Hacker News Reader

Comment by kiallmacinnes | Hacker News Reader

This is true, and it's the very minor security benefit of NAT. However, without the stateful firewall in addition, you're wide open to attack.

Have a windows PC? Did you try access a network share that exists outside your network? Well, now the SMB port is open. Anyone on the internet can reach it. Hopefully your desktop has a stateful firewall to mitigate the hole in your router....

There's going to be hundreds of other examples.

View on HN

I don't think that remote network share access is very common among home Windows users, but Skype is. The last time that I pointed nmap at a PC with Skype on a conversation, the output of open ports was more than a screenful. Skype listens on literally tens of ports.

Granted, this was a while ago.

It's been a while since I used a windows machine that wasn't connected to a domain / managed by a IT dept... But isn't windows file sharing enabled by default on home editions? And from memory, no authentication is required to interact with the service - it's only after you connect, obtain a list of shares, and attempt to open a share that authentication becomes required - leaving plenty of room for bugs to be exploited.

At the end of the day, opening ports, any ports, is "dangerous".. A stateful firewall prevents much of the danger introduced by ports opened via NAT.

Windows ships with an enabled-by-default stateful firewall which rejects any connections from sources not on the local subnet.

Right, but if someone thinks NAT on its own is protecting them... I'll bet they turned that local firewall off too the moment it got in the way of $thing they needed to do ;)

Not really, NAT will keep track of destination address as well so unless the network share outside the network is also the address of an adversary, the SMB port isn't open to the internet.

NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall.

NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs.

(Well, PAT style NAT anyway... But that's what everyone here is talking about...)

Your thinking of the firewall that's built into most consumer routers. The exact technicalities of NAT (PAT actually) are not super well defined, and many implementations will not track the destination address.

Reply on news.ycombinator.com