7 ms·

> (NATs do not enhance security in any meaningful way, but that’s a rant for another time.) Eh, I'm not sure I agree. People plug all kinds of weird and wonder

> (NATs do not enhance security in any meaningful way, but that’s a rant for another time.) Eh, I'm not sure I agree. People plug all kinds of weird and wonderful crap into their home networks, they turn off their Windows firewall and allow connections to RPC ports, all sorts of nonsense. The main factor that prevents even more stuff being exposed to the internet than now (and there's a lot exposed already) is the prevalence of IPv4 NAT devices. OK, UPnP is a thing, and NATs aren't firewalls, but in practice NATs do look and feel enough like a firewall to be at least somewhat useful to the average home user.

johncolanduoni 3y ago
Every router firewall in existence supports some sort of established/related only rule. That’s sufficient to provide all security benefits of a NAT except the hiding of which devices behind the router are making which connections.
- noselasd 3y ago
  Only if those were on by default. Back in the days when my ISP didn’t do NAT , their dsl modem didn’t block anything. Most people do not have the capability to secure their internet connection. I still think the op has a good point in that NAT has protected many home networks , if nothing else from ISP incompetence , even if in theory a firewall could have done it better.
  - johncolanduoni 3y ago
    Modems don't generally block anything, unless they're a modem/router combo. Have you ever actually encountered a device that had a NAT but no stateful firewall?
  - samcat116 3y ago
    They are on by default now. Have been for years.
  - throw0101b 3y ago
    > Only if those were on by default. My Asus RT-AC68U, released in 2013, did/does (by default). * https://www.pcmag.com/reviews/asus-rt-ac68u-dual-band-wireless-ac1900-gigabit-router https://www.pcmag.com/reviews/asus-rt-ac68u-dual-band-wirele... Are you saying routers in 2023 do not? Can you list any examples of currently shipping CPEs that do not?
  - lxgr 3y ago
    > Back in the days when my ISP didn’t do NAT , their dsl modem didn’t block anything. As it should – a modem is not a router.
benlivengood 3y ago
Sure, but any stateful firewall on the home Internet router would be just as secure as NAT. UPnP and friends would create only an allow rule instead of a combination allow rule plus a DNAT entry. If NAT did not have a stateful firewall then it would simply let in any traffic for which an SNAT or DNAT entry matched or else forward it to some default host that was expected to receive most traffic, perhaps the router device itself.
- bombcar 3y ago
  If we didn't have NAT default home routers would ship with "all ports open and routed" firewalls; and in fact that can still happen with IPv6. So in a very real way it has provided protection accidentally.
  - anyfoo 3y ago
    Hah? I'm missing a step here. Why would they ship like that?
    - bombcar 3y ago
      Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And even if the defaults were secure, I guarantee someone would "route all" when that was a known "fix it" issue - just like you used to find people who would forward 1-65535 to their PC to play Internet games. NAT is still annoying and wrong, perhaps, but it DOES provide something akin to a layer of security in some cases; just like security through obscurity DOES provide some security for many things.
      - throw0101b 3y ago
        > Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And guess what: people used to connect their PCs directly to their DSL/cable modems and run PPPoE (or DHCP) on their Windows PCs directly, and their Windows PCs used to get assigned public IP addresses. Times change. It's no longer 2003. We've learned things in both the IPv4 and IPv6 space over the decades.
w7 3y ago
What makes NAT the "main factor" for that. I'm pretty sure every consumer router since at least 2002, if not further back, has had some stateful firewall implementation with default deny rules.
whatupmiked 3y ago
NATs provide one form of network segmentation. Network segmentation is a commonly accepted network security practice. The author maybe thinking of a specific application of NAT, but a blanket “NAT provides no additional security” is not a defensible position.
- otabdeveloper4 3y ago
  Thank you for the voice of sanity. (And anyways, stateful firewalls are a special case of a simple NAT. If you're doing stateful address mangling anyways, why not do something actually useful and hide your LAN addresses?)
- AtlasBarfed 3y ago
  The NAT position is long-parroted IPV6 zealotry. These people saying "the idiots with NATs will turn them off to get things running", but think that "the idiot user" with firewall-only setups won't .... turn off the firewall as the first (and last) debugging step? And the assumption that whatever ipv6 space assigned you/your device will be sufficient is ... optimistic. I can easily see some CGNAT thing giving a single ipv6 to your mobile device and you need to NAT on your end to do more fun things. It doesn't matter than ipv6 can address every atom in the universe. Sine lazy ISP is going to decide your endpoint a single atom.
throw0101b 3y ago
> The main factor that prevents even more stuff being exposed to the internet than now (and there's a lot exposed already) is the prevalence of IPv4 NAT devices. All of this is blocked by default-deny firewall rules. I have IPv6 at home from my residential ISP, and I get a globally routable a 2000::/3 IPv6 address on my systems (via SLAAC), but they are not accessible from the public Internet by default. The idea of publicly routable = publicaly accessible needs to die.
- iforgotpassword 3y ago
  The thing is, you can turn that off. So if the user can turn it off, they will eventually turn it off, because that's just what people do if they have some problem somewhere: toggle random settings they have no clue what they mean, or asked their 14yo "computer wizard" nephew for advice, you name it. With NAT it is impossible to disable the firewall. The worst you can do is put one machine into the DMZ, and people did do that of course because of what I just said, but at least it isn't the entire network at once with every shitty iot fridge smart bulb vibrator toaster the average Joe has today.
  - Arnavion 3y ago
    >With NAT it is impossible to disable the firewall. Nonsense. If we suppose a switch to turn the firewall off, we can suppose a switch to turn NAT off and convert the router into a bridge that connects LAN and WAN. Then a LAN device can speak DHCP to your ISP and get its own public address. It doesn't have to be limited to one LAN device either; my ISP allows two IPs per customer connection to make it easier for people power-cycling their routers / ONTs during troubleshooting.
    - iforgotpassword 3y ago
      That's an outlier. Almost every ISP hands out 0 to 1 ipv4 addresses. And even if it's two, the user will quickly realize that "internet is broken" on some of their devices, as two random ones picked up the addresses and the rest don't get any, and reverse the config change.
harha_ 3y ago
What I've used NAT for (for example in AWS), is that I've split the virtual network into "public" and "private" subnets. Public subnets are behind an internet gateway and are open to the internet, private ones are either only private with no internet access or behind a NAT gateway to allow connections to internet but not the other way around. My understanding has been that it's common practice, segmenting a network like that. I obviously would still configure firewalls for the devices in those different subnets, but what is this kind of NAT usage called if not security enhancement? One thing that came to my mind typing this is, that the fact that there's NAT in there could mask problems with the firewall configuration, if one does not truly test whether the firewall rules are strict enough or not. So if those private subnets behind NAT would somehow magically be switched behind an internet gateway, security holes could emerge.
dfawcus 3y ago
Nope, that is just a form of NAT one is forced to use for IPv4, with a stateful session table. It is that session tracking which adds the "outbound initiated" only behaviour. There is a form of NAT for IPv6 (NPTv6) which can be used to gain pseudo provider independence. It has static mapping rules, with no session table. It allows for "inbound initiated" sessions. So it is NAT which is globally reachable, without the endpoint addresses being globally routable.
dfawcus 3y ago
See https://www.rfc-editor.org/rfc/rfc6204.html https://www.rfc-editor.org/rfc/rfc6204.html and its update https://www.rfc-editor.org/rfc/rfc6204.html https://www.rfc-editor.org/rfc/rfc6204.html which were created because of the "NAT adds security" delusion. They address basic requirements for customer edge IPv6 routers, and some consumer devices are now following that.
- me-vs-cat 3y ago
  I believe you meant your second link to be https://www.rfc-editor.org/rfc/rfc7084 https://www.rfc-editor.org/rfc/rfc7084

