3 ms·

Then you want a firewall whether or not you’re NATing. NAT is not a security measure. It offers you no blocking of incoming traffic. It has no inherent security

Then you want a firewall whether or not you’re NATing. NAT is not a security measure. It offers you no blocking of incoming traffic. It has no inherent security value.

umanwizard 7y ago
How does NAT not block incoming traffic? I'm genuinely confused. Let's assume my laptop is behind a typical home network NAT with public address 123.45.67.89 and internal address 192.168.1.123 . What sequence of commands do you type to send traffic to my laptop?
- crankylinuxuser 7y ago
  > How does NAT not block incoming traffic? https://samy.pl/pwnat/ https://samy.pl/pwnat/ NAT != firewall
  - umanwizard 7y ago
    This seems to require both ends to be running the pwnat software. Again, assuming I am not running any special software, what sequence of commands would you type to send a packet to 192.168.1.123 natted behind 123.45.67.89 ?
    - crankylinuxuser 7y ago
      It's indeed true, if in your contrived case, you have a VM doing nothing inside a NAT behind a public IP, you couldn't access it. https://tools.ietf.org/html/rfc2663 https://tools.ietf.org/html/rfc2663 might bee a good start to see where flaws are and how it works. And it's also a great way to see how a destination machine that you're talking with can puncture through your NAT, cause you did already. And Pwnat didn't strike you as "interesting" in that it could join 2 internal networks as if they were the same collision domain, but not really?
      - deleted 7y ago
        [deleted]
- takeda 7y ago
  First of all there are multiple kinds of NATs, such as SNAT, DNAT, PAT etc. You can for example have one IP being mapped to another IP statically without changing anything. That's the simplest kind of NAT (it is called SNAT) and doesn't do any blocking. Most people when they say NAT they mean PAT, that solution translates basically takes an outbound connection, it allocates a port and maps that port to that local computer. That creates an illusion, of security, but that's all as a side effect, NAT inherently doesn't care about security. There are multiple ways to bypass it, most known is UPnP where hosts can actually request to open an inbound port. The correct way to block inbound traffic is actually to use firewall. If you have a statefull firewall (currently pretty much all of them are statefull) you basically block inbound traffic to your network and that's it. UCLA has /16 address space and it doesn't use NAT it just gives static IP addresses to computers. By default all incoming communication is blocked, but you can submit request to have certain ports opened. Also from my own experience, if you have network with multiple devices, and you want to do something more advanced like traffic shaping, NAT actually makes things much more complicated. You need to keep in mind if you're doing filtering before or after NAT is applied. For example I had a person on my network catch a virus and started sending mail, which got my mail server blacklisted. So I decided to block outbound connections to port 25, forcing everyone to use local SMTP server. In PF the filtering rules apply after NAT, so at that point the user has the same IP as the server. To correctly filter I need to tag the connection when NAT happens and then perform filtering on tags. Without NAT I could simply just use source IP address to do the filtering. Things become even more complex when you also want to do QoS and label traffic. To do NAT you do need firewall, and if you have a stateful firewall you can just do the filtering by firewall. NAT was never designed as a security feature and shouldn't be treated as one.
- dijit 7y ago
  FWIW. Most video games that create peer meshes (and bittorrent) will “punch” the NAT. Even with the stateful firewall that is built in to most routers to prevent unestablished connections inbound. Think of it like this. You need to go to the internet for something. Your NAT will just kludge the packet to make it look like it came from the NAT machine, altering the port and IP. That port and IP combo needs to get back to your PC so the router keeps the mapping it used in a table and looks up all inbound packets to match on that table. So if you have sent a packet, you’ve opened a random port. NAT tries (lazily) to use the source port that matches the destination port. So if you ssh outbound; most NAT implementations will open port 22 to your machine. But the stateful firewall that usually comes with your router will block random inbound connection attempts or packets from your destination that are not acknowledged. Tbh, NAT+firewall doesn’t give you anything extra (security-wise) than a plain stateful firewall gives you.
- msbarnett 7y ago
  Most consumer NATs are completely permissive. Put a single device behind it, through some traffic at the NAT, and it will cheerfully forward it to the host despite the data not being correlated with any outbound packets. With multiple hosts it’s going to depend on the implementation, but it will likely forward it to something it thinks can handle it, because most NATs try to be as transparent as they can, to not trip up unknowledgeable consumers. NAT is not, and has never been a security measure. Just run a damn firewall if you want to drop incoming traffic. The firewall gives you everything you want; you aren’t gaining a damn thing from the NAT.

