then there is the Windows firewall:
- Applications that punch their own holes, like steam
- Windows which grants itself inbound exceptions and reenables them if you disable them
- A non standard filtering order (deny is always defore allow, not in order)
And then there are all those born in the 80s people that were told on LAN parties to "just disable the Windows firewall" and kept doing so.
You caught me. I think a firewall on the router is absolutely essential regardless of NAT scenarios.
With the understanding that you have an entire generation of computer users who equate that internet box with some degree of safety, you will find less friction with some tweak to that experience. You can still call it "port forwarding", block all inbound by default, and keep most of the same UX.
I personally like to operate my home network like a DMZ. Being able to reach any computer from any other without screwing around with networking is very convenient to me. I operate with an all-or-nothing trust model on my LAN. Having some centralized firewall helps a lot with this.
The rest of the world, though, knows that you don't just randomly open ports without good reason and without ways to turn off services.
Perhaps you should inform the IoT community.
This is insane. I don't want to have to learn, document, configure, and patch a different firewall on every internet connected device I own. That's a total nightmare. Computers can have their firewalls managed at the domain level. How is that support to work for bluray players, game consoles, light bulbs, phones, echo devices, door cams, thermostats, and kitchen appliances?
Nope. At a minimum everyone should have a stateful firewall at their edge making their devices impossible to reach/scan from the internet at large. Home routers that defaulted to using NAT made that dead simple.
On the rare occasion you really need something open to the entire internet it can sit in your DMZ. If I ever do make the move to using IPv6 on my network I'll likely continue to use NAT
Home routers have gotten pretty good about sane defaults these days, but at a minimum I'd be disabling UPnP and looking over what those defaults are before trusting it to protect my network.
You could argue that having one edge device running a checked and configured firewall means that you don't have to worry about the firewalls installed on every other device on the network, but anyone who has networking experience will know better. Problems are bound to come up on the internal network if nothing else and troubleshooting issues becomes a lot more complicated!
Also, if we're counting on every IoT product to come with its own embedded firewall you can be sure many of those are going to be so poorly thrown together that they introduce more security problems than they solve. This is a class of products that has earned a horrible reputation in terms of security.
I don't see a way to fix this (and configuration errors are common).
Routers should have dashboards that give easy status of firewall configuration ala Windows firewall: Green for no inbound rules (or whitelisted rules) and yellow/red for non-checked rules.
Routers could even have LEDs or status displays like some higher end Ubiquiti prosumer products have, showing firewall status.
Routers could have a user-accessible API and Windows client that shows status on a taskbar item.
The technical solutions are there, but I don't have faith ASUS and co will build a competent product.
Secure systems are robust against user mistakes (and even middlemen mistakes). A NAT is one such system. Alternatives do not work like that.
The last time I was looking for a home router I specifically went for Asus because their default firmware is pretty good, and third-party options are available:
* https://www.asuswrt-merlin.net/features
Currently running an RT-AC68U.
Of course, I have no idea how often an ISP actually changes your IPv6 prefix. In an ideal world, it'd never change...
A dynamic IP change can just happen without much warning, and enjoy possibly spending an hour befuddled before you realize what happened.