5 ms·

No it isn't, that's basic stateful firewalling. NAT in no way provides security. At all.

by ikiris 5y ago

10000truths 5y ago
Even stateful firewalls don’t protect you from being hacked. Hacks occur when you run untrusted code on your machine. That untrusted code can easily bypass your stateful firewall by initiating a connection to a C&C server.
throwawaaarrgh 5y ago
The fact that a kid with a port scanner can't remotely connect to and exploit your printer is due to NAT not being able to route the traffic, whether you have a stateful firewall or not. The majority of internet-addressable devices in the world do not have firewalls. Hence, NAT keeps most devices safe from drive-by RCE. There are plenty of attacks to get around that, but by default, nothing else protects random devices like NAT does.
- dnautics 5y ago
  Yes I agree with this but do note that in your gp you stated "every single personal device", not "half of all personal devices"
- throw0101a 5y ago
  > The majority of internet-addressable devices in the world do not have firewalls. Hence, NAT keeps most devices safe from drive-by RCE. According to System Preferences, my Mac's firewall is currently turned off. Here are the current non-NATed IPv6 addresses on it: $ ifconfig en1 | grep inet6 | grep -v fe80 inet6 2607:f2c0:93c7:fe00:144f:b9a3:bcd4:ef6 prefixlen 64 autoconf secured inet6 2607:f2c0:93c7:fe00:e04c:f356:f2:b9e2 prefixlen 64 autoconf temporary You should be able to ping(6). Can you connect to tcp/22? If not, it shows that my router's stateful packet inspection (SPI) works even when NAT isn't present. * http://www.ipv6scanner.com/cgi-bin/main.py http://www.ipv6scanner.com/cgi-bin/main.py The results of an nmap of one of those address from the system itself: PORT STATE SERVICE REASON 22/tcp open ssh syn-ack 111/tcp open rpcbind syn-ack 1022/tcp open exp2 syn-ack 2049/tcp open nfs syn-ack If you have a device doing NAT, then that device is already doing SPI, and so the NAT part is redundant. It is the SPI that gives you the security.
  - throwawaaarrgh 5y ago
    Well first, IPv6 doesn't need NAT, and mostly never uses NAT. If IPv6 devices used NAT, they would be protected. But since they aren't using NAT, they aren't protected. You're right that devices that enable IPv6 (and network routers that give out IPv6 addresses) are not protected by NAT, but luckily it's still a small amount of traffic/devices worldwide. But this is changing, and so NAT won't help people for much longer. Second, SPI isn't used for security here. It's true that SPI is used by NAT, and that SPI can be used to prevent, say, a specially crafted packet from passing from a public network through a router into a private network. But something other than SPI has to actually enforce that. That "something" is usually extra features of the network stack, like disabling source-routing, reverse-path filtering, ARP filtering, etc. All SPI is doing is helping the NAT engine track the connections it is translating. For "good faith" traffic (that is, not crafted by an attacker to work around crappy NAT routers) NAT still provides security. Actually it's not NAT at all that's providing the security - it's just the routing. You can't pass traffic from a public network into a private network, and almost all devices behind NAT are on private networks. So NAT provides security merely by keeping devices on a private network.
    - throw0101a 5y ago
      > But since they aren't using NAT, they aren't protected. I just demonstrated that protection exists without NAT. > […] but luckily it's still a small amount of traffic/devices worldwide. I don't think this is correct. Just about all devices on a cellular/mobile network nowadays are probably using IPv6 natively, with CGNAT for IPv4. That's a lot of devices. * https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mobile-networks-why-and-how.html https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mob... An experiment: temporarily disable Wifi on your cell phone, go to your browser, search of "what is my ip address". Chances are that you'll see an IPv6 address there: if using Google they'll return something an IPv6 address at the top, and a list of different web sites that do the same thing. If you go to a website you'll probably get an IPv6 and an IPv4 address. > But something other than SPI has to actually enforce that. Connection tracking is sufficient for most modern protocols (i.e., not (active) FTP): > A stateful firewall keeps track of the state of network connections, such as TCP streams, UDP datagrams, and ICMP messages, and can apply labels such as LISTEN, ESTABLISHED, or CLOSING.[2] State table entries are created for TCP streams or UDP datagrams that are allowed to communicate through the firewall in accordance with the configured security policy. Once in the table, all RELATED packets of a stored session are streamlined allowed, taking less CPU cycles than standard inspection. Related packets are also permitted to return through the firewall even if no rule is configured to allow communications from that host. * https://en.wikipedia.org/wiki/Stateful_firewall https://en.wikipedia.org/wiki/Stateful_firewall * https://en.wikipedia.org/wiki/Firewall_(computing)#Connection_tracking https://en.wikipedia.org/wiki/Firewall_(computing)#Connectio... > Actually it's not NAT at all that's providing the security - it's just the routing. Yes, that's exactly my point. And as part of routing packets one can inspect their headers and drop or allow them as desired.