johncolanduoni 3y ago

Every router firewall in existence supports some sort of established/related only rule. That’s sufficient to provide all security benefits of a NAT except the hiding of which devices behind the router are making which connections.

noselasd 3y ago
Only if those were on by default. Back in the days when my ISP didn’t do NAT , their dsl modem didn’t block anything. Most people do not have the capability to secure their internet connection. I still think the op has a good point in that NAT has protected many home networks , if nothing else from ISP incompetence , even if in theory a firewall could have done it better.
- johncolanduoni 3y ago
  Modems don't generally block anything, unless they're a modem/router combo. Have you ever actually encountered a device that had a NAT but no stateful firewall?
- samcat116 3y ago
  They are on by default now. Have been for years.
- throw0101b 3y ago
  > Only if those were on by default. My Asus RT-AC68U, released in 2013, did/does (by default). * https://www.pcmag.com/reviews/asus-rt-ac68u-dual-band-wireless-ac1900-gigabit-router https://www.pcmag.com/reviews/asus-rt-ac68u-dual-band-wirele... Are you saying routers in 2023 do not? Can you list any examples of currently shipping CPEs that do not?
- lxgr 3y ago
  > Back in the days when my ISP didn’t do NAT , their dsl modem didn’t block anything. As it should – a modem is not a router.

benlivengood 3y ago

Sure, but any stateful firewall on the home Internet router would be just as secure as NAT. UPnP and friends would create only an allow rule instead of a combination allow rule plus a DNAT entry. If NAT did not have a stateful firewall then it would simply let in any traffic for which an SNAT or DNAT entry matched or else forward it to some default host that was expected to receive most traffic, perhaps the router device itself.

