Hacker News Reader

> being behind a NAT is a very useful first tier security barrier.

Misconception. being behind a NAT without a firewall is a very useful nothing in terms of security, because one is basically a static route away from being reachable. It just happens that masquerading is coupled with packet dropping in most appliances and configurations. Only the firewall protects you.

View on HN

Even if I don't have a firewall, pretty much any competent ISP will configure its switches to drop any packet pointing to/from something that looks like private IP address space. Not to mention they wouldn't route it to me anyway.

So even if I don't have a firewall, you would probably need to physically plug yourself directly on the WAN port of my NAT box for your static route to work.

Not to say the firewall is useless, but even by itself, the combination NAT + private IP space prevents a lot of attacks. That's very different from what happens when you have no NAT and no firewall, where you are basically reachable by any kid on the other side of the earth.

Reply on news.ycombinator.com