3 ms·
I have yet to see a "NAT is not security" rebuttal that does not make either one or both of these points: - NAT is not a security feature because it wasn't des
by mzajc 9mo ago
I have yet to see a "NAT is not security" rebuttal that does not make either one or both of these points:
- NAT is not a security feature because it wasn't designed as one (this post), and/or
- NAT is not a security feature because it does not, without a firewall, protect against an attacker on the WAN subnet, or another difficult-to-exploit scenario.
And yet making LAN devices unroutable from the Internet does on its own makes exploitation much more difficult. It's admittedly not a perfect measure, but it's one that IPv6 deployments with routable addresses for LAN devices lack. I would wager this does make a difference in the proliferation of botnets, especially given the lackluster standards of consumer network equipment security.
- Dagger2 9mo agoYou should read my other comments on this post. I've attempted, multiple times (but apparently without much success) to make the point that NAT is not a security feature because it does not, without a firewall, protect against an attacker. You don't need a qualifier like "on the WAN subnet". It just doesn't do anything to protect you from inbound connections at all.
- ahefner 9mo agoI think you're not technically wrong, but you're defining NAT differently than the majority of people you're arguing with (those who assume NAT also implies a firewall blocking inbound connections), and the remaining minority (the "on the WAN subnet" crowd) are dismissing outright the idea as a reasonable attack vector that an attacker close enough to be able to send packets destined for non-internet routable addresses to your router. Is the latter something that was/is actively exploited?
- bandrami 9mo agoThere's an implicit trust of ISPs in the comments that I find concerning