3 ms·

There isn't any security aspect to NAT, you're relying on the fact nobody's added an upstream route back to you: https://www.anvilsecure.com/blog/dhcp-games-wi

There isn't any security aspect to NAT, you're relying on the fact nobody's added an upstream route back to you: https://www.anvilsecure.com/blog/dhcp-games-with-smart-router-devices.html https://www.anvilsecure.com/blog/dhcp-games-with-smart-route...

effie 5y ago
NAT without port forwarding done by router facing the ISP, the default kind of NAT which the subscriber does not have to worry about configuring, has very great security aspect. Connect your home network devices to the router doing that kind of NAT,and this automatically protects all devices in your local network from incoming connections.
- southerntofu 5y ago
  Yes, but that's an unintended consequence and cannot be relied upon. Any default-configuration firewall would achieve the same, but in a more reliable manner.
  - kiallmacinnes 5y ago
    > that's an unintended consequence No, it's entirely unrelated to NAT. That's a consequence of the firewall on the router. IPv6 doesn't get rid of the firewall.
    - southerntofu 5y ago
      That was precisely my point. Thanks for clarifying :)
  - effie 5y ago
    > that's an unintended consequence Even granted that, so what? It does protect home devices' ports by default, no? > any default-configuration firewall would achieve the same OK, but default NAT does achieve it as well, right?
- jeroenhd 5y ago
  It does protect all devices in your home network, until someone uses one of the various NAT slipstreaming attacks from a malicious ad and open up the web interface to your IP cameras without you noticing. NAT has become too complex and most consumer versions of it are developed for ease of use over security. Don't trust NAT to protect your network, because the device doing NAT in your home network most likely wasn't developed to use it as a security measure.
  - yardstick 5y ago
    Isn’t that attack still possible on IPv6? It’s an attack on the stateful firewall connection tracking, not NAT.

effie 5y ago

NAT without port forwarding done by router facing the ISP, the default kind of NAT which the subscriber does not have to worry about configuring, has very great security aspect. Connect your home network devices to the router doing that kind of NAT,and this automatically protects all devices in your local network from incoming connections.

southerntofu 5y ago
Yes, but that's an unintended consequence and cannot be relied upon. Any default-configuration firewall would achieve the same, but in a more reliable manner.
- kiallmacinnes 5y ago
  > that's an unintended consequence No, it's entirely unrelated to NAT. That's a consequence of the firewall on the router. IPv6 doesn't get rid of the firewall.
  - southerntofu 5y ago
    That was precisely my point. Thanks for clarifying :)
- effie 5y ago
  > that's an unintended consequence Even granted that, so what? It does protect home devices' ports by default, no? > any default-configuration firewall would achieve the same OK, but default NAT does achieve it as well, right?
jeroenhd 5y ago
It does protect all devices in your home network, until someone uses one of the various NAT slipstreaming attacks from a malicious ad and open up the web interface to your IP cameras without you noticing. NAT has become too complex and most consumer versions of it are developed for ease of use over security. Don't trust NAT to protect your network, because the device doing NAT in your home network most likely wasn't developed to use it as a security measure.
- yardstick 5y ago
  Isn’t that attack still possible on IPv6? It’s an attack on the stateful firewall connection tracking, not NAT.