3 ms·
You can simply not route a specific range, no firewall needed. NAT, on its own, doesn't provide security. At best, it provides obscurity. At worst, it breaks s
by imoverclocked 5y ago
You can simply not route a specific range, no firewall needed.
NAT, on its own, doesn't provide security. At best, it provides obscurity. At worst, it breaks security [2]. NAT needs a properly configured firewall to provide security [1]. In this sense, NAT vs a Firewall is a false dichotomy.
[1] https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
[2] https://www.computerworld.com/article/2556611/nat-traversal--nat-t--security-issues.html https://www.computerworld.com/article/2556611/nat-traversal-...
edit: formatting
- tsimionescu 5y agoI wasn't claiming NAT is adding security. A combined IPv4 NAT/firewall will not necessarily be less performant than an IPv6 firewall - that was my claim. Also, GP claimed that certain services that don't work because of NAT would work on an IPv6 network. I was curious which services those might be, that don't work because of NAT but wouldn't be affected by a firewall.
- Dagger2 5y agoIf you're behind CGNAT then generally you won't be able to accept any inbound connections, so even things like a basic webserver aren't doable.