4 ms·

No... it's not? It's simply a widely-used technique to rewrite the addresses of IP packets that transit a router. It inherently makes no policy decisions on whi

by growse 2y ago

No... it's not? It's simply a widely-used technique to rewrite the addresses of IP packets that transit a router. It inherently makes no policy decisions on which packets should and shouldn't flow over and above what a router does anyway.

mixmastamyk 2y ago
I’ve never seen one without the other, so while technically correct, not useful to debate.
- growse 2y ago
  shrug at work we use NAT to let two different networks with overlapping addresses talk to each other all the time. No firewalls there. NAT wasn't invented for the home-broadband user, you know. But I'm at least glad we've cleared up the myth that NAT provides any security benefit when, in fact, it's the often deployed accompanying stateful firewall that's actually providing this.
  - mixmastamyk 2y ago
    We out-number companies, perhaps by an order of magnitude.
    - growse 2y ago
      Not by allocated IP address count.
- Dagger2 2y ago
  It's useful to correct this misunderstanding, because people often take "I've always seen NAT come with firewalling" to mean "firewalls are impossible without NAT". You quite regularly see people pop up in these threads arguing something like, oh, I dunno, "In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall.", as if this is somehow a problem with IPv6 rather than a problem with their own understanding. It's hard enough to get people to deploy v6 as it is without them mistakenly believing that a lack of NAT means their router can't provide firewalling either.
cyberax 2y ago
It automatically prevents the outside world from being able to access the inside network. Which is the main function of most of the firewalls. Pretty much everything else in a firewall in the modern world is just useless feature creep.
- Dagger2 2y ago
  It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. Take two networks that are identical, except one is doing NAT and one isn't, and test them. Every connection that works on the without-NAT network will also work on the with-NAT network. The only difference you'll find is that some outbound connections which didn't work on the former will work on the latter. Some would argue that "every connection that used to work still works, and some connections that didn't work before do now work" is kind of the opposite of a firewall.
  - cyberax 2y ago
    > It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. It absolutely does. There is no way with NAT to connect from the outside network to the inside ("but what if the attacker is directly attached to the next hop blahblahblah"). That's all that firewalls need to do, everything else is useless noise in the current world. > Take two networks that are identical, except one is doing NAT and one isn't, and test them. Here's my IP: 192.168.80.36. Feel free to attack me. Go on. The public IPv4 of my router is 76.191.126.81. I even opened a port 8871 for you with a static page with a Bitcoin wallet worth $1000, you just need to get to it. You can't. There's no way to get to my computer without hacking the NAT server first. That's why NAT _is_ a firewall, and a foolproof one at that. It's secure by default, unlike IPv6 firewalls that can fail open.
    - growse 2y ago
      I've just remembered the firewall alignment chart, which asserts a view of the world that an excavator is a firewall. https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0-1df7368a748c.jpeg?format=webp https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0...

by growse 2y ago

mixmastamyk 2y ago

I’ve never seen one without the other, so while technically correct, not useful to debate.

growse 2y ago
shrug at work we use NAT to let two different networks with overlapping addresses talk to each other all the time. No firewalls there. NAT wasn't invented for the home-broadband user, you know. But I'm at least glad we've cleared up the myth that NAT provides any security benefit when, in fact, it's the often deployed accompanying stateful firewall that's actually providing this.
- mixmastamyk 2y ago
  We out-number companies, perhaps by an order of magnitude.
  - growse 2y ago
    Not by allocated IP address count.
Dagger2 2y ago
It's useful to correct this misunderstanding, because people often take "I've always seen NAT come with firewalling" to mean "firewalls are impossible without NAT". You quite regularly see people pop up in these threads arguing something like, oh, I dunno, "In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall.", as if this is somehow a problem with IPv6 rather than a problem with their own understanding. It's hard enough to get people to deploy v6 as it is without them mistakenly believing that a lack of NAT means their router can't provide firewalling either.

cyberax 2y ago

It automatically prevents the outside world from being able to access the inside network. Which is the main function of most of the firewalls. Pretty much everything else in a firewall in the modern world is just useless feature creep.

Dagger2 2y ago
It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. Take two networks that are identical, except one is doing NAT and one isn't, and test them. Every connection that works on the without-NAT network will also work on the with-NAT network. The only difference you'll find is that some outbound connections which didn't work on the former will work on the latter. Some would argue that "every connection that used to work still works, and some connections that didn't work before do now work" is kind of the opposite of a firewall.
- cyberax 2y ago
  > It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. It absolutely does. There is no way with NAT to connect from the outside network to the inside ("but what if the attacker is directly attached to the next hop blahblahblah"). That's all that firewalls need to do, everything else is useless noise in the current world. > Take two networks that are identical, except one is doing NAT and one isn't, and test them. Here's my IP: 192.168.80.36. Feel free to attack me. Go on. The public IPv4 of my router is 76.191.126.81. I even opened a port 8871 for you with a static page with a Bitcoin wallet worth $1000, you just need to get to it. You can't. There's no way to get to my computer without hacking the NAT server first. That's why NAT _is_ a firewall, and a foolproof one at that. It's secure by default, unlike IPv6 firewalls that can fail open.
  - growse 2y ago
    I've just remembered the firewall alignment chart, which asserts a view of the world that an excavator is a firewall. https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0-1df7368a748c.jpeg?format=webp https://sh.itjust.works/pictrs/image/421c9549-83ee-487a-9fa0...