3 ms·
Your broadband argument does not work in 2020. The technology exists for symmetric. NAT is not security. Here's an article from F5: https://www.f5.com/servic
by Jonnax 6y ago
Your broadband argument does not work in 2020. The technology exists for symmetric.
NAT is not security.
Here's an article from F5:
https://www.f5.com/services/resources/white-papers/the-myth-of-network-address-translation-as-security https://www.f5.com/services/resources/white-papers/the-myth-...
And why would the devices be reachable over the internet?
Your router should firewall by default its LAN side subnets.
- saurik 6y agoNAT isn't "security", but it does provide some nice privacy benefits (so IPv6 should absolutely be combined with carrier grade NAT).
- Jonnax 6y agoCarrier grade NAT does not give the user choice of what they want to do with their network. If you want to employ NAT on your network, that should be your choice, not your ISP's.
- saurik 6y agoI don't know what "the choice of what they want to do with their network" means. Is there something that you are able to do with a dynamic IP address that you are somehow unable to do behind NAT+PCP? (I mostly hear people complain about stuff that makes no sense, like "I can't do peer to peer connections", when the core problem there was already 100% solved by PCP.)
- p_l 6y agoInstead of NAT there exist a "best practices" firewall setup that mimics what people expect from NAT, available in various home routers in the last 5 years.
- saurik 6y agoThe privacy features of NAT are due to the NAT part (mixing your traffic together with all the other traffic so you look like a single entity rather than multiple), not a firewall (which is merely a side effect of a NAT and has nothing to do with privacy).