3 ms·
> The most common NAT (PAT) configurations don't deny unsolicited inbound traffic That doesn’t make sense. If I have a single routable IPv4 addresses and 100
by ninkendo 2y ago
> The most common NAT (PAT) configurations don't deny unsolicited inbound traffic
That doesn’t make sense.
If I have a single routable IPv4 addresses and 100 machines behind it with RFC1918 addresses, how can any possible router “allow by default” say, port 22? Which machine would it route it to? Would it pick the first one? Randomly select one?
Of course NAT has to drop incoming unsolicited packets. Unless you tell it which machine to route them too, it couldn’t possibly know how to “allow” them in the first place.
- Dagger2 2y agoIP packets have a "destination IP" header field that specifies where the packet goes. The router reads that to figure out where to send the packet. The only thing NAT does is rewrite the dst or src headers of packets. If there's no rule or state entry that applies to a packet, it doesn't drop the packet. It just leaves the original headers on it.
- ninkendo 2y agoHow would a packet with a destination IP of my internal RFC1918 address have landed on my WAN interface in the first place? It would require my ISP to have a routing rule that sends it to my router. Is that the threat model you’re thinking about?
- icedchai 2y agoHe's assuming your non-routeable RFC1918 addresses are actually routed from the Internet, which won't be happening in the normal consumer use case.