5 ms·

I would phrase it as: NAT accidentally "breaks" or "makes harder/impossible" something which yields increased security, under some circumstances.

• Dagger2 9mo ago
  It doesn't though. NAT edits your outbound connections to appear to come from the router's IP; it doesn't do anything to make inbound connections harder.
  • fc417fc802 9mo ago
    If you don't initiate a corresponding outbound connection first then any attempt at an inbound connection will be dropped (unless you have a DMZ configured ofc). The router literally can't forward the traffic because it doesn't know where it should go.
    • Dagger2 9mo ago
      It might be dropped by a firewall, but not by NAT. IP packets have a "destination IP" field in the header. The router knows where to forward packets because it reads that IP out of the header.
      • tsimionescu 9mo ago
        Sure, but the Internet will not route packets going to RFC1918 addresses. So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dropped. And those that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection or an explicit port forwarding rule will also get refused. This is all behavior that happens even with no firewall whatsoever.
        • Dagger2 9mo ago
          So? How is any of that relevant?
          • tsimionescu 9mo ago
            Because this is exactly what the GP was claiming, and you denied: even without a firewall, packets that don't correspond to an open connection will get dropped by a NAT, even without a firewall. Sure, maybe "dropped" is wrong, as the NAT box will probably instead send a RST packet, but this is almost entirely irrelevant.
            • Dagger2 9mo ago
              Right, we were talking about NAT. So how is any of that non-NAT-related stuff relevant? > Sure, but the Internet will not route packets going to RFC1918 addresses This is about RFC1918, not NAT. > So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dropped. This is about reverse path filtering, not NAT. > And those that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection or an explicit port forwarding rule will also get refused. And this is... actually not true. If there's a server listening on the relevant port, the connection is accepted.
              • tsimionescu 9mo ago
                > And this is... actually not true. If there's a server listening on the relevant port, the connection is accepted. Fine. Packets that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection, an explicit port forwarding rule, OR the port of a service on the router itself listening on the WAN IP will also get refused. The point is that any LAN box sitting behind the NAT will not get that packet, same as if the router had a stateful firewall running. And sure, this is not purely a property of the NAT itself, it's a combination of the Internet not routing private IP addresses, reverse path filtering, and NAT. That still doesn't need any firewall to achieve this.
    • icedchai 9mo ago
      No, the router doesn't forward it because it doesn't get there in the first place. Your 192.168.1.0/24 private network is not going to be routed across the internet.