Selfhosted

NAT provides some measure of security as pure coincidence to how it works. It is not designed or intended to provide security. It does not inspect packet payloads in order to filter them for security. It looks at the header and attempts to route it to an internal IP address (your devices on your LAN) and if it cannot, it will drop the packet because the header will only have the external IP address -- the packet has no idea which device it is supposed to go to. Forwarding a port is telling the NAT to assume that when a packet hits a certain port, if it doesn't know the destination internal IP, forward it to some internal IP anyway.

The reason you can connect to websites, ssh outside, FTP, whatever, is because your connection comes from your internal IP first to some other IP and therefore, NAT knows which internal IP to route those packets to.

Take for example this scenario:

You download some software. It has malware that provides command and control (C2) to someone else outside of your network. A firewall and/or antivirus may be able to stop this and hopefully notify you. NAT will not help here. Furthermore, if you have uPNP enabled (usually it is by default on your router) the malware can forward any ports through your NAT to the compromised device opening it up to bot attacks and the like.

Another scenario:

You want to play a video game with you and your friends and you're going to host it. So either you manually forward those ports or perhaps uPNP just does it for you. That game has an exploit known by attackers, or perhaps it can just be DDoS'd. Your NAT isn't going to stop that. Hopefully a firewall will help you here. It definitely will if you set up explicit rules so that if they aren't your friend's IPs it will drop them. Though it is possible the game is exploitable and your friend's are compromised.

Take for example malware has been known to spread via Minecraft.

EDIT: Quoting @Kid_Thunder@kbin.social from elsewhere in the thread because they summed it up beautifully:

NAT provides some security by sheer coincidence and not by design.

NAT is not security.

NAT is a stop-gap measure because there aren't enough IPv4 addresses that exist in the world. NAT was created so multiple Local Area Networks all over the world could use the same IP numbers and not end up with IP conflicts.

Way way way back in the early days of the internet, there were no LAN IP and WAN IPs You had your Wide Area Network (Internet) IP and that was it. Prior to NAT all devices were directly accessible via their WAN IP on the whole ass internet.

To give you an idea, IPv4 came out in 1980 and it wasn't until May of 1994 that the first RFC on NAT was published.

IPv6 is a full replacement for IPv4 that has not been fully adopted despite being around for 20 years or so. It has something like 16 undicillion (I don't recall, it's a fucking massive number) existing IP numbers, so it could take a few generations for it to run out of address space.

The thing is, it's come full circle and IPv6 now is the same as IPv4 used to be and you can access a "local" IP directly from the wider internet and Network Address Translation is not needed in the routing setup at all. (I believe it's called a Global Unicast Address, but it's been a minute, so don't quote me on that)

I reiterate NAT was never meant as a real security measure as it is simply Security Through Obscurity at best.

Further, it's not even that obscure, NAT is often misconfigured meaning internal IPs and ports leak to the wider internet regularly.

Obligatory South Park Ski Instructor:

https://en.wikipedia.org/wiki/Network_address_translation

https://en.wikipedia.org/wiki/Internet_Protocol_version_4

https://en.wikipedia.org/wiki/Internet_Protocol_version_4#Address_space_exhaustion

https://en.wikipedia.org/wiki/IPv6_address

https://en.wikipedia.org/wiki/IPv6_address#Unicast_addresses

Security from what? Get a threat model.

A NAT will restrict connections from the internet, but won't stop attacks from your local network. As your network grows, it might be a good idea to isolate shitty IOT devices (firmware is often full of holes), home internet and sensitive devices like cameras.

As I understand it, NAT is a firewall with only a very basic configuration: allow all outbound and accept only established inbound. If you don't expect to have any incoming connections and completely trust all your internal devices then its good enough.

However, if you start wanting to port forward for servers (SSH, FTP, video games) you need to poke holes in the NAT firewall and it has no additional configuration options to help you. The same goes for if you have internal (ex. IoT) devices that you don't necessarily trust, there are no rules to block outbound traffic.

There are several ways to evade NAT. Your router may or may not block those, on a case by case decision. You must know really well how it will behave to have any confidence that you are secure.

Or, in other words, NAT isn't a security feature because it's not built to provide security. It may be intentionally broken so your home network works better, and it may have obvious security flaws that nobody looked after. For network security, you should use something intended to give you network security.

Will you let the fortune tell if your network is safe or not?

Why don't configure your nftables, iptables, UFW, firewalld or whatever to be redundant? It's not like it consumes much more resources from your system

Maybe there is an exploit to your router that enables the hacker to access your full network. Maybe there is a glitch in your router that bypass the NAT. Maybe someone can access other devices from another source rather than the router connection (for example, it connects properly into the service, but this service has a flaw that allow full control over your network).

If a device is connect to the internet, it is somehow vulnerable. The safest machine is that one disconnected from the internet and preferably turned off.

For incoming traffic on IPv4 only, NAT technically is fine. But it won't block any outgoing traffic, and IPv6 doesn't use NAT at all.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

4 acronyms in this thread; the most compressed thread commented on today has 16 acronyms.

[Thread #546 for this sub, first seen 26th Feb 2024, 16:15] [FAQ] [Full list] [Contact] [Source code]

You don't know what your ISP-provided router does exactly. It may let some traffic through from the outside. It may get an over-the-air firmware update or config change at any time from your ISP. It definitely has well-known, unfixed vulnerabilities.

Also, if you rely on NAT, you have to have 100% trust in all devices that are inside your network.

New Lemmy Post: Can someone explain to me why NAT is not enough for security? (https://lemmy.world/post/12434129)
Tagging: #SelfHosted

(Replying in the OP of this thread (NOT THIS BOT!) will appear as a comment in the lemmy discussion.)

I am a FOSS bot. Check my README: https://github.com/db0/lemmy-tagginator/blob/main/README.md

It actually kinda is. Is someone trying to sell you into a firewall?

Because you need a firewall to block and control traffic. Its the same way with vlans.