6 ms·

Sure, but any stateful firewall on the home Internet router would be just as secure as NAT. UPnP and friends would create only an allow rule instead of a combi

Sure, but any stateful firewall on the home Internet router would be just as secure as NAT. UPnP and friends would create only an allow rule instead of a combination allow rule plus a DNAT entry. If NAT did not have a stateful firewall then it would simply let in any traffic for which an SNAT or DNAT entry matched or else forward it to some default host that was expected to receive most traffic, perhaps the router device itself.

bombcar 3y ago
If we didn't have NAT default home routers would ship with "all ports open and routed" firewalls; and in fact that can still happen with IPv6. So in a very real way it has provided protection accidentally.
- anyfoo 3y ago
  Hah? I'm missing a step here. Why would they ship like that?
  - bombcar 3y ago
    Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And even if the defaults were secure, I guarantee someone would "route all" when that was a known "fix it" issue - just like you used to find people who would forward 1-65535 to their PC to play Internet games. NAT is still annoying and wrong, perhaps, but it DOES provide something akin to a layer of security in some cases; just like security through obscurity DOES provide some security for many things.
    - throw0101b 3y ago
      > Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And guess what: people used to connect their PCs directly to their DSL/cable modems and run PPPoE (or DHCP) on their Windows PCs directly, and their Windows PCs used to get assigned public IP addresses. Times change. It's no longer 2003. We've learned things in both the IPv4 and IPv6 space over the decades.
    - anyfoo 3y ago
      > Because they did ship like that, years ago Yeah, years ago. Years ago there was no encryption whatsoever. "Host based" authentication was common. And not the type that used certificates (or, in fact, cryptography of any kind), but the kind where you would enter IP addresses, host names, or even just patterns of those into a file called ".rhosts", and those then were the hosts that were allowed to run commands as root completely without further authentication. When you shared a folder in Windows using SMB, you usually shared it to anyone, including the Internet. Windows did not even have a good concept of separate user accounts. This is not an exaggeration, a very significant portion of unsuspecting users had their hard disk made available to everyone because they intended to share it with their own little local network. No password, no nothing. The Internet was littered with public FTP servers, of which a lot, and a lot of very public ones, had a directory called "/incoming" where you could upload and make available things for everyone else. IRC had a thing called "CTCP", client-to-client-protocol, with which two users' IRC clients communicated directly, client IP to client IP. That's right, you were chatting (or not chatting) to some "rando", and they not only had your IP address, they had the ability to send commands to your IRC client. WiFi, for a surprisingly long time, had encryption optional. And when it was turned on, it was easy to crack. The Internet was a very trusting place, and became gradually less so. With or without NAT, routers would have added strict, stateful firewalls, for the same reasons that everything else I've written above stopped.
      - kortilla 3y ago
        You’re way off on your comparisons. Routers that shipped with WPA3 had an IPv6 setting of “enable ipv6” and nothing else. Comparing it to a bygone era of no encryption is dumb.
        anyfoo 3y ago
        I’m not sure what you’re saying. That that checkbox enabled IPv6 and made all IPv6 capable devices behind the router accessible without any filtering? You said “had”, so presumably people found out what a bad idea that is and routers added filtering without also introducing NAT for IPv6. Isn’t that exactly the point?
    - vel0city 3y ago
      Gas back in the day was also shipped with lead additives. Things change. I don't think I've ever had a home router that didn't also advertise a stateful firewall and I've been buying home routers since 802.11b was a new thing. Are you sure you're not thinking of modems not shipping with a firewall? Because yeah, a pure modem probably doesn't have a firewall. I wouldn't want a modem with a firewall.
- zamadatix 3y ago
  All ports open and routed outbound sure, that's how they are now. Inbound though there isn't any clear reason to suddenly switch to allowing inbound session initiation to any port just because you aren't translating the port. It may have been a good kick back 20+ years ago when security wasn't as much a concern as just getting working internet. Not sure it's actually a relevant distinction at this point though.
- throw0101b 3y ago
  > If we didn't have NAT default home routers would ship with "all ports open and routed" firewalls; and in fact that can still happen with IPv6. [citation needed] Because my not-very-new Asus AC-something home router does get a /56 assignment from my residential ISP and none of my systems with a 2000::/3 address are accessible from the Internet.
- deleted 3y ago
  [deleted]
tjoff 3y ago
Sure, but the failure modes of NAT is pretty good and the NAT is hard to misconfigure. That the crappiest firewall could do the same is missing the point. People back in the day didn't have crappy firewalls, they had nothing. NAT was and is a brilliant first step that everyone has nowadays. UPnP tries its best to make it worse though but the existence of UPnP is alone proof that a crappy or good firewall wouldn't have been better than NAT for the common user.

