Hacker News Reader

Comment by lmm | Hacker News Reader

It forces the use of some system that statefully tracks packets and makes routing decisions based on that information. Such a system will be capable of firewalling unless you go out of your way to make it not.

View on HN

No, your thinking of a stateful IPv4 home style NAT. There's also stateless subnet mapping.

There are some stateless things that are also called NAT, sure, but that's not what we're talking about here. (Fairly obviously, since a stateless mapping doesn't and can't save addresses).

But this feels tautological. It's been reduced to "If you want to use NAT with features that only a firewall gives you, then that forces you to use a firewall".

I suspect when people talk about "NAT" in the context of a residential connection, what they actually mean is a "default-deny firewall with connection tracking".

Feel free to replace "NAT" with "the kind of NAT that permits you to share an address between multiple devices" if you feel the need to be pointlessly pedantic about it. The point is that any device that allows sharing a single IP between multiple devices will necessarily implement connection tracking, and will therefore be capable of functioning as a firewall.

(Are you going to point out that statelessly blocking a fixed IP range used to be called "firewalling" so a device without connection tracking can still technically be a "firewall" next?)

Pretty much any system that's capable of handling IP traffic is also capable of firewalling. Not sure what that's got to do with address rewriting though.

> Pretty much any system that's capable of handling IP traffic is also capable of firewalling.

A system that can't track connection state, or doesn't have enough capacity to do so at line rate, can't meaningfully firewall. When the norm for home equipment is ISPs sending it out for "free", they absolutely send out the cheapest stuff they can get away with, and in the pre-smartphone era that meant "modems" that would just provide a straight PPPoA connection with no firewalling.

Reply on news.ycombinator.com