Re:Is there hope for IPv6?
by AnIdiotOnTheNet on Sunday January 06, 2019 @12:03AM
(#18836668)
> call the result secure since anybody sharing your upstream L2 network, plus your ISP and anyone who can trick, force or coerce them into cooperating could still access your network
Ok, so the L2 thing isn't unheard of, but otherwise these are relatively unrealistic scenarios to be concerned about, don't you think?
I guess, but the fact remains that using RFC1918 is still both more effort and less secure than just using a firewall is, and that NAT doesn't help the situation.
Do you really want the security of your network to rely on your ISP always doing the right thing for you?
Terminology shifted, when NAT is talked about it is generally considered to be MASQ NAT to RFC1918 ranges
Even then, that would still only put you into the situation in the second paragraph of my previous post. You would still need a firewall, and if you have a firewall then shifting to RFC1918, adding MASQ NAT or even doing both won't help, because inbound connections are already blocked.
Even NAT in combination with RFC1918 doesn't give you security. The use of RFC1918 would certainly limit the set of people that could connect to your LAN machines, but it would be hard to call the result secure since anybody sharing your upstream L2 network, plus your ISP and anyone who can trick, force or coerce them into cooperating could still access your network.
And what does NAT add to the situation? Certainly not any security, since any connections that were possible before you added the NAT will still be possible afterwards too. In fact a lot more connections will become possible, so it seems like it reduces the security rather than improves it.