The point is NAT is actually a couple of rules in router's stateful firewall, it is done by firewall, and firewall can't do it without explicit configuration. There can't be 'default allow NAT' config.
  - zAy0LfpBZLC8mAC 7y ago
    ... which doesn't change that that "default allow" firewall will still pass through all packets, and thus allow access to all your internal devices/machines? Absence of NAT rules does not prevent packets from passing through the firewall, it only prevents rewriting of addresses.
    - ComodoHacker 7y ago
      The point you were objecting to was "external device can't connect to a device behind NAT without explicit configuration". Without NAT rules access to internal devices is prevented because packets don't get routed to private IPs.
      - zAy0LfpBZLC8mAC 7y ago
        That just isn't the case, though. A router without NAT and without a firewall (or a combined NAT/firewall thingy with default allow and no further rules) will route packets addressed to "private addresses" just fine. An IP router does not distinguish between "private addresses" and "non-private addresses": As long as there is a route for a prefix in the routing table, the router will route packets addressed to that prefix, and your typical home router most definitely does have a route for your LAN prefix.

by jfries 7y ago

I've heard before that "NAT is not intended as security", but isn't the effect still the same, that an external device can't connect to a device behind NAT without explicit configuration allowing it?

AmericanChopper 7y ago

I find this argument to be completely ridiculous, and it’s become remarkably common among those who wish to justify some of IPv6s shortcomings. Whether it was designed to be a security control or not, it is one, and it’s an incredibly important one. Anything that controls how hosts are allowed to communicate with each other is a security control. The argument is so absurd that I literally can’t believe people go around parroting it.

zAy0LfpBZLC8mAC 7y ago
Please explain how NAT without a stateful firewall provides security against what.
- AmericanChopper 7y ago
  It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. It’s a form of access control. What is your justification for saying that access control measures are not security controls? That is so incredibly contrived.
  - zAy0LfpBZLC8mAC 7y ago
    > It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. So, how does it do that? > What is your justification for saying that access control measures are not security controls? I am not saying that. It simply isn't an access control measure.
    - AmericanChopper 7y ago
      > So, how does it do that? By rewriting the IP headers of packets as they traverse routing devices. If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought. > It simply isn't an access control measure. Then why can’t other internet connected devices connect to my internet connected laptop? If I’d connected my laptop directly to my ISP then they would be able to. But I didn’t do that, I connected my home router to my ISP, and I connected my laptop to my home router, which is providing access control for me.
      - zAy0LfpBZLC8mAC 7y ago
        > By rewriting the IP headers of packets as they traverse routing devices. How does that prevent hosts on that other network from accessing hosts on your "private network"? Like, a packet addressed to one of the hosts on your "private network" arrives at your NAT gateway from the "other network". How does the NAT rewrite the IP headers, and how does that provide access control? > If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought. Even that would not be contrived. If removing the NAT function does not change the security functions of a router, then the NAT obviously does not provide security, at best it implies the presence of certain security functions. But even that just isn't the case. > But I didn’t do that, I connected my home router to my ISP, and I connected my laptop to my home router, which is providing access control for me. Then that presumably is because your home router provides access control? What does that have to do with NAT, though?
        AmericanChopper 7y ago
        Because without NAT, none of the devices on my home network would be able to connect to any internet connected hosts. That is, unless I assigned internet routable addresses to their network interfaces. If I did that, I’d either have to install firewalls on my devices, or expose all services running on my devices to the internet. But I don’t have to do that, because my home router uses NAT to allow all devices on my home network to connect to the internet, without allowing other devices on the internet inbound access. If you have a point to make, then explain what it is. If you’re just gonna keep asking more contrived questions then I’ll presume you’re simply trolling.

TrueDuality 7y ago

That is generally true, but has weird edge cases. For example using not so specially crafted ICMP packets[1] two hosts each behind independent NATs can communicate with each other without any change to a firewall configuration. Also honorable mentions: The UPnP protocol & STUN servers [1]: https://samy.pl/chownat/ https://samy.pl/chownat/

zx2c4 7y ago
For an even cooler trick, check out pwnat, also from Samy: https://samy.pl/pwnat/ https://samy.pl/pwnat/ Server sends constant icmp pings with fixed payload to unreachable dead Internet IP. Client sends icmp time exceeded message to server containing original fixed ping subpayload, which the server NAT lets through because the payloads match as related traffic. Server then learns client IP and usual chownat udp hole punching tricks apply.
- jakoblorz 7y ago
  Wow that's insane!

zAy0LfpBZLC8mAC 7y ago

No, NAT does not prevent connections, it only rewrites addresses. If your NAT router also has a stateful firewall, that is what prevents inbound connections, and removing the NAT from that equation does not change that.

ComodoHacker 7y ago
The point is NAT is actually a couple of rules in router's stateful firewall, it is done by firewall, and firewall can't do it without explicit configuration. There can't be 'default allow NAT' config.
- zAy0LfpBZLC8mAC 7y ago
  ... which doesn't change that that "default allow" firewall will still pass through all packets, and thus allow access to all your internal devices/machines? Absence of NAT rules does not prevent packets from passing through the firewall, it only prevents rewriting of addresses.
  - ComodoHacker 7y ago
    The point you were objecting to was "external device can't connect to a device behind NAT without explicit configuration". Without NAT rules access to internal devices is prevented because packets don't get routed to private IPs.
    - zAy0LfpBZLC8mAC 7y ago
      That just isn't the case, though. A router without NAT and without a firewall (or a combined NAT/firewall thingy with default allow and no further rules) will route packets addressed to "private addresses" just fine. An IP router does not distinguish between "private addresses" and "non-private addresses": As long as there is a route for a prefix in the routing table, the router will route packets addressed to that prefix, and your typical home router most definitely does have a route for your LAN prefix.