No it isn't, that's basic stateful firewalling. NAT in no way provides security. At all.

by ikiris 5y ago

No it isn't, that's basic stateful firewalling. NAT in no way provides security. At all.

Even stateful firewalls don’t protect you from being hacked. Hacks occur when you run untrusted code on your machine. That untrusted code can easily bypass your stateful firewall by initiating a connection to a C&C server.

throwawaaarrgh 5y ago

The fact that a kid with a port scanner can't remotely connect to and exploit your printer is due to NAT not being able to route the traffic, whether you have a stateful firewall or not. The majority of internet-addressable devices in the world do not have firewalls. Hence, NAT keeps most devices safe from drive-by RCE. There are plenty of attacks to get around that, but by default, nothing else protects random devices like NAT does.

dnautics 5y ago
Yes I agree with this but do note that in your gp you stated "every single personal device", not "half of all personal devices"
throw0101a 5y ago
> The majority of internet-addressable devices in the world do not have firewalls. Hence, NAT keeps most devices safe from drive-by RCE. According to System Preferences, my Mac's firewall is currently turned off. Here are the current non-NATed IPv6 addresses on it: $ ifconfig en1 | grep inet6 | grep -v fe80 inet6 2607:f2c0:93c7:fe00:144f:b9a3:bcd4:ef6 prefixlen 64 autoconf secured inet6 2607:f2c0:93c7:fe00:e04c:f356:f2:b9e2 prefixlen 64 autoconf temporary You should be able to ping(6). Can you connect to tcp/22? If not, it shows that my router's stateful packet inspection (SPI) works even when NAT isn't present. * http://www.ipv6scanner.com/cgi-bin/main.py http://www.ipv6scanner.com/cgi-bin/main.py The results of an nmap of one of those address from the system itself: PORT STATE SERVICE REASON 22/tcp open ssh syn-ack 111/tcp open rpcbind syn-ack 1022/tcp open exp2 syn-ack 2049/tcp open nfs syn-ack If you have a device doing NAT, then that device is already doing SPI, and so the NAT part is redundant. It is the SPI that gives you the security.
- throwawaaarrgh 5y ago
  Well first, IPv6 doesn't need NAT, and mostly never uses NAT. If IPv6 devices used NAT, they would be protected. But since they aren't using NAT, they aren't protected. You're right that devices that enable IPv6 (and network routers that give out IPv6 addresses) are not protected by NAT, but luckily it's still a small amount of traffic/devices worldwide. But this is changing, and so NAT won't help people for much longer. Second, SPI isn't used for security here. It's true that SPI is used by NAT, and that SPI can be used to prevent, say, a specially crafted packet from passing from a public network through a router into a private network. But something other than SPI has to actually enforce that. That "something" is usually extra features of the network stack, like disabling source-routing, reverse-path filtering, ARP filtering, etc. All SPI is doing is helping the NAT engine track the connections it is translating. For "good faith" traffic (that is, not crafted by an attacker to work around crappy NAT routers) NAT still provides security. Actually it's not NAT at all that's providing the security - it's just the routing. You can't pass traffic from a public network into a private network, and almost all devices behind NAT are on private networks. So NAT provides security merely by keeping devices on a private network.
  - throw0101a 5y ago
    > But since they aren't using NAT, they aren't protected. I just demonstrated that protection exists without NAT. > […] but luckily it's still a small amount of traffic/devices worldwide. I don't think this is correct. Just about all devices on a cellular/mobile network nowadays are probably using IPv6 natively, with CGNAT for IPv4. That's a lot of devices. * https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mobile-networks-why-and-how.html https://blogs.akamai.com/2016/06/preparing-for-ipv6-only-mob... An experiment: temporarily disable Wifi on your cell phone, go to your browser, search of "what is my ip address". Chances are that you'll see an IPv6 address there: if using Google they'll return something an IPv6 address at the top, and a list of different web sites that do the same thing. If you go to a website you'll probably get an IPv6 and an IPv4 address. > But something other than SPI has to actually enforce that. Connection tracking is sufficient for most modern protocols (i.e., not (active) FTP): > A stateful firewall keeps track of the state of network connections, such as TCP streams, UDP datagrams, and ICMP messages, and can apply labels such as LISTEN, ESTABLISHED, or CLOSING.[2] State table entries are created for TCP streams or UDP datagrams that are allowed to communicate through the firewall in accordance with the configured security policy. Once in the table, all RELATED packets of a stored session are streamlined allowed, taking less CPU cycles than standard inspection. Related packets are also permitted to return through the firewall even if no rule is configured to allow communications from that host. * https://en.wikipedia.org/wiki/Stateful_firewall https://en.wikipedia.org/wiki/Stateful_firewall * https://en.wikipedia.org/wiki/Firewall_(computing)#Connection_tracking https://en.wikipedia.org/wiki/Firewall_(computing)#Connectio... > Actually it's not NAT at all that's providing the security - it's just the routing. Yes, that's exactly my point. And as part of routing packets one can inspect their headers and drop or allow them as desired.