logoalt Hacker News

ifh-hntoday at 6:43 AM1 replyview on HN

I find the discussion about whether or not NAT is a security feature or not interesting. To my mind NAT was intended to make ipv4 last longer in a clever way as address space dried up. A happy accident of this solution is a basic security feature.

Ipv6 doesn't (currently, will it ever?) have the same address space problem so each device anywhere could be globally routable. But we know that's not really a good thing security-wise. But why couldn't we implement NAT for it as a security mechanism, instead of an address space solution?

Admittedly I'm not expert so I might be talking shit.


Replies

globular-toasttoday at 6:55 AM

Why would you do that when a regular default-deny firewall is and has always been the security feature you need, without the complications and problems of NAT?

show 1 reply