5 ms·

I'll go with the IETF position: NAT (particularly NAPT) actually has the potential to lower overall security because it creates the illusion of a securit

I'll go with the IETF position: NAT (particularly NAPT) actually has the potential to lower overall security because it creates the illusion of a security barrier, but does so without the managed intent of a firewall. Appropriate security mechanisms are implemented in the end host, without reliance on assumptions about routing hacks, firewall filters, or missing NAT translations, which may change over time to enable a service to a neighboring host. In general, defined security barriers assume that any threats are external, leading to practices that make internal breaches much easier. * https://datatracker.ietf.org/doc/html/rfc2993#section-9 https://datatracker.ietf.org/doc/html/rfc2993#section-9 The more likely scenario is your system (or phone) gets compromised, it lives behind the supposedly secure NAT "firewall", and since you had a false sense of security from NAT your entire internal network has all sorts of holes. The era of network moats was over long ago, and NAT is simply perpetuating the illusion. I'd rather take the risk of SPI IPv6 firewalls, have the alleged chaos of allegedly exposed IoT systems, and force everyone to up their security game: short-term pain is healthier IMHO.

horsawlarway 3y ago
> The more likely scenario is your system (or phone) gets compromised, it lives behind the supposedly secure NAT "firewall" It's far easier than that - web pages running on your machine are also "calling from inside the house" if you will (https://static.tvtropes.org/pmwiki/pub/images/campfire.png https://static.tvtropes.org/pmwiki/pub/images/campfire.png) You load up some js on any random site and it can do a pretty thorough scan of your network in a few minutes.
harry8 3y ago
> I'd rather take the risk of... But not on your own network or your parents/friends whoever. You want others to have that pain, as a policy decision, right? It's reasonable but worth clarifying.
arka2147483647 3y ago
> … does so without the managed intent of a firewall. Most home networks have no management, or intent, at all. People just buy whatever boxes are sold to them and plug them in. Now, yes, if you actually design a network, and properly set things up, then a firewall will give you better control. Will grampa Jim do that? Absolutely not.
- GoblinSlayer 3y ago
  You can also have LAN before NAT, and if you're not firewalled from LAN, you can be attacked.

horsawlarway 3y ago

> The more likely scenario is your system (or phone) gets compromised, it lives behind the supposedly secure NAT "firewall" It's far easier than that - web pages running on your machine are also "calling from inside the house" if you will (https://static.tvtropes.org/pmwiki/pub/images/campfire.png https://static.tvtropes.org/pmwiki/pub/images/campfire.png) You load up some js on any random site and it can do a pretty thorough scan of your network in a few minutes.

harry8 3y ago

> I'd rather take the risk of... But not on your own network or your parents/friends whoever. You want others to have that pain, as a policy decision, right? It's reasonable but worth clarifying.

arka2147483647 3y ago

> … does so without the managed intent of a firewall. Most home networks have no management, or intent, at all. People just buy whatever boxes are sold to them and plug them in. Now, yes, if you actually design a network, and properly set things up, then a firewall will give you better control. Will grampa Jim do that? Absolutely not.

GoblinSlayer 3y ago
You can also have LAN before NAT, and if you're not firewalled from LAN, you can be attacked.