“Mangling routing” to a single source IP requires state tracking of outbound sessions to know where to send inbound traffic. No outbound traffic, no session, no inbound traffic.
What the GP is trying to tell you is that you're conflating sateful filtering with NAT. If you rip the address translation part out of a NAT implementation, you get a stateful firewall. You're probably better off with a purpose-designed stateful firewall, but ripping the NAT out of NAT works and is an obvious reduction in complexity.
Insisting that you lose packet filtering if you get rid of NAT is a straw man argument. Nobody is arguing for that. They just want to remove the address mangling portion of the cheap router while keeping the packet filtering.
Firewalls are packet filters. Confusing routing and packet filtering doesn't help anybody solve any problems.
We're talking (I think) about how to mitigate threats from the public internet by dropping unwanted traffic with IPv6. The answer is a firewall (as it is with IPv4).
What would be the ipv6 equivalent? You can call it a donkey all you want.
Hardware that happens to be popular are often updated to a cheaper variant where the manufacturer rides on the fame and good reviews of the original version.
So you can't even do the research once and expect it to hold for future purchases/replacements.
usrusr explained it nicely. It will likely take years before anyone will realize that the firewall doesn't work at all. Whereas a similarly broken NAT router will be declared DOA.
Broken NAT:
iptables -t nat -A POSTROUTING -o outside0 -j MASQUERADE
iptables -P FORWARD ACCEPT
NAT is not a firewall.
True, it will be called a "router" in consumer speak, but all consumer IPv6 routers should actually be firewalls.
NAT isn't doing that filtering, the stateful firewall is.. Every NAT device sold in a very long time has both features..
Some early DSL modems for example had only NAT, and they were horribly insecure.
NAT is not a firewall, and provides near zero security. And, in combination with a stateful firewall, it provides exactly zero additional security.
A NAT router without any kind of firewall functionality is incredibly unsafe too so even the cheapest ones have some of it these days.
Which follows that the cheapest IPv6 routers would also have a firewall and thus would not be inherently worse at protecting the internal network than a v4 router doing NAT would.
Add a stateful firewall with connection tracking, and that port is only open to the 1 server you tried to connect to.
The problem comes when your router receives a packet addressed to one of your local devices. Many people in this thread believe that if the router is NATing outbound connections, it'll drop this inbound packet, but that's not what happens -- the packet will actually be routed to whichever local device it was addressed to, just like any other packet would be.
This should be fairly obvious, because the only thing NAT does is change the apparent source address on outbound connections. It does nothing at all to inbound ones (and you can demonstrate this to yourself by setting up a test network in some VMs and NATing traffic between them with Linux and iptables).
(You can configure a NAT to do things to inbound connections using port forwarding rules and/or a DMZ, but those rules only apply to specific inbound connections. Connections not covered by those rules are treated as normal, and "as normal" for a router means normal routing.)
NAT isn't a firewall, because it doesn't drop connections. All it does is rewrite addresses on connections, not decide which connections can and can't be made.
Absolutely. It's trivial to demonstrate how utterly useless a router configured with NAT, with routing, but without a firewall is. (Useless in the context of a home CPE device for the average home internet subscriber..)
As a side note, yes, packets arriving towards your router with a destination address on your LAN will be forwarded by the router piece of your router.. the firewall piece would prevent this. This is independent of the use of/absence of NAT though..
But it's not trying to drop anything. You can set a default device to throw all incoming connections at.
And with a pure NAT you can't set any rules about what to allow or drop. It only acts like a firewall from one very narrow angle.
NAT on the other hand is not a fundamental requirement for a firewall.
NAT bolts onto a firewall, and it's the firewall that provides the security. Remove NAT, and you haven't lost anything in terms of security.
This is why firewalling is separate from NAT, and why NAT isn't a firewall. Yes, it's true that both NATing and firewalling rely on tracking state, and typically both NAT and firewalling are implemented together in the same software and hardware, but they're two separate behaviors and you can do one without doing the other.
This isn't really 100% true though. Since IPv4 NAT was never standardized, many many variations exist in the wild and some can be exploited to send unsolicited traffic inside the network defeating the implicit "firewall" aspect of NAT.
NAT translates IPs. Firewalls allow or block traffic based on a policy. In some configurations (static NAT, port forwarding, etc. etc.), there's no firewall aspect to NAT at all. In others (PAT, what this discussion is mostly about), there's often an implicit firewall, but different implementations have widely variable behavior, and it basically should not be depended on as a firewall.
If you want to deny inbound unsolicited traffic, then you need a firewall.
Have a windows PC? Did you try access a network share that exists outside your network? Well, now the SMB port is open. Anyone on the internet can reach it. Hopefully your desktop has a stateful firewall to mitigate the hole in your router....
There's going to be hundreds of other examples.
NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs.
(Well, PAT style NAT anyway... But that's what everyone here is talking about...)
Granted, this was a while ago.
At the end of the day, opening ports, any ports, is "dangerous".. A stateful firewall prevents much of the danger introduced by ports opened via NAT.