3 ms·

> NAT is desirable for security/network isolation reasons For the love of expletive this mistaken belief needs to have died yesterday. NAT boxes help primarily

> NAT is desirable for security/network isolation reasons For the love of expletive this mistaken belief needs to have died yesterday. NAT boxes help primarily because they also contain a firewall. But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. (Yes, that does still happen, so you keep your firewall.) > no distinction between a local IP and a public IP https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address

BonoboIO 2y ago
Amen! In the 2000s I had a newly setup windows xp with the modem on the internet. After 30 minutes it was toast. Riddled with viruses.
- nurettin 2y ago
  I had the same, except I was not running it as admin, so nothing could touch system32 or the boot sector.
aboardRat4 2y ago
>But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. That is Survivor Bias at its best. The originate _inside_ because NAT effectively blocks all _external_ requests.
- eqvinox 2y ago
  > The originate _inside_ because NAT effectively blocks all _external_ requests. You mean the firewall effectively blocks all external requests.
  - noduerme 2y ago
    Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingly little of it on modern OSes comes from external sources like a scan revealing a mistakenly open port. It's just that the threat profile has shifted toward making users make mistakes to the point where so much resource is thrown at fooling users now that, by the numbers and the ransomware profits, it's more effective than trying to penetrate software remotely.
    - tjoff 2y ago
      That is because most systems comes with a firewall on and fairly limited surface area in the form of exposed services. But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world.
      - throw0101d 2y ago
        > But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world. Yes. And you can not-expose them via default deny firewall rule. My home printer had an IPv6 in a prefix assigned from my ISP, but it was not accessible to the Internet (it was actually ping6-able because my Asus allowed ICMPv6 by default, but I could not connect to its web interface, like I can internally). Neither could I SSH into my macOS desktop or laptop from the outside (but could between the two internally). And even if my globally addressable devices were globally reachable (which they were not), good luck scanning a /64.
        tjoff 2y ago
        I know. But this old NAT vs. firewall crap was pointless decades ago. Still is.
  - Sophira 2y ago
    You are technically correct that iptables is what provides the NAT functionality on Linux (by way of the MASQUERADE target), which many routers run. However, you are very incorrect that the firewall is directly involved in blocking the request. The reason NAT works for this is because by default there are no Internet-accessible services available via the router. If a request is received by the router that doesn't match an open port, its OS will, by default, reject it, with no firewall required.

BonoboIO 2y ago

Amen! In the 2000s I had a newly setup windows xp with the modem on the internet. After 30 minutes it was toast. Riddled with viruses.

nurettin 2y ago
I had the same, except I was not running it as admin, so nothing could touch system32 or the boot sector.

aboardRat4 2y ago

>But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. That is Survivor Bias at its best. The originate _inside_ because NAT effectively blocks all _external_ requests.

eqvinox 2y ago
> The originate _inside_ because NAT effectively blocks all _external_ requests. You mean the firewall effectively blocks all external requests.
- noduerme 2y ago
  Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingly little of it on modern OSes comes from external sources like a scan revealing a mistakenly open port. It's just that the threat profile has shifted toward making users make mistakes to the point where so much resource is thrown at fooling users now that, by the numbers and the ransomware profits, it's more effective than trying to penetrate software remotely.
  - tjoff 2y ago
    That is because most systems comes with a firewall on and fairly limited surface area in the form of exposed services. But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world.
    - throw0101d 2y ago
      > But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world. Yes. And you can not-expose them via default deny firewall rule. My home printer had an IPv6 in a prefix assigned from my ISP, but it was not accessible to the Internet (it was actually ping6-able because my Asus allowed ICMPv6 by default, but I could not connect to its web interface, like I can internally). Neither could I SSH into my macOS desktop or laptop from the outside (but could between the two internally). And even if my globally addressable devices were globally reachable (which they were not), good luck scanning a /64.
      - tjoff 2y ago
        I know. But this old NAT vs. firewall crap was pointless decades ago. Still is.
- Sophira 2y ago
  You are technically correct that iptables is what provides the NAT functionality on Linux (by way of the MASQUERADE target), which many routers run. However, you are very incorrect that the firewall is directly involved in blocking the request. The reason NAT works for this is because by default there are no Internet-accessible services available via the router. If a request is received by the router that doesn't match an open port, its OS will, by default, reject it, with no firewall required.