71–80 of 122 posts
Earlier quoted context omitted.
I've heard before that "NAT is not intended as security", but isn't the effect still the same, that an external device can't connect to a device behind NAT without explicit configuration allowing it?
No, NAT does not prevent connections, it only rewrites addresses. If your NAT router also has a stateful firewall, that is what prevents inbound connections, and removing the NAT from that equation does not change that.
Earlier quoted context omitted.
LetsEncrypt was likely accelerated by the Snowden leaks, but the discussions around free community run CAs were around long before that precipitous event. For CloudFlare it was likely just an effective way to drive additional business to them while pursuing their business model. I don't think "the masses" fall into the equation at all and likely haven't even really noticed the change besides the "This site isn't safe…
If LetsEncrypt was accelerated by the Snowden leaks, that's a rather sad result. After all, it is absolutely trivial for a nation-state actor to generate SSL certificates for any domain they like, due to the broken state of global PKI. It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over t…
But every connection you're intercepting, you're providing airtight evidence that a misissuance occured (the certificate). It's only a matter of time until you're caught. With certificate transparency, it's broadcast to everyone in the world.
So yes, nation states can bypass pki pretty easily, but it's only feasible for targeted attacks. That's better than the status quo of dragnet surveillance.
Earlier quoted context omitted.
No, NAT does not prevent connections, it only rewrites addresses. If your NAT router also has a stateful firewall, that is what prevents inbound connections, and removing the NAT from that equation does not change that.
So an inbound packet comes in to your NAT and there is no entry for it in the state table. Isn't it then dropped? Isn't that preventing a connection?
If there is no entry in the state table, then NAT rules are consulted to see whether a new rewrite entry should be added (such as DNAT/port forwarding rules on your home router), and if there is no matching rule either, it simply is forwarded without address rewriting.
Earlier quoted context omitted.
So you can replace the security controls provided by NAT with security controls provided by a firewall. How does this support the argument that NAT doesn’t provide any security controls?
NAT is not meant for security. It just unintentionally provides some by preventing inbound connections. That's something you can circumvent in certain scenarios. The technique is called "NAT hole punching".
No, it doesn't.
Shameless plug, but I just wrote a post on rolling this yourself in 15 minutes or less. https://zach.codes/roll-your-own-ngrok/
Earlier quoted context omitted.
> By rewriting the IP headers of packets as they traverse routing devices. How does that prevent hosts on that other network from accessing hosts on your "private network"? Like, a packet addressed to one of the hosts on your "private network" arrives at your NAT gateway from the "other network". How does the NAT rewrite the IP headers, and how does that provide access control? > If you’re trying to say that all NAT…
Because without NAT, none of the devices on my home network would be able to connect to any internet connected hosts. That is, unless I assigned internet routable addresses to their network interfaces. If I did that, I’d either have to install firewalls on my devices, or expose all services running on my devices to the internet. But I don’t have to do that, because my home router uses NAT to allow all devices on my h…
And unfortunately, you don't even answer my questions, instead just hand-waving your way through the explanation, ignoring all the details that would show where your misunderstanding lies.
In any case, no, if you only remove NAT from your home router that also has a stateful firewall, nothing changes security-wise. It just doesn't. No need to install firewalls on all your devices or anything like that, having a firewall on your uplink router is still perfectly sufficient for that without NAT.
And if your home router really only does NAT, without a stateful firewall that prevents inbound connections, then no, your NAT-only router does not prevent inbound access to your home network.
I understand that you believe otherwise, but your belief simply is incorrect, but you won't be able to understand why if you don't dive into how a NAT gateway actually works instead of hand-waving your way through the explanation.
Earlier quoted context omitted.
Is that because there's still usually NAT at the users router or cell tower even with IPv6?
I’ve never seen NAT being used with IPv6. I don’t see the point, it would be more effort to use it than not.
If there is a desire for a certain device then absolutely, give it its own IP, but that is the exception.
Earlier quoted context omitted.
... which doesn't change that that "default allow" firewall will still pass through all packets, and thus allow access to all your internal devices/machines? Absence of NAT rules does not prevent packets from passing through the firewall, it only prevents rewriting of addresses.
The point you were objecting to was "external device can't connect to a device behind NAT without explicit configuration". Without NAT rules access to internal devices is prevented because packets don't get routed to private IPs.
Earlier quoted context omitted.
I’ve never seen NAT being used with IPv6. I don’t see the point, it would be more effort to use it than not.
Yes, but it would be worth it. There is no need nor benefit to have a per-device unique address advertised to the world. If there is a desire for a certain device then absolutely, give it its own IP, but that is the exception.
Yes, there is!
But possibly more importantly: There is no benefit to assigning devices ambiguous addresses. It's as sensible as having all rooms in your business have "1" as their room number because you somehow have convinced yourself that that prevents people from entering your building.