Hacker News Reader

NAT doesn't ever provide security, only pretending to.

I’ve seen this sentiment repeated over and over in this thread without a single explanation.

Please explain how NAT on IPv4, as used in practice, does not increase security vs connecting machines each directly to a publicly accessible Internet address?

I’m having a hard time understanding how this statement can possible be true.

Here is the very simple but practical explanation why: https://0day.work/an-example-why-nat-is-not-security/

And more high-level explanation as well: https://www.f5.com/resources/white-papers/the-myth-of-networ...

That's bullshit. "Security" is not a binary switch. NAT is a useful tool in your security toolbox when you want a more nuanced take than either "ban all ports" or "let every port flap open on the internets, #yolo".

NAT is useless for that. Firewalls are the tool for blocking connections.

Why is there a difference in captcha exposure between IPv4 and IPv6 then? Maybe there is no actual security, but the people deploying these captchas seem to think there is a need to deploy them for IPv6 users.

Reply on news.ycombinator.com