5 ms·

It doesn't even give that. Stateful NAT necessitates state tracking but doesn't require a stateful firewall. I've tested it -- NATing the outbound connections

It doesn't even give that. Stateful NAT necessitates state tracking but doesn't require a stateful firewall. I've tested it -- NATing the outbound connections from your router has no impact whatsoever on inbound connections (which makes sense, but people have a really hard time wrapping their heads around the idea).

sjwright 6y ago
Regardless of its appropriateness or effectiveness, however weak it may be, in the real world where normal people live, NAT is the first line of defence against inbound attacks for most personal computers and personal devices on the internet. The real criticism is that the presence of NAT has created dangerous complacency among consumers and operating system vendors, relying upon its pseudo-firewall properties for "security" that can be described as barely good enough, arguably not even that.
- Dagger2 6y ago
  NAT can't prevent inbound connections, so... no, the first line of defence for most personal computers and personal devices on the internet, in the real world where normal people live, cannot be NAT. It's just not a thing that it does.
  - sjwright 6y ago
    How interesting. So tell me, how do you craft an inbound connection to an arbitrary port on an arbitrary device that is behind NAT?
    - Dagger2 6y ago
      `telnet <IP of destination device> <port>` will do the job.
      - sjwright 6y ago
        Okay then, the IP is 10.1.5.12 and the port is 80. Go for it. Do you even know what NAT is?
        Dagger2 6y ago
        That's an RFC1918 IP. I'm not going to be able to reach it from here. So long as you aren't also running a firewall, your ISP or anyone on your immediate upstream network could reach it just fine though. If you get me access to that network then I'd be happy to demonstrate. Yes, I know what NAT is.
        sjwright 6y ago
        You think my ISP can reach my local network “just fine”? Yeah, that’s completely wrong and absurd. I’m pretty sure you don’t know what NAT means.
        Dagger2 6y ago
        It means the rewriting of the apparent source address of outbound connections, yes? On Linux, you would do it with `iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE`. Is that an accurate enough description to convince you that I know what NAT means? "Rewriting the apparent source address of outbound connections" means that it's an operation you apply to outbound connections. Inbound connections are completely unaffected. This is made even more obvious by the `iptables` command above: it explicitly says "-o wan0", which restricts the rule to applying only to connections going out of wan0, not to ones coming in from it. So yes, your ISP (or rather, anyone on the immediate upstream network, which is typically the ISP) can connect to your 10.1.5.12 -- that's just basic routing -- and NAT won't stop them because NAT doesn't do anything to inbound connections.
        sjwright 6y ago
        Ah, you seem to be under the misapprehension that consumer NAT devices act as BGP routers. No, in all normal configurations the “WAN” port listens on one IP only. Any traffic bound for a private/bogon range—even if it matches your internal range is discarded, not routed or forwarded. This is trivial to prove by placing a NAT router on your internal network (“double-NAT”) and attempting to connect to devices on the second layer of NAT from a device on the first. But even if that were true, it would be a mere technicality that doesn’t refute the point made ten or so posts ago. NAT does remain an imperfect yet semi-functional pseudo-firewall for stray inbound connections from the Internet at large.

sjwright 6y ago

Regardless of its appropriateness or effectiveness, however weak it may be, in the real world where normal people live, NAT is the first line of defence against inbound attacks for most personal computers and personal devices on the internet. The real criticism is that the presence of NAT has created dangerous complacency among consumers and operating system vendors, relying upon its pseudo-firewall properties for "security" that can be described as barely good enough, arguably not even that.

Dagger2 6y ago
NAT can't prevent inbound connections, so... no, the first line of defence for most personal computers and personal devices on the internet, in the real world where normal people live, cannot be NAT. It's just not a thing that it does.
- sjwright 6y ago
  How interesting. So tell me, how do you craft an inbound connection to an arbitrary port on an arbitrary device that is behind NAT?
  - Dagger2 6y ago
    `telnet <IP of destination device> <port>` will do the job.
    - sjwright 6y ago
      Okay then, the IP is 10.1.5.12 and the port is 80. Go for it. Do you even know what NAT is?
      - Dagger2 6y ago
        That's an RFC1918 IP. I'm not going to be able to reach it from here. So long as you aren't also running a firewall, your ISP or anyone on your immediate upstream network could reach it just fine though. If you get me access to that network then I'd be happy to demonstrate. Yes, I know what NAT is.
        sjwright 6y ago
        You think my ISP can reach my local network “just fine”? Yeah, that’s completely wrong and absurd. I’m pretty sure you don’t know what NAT means.
        Dagger2 6y ago
        It means the rewriting of the apparent source address of outbound connections, yes? On Linux, you would do it with `iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE`. Is that an accurate enough description to convince you that I know what NAT means? "Rewriting the apparent source address of outbound connections" means that it's an operation you apply to outbound connections. Inbound connections are completely unaffected. This is made even more obvious by the `iptables` command above: it explicitly says "-o wan0", which restricts the rule to applying only to connections going out of wan0, not to ones coming in from it. So yes, your ISP (or rather, anyone on the immediate upstream network, which is typically the ISP) can connect to your 10.1.5.12 -- that's just basic routing -- and NAT won't stop them because NAT doesn't do anything to inbound connections.
        sjwright 6y ago
        Ah, you seem to be under the misapprehension that consumer NAT devices act as BGP routers. No, in all normal configurations the “WAN” port listens on one IP only. Any traffic bound for a private/bogon range—even if it matches your internal range is discarded, not routed or forwarded. This is trivial to prove by placing a NAT router on your internal network (“double-NAT”) and attempting to connect to devices on the second layer of NAT from a device on the first. But even if that were true, it would be a mere technicality that doesn’t refute the point made ten or so posts ago. NAT does remain an imperfect yet semi-functional pseudo-firewall for stray inbound connections from the Internet at large.