bombcar 3y ago
If we didn't have NAT default home routers would ship with "all ports open and routed" firewalls; and in fact that can still happen with IPv6. So in a very real way it has provided protection accidentally.
- anyfoo 3y ago
  Hah? I'm missing a step here. Why would they ship like that?
  - bombcar 3y ago
    Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And even if the defaults were secure, I guarantee someone would "route all" when that was a known "fix it" issue - just like you used to find people who would forward 1-65535 to their PC to play Internet games. NAT is still annoying and wrong, perhaps, but it DOES provide something akin to a layer of security in some cases; just like security through obscurity DOES provide some security for many things.
    - throw0101b 3y ago
      > Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And guess what: people used to connect their PCs directly to their DSL/cable modems and run PPPoE (or DHCP) on their Windows PCs directly, and their Windows PCs used to get assigned public IP addresses. Times change. It's no longer 2003. We've learned things in both the IPv4 and IPv6 space over the decades.

w7 3y ago

What makes NAT the "main factor" for that. I'm pretty sure every consumer router since at least 2002, if not further back, has had some stateful firewall implementation with default deny rules.

whatupmiked 3y ago

NATs provide one form of network segmentation. Network segmentation is a commonly accepted network security practice. The author maybe thinking of a specific application of NAT, but a blanket “NAT provides no additional security” is not a defensible position.

otabdeveloper4 3y ago
Thank you for the voice of sanity. (And anyways, stateful firewalls are a special case of a simple NAT. If you're doing stateful address mangling anyways, why not do something actually useful and hide your LAN addresses?)
AtlasBarfed 3y ago
The NAT position is long-parroted IPV6 zealotry. These people saying "the idiots with NATs will turn them off to get things running", but think that "the idiot user" with firewall-only setups won't .... turn off the firewall as the first (and last) debugging step? And the assumption that whatever ipv6 space assigned you/your device will be sufficient is ... optimistic. I can easily see some CGNAT thing giving a single ipv6 to your mobile device and you need to NAT on your end to do more fun things. It doesn't matter than ipv6 can address every atom in the universe. Sine lazy ISP is going to decide your endpoint a single atom.

throw0101b 3y ago

> The main factor that prevents even more stuff being exposed to the internet than now (and there's a lot exposed already) is the prevalence of IPv4 NAT devices. All of this is blocked by default-deny firewall rules. I have IPv6 at home from my residential ISP, and I get a globally routable a 2000::/3 IPv6 address on my systems (via SLAAC), but they are not accessible from the public Internet by default. The idea of publicly routable = publicaly accessible needs to die.

iforgotpassword 3y ago
The thing is, you can turn that off. So if the user can turn it off, they will eventually turn it off, because that's just what people do if they have some problem somewhere: toggle random settings they have no clue what they mean, or asked their 14yo "computer wizard" nephew for advice, you name it. With NAT it is impossible to disable the firewall. The worst you can do is put one machine into the DMZ, and people did do that of course because of what I just said, but at least it isn't the entire network at once with every shitty iot fridge smart bulb vibrator toaster the average Joe has today.
- Arnavion 3y ago
  >With NAT it is impossible to disable the firewall. Nonsense. If we suppose a switch to turn the firewall off, we can suppose a switch to turn NAT off and convert the router into a bridge that connects LAN and WAN. Then a LAN device can speak DHCP to your ISP and get its own public address. It doesn't have to be limited to one LAN device either; my ISP allows two IPs per customer connection to make it easier for people power-cycling their routers / ONTs during troubleshooting.
  - iforgotpassword 3y ago
    That's an outlier. Almost every ISP hands out 0 to 1 ipv4 addresses. And even if it's two, the user will quickly realize that "internet is broken" on some of their devices, as two random ones picked up the addresses and the rest don't get any, and reverse the config change.

harha_ 3y ago

What I've used NAT for (for example in AWS), is that I've split the virtual network into "public" and "private" subnets. Public subnets are behind an internet gateway and are open to the internet, private ones are either only private with no internet access or behind a NAT gateway to allow connections to internet but not the other way around. My understanding has been that it's common practice, segmenting a network like that. I obviously would still configure firewalls for the devices in those different subnets, but what is this kind of NAT usage called if not security enhancement? One thing that came to my mind typing this is, that the fact that there's NAT in there could mask problems with the firewall configuration, if one does not truly test whether the firewall rules are strict enough or not. So if those private subnets behind NAT would somehow magically be switched behind an internet gateway, security holes could emerge.

dfawcus 3y ago

Nope, that is just a form of NAT one is forced to use for IPv4, with a stateful session table. It is that session tracking which adds the "outbound initiated" only behaviour. There is a form of NAT for IPv6 (NPTv6) which can be used to gain pseudo provider independence. It has static mapping rules, with no session table. It allows for "inbound initiated" sessions. So it is NAT which is globally reachable, without the endpoint addresses being globally routable.

dfawcus 3y ago

See https://www.rfc-editor.org/rfc/rfc6204.html https://www.rfc-editor.org/rfc/rfc6204.html and its update https://www.rfc-editor.org/rfc/rfc6204.html https://www.rfc-editor.org/rfc/rfc6204.html which were created because of the "NAT adds security" delusion. They address basic requirements for customer edge IPv6 routers, and some consumer devices are now following that.

me-vs-cat 3y ago
I believe you meant your second link to be https://www.rfc-editor.org/rfc/rfc7084 https://www.rfc-editor.org/rfc/rfc7084