3 ms·
Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of
by jbverschoor 4y ago
Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..
- stephen_g 4y agoIn any case, your endpoints really do need to be reasonably secure in themselves - especially if the firewall isn’t yours as then you are probably sharing the network with other devices on the inside of the network that can attack you directly, and even if not, it just takes one device being compromised and somebody has full inside access to the network, with the firewall not being able to do much…
- jbverschoor 4y agoGood luck with your home automation, printer, and tv
- BenjiWiebe 4y agoNAT doesn't protect you from things inside your LAN either. Where you have NAT+firewall with IPv4 now, you'll need a firewall with IPv6.
- viraptor 4y agoThe same comment applies to ipv4. Port bindings accessible from outside by accident, misconfigured upnp, SIP-ALG with vulnerabilities, various other router issues. "What if my firewall is broken" is not a new ipv6 consideration.
- jbverschoor 4y agoIt’s not, but the “beauty” of NAT is that you have an extra line of defense because of its limitations. Port bindings and upnp are far less impactful and less common.
- viraptor 4y agoI'm not talking about preconfigured port mapping. I'm taking about bindings as in entries in NAT. That happens on every outbound connection and has stateful processing. We're still finding issues with it, like the relatively recent NAT Slipstream vulnerability.