Then you want a firewall whether or not you’re NATing. NAT is not a security measure. It offers you no blocking of incoming traffic. It has no inherent security value.

umanwizard 7y ago

How does NAT not block incoming traffic? I'm genuinely confused. Let's assume my laptop is behind a typical home network NAT with public address 123.45.67.89 and internal address 192.168.1.123 . What sequence of commands do you type to send traffic to my laptop?

crankylinuxuser 7y ago
> How does NAT not block incoming traffic? https://samy.pl/pwnat/ https://samy.pl/pwnat/ NAT != firewall
- umanwizard 7y ago
  This seems to require both ends to be running the pwnat software. Again, assuming I am not running any special software, what sequence of commands would you type to send a packet to 192.168.1.123 natted behind 123.45.67.89 ?
  - crankylinuxuser 7y ago
    It's indeed true, if in your contrived case, you have a VM doing nothing inside a NAT behind a public IP, you couldn't access it. https://tools.ietf.org/html/rfc2663 https://tools.ietf.org/html/rfc2663 might bee a good start to see where flaws are and how it works. And it's also a great way to see how a destination machine that you're talking with can puncture through your NAT, cause you did already. And Pwnat didn't strike you as "interesting" in that it could join 2 internal networks as if they were the same collision domain, but not really?
    - deleted 7y ago
      [deleted]
takeda 7y ago
First of all there are multiple kinds of NATs, such as SNAT, DNAT, PAT etc. You can for example have one IP being mapped to another IP statically without changing anything. That's the simplest kind of NAT (it is called SNAT) and doesn't do any blocking. Most people when they say NAT they mean PAT, that solution translates basically takes an outbound connection, it allocates a port and maps that port to that local computer. That creates an illusion, of security, but that's all as a side effect, NAT inherently doesn't care about security. There are multiple ways to bypass it, most known is UPnP where hosts can actually request to open an inbound port. The correct way to block inbound traffic is actually to use firewall. If you have a statefull firewall (currently pretty much all of them are statefull) you basically block inbound traffic to your network and that's it. UCLA has /16 address space and it doesn't use NAT it just gives static IP addresses to computers. By default all incoming communication is blocked, but you can submit request to have certain ports opened. Also from my own experience, if you have network with multiple devices, and you want to do something more advanced like traffic shaping, NAT actually makes things much more complicated. You need to keep in mind if you're doing filtering before or after NAT is applied. For example I had a person on my network catch a virus and started sending mail, which got my mail server blacklisted. So I decided to block outbound connections to port 25, forcing everyone to use local SMTP server. In PF the filtering rules apply after NAT, so at that point the user has the same IP as the server. To correctly filter I need to tag the connection when NAT happens and then perform filtering on tags. Without NAT I could simply just use source IP address to do the filtering. Things become even more complex when you also want to do QoS and label traffic. To do NAT you do need firewall, and if you have a stateful firewall you can just do the filtering by firewall. NAT was never designed as a security feature and shouldn't be treated as one.
dijit 7y ago
FWIW. Most video games that create peer meshes (and bittorrent) will “punch” the NAT. Even with the stateful firewall that is built in to most routers to prevent unestablished connections inbound. Think of it like this. You need to go to the internet for something. Your NAT will just kludge the packet to make it look like it came from the NAT machine, altering the port and IP. That port and IP combo needs to get back to your PC so the router keeps the mapping it used in a table and looks up all inbound packets to match on that table. So if you have sent a packet, you’ve opened a random port. NAT tries (lazily) to use the source port that matches the destination port. So if you ssh outbound; most NAT implementations will open port 22 to your machine. But the stateful firewall that usually comes with your router will block random inbound connection attempts or packets from your destination that are not acknowledged. Tbh, NAT+firewall doesn’t give you anything extra (security-wise) than a plain stateful firewall gives you.
msbarnett 7y ago
Most consumer NATs are completely permissive. Put a single device behind it, through some traffic at the NAT, and it will cheerfully forward it to the host despite the data not being correlated with any outbound packets. With multiple hosts it’s going to depend on the implementation, but it will likely forward it to something it thinks can handle it, because most NATs try to be as transparent as they can, to not trip up unknowledgeable consumers. NAT is not, and has never been a security measure. Just run a damn firewall if you want to drop incoming traffic. The firewall gives you everything you want; you aren’t gaining a damn thing from the NAT.