4 ms·
> You should stop thinking of NAT as a security mechanism and think of it as the emergency address exhaustion prevention that it is. I hate this attitude. Thi
by ajross 4y ago
> You should stop thinking of NAT as a security mechanism and think of it as the emergency address exhaustion prevention that it is.
I hate this attitude. This is isomporphic to saying "stop thinking of system call interfaces as a security mechanism and think of them as an address space sharing mechanism". It's not technically wrong, but it's wrong in practice.
Even the most naive NAT can't misroute an inbound packet. If you have an internal host and it doesn't talk to anything outside the firewall, then no one else can reach it. They have no name for it, the packets won't go. You get this even if you don't understand how it works. You get this even if the router has no idea about the host.
Give everything a unique address and now the router needs to know who is safe and who isn't. That's a decision point that requires configuration by human beings, and human beings get stuff wrong.
No, NAT is your friend. Use NAT. Use it even if you're an IPv6 nut.
- kazen44 4y agowhy would NAT not be any configuration compared to Firewall rulesets? heck, they even inventend protocols to do automatic NAT setup (UPNP) because configuring NAT by hand confuses people a lot.
- ajross 4y agoI'm sorry, I don't follow. Our grandparents have working, secure NAT setups that no human being needed to configure. I've never once seen a "firewall ruleset" configured by a non-geek.
- justeleblanc 4y agoReally? I changed ISPs the other day. Got my new modem/router. You know what I did in terms of firewalls? Nothing. You know what I have? A firewall that blocks all unknown incoming connections. Does it work? Yes. Did I even have to do anything besides plug in the box? No.
- dragoncrab 4y agoHappy you. All the 3 ISPs I dealt with in Hungary in the last 10 years provided 0 firewall capability for IPv6 in their integrated router/modem. Once you start assigning the addresses, every compatible IoT gadget you have is reachable from the public web. In this state, IPv6 is a pure security stepback for average residential users with 0 upside. I can't take any comment seriously who is speaking of configuring a stateful firewall in a residential environment.
- TacticalCoder 4y agoNot commenting on the whole IPv6 vs IPv4 debate but simply answering your question... There aren't enough IPv4 addresses, so any ISP using IPv4 addresses is going to give 99.999% of their customers exactly one IPv4 address. Not ten. Not two. One. So NAT has to work. Grandma has nothing to configure because either NAT works or grandma is calling her ISP to ask why her tablet ain't working. So when the customer gets exactly one IPv4 address, the ISP is forced to hand a router doing IPv4 NAT. They have no way around it. While if you take an ISP handing out hundreds of billions of IPv6 addresses to each customer, well... They are not forced to hand a router which does proper firewalling. It's not a question of whether it'd be easier for the ISP to give a correctly configured IPv6 router firewall vs handing an IPv4 correctly doing NAT. It's that when they hand one IPv4 address, they don't have the choice. NAT must work and there's no way around it.
- megous 4y ago"Even the most naive NAT" That would be full cone NAT, right? Can't think of anything more naive... :) And that can definitely bite you in the ass.
- deleted 4y ago[deleted]