Hacker News Reader

Comment by crehn | Hacker News Reader

What about the security aspects of NAT?

e.g. Isolating subnets and restricting outbound access. Seems like a useful defence-in-depth mechanism in case of misconfigured firewall rules.

View on HN

There isn't any security aspect to NAT, you're relying on the fact nobody's added an upstream route back to you:

https://www.anvilsecure.com/blog/dhcp-games-with-smart-route...

NAT without port forwarding done by router facing the ISP, the default kind of NAT which the subscriber does not have to worry about configuring, has very great security aspect. Connect your home network devices to the router doing that kind of NAT,and this automatically protects all devices in your local network from incoming connections.

Yes, but that's an unintended consequence and cannot be relied upon. Any default-configuration firewall would achieve the same, but in a more reliable manner.

> that's an unintended consequence

No, it's entirely unrelated to NAT. That's a consequence of the firewall on the router.

IPv6 doesn't get rid of the firewall.

That was precisely my point. Thanks for clarifying :)

> that's an unintended consequence Even granted that, so what? It does protect home devices' ports by default, no?

> any default-configuration firewall would achieve the same

OK, but default NAT does achieve it as well, right?

It does protect all devices in your home network, until someone uses one of the various NAT slipstreaming attacks from a malicious ad and open up the web interface to your IP cameras without you noticing.

NAT has become too complex and most consumer versions of it are developed for ease of use over security. Don't trust NAT to protect your network, because the device doing NAT in your home network most likely wasn't developed to use it as a security measure.

Isn’t that attack still possible on IPv6? It’s an attack on the stateful firewall connection tracking, not NAT.

Reply on news.ycombinator.com