logoalt Hacker News

Dagger2last Saturday at 12:46 AM1 replyview on HN

It keeps getting repeated precisely because it isn't gaslighting. And yet we still see people claiming that NAT is security.

The only reason those networks aren't exposed to the whole Internet on v4 is because they're using RFC1918, not because of NAT -- but that still leaves them exposed to some outside networks, so routers come with firewalls, which act as an actual security boundary.

And they won't be exposed on v6, because those exact same firewalls work their magic on v6 too.

NAT doesn't provide and isn't needed for security. Its main security contribution is to confuse people about how secure their network is.


Replies

sedawkgreplast Tuesday at 3:44 AM

NAT effectively stops inbound connectivity at the NAT edge. A system could be a dozen hops beyond that and no inbound traffic can reach it.

IPv6 (without any NAT) means that the source and destination are fully routable.

How folks DON'T see this as a functional component of security is beyond me.

show 1 reply