3 ms·

I responded to a similar comment there: https://news.ycombinator.com/item?id=39163623 https://news.ycombinator.com/item?id=39163623 > DENY doesn't provide you

I responded to a similar comment there: https://news.ycombinator.com/item?id=39163623 https://news.ycombinator.com/item?id=39163623 > DENY doesn't provide you stateful tracking. Yes, but I wrote that for the usual "but NAT doesn't let attackers get in my network!!1" in mind. Not the first time here: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=justsomehnguy%20NAT&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... sigh I probably should just make a blog post on it or something and just point people there.

cyberax 3y ago
The thing is, NOTHING in your post disputes that NAT provides very real, simple, and robust security for local networks. With NAT you simply can NOT make unsolicited connections to internal hosts. It's not an illusion, it's actual security. Is it completely foolproof? No. But it definitely makes it easier to use, e.g. esp8266-based devices without worrying that they'd be knocked offline by an automated script that sends a couple megabits of traffic their way. And to do the same on IPv6 you need 80% of NAT, in particular you need stateful connection tracking.
- Dagger2 3y ago
  You simply can. NAT doesn't give any security whatsoever. Here's an unsolicited connection to an internal host over a router that's doing NAT: (192.168.0.101)$ echo "Hello from inside" | nc -vlp5000 Connection from [203.0.113.1] port 5000 [tcp/*] accepted (family 2, sport 36596) (203.0.113.1)$ nc 192.168.0.101 5000 Hello from inside And here's the 3-way handshake captured on the router: wan0 In IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [S] lan0 Out IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [S] lan0 In IP 192.168.0.101.5000 > 203.0.113.1.36854: Flags [S.] wan0 Out IP 192.168.0.101.5000 > 203.0.113.1.36854: Flags [S.] wan0 In IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [.] lan0 Out IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [.] See? It works just fine. Here's the other direction, just in case you think I wasn't NATing: lan0 In IP 192.168.0.101.44682 > 203.0.113.1.5000: Flags [S] wan0 Out IP 203.0.113.58.44682 > 203.0.113.1.5000: Flags [S] (If you want to see any aspect of the config, just ask. Give me commands to run if you want.)
  - cyberax 3y ago
    I can also deliberately misconfigure the router, connect directly to it's WAN port, and then pretend that it somehow validated my nonsense statement. This works ONLY if you control the ISP infrastructure, and the router is allowing inbound traffic to LAN. Mikrotik by default doesn't.
    - justsomehnguy 3y ago
      Lol, Mikrotik by default has an empty firewall ruleset with policy ACCEPT.
      - cyberax 3y ago
        It also doesn't add routes between the outer and inner networks.
        Dagger2 3y ago
        That's not quite how routes work, but... of course it does. Outbound connections wouldn't work otherwise.
    - Dagger2 3y ago
      The fact that it works at all disproves your "you can't do it" claim. I didn't misconfigure the router here. Please ask for whatever config info would convince you of that. It's true that most router devices you buy (presumably including Mikrotik) do block inbound connections by default, but they do it with a firewall, not with NAT. The reason they need the firewall is because NAT doesn't do it.
      - cyberax 3y ago
        Yes, it is correct. You can't do it in practice, because it requires you to control the ISP. This automatically makes it a non-issue for pretty much all home and small office networks. Meanwhile, the DEFAULT state for IPv6 is being open to the world. > I didn't misconfigure the router here. Please ask for whatever config info would convince you of that. OK. How can I ping your address? It should be easy, right? I'll even give you my IP: 208.52.76.162 , what do I need to set up to be able to ping all your internal hosts? Let's make that experiment.

cyberax 3y ago

The thing is, NOTHING in your post disputes that NAT provides very real, simple, and robust security for local networks. With NAT you simply can NOT make unsolicited connections to internal hosts. It's not an illusion, it's actual security. Is it completely foolproof? No. But it definitely makes it easier to use, e.g. esp8266-based devices without worrying that they'd be knocked offline by an automated script that sends a couple megabits of traffic their way. And to do the same on IPv6 you need 80% of NAT, in particular you need stateful connection tracking.

Dagger2 3y ago
You simply can. NAT doesn't give any security whatsoever. Here's an unsolicited connection to an internal host over a router that's doing NAT: (192.168.0.101)$ echo "Hello from inside" | nc -vlp5000 Connection from [203.0.113.1] port 5000 [tcp/*] accepted (family 2, sport 36596) (203.0.113.1)$ nc 192.168.0.101 5000 Hello from inside And here's the 3-way handshake captured on the router: wan0 In IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [S] lan0 Out IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [S] lan0 In IP 192.168.0.101.5000 > 203.0.113.1.36854: Flags [S.] wan0 Out IP 192.168.0.101.5000 > 203.0.113.1.36854: Flags [S.] wan0 In IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [.] lan0 Out IP 203.0.113.1.36854 > 192.168.0.101.5000: Flags [.] See? It works just fine. Here's the other direction, just in case you think I wasn't NATing: lan0 In IP 192.168.0.101.44682 > 203.0.113.1.5000: Flags [S] wan0 Out IP 203.0.113.58.44682 > 203.0.113.1.5000: Flags [S] (If you want to see any aspect of the config, just ask. Give me commands to run if you want.)
- cyberax 3y ago
  I can also deliberately misconfigure the router, connect directly to it's WAN port, and then pretend that it somehow validated my nonsense statement. This works ONLY if you control the ISP infrastructure, and the router is allowing inbound traffic to LAN. Mikrotik by default doesn't.
  - justsomehnguy 3y ago
    Lol, Mikrotik by default has an empty firewall ruleset with policy ACCEPT.
    - cyberax 3y ago
      It also doesn't add routes between the outer and inner networks.
      - Dagger2 3y ago
        That's not quite how routes work, but... of course it does. Outbound connections wouldn't work otherwise.
  - Dagger2 3y ago
    The fact that it works at all disproves your "you can't do it" claim. I didn't misconfigure the router here. Please ask for whatever config info would convince you of that. It's true that most router devices you buy (presumably including Mikrotik) do block inbound connections by default, but they do it with a firewall, not with NAT. The reason they need the firewall is because NAT doesn't do it.
    - cyberax 3y ago
      Yes, it is correct. You can't do it in practice, because it requires you to control the ISP. This automatically makes it a non-issue for pretty much all home and small office networks. Meanwhile, the DEFAULT state for IPv6 is being open to the world. > I didn't misconfigure the router here. Please ask for whatever config info would convince you of that. OK. How can I ping your address? It should be easy, right? I'll even give you my IP: 208.52.76.162 , what do I need to set up to be able to ping all your internal hosts? Let's make that experiment.