bombcar 3y ago

If we didn't have NAT default home routers would ship with "all ports open and routed" firewalls; and in fact that can still happen with IPv6. So in a very real way it has provided protection accidentally.

anyfoo 3y ago
Hah? I'm missing a step here. Why would they ship like that?
- bombcar 3y ago
  Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And even if the defaults were secure, I guarantee someone would "route all" when that was a known "fix it" issue - just like you used to find people who would forward 1-65535 to their PC to play Internet games. NAT is still annoying and wrong, perhaps, but it DOES provide something akin to a layer of security in some cases; just like security through obscurity DOES provide some security for many things.
  - throw0101b 3y ago
    > Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And guess what: people used to connect their PCs directly to their DSL/cable modems and run PPPoE (or DHCP) on their Windows PCs directly, and their Windows PCs used to get assigned public IP addresses. Times change. It's no longer 2003. We've learned things in both the IPv4 and IPv6 space over the decades.
  - anyfoo 3y ago
    > Because they did ship like that, years ago Yeah, years ago. Years ago there was no encryption whatsoever. "Host based" authentication was common. And not the type that used certificates (or, in fact, cryptography of any kind), but the kind where you would enter IP addresses, host names, or even just patterns of those into a file called ".rhosts", and those then were the hosts that were allowed to run commands as root completely without further authentication. When you shared a folder in Windows using SMB, you usually shared it to anyone, including the Internet. Windows did not even have a good concept of separate user accounts. This is not an exaggeration, a very significant portion of unsuspecting users had their hard disk made available to everyone because they intended to share it with their own little local network. No password, no nothing. The Internet was littered with public FTP servers, of which a lot, and a lot of very public ones, had a directory called "/incoming" where you could upload and make available things for everyone else. IRC had a thing called "CTCP", client-to-client-protocol, with which two users' IRC clients communicated directly, client IP to client IP. That's right, you were chatting (or not chatting) to some "rando", and they not only had your IP address, they had the ability to send commands to your IRC client. WiFi, for a surprisingly long time, had encryption optional. And when it was turned on, it was easy to crack. The Internet was a very trusting place, and became gradually less so. With or without NAT, routers would have added strict, stateful firewalls, for the same reasons that everything else I've written above stopped.
    - kortilla 3y ago
      You’re way off on your comparisons. Routers that shipped with WPA3 had an IPv6 setting of “enable ipv6” and nothing else. Comparing it to a bygone era of no encryption is dumb.
      - anyfoo 3y ago
        I’m not sure what you’re saying. That that checkbox enabled IPv6 and made all IPv6 capable devices behind the router accessible without any filtering? You said “had”, so presumably people found out what a bad idea that is and routers added filtering without also introducing NAT for IPv6. Isn’t that exactly the point?
  - vel0city 3y ago
    Gas back in the day was also shipped with lead additives. Things change. I don't think I've ever had a home router that didn't also advertise a stateful firewall and I've been buying home routers since 802.11b was a new thing. Are you sure you're not thinking of modems not shipping with a firewall? Because yeah, a pure modem probably doesn't have a firewall. I wouldn't want a modem with a firewall.
zamadatix 3y ago
All ports open and routed outbound sure, that's how they are now. Inbound though there isn't any clear reason to suddenly switch to allowing inbound session initiation to any port just because you aren't translating the port. It may have been a good kick back 20+ years ago when security wasn't as much a concern as just getting working internet. Not sure it's actually a relevant distinction at this point though.
throw0101b 3y ago
> If we didn't have NAT default home routers would ship with "all ports open and routed" firewalls; and in fact that can still happen with IPv6. [citation needed] Because my not-very-new Asus AC-something home router does get a /56 assignment from my residential ISP and none of my systems with a 2000::/3 address are accessible from the Internet.
deleted 3y ago
[deleted]

tjoff 3y ago

Sure, but the failure modes of NAT is pretty good and the NAT is hard to misconfigure. That the crappiest firewall could do the same is missing the point. People back in the day didn't have crappy firewalls, they had nothing. NAT was and is a brilliant first step that everyone has nowadays. UPnP tries its best to make it worse though but the existence of UPnP is alone proof that a crappy or good firewall wouldn't have been better than NAT for the common user.