4 ms·
It's not actually secure; your router will route inbound packets to whatever IP is in the packet's destination header, and that can be a machine on your LAN. Th
by Dagger2 3y ago
It's not actually secure; your router will route inbound packets to whatever IP is in the packet's destination header, and that can be a machine on your LAN. This remains true whether or not you're applying NAT to your outbound connections.
If anything, NAT makes you less secure by tricking you into a false sense of security.
(It's also worse if you're deliberately running servers, because it catastrophically reduces the search space needed for a hostile actor to find those servers via network scanning. At least, it does on v6 -- on v4 the search space is already too small to be a relevant factor.)
- hot_gril 3y ago> your router will route inbound packets to whatever IP is in the packet's destination header, and that can be a machine on your LAN The dst is going to be the router's address, not one of the LAN's private IPs.
- Dagger2 3y agoNot necessarily. What enforces that? You can't rely on your attackers to kindly not send traffic to IPs you don't want them to.
- hot_gril 3y agoThe routers. My ISP can't route dst=192.168.1.2 to anywhere, and even if someone managed to splice the packet in between my router and the ISP, my router won't take that dst. That address doesn't exist on the WAN.
- Dagger2 3y agoNo, the routers don't enforce that, and your ISP can route packets with a destination IP of 192.168.1.2, or anything else they like, to you just fine. Your router will happily "take" that destination IP. The only reason it won't is because of a firewall, not because of NAT.