3 ms·

Then you're doing something very wrong. You can't rely on NAT to stop connections, because that's not a thing NAT does. You need to be using a firewall. NAT is

Then you're doing something very wrong. You can't rely on NAT to stop connections, because that's not a thing NAT does. You need to be using a firewall. NAT is just an extra, useless, complicated and unnecessary thing to be adding to the top of that; one that makes it hard to understand how your network is even working, and which makes it harder rather than easier to secure.

umanwizard 7y ago
Can you explain how an outside person (other than my ISP) can make an outside connection to my laptop despite being behind a NAT? Assuming for concreteness that my laptop's internal (NATted) address is 192.168.1.123 and my router's public address is 123.45.67.89. What sequence of commands would you type to open a TCP connection to my laptop?
- takeda 7y ago
  NAT is implemented on a firewall, the blocking of incoming connections is a side effect and isn't even intentional (that's why UPnP exists). Since you already have a firewall you can just add a single rule that block incoming connections and that's all you actually need.
- ATsch 7y ago
  You are right that it would be hard to open a TCP connection with you on a specific target port on a 1:N NAT without UPnP. If you could, IPv4 exhaustion would not be an issue. However, NAT is just a mapping from an internal IP to an external Port number. With pure NAT, once you have created a connection to the outside, anyone can send packets to that external port, and have them delivered to your device. Of course, this mapping is inherently lossy. You are mapping the port space of one device onto N devices. This does mean external IPs can only send your devices packets on ports they have previously used as source ports, but you are still not safe. You might own devices that, for example, have vulnerabilities in their networking stack. Not that rare. You also might not want to disclose the number of devices active in a network, allow them to be fingerprinted by their response, or similar. Some UDP client applications might also not check the IP addresses of incoming packets. UDP server applications also commonly use the same socket for connections to other hosts as it listens on. So, to elaborate on that last example, you might run, say, a video surveillance server. It might listen for RTP on UDP port 12345. It then uses that same socket to send a UDP packet to licensecheck.example.com. That packet will have a source port of 12345. NAT will then map internal_ip:12345 to external_ip:xyz. Anyone can now view your cameras on external_ip:xyz. So either way, you'll want a stateful firewall. Deny incoming, allow outgoing. That's what firewalls are there for, and that's what gives you your security, NAT or no NAT.
- Dagger2 7y ago
  If you have routing to the IP, then it's just a matter of: $ telnet <ip> <port> If you don't have routing, then you'll need to arrange it somehow. With the example addresses you gave, you could do it by being on your immediate upstream network and then running: $ ip route add 192.168.1.123/24 via 123.45.67.89 $ telnet 192.168.1.123 <port>
JohnFen 7y ago
> You need to be using a firewall. Indeed, I never said otherwise. What I'm saying is that I want to disallow all incoming connections to any machine that isn't in my yellow zone, and selectively forward some traffic to servers in my green zone. I can absolutely use router and firewall rules to accomplish that. But when I do, I've essentially implemented a NAT.

umanwizard 7y ago

Can you explain how an outside person (other than my ISP) can make an outside connection to my laptop despite being behind a NAT? Assuming for concreteness that my laptop's internal (NATted) address is 192.168.1.123 and my router's public address is 123.45.67.89. What sequence of commands would you type to open a TCP connection to my laptop?

takeda 7y ago
NAT is implemented on a firewall, the blocking of incoming connections is a side effect and isn't even intentional (that's why UPnP exists). Since you already have a firewall you can just add a single rule that block incoming connections and that's all you actually need.
ATsch 7y ago
You are right that it would be hard to open a TCP connection with you on a specific target port on a 1:N NAT without UPnP. If you could, IPv4 exhaustion would not be an issue. However, NAT is just a mapping from an internal IP to an external Port number. With pure NAT, once you have created a connection to the outside, anyone can send packets to that external port, and have them delivered to your device. Of course, this mapping is inherently lossy. You are mapping the port space of one device onto N devices. This does mean external IPs can only send your devices packets on ports they have previously used as source ports, but you are still not safe. You might own devices that, for example, have vulnerabilities in their networking stack. Not that rare. You also might not want to disclose the number of devices active in a network, allow them to be fingerprinted by their response, or similar. Some UDP client applications might also not check the IP addresses of incoming packets. UDP server applications also commonly use the same socket for connections to other hosts as it listens on. So, to elaborate on that last example, you might run, say, a video surveillance server. It might listen for RTP on UDP port 12345. It then uses that same socket to send a UDP packet to licensecheck.example.com. That packet will have a source port of 12345. NAT will then map internal_ip:12345 to external_ip:xyz. Anyone can now view your cameras on external_ip:xyz. So either way, you'll want a stateful firewall. Deny incoming, allow outgoing. That's what firewalls are there for, and that's what gives you your security, NAT or no NAT.
Dagger2 7y ago
If you have routing to the IP, then it's just a matter of: $ telnet <ip> <port> If you don't have routing, then you'll need to arrange it somehow. With the example addresses you gave, you could do it by being on your immediate upstream network and then running: $ ip route add 192.168.1.123/24 via 123.45.67.89 $ telnet 192.168.1.123 <port>

JohnFen 7y ago

> You need to be using a firewall. Indeed, I never said otherwise. What I'm saying is that I want to disallow all incoming connections to any machine that isn't in my yellow zone, and selectively forward some traffic to servers in my green zone. I can absolutely use router and firewall rules to accomplish that. But when I do, I've essentially implemented a NAT.