3 ms·
Having managed both, it is absolutely, 100%, not easier to manage NAT than a firewall. For example, here's a valid OpenBSD pf configuration: pass out on $ext
by kstrauser 3y ago
Having managed both, it is absolutely, 100%, not easier to manage NAT than a firewall. For example, here's a valid OpenBSD pf configuration:
pass out on $ext_if from any to any
That's it. That's the entire stateful firewall config: Don't allow anything inbound at all, except directly in response to an outbound connection.
If your firewall has a GUI, it'll be as easy to configure that as it is the NAT. If your firewall has a CLI, I guarantee there's no NAT in the world that's easier to configure than the above stateful firewall.
- JohnFen 3y agoWell, it's not quite that simple given my LAN's topology -- but you're right that it isn't incredibly complicated. I just prefer to manage it a different way. The end result is the same, so I'm not sure what the issue is here.
- ranger_danger 3y agoDepending on your threat level and exact firewall configuration, any bidirectional connection can be used to punch through in some way.