3 ms·
> I don't want any random machines behind my router to be able to open ports to the internet at large. While it's hypothetically possible to have NAT without a
by kstrauser 3y ago
> I don't want any random machines behind my router to be able to open ports to the internet at large.
While it's hypothetically possible to have NAT without a firewall, I've never personally touched or seen such a thing. I can confidently state that if you have NAT, you also have a firewall. Use it.
- JohnFen 3y agoI never said a thing about not using a firewall. My firewall is what protects my LAN, after all.
- kstrauser 3y agoThen you’re not getting any extra protection from a NAT.
- JohnFen 3y agoTrue! I wasn't claiming that I was. What I am claiming is that doing it this way is more convenient for me. Since IPv6 doesn't give any benefits that matter to me, the only reason I'd do it is to maintain the ability to talk to my ISP. So my goal would be to make the transition as quick and easy for me as possible.
- jeroenhd 3y agoBecause of NAT ALGs, most consumer NAT devices actually allow plaintext protocols to bypass the internet-facing firewalls inside routers. Unless you program your own ALGs, you basically get to pick between "SIP, FTP, and a bunch of other protocols don't work without port forwards" or "your public firewall is off for almost anyone who can make your computer load an ad". NAT breaks internet protocols and as a result we got firewall-evading workarounds.
- deleted 3y ago[deleted]
- nijave 3y ago1:1 NAT or floating IPs. I've only ever seen those to simplify server setups where a subset of servers need a public IP